S6-ACCESSRULES-CDB-FROM-FS(8)

💅 s6-accessrules-cdb-from-fs(8) — bestie, we’re compiling a ruleset directory into a CDB file ✨

🌸 NAME 🌸

<pink>s6-accessrules-cdb-from-fs</pink> — okay so this icon compiles a directory containing a ruleset suitable for s6-ipcserver-access(8) or s6-tcpserver-access(8) into a CDB[1] file. Literally that’s the whole gig. 🫶

✨ SYNOPSIS ✨

s6-accessrules-cdb-from-fs [-m mode] cdbfile dir

💖 DESCRIPTION 💖

s6-accessrules-cdb-from-fs compiles the dir directory containing a ruleset into a CDB[1] file cdbfile then exits 0. No cap, that’s it. 🎀

🗂️ Ruleset directory format 🗂️

For s6-accessrules-cdb-from-fs, s6-ipcserver-access(8), or s6-tcpserver-access(8) to understand it, dir must have a specific format. Bestie, this is not a free-for-all. 💅

dir contains a series of directories:

• ip4 — rules on IPv4 addresses. 🌐
• ip6 — rules on IPv6 addresses. 🛰️
• reversedns — rules on host names. 🏷️
• uid — rules on user IDs. 👤
• gid — rules on group IDs. 👥

Depending on the application, other directories can appear in dir and be compiled into cdbfile, but s6-tcpserver-access(8) only uses the first three, and s6-ipcserver-access(8) only uses the last two. So yeah, context matters. 🙈

Each of those directories contains a set of rules. A rule is a subdirectory named after the set of keys it matches, and containing actions that will be executed if the rule is the first matching rule for the tested key. First match wins, periodt. 👑

The syntax for the rule name is dependent on the nature of keys, and fully documented in s6-accessrules(7). For instance, a subdirectory named 192.168.0.0_27 in the ip4 directory will match every IPv4 address in the 192.168.0.0/27 network that does not match a more precise rule. Iconic little network moment. 🌈

The syntax for the actions, however, is the same for every type of key. A rule subdirectory can contain the following elements:

• A file (that can be empty) named allow. If such a file exists, a key matching this rule will be immediately accepted. ✅
• A file (that can be empty) named deny. If such a file exists and no allow file exists, a key matching this rule will be immediately denied. 🚫
• A subdirectory named env. If such a directory exists along with an allow file, then its contents represent environment modifications that will be applied after accepting the connection and before executing the next program in the chain, as if the s6-envdir(8) program, without options, was applied to env. env has exactly the same format as a directory suitable for s6-envdir(8); however, if the modifications take up more than 4096 bytes when compiled into cdbfile, then s6-accessrules-cdb-from-fs will complain and exit 100. ⚠️
• A file named exec. If such a file exists along with an allow file, then its contents represent a command line that, interpreted by the execlineb(1) launcher, will be executed after accepting the connection, totally bypassing the original command line. s6-accessrules-cdb-from-fs truncates the exec file to 4096 bytes max when embedding it into cdbfile, so make sure it is not larger than that. 🏃‍♀️💨

cdbfile can exist prior to, and during, the compilation, which actually works in a temporary file in the same directory as cdbfile and performs an atomic replacement when it is done. So it is not necessary to interrupt a running service during the compilation. Slay, zero-downtime vibes. ✨

If s6-accessrules-cdb-from-fs fails at some point, the temporary file is removed. However, this doesn’t happen if s6-accessrules-cdb-from-fs is interrupted by a signal. 😭 Important caveat, bestie.

After the program successfully completes, if dir was a suitable candidate for the -i option of s6-ipcserver-access(8) or s6-tcpserver-access(8), then cdbfile will be a suitable candidate for the -x option of the same program, implementing the same ruleset. Full circle. 🫶

cdbfile can be decompiled by the s6-accessrules-fs-from-cdb(8) program. Cute. 🎀

💅 OPTIONS 💅

• -m mode — Create cdbfile with permissions mode (an octal number). 🔐

🔥 SEE ALSO 🔥

execlineb(1), s6-accessrules-fs-from-cdb(8), s6-connlimit(8), s6-ioconnect(8), s6-ipcclient(8), s6-ipcserver(8), s6-ipcserver-access(8), s6-ipcserver-socketbinder(8), s6-ipcserverd(8), s6-tcpserver-access(8)

[1] https://en.wikipedia.org/wiki/Cdb_(software)

This man page is ported from the authoritative documentation at: https://skarnet.org/software/s6/s6-accessrules-cdb-from-fs.html

👑 AUTHORS 👑

Laurent Bercot Alexis <flexibeast@gmail.com> (man page port)

---

🌸💖 That’s the page, bestie — source/version: Debian, date: October 4, 2025, manual: S6-ACCESSRULES-CDB-FROM-FS(8), System Manager's Manual. Stay iconic and may your rulesets always be first-match correct. 💅✨