core-agent-linux/vm-systemd/qubes-firewall.service

[Unit]
Description=Qubes firewall updater
ConditionPathExists=/var/run/qubes-service/qubes-firewall
After=qubes-iptables.service
Before=qubes-network.service

[Service]
Type=notify
ExecStart=/usr/bin/qubes-firewall

[Install]
WantedBy=multi-user.target
vm/init: introduce SystemD startup scripts 2012-01-10 12:10:16 +01:00			`[Unit]`
			`Description=Qubes firewall updater`
			`ConditionPathExists=/var/run/qubes-service/qubes-firewall`
network: order qubes-firewall service before enabling IP forwarding Start qubes-firewall (which will add "DROP by default" rule) before enabling IP forwarding, to not leave a time slot where some connection could go around configured firewall. QubesOS/qubes-issues#3269 2017-11-20 02:42:39 +01:00			`After=qubes-iptables.service`
			`Before=qubes-network.service`
vm/init: introduce SystemD startup scripts 2012-01-10 12:10:16 +01:00
			`[Service]`
qubes-firewall: signal service readiness only after initial scripts qubes-firewall.service have Before=qubes-network.service. The latter enable ip_forwarding. Make sure the ordering cover not only service fork, but all its startup sequence, including initial rules and user scripts. Reported-by: @tasket 2018-04-20 16:38:25 +02:00			`Type=notify`
Move `qubes-firewall` from `sbin` to `bin` 2019-11-26 00:47:08 +01:00			`ExecStart=/usr/bin/qubes-firewall`
vm/init: introduce SystemD startup scripts 2012-01-10 12:10:16 +01:00
			`[Install]`
			`WantedBy=multi-user.target`