<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style> </head> <body dir="ltr"> <div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif;"> <span style="font-size: 12pt; color: rgb(0, 0, 0);">So, the main option now, is to write a script that looks for any service without a </span><span style="font-size: 11pt; color: rgb(0, 0, 0);">RestrictAddressFamilies and make a dropin to restrict it, and run the script whenever a new service is added?<br> <br> Was hoping to avoid that as its complex / potentially error prone. But if thats what it takes, thats what it takes.</span></div> <div style="color: inherit;" id="appendonsend"></div> <div><br> </div> <div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> Thanks!</div> <div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> Kevin</div> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <hr style="display: inline-block; width: 98%;"> <span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><b>From:</b> Michal Koutnı<br> <b>Sent:</b> Wednesday, January 29, 2025 9:12 AM<br> <b>To:</b> Fox, Kevin M<br> <b>Cc:</b> systemd-devel@lists.freedesktop.org<br> <b>Subject:</b> Re: [systemd-devel] By default, restrict vsock </span> <div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style="font-size: 11pt;">On Fri, Jan 24, 2025 at 05:20:50PM +0000, "Fox, Kevin M" <Kevin.Fox@pnnl.gov> wrote:<br> > So, I think there still is a problem here.<br> ><br> > Any ideas?<br> <br> Hm, the latter is clearly generally unadvisable, so stick with the first<br> approach and allow the AF_VSOCK in a higher drop-in, in your case<br> <br> /usr/lib/systemd/system/particular.service.d/20-vsock-enable.conf<br> <br> (Admiteddly, the service config would be broken down to multiple files<br> this way.)<br> <br> HTH,<br> Michal<br> </div> </body> </html>