Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2024-12-22 21:49:22 -05:00
Code Issues Packages Projects Releases Wiki Activity

use dedicated geoipupdate user

Browse Source
This commit is contained in:
Daniel Micay 2022-07-26 23:09:06 -04:00
parent 6081f9fa73
commit 54b52a3655
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nftables-dns.conf
View File

@ -48,12 +48,12 @@ table inet filter {
type filter hook output priority filter
oif lo goto output-internal
skuid != {root, systemd-network, chrony, unbound, powerdns} counter goto output-reject
skuid != {root, systemd-network, chrony, unbound, powerdns, geoipupdate} counter goto output-reject
}
chain output-internal {
skuid unbound meta l4proto {tcp, udp} th sport 53 th dport >= 1024 accept
skuid {chrony, powerdns} meta l4proto {tcp, udp} th sport >= 1024 th dport 53 accept
skuid {chrony, powerdns, geoipupdate} meta l4proto {tcp, udp} th sport >= 1024 th dport 53 accept
skuid != root counter goto output-reject
accept