22 lines
1.0 KiB
Desktop File
22 lines
1.0 KiB
Desktop File
[Unit]
|
|
# Deliberately the same shape as /etc/systemd/system/node_exporter_nft_guard.service,
|
|
# which is this host's established pattern for a composable guard table
|
|
# that lives alongside ufw's own ip/ip6 filter tables rather than fighting
|
|
# them. Ordered Before= the VM unit so a guest can never run with the
|
|
# second layer absent - though note the FIRST layer is IPAddressDeny= in
|
|
# owuivm.service, which does not depend on this unit at all.
|
|
Description=Second-layer egress filter for the owuitools VM sandbox
|
|
Documentation=https://documentation.ubuntu.com/security/security-features/network/firewall/nftables/
|
|
Before=owuivm.service owuivm-maint.service
|
|
After=local-fs.target
|
|
ConditionPathExists=/etc/nftables.d/60-owuivm.nft
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/bin/sh -c '/usr/sbin/nft delete table inet owuivm_guard >/dev/null 2>&1 || true; exec /usr/sbin/nft -f /etc/nftables.d/60-owuivm.nft'
|
|
ExecStop=/bin/sh -c '/usr/sbin/nft delete table inet owuivm_guard >/dev/null 2>&1 || true'
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|