diff --git a/man/systemd.resource-control.xml b/man/systemd.resource-control.xml
index a1856f06dd..f5cbe688ee 100644
--- a/man/systemd.resource-control.xml
+++ b/man/systemd.resource-control.xml
@@ -772,26 +772,32 @@ BPFProgram=bind6:/sys/fs/bpf/sock-addr-hook
Allow or deny binding a socket address to a socket by matching it with the bind-rule and
applying a corresponding action if there is a match.
- bind-rule describes socket properties such as address-family
- and ip-ports.
+ bind-rule describes socket properties such as address-family,
+ transport-protocol and ip-ports.
- bind-rule := [address-family:]ip-ports
+ bind-rule :=
+ { [address-family:][transport-protocol:][ip-ports] | any }
address-family := { ipv4 | ipv6 }
- ip-ports := { ip-port | ip-port-range |
- any }
+ transport-protocol := { tcp | udp }
- An optional address-family expects IPv4 or IPv6 values.
- If not specified, a rule will be matched for both IPv4 and IPv6 addresses and applied depending on other socket fields, e.g.
+ ip-ports := { ip-port | ip-port-range }
+
+ An optional address-family expects ipv4 or ipv6 values.
+ If not specified, a rule will be matched for both IPv4 and IPv6 addresses and applied depending on other socket fields, e.g. transport-protocol,
ip-port.
- ip-port value must lie within 1…65535 interval inclusively, i.e.
+ An optional transport-protocol expects tcp or udp transport protocol names.
+ If not specified, a rule will be matched for any transport protocol.
+
+ An optional ip-port value must lie within 1…65535 interval inclusively, i.e.
dynamic port 0 is not allowed. A range of sequential ports is described by
ip-port-range := ip-port-low-ip-port-high,
where ip-port-low is smaller than or equal to ip-port-high
- and both are within 1…65535 inclusively. A special value any
- should be used to apply a rule to any port with a positive value.
+ and both are within 1…65535 inclusively.
+
+ A special value any can be used to apply a rule to any address family, transport protocol and any port with a positive value.
To allow multiple rules assign SocketBindAllow= or SocketBindDeny= multiple times.
To clear the existing assignments pass an empty SocketBindAllow= or SocketBindDeny=
@@ -825,11 +831,26 @@ SocketBindDeny=any
…
# Deny binding IPv6 socket addresses.
[Service]
-SocketBindDeny=ipv6:any
+SocketBindDeny=ipv6
…
# Deny binding IPv4 and IPv6 socket addresses.
[Service]
SocketBindDeny=any
+…
+# Allow binding only over TCP
+[Service]
+SocketBindAllow=tcp
+SocketBindDeny=any
+…
+# Allow binding only over IPv6/TCP
+[Service]
+SocketBindAllow=ipv6:tcp
+SocketBindDeny=any
+…
+# Allow binding ports within 10000-65535 range over IPv4/UDP.
+[Service]
+SocketBindAllow=ipv4:udp:10000-65535
+SocketBindDeny=any
…