I am trying to get iptables to mark packets from a specific systemd slice but I am not having much luck.
Here are the the details :
I’m running LXD 4.6.
My Container is Fedora 32 unprivileged and “raw.lxc lxc.mount.auto = cgroup:rw:force” is set on it.
I can see the PID of the process in cgroup.procs under the cgroup for the service just fine.
I am using CGroup V2 and systemd version is 245.8.
From inside the container running
iptables -t mangle -A INPUT -m cgroup --path "system.slice" -j MARK --set-mark 10
it works fine for the entire
When I try to change the slice on a service, for example, sshd by overriding the service unit file like
systemctl edit sshd —> then add
[Service] Slice=sshd.slice # or system-sshd.slice
Then reboot the container and try
iptables -t mangle -A INPUT -m cgroup --path <no matter what path I type> -j MARK --set-mark 10
this fails with a dmesg error like such : xt_cgroup Invalid Path, errno=-2.
I am not sure what would be the correct “path” to include in this command ?
what would be the correct way to accomplish using cgroups to mark packets generated or related to specific processes in order to further process them in iptables/netfilter ?
Thank you in advance