From 4298d0b5128326621c8f537107c4c8b459490721 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 25 Feb 2014 20:37:03 +0100
Subject: core: add new RestrictAddressFamilies= switch

This new unit settings allows restricting which address families are
available to processes. This is an effective way to minimize the attack
surface of services, by turning off entire network stacks for them.

This is based on seccomp, and does not work on x86-32, since seccomp
cannot filter socketcall() syscalls on that platform.
---
 src/core/execute.h | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'src/core/execute.h')

diff --git a/src/core/execute.h b/src/core/execute.h
index 2bfe227145..3c905cefae 100644
--- a/src/core/execute.h
+++ b/src/core/execute.h
@@ -178,6 +178,9 @@ struct ExecContext {
         int syscall_errno;
         bool syscall_whitelist:1;
 
+        Set *address_families;
+        bool address_families_whitelist:1;
+
         bool oom_score_adjust_set:1;
         bool nice_set:1;
         bool ioprio_set:1;
-- 
cgit v1.2.3-54-g00ecf