From 5105e844c2ff6a3e320bf8cdadc5094d4eaef2b7 Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Fri, 17 Jul 2020 10:39:40 +0200 Subject: iptables: accept lock file name at runtime allow users to override at runtime the lock file to use through the XTABLES_LOCKFILE environment variable. It allows to use iptables when the user has granted enough capabilities (e.g. a user+network namespace) to configure the network but that lacks access to the XT_LOCK_NAME (by default placed under /run). $ XTABLES_LOCKFILE=/tmp/xtables unshare -rn iptables ... Signed-off-by: Giuseppe Scrivano Signed-off-by: Pablo Neira Ayuso --- iptables/iptables.8.in | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'iptables/iptables.8.in') diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in index 054564b3..999cf339 100644 --- a/iptables/iptables.8.in +++ b/iptables/iptables.8.in @@ -397,6 +397,14 @@ corresponding to that rule's position in the chain. \fB\-\-modprobe=\fP\fIcommand\fP When adding or inserting rules into a chain, use \fIcommand\fP to load any necessary modules (targets, match extensions, etc). + +.SH LOCK FILE +iptables uses the \fI@XT_LOCK_NAME@\fP file to take an exclusive lock at +launch. + +The \fBXTABLES_LOCKFILE\fP environment variable can be used to override +the default setting. + .SH MATCH AND TARGET EXTENSIONS .PP iptables can use extended packet matching and target modules. -- cgit v1.2.3