diff options
| author | Daniel Borkmann <dborkman@redhat.com> | 2013-12-23 18:46:29 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-01-04 15:45:34 +0100 |
| commit | 6465867eb48506687872b838b1ddfee61d1a0aeb (patch) | |
| tree | c1f4b3f6410bb04461dd7dad76bea3b6f6c7678f /extensions/libxt_cgroup.man | |
| parent | 3cefc136d13f426fd68808ddfd39ada0c90f23db (diff) | |
iptables: add libxt_cgroup frontend
This patch adds the user space extension/frontend for process matching
based on cgroups from the kernel patch entitled "netfilter: xtables:
lightweight process control group matching".
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/libxt_cgroup.man')
| -rw-r--r-- | extensions/libxt_cgroup.man | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/extensions/libxt_cgroup.man b/extensions/libxt_cgroup.man new file mode 100644 index 00000000..456a0311 --- /dev/null +++ b/extensions/libxt_cgroup.man @@ -0,0 +1,15 @@ +.TP +[\fB!\fP] \fB\-\-cgroup\fP \fIfwid\fP +Match corresponding cgroup for this packet. + +Can be used to assign particular firewall policies for aggregated +task/jobs on the system. This allows for more fine-grained firewall +policies that only match for a subset of the system's processes. +fwid is the maker set through the net_cls cgroup's id. +.PP +Example: +.PP +iptables \-A OUTPUT \-p tcp \-\-sport 80 \-m cgroup ! \-\-cgroup 1 +\-j DROP +.PP +Available since Linux 3.14. |