From 2ff29969b1a60cade7e3968aeddf90fde511ab57 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20Koutn=C3=BD?= Date: Mon, 30 Jun 2025 16:15:26 +0200 Subject: doc: Clarify cgroup meta variable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The documentation mentions control group id where the meaning is a class id associated to the cgroup of a socket. This used to be fine until there came cgroup v2 that use similar terminolgy (cgroup id) for very different thing -- a numeric identifier of a particular (v2) cgroup. This contemporary cgroup id isn't exposed by netfilter (v2 matching is based on paths externally). Fix the docs and decrease confusion by more precise description of the metavariable. [ Added comment in description to refer to socket cgroupv2 --pablo ] Signed-off-by: Michal Koutný Signed-off-by: Pablo Neira Ayuso --- doc/primary-expression.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'doc') diff --git a/doc/primary-expression.txt b/doc/primary-expression.txt index ea231fe5..2266724e 100644 --- a/doc/primary-expression.txt +++ b/doc/primary-expression.txt @@ -117,7 +117,7 @@ devgroup outgoing device group| devgroup |cgroup| -control group id | +control group net_cls.classid (for matching on cgroupv2, see *socket cgroupv2*)| integer (32 bit) |random| pseudo-random number| -- cgit v1.2.3