Re:IP Accounting and Access Lists with Systemd
by jcrites on Tuesday October 10, 2017 @05:08AM
(#15440420)
Another great sandboxing capability added to systemd, and as easily employed as a single flag:
IPAddressDeny=any
What I enjoy about systemd is the fact that I can employ capabilities like this with any process on the system using only a line of configuration. FTA:
> It's a simple way to lock down distribution/vendor supplied system services by default. For example, if you ship a service that you know never needs to access the network, then simply set IPAddressDeny=any (possibly combined with IPAddressAllow=localhost) for it, and it will live in a very tight networking sand-box it cannot escape from. systemd itself makes use of this for a number of its services by default now. For example, the logging service systemd-journald.service, the login manager systemd-logind or the core-dump processing unit [email protected] all have such a rule set out-of-the-box, because we know that neither of these services should be able to access the network, under any circumstances.
> It's a simple way to lock down distribution/vendor supplied system services by default. For example, if you ship a service that you know never needs to access the network, then simply set IPAddressDeny=any (possibly combined with IPAddressAllow=localhost) for it, and it will live in a very tight networking sand-box it cannot escape from. systemd itself makes use of this for a number of its services by default now. For example, the logging service systemd-journald.service, the login manager systemd-logind or the core-dump processing unit [email protected] all have such a rule set out-of-the-box, because we know that neither of these services should be able to access the network, under any circumstances.