From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Topi Miettinen <toiwoton@gmail.com>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: Support for loading firewall rules with cgroup(v2) expressions early
Date: Wed, 6 Apr 2022 00:18:09 +0200 [thread overview]
Message-ID: <YkzAIUEmsxebKj8l@salvia> (raw)
In-Reply-To: <dbbe9ff4-4ec8-b979-9a35-7f79b3fbb9cb@gmail.com>
On Thu, Mar 31, 2022 at 06:10:19PM +0300, Topi Miettinen wrote:
> On 31.3.2022 0.47, Pablo Neira Ayuso wrote:
> > On Wed, Mar 30, 2022 at 07:37:00PM +0300, Topi Miettinen wrote:
[...]
> > > Nice ideas, but the rules can't be loaded before the cgroups are realized at
> > > early boot:
> > >
> > > Mar 30 19:14:45 systemd[1]: Starting nftables...
> > > Mar 30 19:14:46 nft[1018]: /etc/nftables.conf:305:5-44: Error: cgroupv2 path
> > > fails: Permission denied
> > > Mar 30 19:14:46 nft[1018]: "system.slice/systemd-timesyncd.service" : jump
> > > systemd_timesyncd
> > > Mar 30 19:14:46 nft[1018]: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > > Mar 30 19:14:46 systemd[1]: nftables.service: Main process exited,
> > > code=exited, status=1/FAILURE
> > > Mar 30 19:14:46 systemd[1]: nftables.service: Failed with result
> > > 'exit-code'.
> > > Mar 30 19:14:46 systemd[1]: Failed to start nftables.
> >
> > I guess this unit file performs nft -f on cgroupsv2 that do not exist
> > yet.
>
> Yes, that's the case. Being able to do so with for example "cgroupsv2name"
> would be nice.
Cgroupsv2 names might be arbitrarily large, correct? ie. PATH_MAX.
next prev parent reply other threads:[~2022-04-06 4:47 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-26 10:09 Support for loading firewall rules with cgroup(v2) expressions early Topi Miettinen
2022-03-27 21:31 ` Pablo Neira Ayuso
2022-03-28 14:08 ` Topi Miettinen
2022-03-28 15:05 ` Pablo Neira Ayuso
2022-03-28 17:46 ` Topi Miettinen
2022-03-29 18:20 ` Topi Miettinen
2022-03-29 22:25 ` Pablo Neira Ayuso
2022-03-30 2:53 ` Pablo Neira Ayuso
2022-04-02 8:12 ` Topi Miettinen
2022-04-03 18:32 ` Topi Miettinen
2022-04-05 22:00 ` Pablo Neira Ayuso
2022-04-06 13:57 ` Topi Miettinen
2022-03-30 16:37 ` Topi Miettinen
2022-03-30 21:47 ` Pablo Neira Ayuso
2022-03-31 15:10 ` Topi Miettinen
2022-04-05 22:18 ` Pablo Neira Ayuso [this message]
2022-04-06 14:02 ` Topi Miettinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YkzAIUEmsxebKj8l@salvia \
--to=pablo@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=toiwoton@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).