SocketBindAllow setting
The property SocketBindAllow is a systemd unit setting used for sandboxing. It is available since systemd 249.
Purpose: define which address families, transport protocols, and/or ports are allowed to bind() to a socket
Why and when to use SocketBindAllow
The setting SocketBindAllow is used together with SocketBindDeny and defines restrictions on the usage of the system call bind(2) on a network socket.
Settings
Both SocketBindAllow and SocketBindDeny use a bind-rule. See SocketBindDeny for the details.
Generic advice
This setting is useful in combination with SocketBindDeny to create an allow-list.
Examples
Allow binding on TCP port 80
[Service]
SocketBindDeny=any
SocketBindAllow=tcp:80
Allow binding on port 443 (IPv4/IPv6, TCP/UDP)
[Service]
SocketBindDeny=any
SocketBindAllow=443
Related hardening profiles
The systemd unit setting SocketBindAllow is used in the following hardening profiles.
