Blame extensions/libxt_cgroup.man
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
[\fB!\fP] \fB\-\-path\fP \fIpath\fP
|
|
Packit |
7b22a4 |
Match cgroup2 membership.
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
Each socket is associated with the v2 cgroup of the creating process.
|
|
Packit |
7b22a4 |
This matches packets coming from or going to all sockets in the
|
|
Packit |
7b22a4 |
sub-hierarchy of the specified path. The path should be relative to
|
|
Packit |
7b22a4 |
the root of the cgroup2 hierarchy.
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
[\fB!\fP] \fB\-\-cgroup\fP \fIclassid\fP
|
|
Packit |
7b22a4 |
Match cgroup net_cls classid.
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
classid is the marker set through the cgroup net_cls controller. This
|
|
Packit |
7b22a4 |
option and \-\-path can't be used together.
|
|
Packit |
7b22a4 |
.PP
|
|
Packit |
7b22a4 |
Example:
|
|
Packit |
7b22a4 |
.IP
|
|
Packit |
7b22a4 |
iptables \-A OUTPUT \-p tcp \-\-sport 80 \-m cgroup ! \-\-path service/http-server \-j DROP
|
|
Packit |
7b22a4 |
.IP
|
|
Packit |
7b22a4 |
iptables \-A OUTPUT \-p tcp \-\-sport 80 \-m cgroup ! \-\-cgroup 1
|
|
Packit |
7b22a4 |
\-j DROP
|
|
Packit |
7b22a4 |
.PP
|
|
Packit |
7b22a4 |
\fBIMPORTANT\fP: when being used in the INPUT chain, the cgroup
|
|
Packit |
7b22a4 |
matcher is currently only of limited functionality, meaning it
|
|
Packit |
7b22a4 |
will only match on packets that are processed for local sockets
|
|
Packit |
7b22a4 |
through early socket demuxing. Therefore, general usage on the
|
|
Packit |
7b22a4 |
INPUT chain is not advised unless the implications are well
|
|
Packit |
7b22a4 |
understood.
|
|
Packit |
7b22a4 |
.PP
|
|
Packit |
7b22a4 |
Available since Linux 3.14.
|