FIREWALLD.LOCKDOWN(5)

💅 FIREWALLD.LOCKDOWN(5) — the lockdown whitelist glow-up

okay so bestie, welcome to firewalld.lockdown-whitelist (section 5 of your manual, iykyk) — literally the firewalld lockdown whitelist configuration file. yes it's a whole file. yes it's iconic. let's get into it 🎀

---

✨ SYNOPSIS ✨

/etc/firewalld/lockdown-whitelist.xml

that's the path, that's the vibe, periodt. 💖

---

🌸 DESCRIPTION 🌸

so this file — the firewalld lockdown-whitelist configuration file — is where you keep the selinux contexts, commands, users and user ids that are white-listed when the firewalld lockdown feature is enabled. like, lockdown mode is ON and these are the certified besties allowed through 🫶 (peep firewalld.conf(5) and firewall-cmd(1) for the deets on lockdown itself, no cap).

this example configuration file shows the structure of an lockdown-whitelist file, and it's giving very demure, very mindful:

<?xml version="1.0" encoding="utf-8"?>
<whitelist>
  <selinux context="selinuxcontext"/>
  <command name="commandline[*]"/>
  <user {name="username|id="userid"}/>
</whitelist>

---

⭐ OPTIONS ⭐

the config can contain these tags and attributes. some of them are mandatory, others are optional — so pay attention, bestie 👀

🦋 whitelist

the mandatory whitelist start and end tag defines the lockdown-whitelist. this tag can only be used once in a lockdown-whitelist configuration file. there are no attributes for this. one (1) whitelist tag, that's the whole assignment 💅

💜 selinux

is an optional empty-element tag and can be used several times to have more than one selinux contexts entries. a selinux entry has exactly one attribute:

• context="string" — the context is the security (SELinux) context of a running application or service.

to get the context of a running application use ps -e --context and search for the application that should be white-listed. literally that's it, go find your app 🔍

⚠️ Warning: if the context of an application is unconfined, then this will open access for more than the desired application. so like... not the slay you think it is 😭 careful.

🎀 command

is an optional empty-element tag and can be used several times to have more than one command entry. a command entry has exactly one attribute:

• name="string" — the command string is a complete command line including path and also attributes.

if a command entry ends with an asterisk '*', then all command lines starting with the command will match. if the '*' is not there the absolute command inclusive arguments must match. so the asterisk is the "and friends" of your command line, got it? ✨

commands for user root and others is not always the same, the used path depends on the use of the PATH environment variable. so lowkey the PATH matters, fr fr.

🌈 user

is an optional empty-element tag and can be used several times to white-list more than one user. a user entry has exactly one attribute of these:

• name="string" — the user with the name string will be white-listed. 💖
• id="integer" — the user with the id userid will be white-listed. 🔢

---

🧚 SEE ALSO 🧚

firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1), firewalld.conf(5), firewalld.direct(5), firewalld.dbus(5), firewalld.icmptype(5), firewalld.lockdown-whitelist(5), firewall-offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5), firewalld.zone(5), firewalld.zones(5), firewalld.policy(5), firewalld.policies(5), firewalld.ipset(5), firewalld.helper(5)

yeah that's a whole friend group, read them all, they're all main characters 🫶

---

📌 NOTES 📌

firewalld home page, the sacred link:

http://firewalld.org

---

👑 AUTHORS 👑

• Thomas Woerner <twoerner@redhat.com> — Developer
• Jiri Popelka <jpopelka@redhat.com> — Developer
• Eric Garver <eric@garver.life> — Developer

---

and that's the whole page bestie, you ate that 💅✨

this little masterpiece is from firewalld 2.1.2 — FIREWALLD.LOCKDOWN(5), signing off 🎀🦋💖