diff --git a/man/systemd.resource-control.xml b/man/systemd.resource-control.xml
index e9747cefbb..bb1078119d 100644
--- a/man/systemd.resource-control.xml
+++ b/man/systemd.resource-control.xml
@@ -1005,6 +1005,92 @@ RestrictNetworkInterfaces=~eth1
+
+ NFTSet=family:table:set
+
+ This setting provides a method for integrating dynamic cgroup, user and group IDs into
+ firewall rules with NFT
+ sets. The benefit of using this setting is to be able to use the IDs as selectors in firewall rules
+ easily and this in turn allows more fine grained filtering. NFT rules for cgroup matching use
+ numeric cgroup IDs, which change every time a service is restarted, making them hard to use in
+ systemd environment otherwise. Dynamic and random IDs used by DynamicUser= can
+ be also integrated with this setting.
+
+ This option expects a whitespace separated list of NFT set definitions. Each definition
+ consists of a colon-separated tuple of source type (one of cgroup,
+ user or group), NFT address family (one of
+ arp, bridge, inet, ip,
+ ip6, or netdev), table name and set name. The names of tables
+ and sets must conform to lexical restrictions of NFT table names. The type of the element used in
+ the NFT filter must match the type implied by the directive (cgroup,
+ user or group) as shown in the table below. When a control
+ group or a unit is realized, the corresponding ID will be appended to the NFT sets and it will be
+ be removed when the control group or unit is removed. systemd only inserts
+ elements to (or removes from) the sets, so the related NFT rules, tables and sets must be prepared
+ elsewhere in advance. Failures to manage the sets will be ignored.
+
+
+ Defined <varname>source type</varname> values
+
+
+
+
+
+
+ Source type
+ Description
+ Corresponding NFT type name
+
+
+
+
+
+ cgroup
+ control group ID
+ cgroupsv2
+
+
+ user
+ user ID
+ meta skuid
+
+
+ group
+ group ID
+ meta skgid
+
+
+
+
+
+ If the firewall rules are reinstalled so that the contents of NFT sets are destroyed, command
+ systemctl daemon-reload can be used to refill the sets.
+
+ Example:
+ [Unit]
+NFTSet=cgroup:inet:filter:my_service user:inet:filter:serviceuser
+
+ Corresponding NFT rules:
+ table inet filter {
+ set my_service {
+ type cgroupsv2
+ }
+ set serviceuser {
+ typeof meta skuid
+ }
+ chain x {
+ socket cgroupv2 level 2 @my_service accept
+ drop
+ }
+ chain y {
+ meta skuid @serviceuser accept
+ drop
+ }
+}
+
+
+
+
BPF Programs
@@ -1500,92 +1586,6 @@ DeviceAllow=/dev/loop-control
-
-
- NFTSet=family:table:set
-
- This setting provides a method for integrating dynamic cgroup, user and group IDs into
- firewall rules with NFT
- sets. The benefit of using this setting is to be able to use the IDs as selectors in firewall rules
- easily and this in turn allows more fine grained filtering. NFT rules for cgroup matching use
- numeric cgroup IDs, which change every time a service is restarted, making them hard to use in
- systemd environment otherwise. Dynamic and random IDs used by DynamicUser= can
- be also integrated with this setting.
-
- This option expects a whitespace separated list of NFT set definitions. Each definition
- consists of a colon-separated tuple of source type (one of cgroup,
- user or group), NFT address family (one of
- arp, bridge, inet, ip,
- ip6, or netdev), table name and set name. The names of tables
- and sets must conform to lexical restrictions of NFT table names. The type of the element used in
- the NFT filter must match the type implied by the directive (cgroup,
- user or group) as shown in the table below. When a control
- group or a unit is realized, the corresponding ID will be appended to the NFT sets and it will be
- be removed when the control group or unit is removed. systemd only inserts
- elements to (or removes from) the sets, so the related NFT rules, tables and sets must be prepared
- elsewhere in advance. Failures to manage the sets will be ignored.
-
-
- Defined <varname>source type</varname> values
-
-
-
-
-
-
- Source type
- Description
- Corresponding NFT type name
-
-
-
-
-
- cgroup
- control group ID
- cgroupsv2
-
-
- user
- user ID
- meta skuid
-
-
- group
- group ID
- meta skgid
-
-
-
-
-
- If the firewall rules are reinstalled so that the contents of NFT sets are destroyed, command
- systemctl daemon-reload can be used to refill the sets.
-
- Example:
- [Unit]
-NFTSet=cgroup:inet:filter:my_service user:inet:filter:serviceuser
-
- Corresponding NFT rules:
- table inet filter {
- set my_service {
- type cgroupsv2
- }
- set serviceuser {
- typeof meta skuid
- }
- chain x {
- socket cgroupv2 level 2 @my_service accept
- drop
- }
- chain y {
- meta skuid @serviceuser accept
- drop
- }
-}
-
-
-