23.10.2019 11:54, Per Jessen пишет:

Andrei Borzenkov wrote:

...

23.10.2019 9:41, Per Jessen пишет:

...

I'm sure this is a case of needing another pair of eyes. Mine are getting tired.

I have the following service unit:

------------------------ systemctl cat firewall@ipv4 # /etc/systemd/system/firewall@.service [Unit] Description=firewall %i After=network.target

Not exactly related but this is generally considered too late. You have small window between network up and firewall effective.

Thanks, I'll have to look into that. Do you happen to know what might give a better timing - generally only two interfaces on these boxes, I could perhaps depend directly on them?

Author: Lennart Poettering Date: Wed Jun 11 11:33:02 2014 +0200 units: introduce network-pre.target as place to hook in firewalls network-pre.target is a passive target that should be pulled in by services that want to be executed before any network is configured (for example: firewall scrips). network-pre.target should be ordered before all network managemet services (but not be pulled in by them). network-pre.target should be order after all services that want to be executed before any network is configured (and be pulled in by them).

...

...

[Service] Type=oneshot ExecStart=/usr/local/bin/firewall-%i ExecStop=/usr/local/bin/firewall-%i stop

I think specifiers in Exec* directives are supported starting with v229 and Leap 42.3 has v228 (although of course it could have been backported). I could not find anything in NEWS unfortunately and commit message is not entirely helpful, but this is the only commit that added resolving of specifiers there.

Aha .... firewall-ipv4 is just a script, I guess I can just use:

ExecStart=/bin/bash /usr/local/bin/firewall-%i

I do not think it will work but of course you may try. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

23.10.2019 13:06, Per Jessen пишет:

...

...

Aha .... firewall-ipv4 is just a script, I guess I can just use:

ExecStart=/bin/bash /usr/local/bin/firewall-%i

I do not think it will work but of course you may try.

Remarkably, it does work.

Right, systemd expanded specifiers in command arguments from the very beginning, but it happened later, when command was going to be executed. Later specifiers handling was moved to configuration parsing stage at which point it also started to work for command name. Not sure whether it really was intentional though, as usually such changes are listed in NEWS. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org