#include "errno-util.h"
#include "fd-util.h"
#include "fileio.h"
+#include "in-addr-prefix-util.h"
#include "ip-protocol-list.h"
#include "limits-util.h"
#include "parse-util.h"
#include "path-util.h"
#include "percent-util.h"
+#include "socket-util.h"
BUS_DEFINE_PROPERTY_GET(bus_property_get_tasks_max, "t", TasksMax, tasks_max_resolve);
void *userdata,
sd_bus_error *error) {
- CGroupContext *c = userdata;
+ CGroupContext *c = ASSERT_PTR(userdata);
assert(bus);
assert(reply);
- assert(c);
if (!c->delegate)
return sd_bus_message_append(reply, "as", 0);
void *userdata,
sd_bus_error *error) {
- CPUSet *cpus = userdata;
+ CPUSet *cpus = ASSERT_PTR(userdata);
_cleanup_free_ uint8_t *array = NULL;
size_t allocated;
assert(bus);
assert(reply);
- assert(cpus);
(void) cpu_set_to_dbus(cpus, &array, &allocated);
return sd_bus_message_append_array(reply, 'y', array, allocated);
void *userdata,
sd_bus_error *error) {
- CGroupContext *c = userdata;
- CGroupIODeviceWeight *w;
+ CGroupContext *c = ASSERT_PTR(userdata);
int r;
assert(bus);
assert(reply);
- assert(c);
r = sd_bus_message_open_container(reply, 'a', "(st)");
if (r < 0)
void *userdata,
sd_bus_error *error) {
- CGroupContext *c = userdata;
- CGroupIODeviceLimit *l;
+ CGroupContext *c = ASSERT_PTR(userdata);
int r;
assert(bus);
assert(reply);
- assert(c);
r = sd_bus_message_open_container(reply, 'a', "(st)");
if (r < 0)
void *userdata,
sd_bus_error *error) {
- CGroupContext *c = userdata;
- CGroupIODeviceLatency *l;
+ CGroupContext *c = ASSERT_PTR(userdata);
int r;
assert(bus);
assert(reply);
- assert(c);
r = sd_bus_message_open_container(reply, 'a', "(st)");
if (r < 0)
void *userdata,
sd_bus_error *error) {
- CGroupContext *c = userdata;
- CGroupBlockIODeviceWeight *w;
+ CGroupContext *c = ASSERT_PTR(userdata);
int r;
assert(bus);
assert(reply);
- assert(c);
r = sd_bus_message_open_container(reply, 'a', "(st)");
if (r < 0)
void *userdata,
sd_bus_error *error) {
- CGroupContext *c = userdata;
- CGroupBlockIODeviceBandwidth *b;
+ CGroupContext *c = ASSERT_PTR(userdata);
int r;
assert(bus);
assert(reply);
- assert(c);
r = sd_bus_message_open_container(reply, 'a', "(st)");
if (r < 0)
void *userdata,
sd_bus_error *error) {
- CGroupContext *c = userdata;
- CGroupDeviceAllow *a;
+ CGroupContext *c = ASSERT_PTR(userdata);
int r;
assert(bus);
assert(reply);
- assert(c);
r = sd_bus_message_open_container(reply, 'a', "(ss)");
if (r < 0)
void *userdata,
sd_bus_error *error) {
- IPAddressAccessItem** items = userdata, *i;
+ Set **prefixes = ASSERT_PTR(userdata);
+ struct in_addr_prefix *i;
int r;
r = sd_bus_message_open_container(reply, 'a', "(iayu)");
if (r < 0)
return r;
- LIST_FOREACH(items, i, *items) {
+ SET_FOREACH(i, *prefixes) {
r = sd_bus_message_open_container(reply, 'r', "iayu");
if (r < 0)
void *userdata,
sd_bus_error *error) {
CGroupContext *c = userdata;
- CGroupBPFForeignProgram *p;
int r;
r = sd_bus_message_open_container(reply, 'a', "(ss)");
sd_bus_message *reply,
void *userdata,
sd_bus_error *error) {
- CGroupSocketBindItem **items = userdata, *i;
- int r;
- assert(items);
+ CGroupSocketBindItem **items = ASSERT_PTR(userdata);
+ int r;
r = sd_bus_message_open_container(reply, 'a', "(iiqq)");
if (r < 0)
return sd_bus_message_close_container(reply);
}
+static int property_get_restrict_network_interfaces(
+ sd_bus *bus,
+ const char *path,
+ const char *interface,
+ const char *property,
+ sd_bus_message *reply,
+ void *userdata,
+ sd_bus_error *error) {
+ int r;
+ CGroupContext *c = ASSERT_PTR(userdata);
+ char *iface;
+
+ assert(bus);
+ assert(reply);
+
+ r = sd_bus_message_open_container(reply, 'r', "bas");
+ if (r < 0)
+ return r;
+
+ r = sd_bus_message_append(reply, "b", c->restrict_network_interfaces_is_allow_list);
+ if (r < 0)
+ return r;
+
+ r = sd_bus_message_open_container(reply, 'a', "s");
+ if (r < 0)
+ return r;
+
+ SET_FOREACH(iface, c->restrict_network_interfaces) {
+ r = sd_bus_message_append(reply, "s", iface);
+ if (r < 0)
+ return r;
+ }
+
+ r = sd_bus_message_close_container(reply);
+ if (r < 0)
+ return r;
+
+ return sd_bus_message_close_container(reply);
+}
+
const sd_bus_vtable bus_cgroup_vtable[] = {
SD_BUS_VTABLE_START(0),
SD_BUS_PROPERTY("Delegate", "b", bus_property_get_bool, offsetof(CGroupContext, delegate), 0),
SD_BUS_PROPERTY("CPUQuotaPerSecUSec", "t", bus_property_get_usec, offsetof(CGroupContext, cpu_quota_per_sec_usec), 0),
SD_BUS_PROPERTY("CPUQuotaPeriodUSec", "t", bus_property_get_usec, offsetof(CGroupContext, cpu_quota_period_usec), 0),
SD_BUS_PROPERTY("AllowedCPUs", "ay", property_get_cpuset, offsetof(CGroupContext, cpuset_cpus), 0),
+ SD_BUS_PROPERTY("StartupAllowedCPUs", "ay", property_get_cpuset, offsetof(CGroupContext, startup_cpuset_cpus), 0),
SD_BUS_PROPERTY("AllowedMemoryNodes", "ay", property_get_cpuset, offsetof(CGroupContext, cpuset_mems), 0),
+ SD_BUS_PROPERTY("StartupAllowedMemoryNodes", "ay", property_get_cpuset, offsetof(CGroupContext, startup_cpuset_mems), 0),
SD_BUS_PROPERTY("IOAccounting", "b", bus_property_get_bool, offsetof(CGroupContext, io_accounting), 0),
SD_BUS_PROPERTY("IOWeight", "t", NULL, offsetof(CGroupContext, io_weight), 0),
SD_BUS_PROPERTY("StartupIOWeight", "t", NULL, offsetof(CGroupContext, startup_io_weight), 0),
SD_BUS_PROPERTY("BPFProgram", "a(ss)", property_get_bpf_foreign_program, 0, 0),
SD_BUS_PROPERTY("SocketBindAllow", "a(iiqq)", property_get_socket_bind, offsetof(CGroupContext, socket_bind_allow), 0),
SD_BUS_PROPERTY("SocketBindDeny", "a(iiqq)", property_get_socket_bind, offsetof(CGroupContext, socket_bind_deny), 0),
+ SD_BUS_PROPERTY("RestrictNetworkInterfaces", "(bas)", property_get_restrict_network_interfaces, 0, 0),
SD_BUS_VTABLE_END
};
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
_cleanup_free_ char *buf = NULL;
_cleanup_fclose_ FILE *f = NULL;
- char **entry;
size_t size = 0;
if (n == 0)
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
_cleanup_free_ char *buf = NULL;
_cleanup_fclose_ FILE *f = NULL;
- CGroupBPFForeignProgram *fp;
size_t size = 0;
if (n == 0)
unit_write_setting(u, flags, name, buf);
- if (!LIST_IS_EMPTY(c->bpf_foreign_programs)) {
+ if (c->bpf_foreign_programs) {
r = bpf_foreign_supported();
if (r < 0)
return r;
}
DISABLE_WARNING_TYPE_LIMITS;
-BUS_DEFINE_SET_CGROUP_WEIGHT(cpu_weight, CGROUP_MASK_CPU, CGROUP_WEIGHT_IS_OK, CGROUP_WEIGHT_INVALID);
BUS_DEFINE_SET_CGROUP_WEIGHT(cpu_shares, CGROUP_MASK_CPU, CGROUP_CPU_SHARES_IS_OK, CGROUP_CPU_SHARES_INVALID);
BUS_DEFINE_SET_CGROUP_WEIGHT(io_weight, CGROUP_MASK_IO, CGROUP_WEIGHT_IS_OK, CGROUP_WEIGHT_INVALID);
BUS_DEFINE_SET_CGROUP_WEIGHT(blockio_weight, CGROUP_MASK_BLKIO, CGROUP_BLKIO_WEIGHT_IS_OK, CGROUP_BLKIO_WEIGHT_INVALID);
BUS_DEFINE_SET_CGROUP_LIMIT(swap, CGROUP_MASK_MEMORY, physical_memory_scale, 0);
REENABLE_WARNING;
+static int bus_cgroup_set_cpu_weight(
+ Unit *u,
+ const char *name,
+ uint64_t *p,
+ sd_bus_message *message,
+ UnitWriteFlags flags,
+ sd_bus_error *error) {
+ uint64_t v;
+ int r;
+ assert(p);
+ r = sd_bus_message_read(message, "t", &v);
+ if (r < 0)
+ return r;
+ if (!CGROUP_WEIGHT_IS_OK(v) && v != CGROUP_WEIGHT_IDLE)
+ return sd_bus_error_setf(
+ error, SD_BUS_ERROR_INVALID_ARGS, "Value specified in %s is out of range", name);
+ if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
+ *p = v;
+ unit_invalidate_cgroup(u, CGROUP_MASK_CPU);
+ if (v == CGROUP_WEIGHT_INVALID)
+ unit_write_settingf(u, flags, name, "%s=", name);
+ else if (v == CGROUP_WEIGHT_IDLE)
+ unit_write_settingf(u, flags, name, "%s=idle", name);
+ else
+ unit_write_settingf(u, flags, name, "%s=%" PRIu64, name, v);
+ }
+ return 1;
+}
+
static int bus_cgroup_set_tasks_max(
Unit *u,
const char *name,
unit_invalidate_cgroup(u, CGROUP_MASK_CPU);
if (c->cpu_quota_period_usec == USEC_INFINITY)
unit_write_setting(u, flags, "CPUQuotaPeriodSec", "CPUQuotaPeriodSec=");
- else {
- char v[FORMAT_TIMESPAN_MAX];
+ else
unit_write_settingf(u, flags, "CPUQuotaPeriodSec",
"CPUQuotaPeriodSec=%s",
- format_timespan(v, sizeof(v), c->cpu_quota_period_usec, 1));
- }
+ FORMAT_TIMESPAN(c->cpu_quota_period_usec, 1));
}
return 1;
- } else if (STR_IN_SET(name, "AllowedCPUs", "AllowedMemoryNodes")) {
+ } else if (STR_IN_SET(name, "AllowedCPUs", "StartupAllowedCPUs", "AllowedMemoryNodes", "StartupAllowedMemoryNodes")) {
const void *a;
size_t n;
_cleanup_(cpu_set_reset) CPUSet new_set = {};
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
_cleanup_free_ char *setstr = NULL;
- CPUSet *set;
+ CPUSet *set = NULL;
setstr = cpu_set_to_range_string(&new_set);
if (!setstr)
if (streq(name, "AllowedCPUs"))
set = &c->cpuset_cpus;
- else
+ else if (streq(name, "StartupAllowedCPUs"))
+ set = &c->startup_cpuset_cpus;
+ else if (streq(name, "AllowedMemoryNodes"))
set = &c->cpuset_mems;
+ else if (streq(name, "StartupAllowedMemoryNodes"))
+ set = &c->startup_cpuset_mems;
+
+ assert(set);
cpu_set_reset(set);
*set = new_set;
return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Path '%s' specified in %s= is not normalized.", name, path);
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
- CGroupIODeviceLimit *a = NULL, *b;
+ CGroupIODeviceLimit *a = NULL;
- LIST_FOREACH(device_limits, b, c->io_device_limits) {
+ LIST_FOREACH(device_limits, b, c->io_device_limits)
if (path_equal(path, b->path)) {
a = b;
break;
}
- }
if (!a) {
CGroupIOLimitType type;
return r;
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
- CGroupIODeviceLimit *a;
_cleanup_free_ char *buf = NULL;
_cleanup_fclose_ FILE *f = NULL;
size_t size = 0;
- if (n == 0) {
+ if (n == 0)
LIST_FOREACH(device_limits, a, c->io_device_limits)
a->limits[iol_type] = cgroup_io_limit_defaults[iol_type];
- }
unit_invalidate_cgroup(u, CGROUP_MASK_IO);
fprintf(f, "%s=\n", name);
LIST_FOREACH(device_limits, a, c->io_device_limits)
- if (a->limits[iol_type] != cgroup_io_limit_defaults[iol_type])
- fprintf(f, "%s=%s %" PRIu64 "\n", name, a->path, a->limits[iol_type]);
+ if (a->limits[iol_type] != cgroup_io_limit_defaults[iol_type])
+ fprintf(f, "%s=%s %" PRIu64 "\n", name, a->path, a->limits[iol_type]);
r = fflush_and_check(f);
if (r < 0)
return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "IODeviceWeight= value out of range");
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
- CGroupIODeviceWeight *a = NULL, *b;
+ CGroupIODeviceWeight *a = NULL;
- LIST_FOREACH(device_weights, b, c->io_device_weights) {
+ LIST_FOREACH(device_weights, b, c->io_device_weights)
if (path_equal(b->path, path)) {
a = b;
break;
}
- }
if (!a) {
a = new0(CGroupIODeviceWeight, 1);
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
_cleanup_free_ char *buf = NULL;
_cleanup_fclose_ FILE *f = NULL;
- CGroupIODeviceWeight *a;
size_t size = 0;
- if (n == 0) {
+ if (n == 0)
while (c->io_device_weights)
cgroup_context_free_io_device_weight(c, c->io_device_weights);
- }
unit_invalidate_cgroup(u, CGROUP_MASK_IO);
return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Path '%s' specified in %s= is not normalized.", name, path);
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
- CGroupIODeviceLatency *a = NULL, *b;
+ CGroupIODeviceLatency *a = NULL;
- LIST_FOREACH(device_latencies, b, c->io_device_latencies) {
+ LIST_FOREACH(device_latencies, b, c->io_device_latencies)
if (path_equal(b->path, path)) {
a = b;
break;
}
- }
if (!a) {
a = new0(CGroupIODeviceLatency, 1);
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
_cleanup_free_ char *buf = NULL;
_cleanup_fclose_ FILE *f = NULL;
- char ts[FORMAT_TIMESPAN_MAX];
- CGroupIODeviceLatency *a;
size_t size = 0;
- if (n == 0) {
+ if (n == 0)
while (c->io_device_latencies)
cgroup_context_free_io_device_latency(c, c->io_device_latencies);
- }
unit_invalidate_cgroup(u, CGROUP_MASK_IO);
fputs("IODeviceLatencyTargetSec=\n", f);
LIST_FOREACH(device_latencies, a, c->io_device_latencies)
fprintf(f, "IODeviceLatencyTargetSec=%s %s\n",
- a->path, format_timespan(ts, sizeof(ts), a->target_usec, 1));
+ a->path, FORMAT_TIMESPAN(a->target_usec, 1));
r = fflush_and_check(f);
if (r < 0)
} else if (STR_IN_SET(name, "BlockIOReadBandwidth", "BlockIOWriteBandwidth")) {
const char *path;
- bool read = true;
unsigned n = 0;
uint64_t u64;
+ bool read;
- if (streq(name, "BlockIOWriteBandwidth"))
- read = false;
+ read = streq(name, "BlockIOReadBandwidth");
r = sd_bus_message_enter_container(message, 'a', "(st)");
if (r < 0)
return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Path '%s' specified in %s= is not normalized.", name, path);
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
- CGroupBlockIODeviceBandwidth *a = NULL, *b;
+ CGroupBlockIODeviceBandwidth *a = NULL;
- LIST_FOREACH(device_bandwidths, b, c->blockio_device_bandwidths) {
+ LIST_FOREACH(device_bandwidths, b, c->blockio_device_bandwidths)
if (path_equal(path, b->path)) {
a = b;
break;
}
- }
if (!a) {
a = new0(CGroupBlockIODeviceBandwidth, 1);
return r;
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
- CGroupBlockIODeviceBandwidth *a;
_cleanup_free_ char *buf = NULL;
_cleanup_fclose_ FILE *f = NULL;
size_t size = 0;
- if (n == 0) {
+ if (n == 0)
LIST_FOREACH(device_bandwidths, a, c->blockio_device_bandwidths) {
if (read)
a->rbps = CGROUP_LIMIT_MAX;
else
a->wbps = CGROUP_LIMIT_MAX;
}
- }
unit_invalidate_cgroup(u, CGROUP_MASK_BLKIO);
return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "BlockIODeviceWeight= out of range");
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
- CGroupBlockIODeviceWeight *a = NULL, *b;
+ CGroupBlockIODeviceWeight *a = NULL;
- LIST_FOREACH(device_weights, b, c->blockio_device_weights) {
+ LIST_FOREACH(device_weights, b, c->blockio_device_weights)
if (path_equal(b->path, path)) {
a = b;
break;
}
- }
if (!a) {
a = new0(CGroupBlockIODeviceWeight, 1);
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
_cleanup_free_ char *buf = NULL;
_cleanup_fclose_ FILE *f = NULL;
- CGroupBlockIODeviceWeight *a;
size_t size = 0;
- if (n == 0) {
+ if (n == 0)
while (c->blockio_device_weights)
cgroup_context_free_blockio_device_weight(c, c->blockio_device_weights);
- }
unit_invalidate_cgroup(u, CGROUP_MASK_BLKIO);
return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "DeviceAllow= requires combination of rwm flags");
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
- CGroupDeviceAllow *a = NULL, *b;
+ CGroupDeviceAllow *a = NULL;
- LIST_FOREACH(device_allow, b, c->device_allow) {
+ LIST_FOREACH(device_allow, b, c->device_allow)
if (path_equal(b->path, path)) {
a = b;
break;
}
- }
if (!a) {
a = new0(CGroupDeviceAllow, 1);
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
_cleanup_free_ char *buf = NULL;
_cleanup_fclose_ FILE *f = NULL;
- CGroupDeviceAllow *a;
size_t size = 0;
- if (n == 0) {
+ if (n == 0)
while (c->device_allow)
cgroup_context_free_device_allow(c, c->device_allow);
- }
unit_invalidate_cgroup(u, CGROUP_MASK_DEVICES);
return 1;
} else if (STR_IN_SET(name, "IPAddressAllow", "IPAddressDeny")) {
- IPAddressAccessItem **list;
+ _cleanup_set_free_ Set *new_prefixes = NULL;
size_t n = 0;
- list = streq(name, "IPAddressAllow") ? &c->ip_address_allow : &c->ip_address_deny;
-
r = sd_bus_message_enter_container(message, 'a', "(iayu)");
if (r < 0)
return r;
return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Prefix length %" PRIu32 " too large for address family %s.", prefixlen, af_to_name(family));
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
- IPAddressAccessItem *item;
-
- item = new0(IPAddressAccessItem, 1);
- if (!item)
- return -ENOMEM;
+ struct in_addr_prefix prefix = {
+ .family = family,
+ .prefixlen = prefixlen,
+ };
- item->family = family;
- item->prefixlen = prefixlen;
- memcpy(&item->address, ap, an);
+ memcpy(&prefix.address, ap, an);
- LIST_PREPEND(items, *list, item);
+ r = in_addr_prefix_add(&new_prefixes, &prefix);
+ if (r < 0)
+ return r;
}
r = sd_bus_message_exit_container(message);
if (r < 0)
return r;
- *list = ip_address_access_reduce(*list);
-
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
_cleanup_free_ char *buf = NULL;
_cleanup_fclose_ FILE *f = NULL;
- IPAddressAccessItem *item;
size_t size = 0;
-
- if (n == 0)
- *list = ip_address_access_free_all(*list);
+ Set **prefixes;
+ bool *reduced;
unit_invalidate_cgroup_bpf(u);
f = open_memstream_unlocked(&buf, &size);
if (!f)
return -ENOMEM;
- fputs(name, f);
- fputs("=\n", f);
+ prefixes = streq(name, "IPAddressAllow") ? &c->ip_address_allow : &c->ip_address_deny;
+ reduced = streq(name, "IPAddressAllow") ? &c->ip_address_allow_reduced : &c->ip_address_deny_reduced;
- LIST_FOREACH(items, item, *list) {
- char buffer[CONST_MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN)];
+ if (n == 0) {
+ *reduced = true;
+ *prefixes = set_free(*prefixes);
+ fputs(name, f);
+ fputs("=\n", f);
+ } else {
+ *reduced = false;
- errno = 0;
- if (!inet_ntop(item->family, &item->address, buffer, sizeof(buffer)))
- return errno_or_else(EINVAL);
+ r = in_addr_prefixes_merge(prefixes, new_prefixes);
+ if (r < 0)
+ return r;
- fprintf(f, "%s=%s/%u\n", name, buffer, item->prefixlen);
+ const struct in_addr_prefix *p;
+ SET_FOREACH(p, new_prefixes)
+ fprintf(f, "%s=%s\n", name,
+ IN_ADDR_PREFIX_TO_STRING(p->family, &p->address, p->prefixlen));
}
r = fflush_and_check(f);
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
_cleanup_free_ char *buf = NULL;
_cleanup_fclose_ FILE *f = NULL;
- CGroupSocketBindItem *item;
size_t size = 0;
if (n == 0)
return 1;
}
+ if (streq(name, "RestrictNetworkInterfaces")) {
+ int is_allow_list;
+ _cleanup_strv_free_ char **l = NULL;
+
+ r = sd_bus_message_enter_container(message, 'r', "bas");
+ if (r < 0)
+ return r;
+
+ r = sd_bus_message_read(message, "b", &is_allow_list);
+ if (r < 0)
+ return r;
+
+ r = sd_bus_message_read_strv(message, &l);
+ if (r < 0)
+ return r;
+
+ r = sd_bus_message_exit_container(message);
+ if (r < 0)
+ return r;
+
+ if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
+ _cleanup_free_ char *joined = NULL;
+
+ if (strv_isempty(l)) {
+ c->restrict_network_interfaces_is_allow_list = false;
+ c->restrict_network_interfaces = set_free(c->restrict_network_interfaces);
+
+ unit_write_settingf(u, flags, name, "%s=", name);
+ return 1;
+ }
+
+ if (set_isempty(c->restrict_network_interfaces))
+ c->restrict_network_interfaces_is_allow_list = is_allow_list;
+
+ STRV_FOREACH(s, l) {
+ if (!ifname_valid(*s)) {
+ log_full(LOG_WARNING, "Invalid interface name, ignoring: %s", *s);
+ continue;
+ }
+ if (c->restrict_network_interfaces_is_allow_list != (bool) is_allow_list)
+ free(set_remove(c->restrict_network_interfaces, *s));
+ else {
+ r = set_put_strdup(&c->restrict_network_interfaces, *s);
+ if (r < 0)
+ return log_oom();
+ }
+ }
+
+ joined = strv_join(l, " ");
+ if (!joined)
+ return -ENOMEM;
+
+ unit_write_settingf(u, flags, name, "%s=%s%s", name, is_allow_list ? "" : "~", joined);
+ }
+
+ return 1;
+ }
if (streq(name, "DisableControllers") || (u->transient && u->load_state == UNIT_STUB))
return bus_cgroup_set_transient_property(u, c, name, message, flags, error);
projects / thirdparty / systemd.git / blobdiff