Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket_bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket-bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket-bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket-bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket-bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd/systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html

Introduce BPF program compiled from BPF source code in
restricted C - socket-bind.
It addresses feature request [0].

The goal is to allow systemd services to bind(2) only to a predefined set
of ports. This prevents assigning socket address with unallowed port
to a socket and creating servers listening on that port.

This compliments firewalling feature presenting in systemd:
whereas cgroup/{egress|ingress} hooks act on packets, this doesn't
protect from untrusted service or payload hijacking an important port.

While ports in 0-1023 range are restricted to root only, 1024-65535
range is not protected by any mean.

Performance is another aspect of socket_bind feature since per-packet
cost can be eliminated for some port-based filtering policies.

The feature is implemented with cgroup/bind{4|6} hooks [1].
In contrast to the present systemd approach using raw bpf instructions,
this program is compiled from sources. Stretch goal is to
make bpf ecosystem in systemd more friendly for developer and to clear
path for more BPF programs.

[0] systemd/systemd#13496 (comment)
[1] https://www.spinics.net/lists/netdev/msg489054.html