From: Mauricio Vásquez Date: Thu, 21 Jan 2021 16:19:07 +0000 (-0500) Subject: core: add load fragment implementation for RestrictNetworkInterfaces= X-Git-Tag: v250-rc1~800^2~7 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4f0c25c794cdf417437db4ec9b787cc409331627;p=thirdparty%2Fsystemd.git core: add load fragment implementation for RestrictNetworkInterfaces= Signed-off-by: Mauricio Vásquez --- diff --git a/src/core/load-fragment-gperf.gperf.in b/src/core/load-fragment-gperf.gperf.in index 96507907f67..489841af7a7 100644 --- a/src/core/load-fragment-gperf.gperf.in +++ b/src/core/load-fragment-gperf.gperf.in @@ -233,6 +233,7 @@ {{type}}.BPFProgram, config_parse_bpf_foreign_program, 0, offsetof({{type}}, cgroup_context) {{type}}.SocketBindAllow, config_parse_cgroup_socket_bind, 0, offsetof({{type}}, cgroup_context.socket_bind_allow) {{type}}.SocketBindDeny, config_parse_cgroup_socket_bind, 0, offsetof({{type}}, cgroup_context.socket_bind_deny) +{{type}}.RestrictNetworkInterfaces, config_parse_restrict_network_interfaces, 0, offsetof({{type}}, cgroup_context) {%- endmacro -%} %{ diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c index 6eefaaf27d7..92815b1dbae 100644 --- a/src/core/load-fragment.c +++ b/src/core/load-fragment.c @@ -5711,6 +5711,72 @@ int config_parse_cgroup_socket_bind( return 0; } +int config_parse_restrict_network_interfaces( + const char *unit, + const char *filename, + unsigned line, + const char *section, + unsigned section_line, + const char *lvalue, + int ltype, + const char *rvalue, + void *data, + void *userdata) { + CGroupContext *c = data; + bool is_allow_rule = true; + int r; + + assert(filename); + assert(lvalue); + assert(rvalue); + assert(data); + + if (isempty(rvalue)) { + /* Empty assignment resets the list */ + c->restrict_network_interfaces = set_free(c->restrict_network_interfaces); + return 0; + } + + if (rvalue[0] == '~') { + is_allow_rule = false; + rvalue++; + } + + if (set_isempty(c->restrict_network_interfaces)) + /* Only initialize this when creating the set */ + c->restrict_network_interfaces_is_allow_list = is_allow_rule; + + for (const char *p = rvalue;;) { + _cleanup_free_ char *word = NULL; + + r = extract_first_word(&p, &word, NULL, EXTRACT_UNQUOTE); + if (r == 0) + break; + if (r == -ENOMEM) + return log_oom(); + if (r < 0) { + log_syntax(unit, LOG_WARNING, filename, line, r, + "Trailing garbage in %s, ignoring: %s", lvalue, rvalue); + break; + } + + if (!ifname_valid(word)) { + log_syntax(unit, LOG_WARNING, filename, line, 0, "Invalid interface name, ignoring: %s", word); + continue; + } + + if (c->restrict_network_interfaces_is_allow_list != is_allow_rule) + free(set_remove(c->restrict_network_interfaces, word)); + else { + r = set_put_strdup(&c->restrict_network_interfaces, word); + if (r < 0) + return log_oom(); + } + } + + return 0; +} + static int merge_by_names(Unit **u, Set *names, const char *id) { char *k; int r; diff --git a/src/core/load-fragment.h b/src/core/load-fragment.h index 45e9c397e4e..fe98091ee47 100644 --- a/src/core/load-fragment.h +++ b/src/core/load-fragment.h @@ -141,6 +141,7 @@ CONFIG_PARSER_PROTOTYPE(config_parse_socket_timestamping); CONFIG_PARSER_PROTOTYPE(config_parse_extension_images); CONFIG_PARSER_PROTOTYPE(config_parse_bpf_foreign_program); CONFIG_PARSER_PROTOTYPE(config_parse_cgroup_socket_bind); +CONFIG_PARSER_PROTOTYPE(config_parse_restrict_network_interfaces); /* gperf prototypes */ const struct ConfigPerfItem* load_fragment_gperf_lookup(const char *key, GPERF_LEN_TYPE length); diff --git a/test/fuzz/fuzz-unit-file/directives-all.service b/test/fuzz/fuzz-unit-file/directives-all.service index 3039d1c0cdc..494c7545e48 100644 --- a/test/fuzz/fuzz-unit-file/directives-all.service +++ b/test/fuzz/fuzz-unit-file/directives-all.service @@ -886,6 +886,7 @@ RemoveIPC= ReserveVT= RestrictAddressFamilies= RestrictNamespaces= +RestrictNetworkInterfaces= RestrictRealtime= RestrictSUIDSGID= RuntimeDirectory= diff --git a/test/fuzz/fuzz-unit-file/directives.mount b/test/fuzz/fuzz-unit-file/directives.mount index d161c81ff68..fd82fc5348e 100644 --- a/test/fuzz/fuzz-unit-file/directives.mount +++ b/test/fuzz/fuzz-unit-file/directives.mount @@ -144,6 +144,7 @@ RemoveIPC= RestartKillSignal= RestrictAddressFamilies= RestrictNamespaces= +RestrictNetworkInterfaces= RestrictRealtime= RestrictSUIDSGID= RootDirectory= diff --git a/test/fuzz/fuzz-unit-file/directives.scope b/test/fuzz/fuzz-unit-file/directives.scope index 7e69cf816b6..ab490833110 100644 --- a/test/fuzz/fuzz-unit-file/directives.scope +++ b/test/fuzz/fuzz-unit-file/directives.scope @@ -48,6 +48,7 @@ MemoryMin= MemorySwapMax= NetClass= RestartKillSignal= +RestrictNetworkInterfaces= RuntimeMaxSec= SendSIGHUP= SendSIGKILL= diff --git a/test/fuzz/fuzz-unit-file/directives.service b/test/fuzz/fuzz-unit-file/directives.service index 35d1f2a104f..6a80bbcb2fe 100644 --- a/test/fuzz/fuzz-unit-file/directives.service +++ b/test/fuzz/fuzz-unit-file/directives.service @@ -275,6 +275,7 @@ RestartPreventExitStatus= RestartSec= RestrictAddressFamilies= RestrictNamespaces= +RestrictNetworkInterfaces= RestrictRealtime= RestrictSUIDSGID= RootDirectory= diff --git a/test/fuzz/fuzz-unit-file/directives.slice b/test/fuzz/fuzz-unit-file/directives.slice index 789ac8f0db5..17bd431db7d 100644 --- a/test/fuzz/fuzz-unit-file/directives.slice +++ b/test/fuzz/fuzz-unit-file/directives.slice @@ -44,6 +44,7 @@ MemoryMax= MemoryMin= MemorySwapMax= NetClass= +RestrictNetworkInterfaces= Slice= SocketBindAllow= SocketBindDeny= diff --git a/test/fuzz/fuzz-unit-file/directives.socket b/test/fuzz/fuzz-unit-file/directives.socket index 1835167cfba..1a79a0dfd14 100644 --- a/test/fuzz/fuzz-unit-file/directives.socket +++ b/test/fuzz/fuzz-unit-file/directives.socket @@ -180,6 +180,7 @@ RemoveOnStop= RestartKillSignal= RestrictAddressFamilies= RestrictNamespaces= +RestrictNetworkInterfaces= RestrictRealtime= RestrictSUIDSGID= ReusePort= diff --git a/test/fuzz/fuzz-unit-file/directives.swap b/test/fuzz/fuzz-unit-file/directives.swap index 814d066face..204e1725147 100644 --- a/test/fuzz/fuzz-unit-file/directives.swap +++ b/test/fuzz/fuzz-unit-file/directives.swap @@ -141,6 +141,7 @@ RemoveIPC= RestartKillSignal= RestrictAddressFamilies= RestrictNamespaces= +RestrictNetworkInterfaces= RestrictRealtime= RestrictSUIDSGID= RootDirectory=