[systemd-devel] [PATCH v2] Add a network-pre.target to avoid firewall leaks

2014-06-07 Thread Rusty Bird
https://bugs.freedesktop.org/show_bug.cgi?id=79600
---
 Makefile.am   |  1 +
 man/network-pre.target.xml| 82 +++
 units/network-pre.target  | 11 ++
 units/network.target  |  8 
 units/systemd-networkd.service.in |  3 +-
 5 files changed, 104 insertions(+), 1 deletion(-)
 create mode 100644 man/network-pre.target.xml
 create mode 100644 units/network-pre.target

diff --git a/Makefile.am b/Makefile.am
index a2a01d0..79adc34 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -413,6 +413,7 @@ dist_systemunit_DATA = \
units/remote-fs.target \
units/remote-fs-pre.target \
units/network.target \
+   units/network-pre.target \
units/network-online.target \
units/nss-lookup.target \
units/nss-user-lookup.target \
diff --git a/man/network-pre.target.xml b/man/network-pre.target.xml
new file mode 100644
index 000..db52b33
--- /dev/null
+++ b/man/network-pre.target.xml
@@ -0,0 +1,82 @@
+?xml version='1.0'? !--*-nxml-*--
+!DOCTYPE refentry PUBLIC -//OASIS//DTD DocBook XML V4.2//EN
+http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd;
+
+!--
+  This file is part of systemd.
+
+  Copyright 2014 Tom Gundersen
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see http://www.gnu.org/licenses/.
+--
+
+refentry id=network-pre.target
+
+refentryinfo
+titlenetwork-pre.target/title
+productnamesystemd/productname
+
+authorgroup
+author
+contribDeveloper/contrib
+firstnameRusty/firstname
+surnameBird/surname
+emailrustyb...@openmailbox.org/email
+/author
+/authorgroup
+/refentryinfo
+
+refmeta
+refentrytitlenetwork-pre.target/refentrytitle
+manvolnum8/manvolnum
+/refmeta
+
+refnamediv
+refnamenetwork-pre.target/refname
+refpurposeNetwork interface configuration has not yet 
begun/refpurpose
+/refnamediv
+
+refsect1
+titleDescription/title
+
+paravarnamenetwork-pre.target/varname is a systemd 
target intended to be
+activated before any network interface configuration 
begins./para
+/refsect1
+
+refsect1
+titleUsage/title
+
+paraNetwork interface configuration services must 
varnameRequire=/varname,
+and order themselves varnameAfter=/varname, 
varnamenetwork-pre.target/varname./para
+
+paraFirewall services should order themselves 
varnameBefore=/varname, and
+declare a varnameRequiredBy=/varname relation to, 
varnamenetwork-pre.target/varname.
+Once enabled, their failure to start will impede network 
communication, avoiding
+dangerous leaks./para
+
+para(These usages are compatible with older versions of 
systemd that do not ship
+varnamenetwork-pre.target/varname, because relations to 
missing units are
+dropped.)/para
+/refsect1
+
+refsect1
+titleSee Also/title
+para
+
citerefentryrefentrytitlesystemd/refentrytitlemanvolnum1/manvolnum/citerefentry,
+
citerefentryrefentrytitlesystemd.target/refentrytitlemanvolnum5/manvolnum/citerefentry
+
citerefentryrefentrytitlesystemd.unit/refentrytitlemanvolnum5/manvolnum/citerefentry
+/para
+/refsect1
+
+/refentry
diff --git a/units/network-pre.target b/units/network-pre.target
new file mode 100644
index 000..0d4d363
--- /dev/null
+++ b/units/network-pre.target
@@ -0,0 +1,11 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Network (Pre)
+Documentation=man:network-pre.target(8)
+RefuseManualStart=yes
diff --git a/units/network.target b/units/network.target
index 65fc64b..b80a8cc 100644
--- 

Re: [systemd-devel] [PATCH v2] Add a network-pre.target to avoid firewall leaks

2014-06-07 Thread Zbigniew Jędrzejewski-Szmek
Hi,

we *might* want to add a target like this. People often have things
which they want to do before network is configured and it would be a
convenient hook for them. But the reasons should be made
clearer. Currently my iptables.service has Before=basic.target.  Why
is doing something like that not enough?

If it is added, the documentation for the target should be added to
systemd.special(7), we don't want to have a separate man page for every
target. Also, Description= is part of the documentation, and it should
be changed to something meaningful.

 +refsect1
 +titleUsage/title
 +
 +paraNetwork interface configuration services must 
 varnameRequire=/varname,
 +and order themselves varnameAfter=/varname, 
 varnamenetwork-pre.target/varname./para
 +
 +paraFirewall services should order themselves 
 varnameBefore=/varname, and
 +declare a varnameRequiredBy=/varname relation to, 
 varnamenetwork-pre.target/varname.
 +Once enabled, their failure to start will impede network 
 communication, avoiding
 +dangerous leaks./para
dangerous leaks is unclear and imprecise.

 +para(These usages are compatible with older versions of 
 systemd that do not ship
 +varnamenetwork-pre.target/varname, because relations to 
 missing units are
 +dropped.)/para
This is not true. Require=network-pre.target will prevent a service
from being started if network-pre.target unit is not present.

 +[Unit]
 +Description=Network (Pre)
 +Documentation=man:network-pre.target(8)

 +RefuseManualStart=yes
Why?

Zbyszek
___
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel