Hi,
I'd like to use cgroupv2 expressions in firewall rules. But since the
rules are loaded very early in the boot, the expressions are rejected
since the target cgroups are not realized until much later.
Would it be possible to add new cgroupv2 expressions which defer the
check until actual use? For example, 'cgroupv2name' (like iifname etc.)
would check the cgroup path string at rule use time?
Another possibility would be to hook into cgroup directory creation
logic in kernel so that when the cgroup is created, part of the path
checks are performed or something else which would allow non-existent
cgroups to be used. Then the NFT syntax would not need changing, but the
expressions would "just work" even when loaded early.
Indirection through sets ('socket cgroupv2 level @lvl @cgname drop')
might work in some cases, but it would need support from cgroup manager
like systemd which would manage the sets. This would also probably not
be scalable to unprivileged users or containers.
This also applies to old cgroup (v1) expression but that's probably not
worth improving anymore.
Related work on systemd side:
https://github.com/systemd/systemd/issues/22527
-Topi
