diff --git a/stemcell_builder/stages/bosh_monit/apply.sh b/stemcell_builder/stages/bosh_monit/apply.sh index d09aba61ba..961a9e4fb2 100755 --- a/stemcell_builder/stages/bosh_monit/apply.sh +++ b/stemcell_builder/stages/bosh_monit/apply.sh @@ -30,9 +30,5 @@ chmod 0700 $chroot/$bosh_dir/etc/monitrc mkdir -p $chroot/$bosh_app_dir/monit touch $chroot/$bosh_app_dir/monit/empty.monitrc -# nftables rules for monit -mkdir -p $chroot/etc/nftables -cp $dir/assets/monit-nftables.nft $chroot/etc/nftables/monit.nft - cp "$(dirname "$0")/assets/monit.service" "${chroot}/lib/systemd/system/" run_in_chroot "${chroot}" "systemctl enable monit.service" \ No newline at end of file diff --git a/stemcell_builder/stages/bosh_monit/assets/monit-nftables.nft b/stemcell_builder/stages/bosh_monit/assets/monit-nftables.nft deleted file mode 100644 index 3709be6dbd..0000000000 --- a/stemcell_builder/stages/bosh_monit/assets/monit-nftables.nft +++ /dev/null @@ -1,13 +0,0 @@ -table inet filter { - # Chain rules - chain monit_output { - type filter hook output priority 0; policy accept; - - # Allow established and related connections - ct state established,related accept - - socket cgroupv2 level 2 "system.slice/bosh-agent.service" ip daddr 127.0.0.1 tcp dport 2822 log prefix "Matched cgroup bosh-agent monit rule: " accept - skuid 0 ip daddr 127.0.0.1 tcp dport 2822 log prefix "Matched skuid monit rule:" accept - ip daddr 127.0.0.1 tcp dport 2822 log prefix "dropped monit rule:" drop - } -} diff --git a/stemcell_builder/stages/bosh_monit/assets/monit.service b/stemcell_builder/stages/bosh_monit/assets/monit.service index 736e905292..8e447ad127 100644 --- a/stemcell_builder/stages/bosh_monit/assets/monit.service +++ b/stemcell_builder/stages/bosh_monit/assets/monit.service @@ -4,9 +4,7 @@ After=network.target ConditionPathExists=/var/vcap/data/sys/run [Service] -ExecStartPre=/usr/sbin/nft -f /etc/nftables/monit.nft ExecStart=/bin/bash -c 'PATH=/var/vcap/bosh/bin:$PATH exec nice -n -10 /var/vcap/bosh/bin/monit -I -c /var/vcap/bosh/etc/monitrc' -ExecStopPost=/usr/sbin/nft flush chain inet filter monit_output Restart=always KillMode=process