5 ms·

Systemd creates cgroups and you can attach BPF filters with the new `IPIngressFilterPath` option. It's also possible with some `ExecStartPre=bpftool …` hack but

Systemd creates cgroups and you can attach BPF filters with the new `IPIngressFilterPath` option. It's also possible with some `ExecStartPre=bpftool …` hack but it's not so nice because it's racy. The value is that the service configuration knows which exact network behavior a service has. The global iptables state is not context aware unless you tag things by PID. And anyway it's a cleaner approach to bundle the firewall with the service instead of manipulating global iptables state. You can override the BPF firewall by adding a drop-in service file which either appends an additional filter with `IPIngressFilterPath=filter` or deletes all previously configured filters with `IPIngressFilterPath=`.

marios 7y ago
Shipping the required network settings alongside makes sense. i.e.: a smtp mailer declares it needs to access tcp/25. How does one get a global view though ? What am I allowing on this host and more importantly, how do I fix it when things go wrong ? (they always do at some point!)
- ldng 7y ago
  It looks sensible, until you have to debug the beast. If you're not a SystemD developer and/or don't following extremely closely what they are doing you end up with un-manageable system before you know. Just upgrade your distro for security issues and bam lot of thing stop working and you don't know why. It's getting to a point it's ridiculous.
ldng 7y ago
Really, what is the goal and when the feature creep ends ? At Kubernetes certification ? As much as I loved the unit conf + socket activation concept at first and supported SystemD. It's become and unruly teenager. It has severely hindered my productivity on several occasion but I'm stuck with it on Debian. One more glitch and I'll probably start hating it's guts badly...
- tomatocracy 7y ago
  I agree (and I'd say the low point was when I upgraded a laptop to buster and silently ended up with systemd-resolved ignoring my local LAN DNS to try to forward everything to 8.8.8.8 so couldn't resolve local hostnames). However, you're not stuck with systemd on Debian. Install sysvinit-core and remove systemd-sysv, and install libpam-elogind and elogind instead of libpam-systemd if you need it. You'll very likely still end up with some of the libraries installed - it's not the end of the world and you can install Devuan if you really don't want that, but systemd won't be running as PID 1 and you don't get rubbish like journald or resolved.
  - ldng 7y ago
    On my personal machine I might end up doing just that. But that can not always be changed in working environment. Edit : Also been bitten by the DNS mingling.
throwaway5d097 7y ago
https://skarnet.org/software/s6/ https://skarnet.org/software/s6/ also supports socket activation, Obarun, Gentoo and Void support it so far. Would be interesting to see how it'd compare to systemd's use cases with wider adoption.

marios 7y ago

Shipping the required network settings alongside makes sense. i.e.: a smtp mailer declares it needs to access tcp/25. How does one get a global view though ? What am I allowing on this host and more importantly, how do I fix it when things go wrong ? (they always do at some point!)

ldng 7y ago
It looks sensible, until you have to debug the beast. If you're not a SystemD developer and/or don't following extremely closely what they are doing you end up with un-manageable system before you know. Just upgrade your distro for security issues and bam lot of thing stop working and you don't know why. It's getting to a point it's ridiculous.

ldng 7y ago

Really, what is the goal and when the feature creep ends ? At Kubernetes certification ? As much as I loved the unit conf + socket activation concept at first and supported SystemD. It's become and unruly teenager. It has severely hindered my productivity on several occasion but I'm stuck with it on Debian. One more glitch and I'll probably start hating it's guts badly...

tomatocracy 7y ago
I agree (and I'd say the low point was when I upgraded a laptop to buster and silently ended up with systemd-resolved ignoring my local LAN DNS to try to forward everything to 8.8.8.8 so couldn't resolve local hostnames). However, you're not stuck with systemd on Debian. Install sysvinit-core and remove systemd-sysv, and install libpam-elogind and elogind instead of libpam-systemd if you need it. You'll very likely still end up with some of the libraries installed - it's not the end of the world and you can install Devuan if you really don't want that, but systemd won't be running as PID 1 and you don't get rubbish like journald or resolved.
- ldng 7y ago
  On my personal machine I might end up doing just that. But that can not always be changed in working environment. Edit : Also been bitten by the DNS mingling.

throwaway5d097 7y ago

https://skarnet.org/software/s6/ https://skarnet.org/software/s6/ also supports socket activation, Obarun, Gentoo and Void support it so far. Would be interesting to see how it'd compare to systemd's use cases with wider adoption.