Systemd Now Allows Custom BPF Programs To Be Loaded On Cgroups
Written by Michael Larabel in systemd on 29 June 2019 at 07:11 AM EDT. 36 Comments
Systemd now allows loading of custom BPF programs for network traffic filtering that are applied to all sockets created by processes of a given systemd unit.

The motivation for this stems from a feature plan drawn up last year for having systemd install BPF (Berkeley Packet Filter) programs into cgroups. The benefit of this is associating a BPF program for IP filtering with a unit file so systemd can install them once a cgroup is setup.

With the systemd code as of this week, there are now the IPIngressFilterPath and IPEgressFilterPath options so that systemd units can specify a BPF pinned program as an argument. Multiple BPF programs can be specified and apply to all IP packets sent/received under the INET/INET6 sockets created by processes of the unit, in addition to any other filters of the system.

More details in this commit. This change will be in the upcoming systemd 243 release.
Related News
About The Author
Author picture

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter or contacted via

Popular News This Week