neulab/tldr huggingface dataset:
In some cases, a system call will differ from the documented behavior or have a different name.  For example, the faccessat(2) system call does not have flags argument, and the setrlimit(2) library function uses prlimit64(2) system call on modern (2.6.38+) kernels.  These discrepancies are normal but idiosyncratic characteristics of the system call interface and are accounted for by C library wrapper functions.
Some system calls have different names in different architectures and personalities.  In these cases, system call filtering and printing uses the names that match corresponding __NR_* kernel macros of the tracee's architecture and personality.  There are two exceptions from this general rule: arm_fadvise64_64(2) ARM syscall and xtensa_fadvise64_64(2) Xtensa syscall are filtered and printed as fadvise64_64(2).
On x32, syscalls that are intended to be used by 64-bit processes and not x32 ones (for example, readv(2), that has syscall number 19 on x86_64, with its x32 counterpart has syscall number 515), but called with __X32_SYSCALL_BIT flag being set, are designated with #64 suffix.
On some platforms a process that is attached to with the -p option may observe a spurious EINTR return from the current system call that is not restartable.  (Ideally, all system calls should be restarted on strace attach, making the attach invisible to the traced process, but a few system calls aren't.  Arguably, every instance of such behavior is a kernel bug.)  This may have an unpredictable effect on the process if the process takes no action to restart the system call.
As strace executes the specified command directly and does not employ a shell for that, scripts without shebang that usually run just fine when invoked by shell fail to execute with ENOEXEC error.  It is advisable to manually supply a shell as a command with the script as its argument.
Programs that use the setuid bit do not have effective user ID privileges while being traced.
A traced process runs slowly (but check out the --seccomp-bpf option).
Traced processes which are descended from command may be left running after an interrupt signal (CTRL-C).
The original strace was written by Paul Kranenburg for SunOS and was inspired by its trace utility.  The SunOS version of strace was ported to Linux and enhanced by Branko Lankester, who also wrote the Linux kernel support.  Even though Paul released strace 2.5 in 1992, Branko's work was based on Paul's strace 1.5 release from 1991.  In 1993, Rick Sladkey merged strace 2.5 for SunOS and the second release of strace for Linux, added many of the features of truss(1) from SVR4, and produced an strace that worked on both platforms.  In 1994 Rick ported strace to SVR4 and Solaris and wrote the automatic configuration support.  In 1995 he ported strace to Irix and tired of writing about himself in the third person.
Beginning with 1996, strace was maintained by Wichert Akkerman.  During his tenure, strace development migrated to CVS; ports to FreeBSD and many architectures on Linux (including ARM, IA-64, MIPS, PA-RISC, PowerPC, s390, SPARC) were introduced.  In 2002, the burden of strace maintainership was transferred to Roland McGrath.  Since then, strace gained support for several new Linux architectures (AMD64, s390x, SuperH), bi-architecture support for some of them, and received numerous additions and improvements in syscalls decoders on Linux; strace development migrated to git during that period.  Since 2009, strace is actively maintained by Dmitry Levin.  strace gained support for AArch64, ARC, AVR32, Blackfin, Meta, Nios II, OpenRISC 1000, RISC-V, Tile/TileGx, Xtensa architectures since that time.  In 2012, unmaintained and apparently broken support for non-Linux operating systems was removed. Also, in 2012 strace gained support for path tracing and file descriptor path decoding.  In 2014, support for stack traces printing was added.  In 2016, syscall fault injection was implemented.
For the additional information, please refer to the NEWS file and strace repository commit log.
Problems with strace should be reported to the strace mailing list ⟨mailto:strace-devel@lists.strace.io⟩.
strace-log-merge(1), ltrace(1), perf-trace(1), trace-cmd(1), time(1), ptrace(2), proc(5)
strace Home Page ⟨https://strace.io/⟩
The complete list of strace contributors can be found in the CREDITS file.
TIMEOUT(1)                        User Commands                       TIMEOUT(1)
timeout - run a command with a time limit
timeout [OPTION] DURATION COMMAND [ARG]... timeout [OPTION]
Start COMMAND, and kill it if still running after DURATION.
--preserve-status
exit with the same status as COMMAND, even when the
command times out
--foreground
when not running timeout directly from a shell prompt,
allow COMMAND to read from the TTY and get TTY signals; in this mode, children of COMMAND will not be timed out
-k, --kill-after=DURATION
also send a KILL signal if COMMAND is still running
this long after the initial signal was sent
-s, --signal=SIGNAL
specify the signal to be sent on timeout;
SIGNAL may be a name like 'HUP' or a number; see 'kill -l' for a list of signals
-v, --verbose diagnose to stderr any signal sent upon timeout
DURATION is a floating point number with an optional suffix: 's' for seconds (the default), 'm' for minutes, 'h' for hours or 'd' for days.  A duration of 0 disables the associated timeout.
Upon timeout, send the TERM signal to COMMAND, if no other SIGNAL specified.  The TERM signal kills any process that does not block or catch that signal.  It may be necessary to use the KILL signal, since this signal can't be caught.
EXIT status: 124    if COMMAND times out, and --preserve-status is not specified
125    if the timeout command itself fails
126    if COMMAND is found but cannot be invoked
127    if COMMAND cannot be found
137    if COMMAND (or timeout itself) is sent the KILL (9) signal (128+9)
-      the exit status of COMMAND otherwise
Some platforms don't currently support timeouts beyond the year 2038.
kill(1)
Full documentation <https://www.gnu.org/software/coreutils/timeout> or available locally via: info '(coreutils) timeout invocation'
nix-collect-garbage(1)       General Commands Manual      nix-collect-garbage(1)
Name nix-collect-garbage - delete unreachable store paths
Synopsis nix-collect-garbage [--delete-old] [-d] [--delete-older-than period] [--max-freed bytes] [--dry-run]
Description The command nix-collect-garbage is mostly an alias of nix-store --gc (nix-store.md#operation---gc), that is, it deletes all unreachable paths in the Nix store to clean up your system. However, it provides two additional options: -d (--delete-old), which deletes all old generations of all profiles in /nix/var/nix/profiles by invoking nix-env --delete- generations old on all profiles (of course, this makes rollbacks to previous configurations impossible); and --delete-older-than period, where period is a value such as 30d, which deletes all generations older than the specified number of days in all profiles in /nix/var/nix/profiles (except for the generations that were active at that point in time).
Example To delete from the Nix store everything that is not used by the current generations of each profile, do
$ nix-collect-garbage -d
FSELECT(1)                   General Commands Manual                  FSELECT(1)
fselect - find files with SQL-like queries
fselect [ARGS] COLUMN [, COLUMN ...]  [ from ROOT [, ROOT...] ] [where EXPR] [order by COLUMNS] [limit N] [into FORMAT]
fselect is a simple utility with a SQL-like query for finding files.
You write SQL-like query, that's it.
fselect command itself is like a first keyword (select, i.e., file select).  But if you'll put one more select behind occasionally, that's not a problem.
Next you put columns you are interested in.  It could be file name or path, size, modification date, etc.  See full list of possible columns. You can add columns with arbitrary text (put in quotes if it contains spaces).  A few functions (aggregating and formatting) are there for your service.  You can use arithmetic expressions when it makes sense.
Where to search? Specify with from keyword. You can list one or more directories separated with comma.  If you leave the from, then current directory will be processed.
What to search? Use where with any number of conditions.
Order results like in real SQL with order by.  All columns are supported for ordering by, as well as asc/desc parameters and positional numeric shortcuts.
Limiting search results is possible with limit. Formatting options are supported with into keyword.
If you want to use operators containing > or <, put the whole query into double quotes.  This will protect query from the shell and output redirection.  The same applies to queries with parentheses or *, ? and other special symbols that are shell metacharacters
•      name
•      path
•      abspath
•      size
•      hsize or fsize
•      uid
•      gid
•      user
•      group
•      created
•      accessed
•      modified
•      is_dir
•      is_file
•      is_symlink
•      is_pipe or is_fifo
•      is_character or is_char
•      is_block
•      is_socket
•      device
•      inode
•      blocks
•      hardlinks
•      mode
•      user_read
•      user_write
•      user_exec
•      user_all
•      group_read
•      group_write
•      group_exec
•      group_all
•      other_read
•      other_write
•      other_exec
•      other_all
•      suid
•      sgid
•      is_hidden
•      has_xattrs
•      is_shebang
•      width
•      height
•      duration
•      mp3_bitrate or bitrate
•      mp3_freq or freq
•      mp3_title or title
•      mp3_artist or artist
•      mp3_album or album
•      mp3_genre or genre
•      mp3_year
•      exif_datetime
•      exif_altitude or exif_alt
•      exif_latitude or exif_lat
•      exif_longitude or exif_lng or exif_lon
•      exif_make
•      exif_model
•      exif_software
•      exif_version
•      mime
•      is_binary
•      is_text
•      is_archive
•      is_audio
•      is_book
•      is_doc
•      is_image
•      is_source
•      is_video
•      sha1
•      sha2_256 or sha256
•      sha2_512 or sha512
•      sha3_512 or sha3
The fselect utility exists with status 0 as long as the provided query parses correctly.
Find files and directories that match the pattern 'needle': $ fselect name WHERE name =~ "needle"
Start a search in a given directory (/var/log): $ fselect name FROM /var/log
find(1) fd(1)
RENAME(1)               Perl Programmers Reference Guide               RENAME(1)
rename [ -v ] [ -n ] [ -f ] perlexpr [ files ]
-n, --no-act No Action: show what files would have been renamed.
-f, --force Force: overwrite existing files.
The original "rename" did not check for the existence of target filenames, so had to be used with care.  I hope I've fixed that (Robin Barker).
PYFLAKES(1)                                                          PYFLAKES(1)
pyflakes - simple Python 2 source checker
pyflakes [file-or-directory ...]
pyflakes is a simple program which checks Python source files for errors. It is similar to PyChecker in scope, but differs in that it does not execute the modules to check them. This is both safer and faster, although it does not perform as many checks. Unlike PyLint, Pyflakes checks only for logical errors in programs; it does not perform any checks on style.
All commandline arguments are checked, which have to be either regular files or directories. If a directory is given, every .py file within will be checked.
When no commandline arguments are given, data will be read from standard input.
Found warnings including unused imports, undefined variables and unnecessary reimports, are printed on standard output.  Found errors including compile or encoding errors, are printed on standard error.
The exit status is 0 when no warnings or errors are found. Otherwise the exit status is 1.
This manual page was originally written by Bastian Kleineidam <calvin@debian.org> for the Debian distribution of pyflakes (but can be used by others).
GIT-PULL(1)                        Git Manual                        GIT-PULL(1)
git-pull - Fetch from and integrate with another repository or a local branch
git pull [<options>] [<repository> [<refspec>...]]
Incorporates changes from a remote repository into the current branch. If the current branch is behind the remote, then by default it will fast-forward the current branch to match the remote. If the current branch and the remote have diverged, the user needs to specify how to reconcile the divergent branches with --rebase or --no-rebase (or the corresponding configuration option in pull.rebase).
More precisely, git pull runs git fetch with the given parameters and then depending on configuration options or command line flags, will call either git rebase or git merge to reconcile diverging branches.
<repository> should be the name of a remote repository as passed to git- fetch(1). <refspec> can name an arbitrary remote ref (for example, the name of a tag) or even a collection of refs with corresponding remote-tracking branches (e.g., refs/heads/*:refs/remotes/origin/*), but usually it is the name of a branch in the remote repository.
Default values for <repository> and <branch> are read from the "remote" and "merge" configuration for the current branch as set by git-branch(1) --track.
A---B---C master on origin / D---E---F---G master ^ origin/master in your repository
Then "git pull" will fetch and replay the changes from the remote master branch since it diverged from the local master (i.e., E) until its current commit (C) on top of master and record the result in a new commit along with the names of the two parent commits and a log message from the user describing the changes.
A---B---C origin/master /         \ D---E---F---G---H master
See git-merge(1) for details, including how conflicts are presented and handled.
In Git 1.7.0 or later, to cancel a conflicting merge, use git reset --merge. Warning: In older versions of Git, running git pull with uncommitted changes is discouraged: while possible, it leaves you in a state that may be hard to back out of in the case of a conflict.
If any of the remote changes overlap with local uncommitted changes, the merge will be automatically canceled and the work tree untouched. It is generally best to get any local changes in working order before pulling or stash them away with git-stash(1).
-q, --quiet This is passed to both underlying git-fetch to squelch reporting of during transfer, and underlying git-merge to squelch output during merging.
-v, --verbose Pass --verbose to git-fetch and git-merge.
--[no-]recurse-submodules[=yes|on-demand|no] This option controls if new commits of populated submodules should be fetched, and if the working trees of active submodules should be updated, too (see git-fetch(1), git-config(1) and gitmodules(5)).
If the checkout is done via rebase, local submodule commits are rebased as well.
If the update is done via merge, the submodule conflicts are resolved and checked out.
Options related to merging --commit, --no-commit Perform the merge and commit the result. This option can be used to override --no-commit. Only useful when merging.
--edit, -e, --no-edit Invoke an editor before committing successful mechanical merge to further edit the auto-generated merge message, so that the user can explain and justify the merge. The --no-edit option can be used to accept the auto-generated message (this is generally discouraged).
--ff-only Only update to the new history if there is no divergent local history. This is the default when no method for reconciling divergent histories is provided (via the --rebase=* flags).
--ff, --no-ff When merging rather than rebasing, specifies how a merge is handled when the merged-in history is already a descendant of the current history. If merging is requested, --ff is the default unless merging an annotated (and possibly signed) tag that is not stored in its natural place in the refs/tags/ hierarchy, in which case --no-ff is assumed.
--log[=<n>], --no-log In addition to branch names, populate the log message with one-line descriptions from at most <n> actual commits that are being merged. See also git-fmt-merge-msg(1). Only useful when merging.
Only useful when merging.
--[no-]verify By default, the pre-merge and commit-msg hooks are run. When --no-verify is given, these are bypassed. See also githooks(5). Only useful when merging.
-r, --rebase[=false|true|merges|interactive] When true, rebase the current branch on top of the upstream branch after fetching. If there is a remote-tracking branch corresponding to the upstream branch and the upstream branch was rebased since last fetched, the rebase uses that information to avoid rebasing non-local changes.
When set to merges, rebase using git rebase --rebase-merges so that the local merge commits are included in the rebase (see git-rebase(1) for details).
When false, merge the upstream branch into the current branch.
When interactive, enable the interactive mode of rebase.
See pull.rebase, branch.<name>.rebase and branch.autoSetupRebase in git-config(1) if you want to make git pull always use --rebase instead of merging.
Note This is a potentially dangerous mode of operation. It rewrites history, which does not bode well when you published that history already. Do not use this option unless you have read git- rebase(1) carefully.
--no-rebase This is shorthand for --rebase=false.
Options related to fetching --all Fetch all remotes.
-f, --force When git fetch is used with <src>:<dst> refspec it may refuse to update the local branch as discussed in the <refspec> part of the git-fetch(1) documentation. This option overrides that check.
--no-tags By default, tags that point at objects that are downloaded from the remote repository are fetched and stored locally. This option disables this automatic tag following. The default behavior for a remote may be specified with the remote.<name>.tagOpt setting. See git-config(1).
<refspec> Specifies which refs to fetch and which local refs to update. When no <refspec>s appear on the command line, the refs to fetch are read from remote.<repository>.fetch variables instead (see the section "CONFIGURED REMOTE-TRACKING BRANCHES" in git-fetch(1)).
Note There is a difference between listing multiple <refspec> directly on git pull command line and having multiple remote.<repository>.fetch entries in your configuration for a <repository> and running a git pull command without any explicit <refspec> parameters. <refspec>s listed explicitly on the command line are always merged into the current branch after fetching. In other words, if you list more than one remote ref, git pull will create an Octopus merge. On the other hand, if you do not list any explicit <refspec> parameter on the command line, git pull will fetch all the <refspec>s it finds in the remote.<repository>.fetch configuration and merge only the first <refspec> found into the current branch. This is because making an Octopus from remote refs is rarely done, while keeping track of multiple remote heads in one-go by fetching more than one is often useful.
Often people use git pull without giving any parameter. Traditionally, this has been equivalent to saying git pull origin. However, when configuration branch.<name>.remote is present while on branch <name>, that value is used instead of origin.
In order to determine what URL to use to fetch from, the value of the configuration remote.<origin>.url is consulted and if there is not any such variable, the value on the URL: line in $GIT_DIR/remotes/<origin> is used.
In order to determine what remote branches to fetch (and optionally store in the remote-tracking branches) when the command is run without any refspec parameters on the command line, values of the configuration variable remote.<origin>.fetch are consulted, and if there aren’t any, $GIT_DIR/remotes/<origin> is consulted and its Pull: lines are used. In addition to the refspec formats described in the OPTIONS section, you can have a globbing refspec that looks like this:
refs/heads/*:refs/remotes/origin/*
A globbing refspec must have a non-empty RHS (i.e. must store what were fetched in remote-tracking branches), and its LHS and RHS must end with /*. The above specifies that all remote branches are tracked using remote-tracking branches in refs/remotes/origin/ hierarchy under the same name.
The rule to determine which remote branch to merge after fetching is a bit involved, in order not to break backward compatibility.
If explicit refspecs were given on the command line of git pull, they are all merged.
When no refspec was given on the command line, then git pull uses the refspec from the configuration or $GIT_DIR/remotes/<origin>. In such cases, the following rules apply:
1. If branch.<name>.merge configuration for the current branch <name> exists, that is the name of the branch at the remote site that is merged.
2. If the refspec is a globbing one, nothing is merged.
3. Otherwise the remote branch of the first refspec is merged.
•   Update the remote-tracking branches for the repository you cloned from, then merge one of them into your current branch:
$ git pull $ git pull origin
Normally the branch merged in is the HEAD of the remote repository, but the choice is determined by the branch.<name>.remote and branch.<name>.merge options; see git-config(1) for details.
•   Merge into the current branch the remote branch next:
$ git pull origin next
This leaves a copy of next temporarily in FETCH_HEAD, and updates the remote-tracking branch origin/next. The same can be done by invoking fetch and merge:
$ git fetch origin $ git merge origin/next
If you tried a pull which resulted in complex conflicts and would want to start over, you can recover with git reset.
git-fetch(1), git-merge(1), git-config(1)
FIREWALL-CMD(1)                   firewall-cmd                   FIREWALL-CMD(1)
firewall-cmd - firewalld command line client
firewall-cmd [OPTIONS...]
firewall-cmd is the command line client of the firewalld daemon. It provides an interface to manage the runtime and permanent configurations.
The runtime configuration in firewalld is separated from the permanent configuration. This means that things can get changed in the runtime or permanent configuration.
Sequence options are the options that can be specified multiple times, the exit code is 0 if there is at least one item that succeeded. The ALREADY_ENABLED (11), NOT_ENABLED (12) and also ZONE_ALREADY_SET (16) errors are treated as succeeded. If there are issues while parsing the items, then these are treated as warnings and will not change the result as long as there is a succeeded one. Without any succeeded item, the exit code will depend on the error codes. If there is exactly one error code, then this is used. If there are more than one then UNKNOWN_ERROR (254) will be used.
General Options -h, --help Prints a short help text and exits.
-V, --version Print the version string of firewalld. This option is not combinable with other options.
-q, --quiet Do not print status messages.
Status Options --state Check whether the firewalld daemon is active (i.e. running). Returns an exit code 0 if it is active, RUNNING_BUT_FAILED if failure occurred on startup, NOT_RUNNING otherwise. See the section called “EXIT CODES”. This will also print the state to STDOUT.
--reload Reload firewall rules and keep state information. Current permanent configuration will become new runtime configuration, i.e. all runtime only changes done until reload are lost with reload if they have not been also in permanent configuration.
Note: If FlushAllOnReload=no, runtime changes applied via the direct interface are not affected and will therefore stay in place until firewalld daemon is restarted completely. For FlushAllOnReload, see firewalld.conf(5).
--complete-reload Reload firewall completely, even netfilter kernel modules. This will most likely terminate active connections, because state information is lost. This option should only be used in case of severe firewall problems. For example if there are state information problems that no connection can be established with correct firewall rules.
--runtime-to-permanent Save active runtime configuration and overwrite permanent configuration with it. The way this is supposed to work is that when configuring firewalld you do runtime changes only and once you're happy with the configuration and you tested that it works the way you want, you save the configuration to disk.
--check-config Run checks on the permanent configuration. This includes XML validity and semantics.
Log Denied Options --get-log-denied Print the log denied setting.
--set-log-denied=value Add logging rules right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also final reject and drop rules in zones for the configured link-layer packet type. The possible values are: all, unicast, broadcast, multicast and off. The default setting is off, which disables the logging.
This is a runtime and permanent change and will also reload the firewall to be able to add the logging rules.
Permanent Options --permanent The permanent option --permanent can be used to set options permanently. These changes are not effective immediately, only after service restart/reload or system reboot. Without the --permanent option, a change will only be part of the runtime configuration.
If you want to make a change in runtime and permanent configuration, use the same call with and without the --permanent option.
The --permanent option can be optionally added to all options further down where it is supported.
Zone Options --get-default-zone Print default zone for connections and interfaces.
--set-default-zone=zone Set default zone for connections and interfaces where no zone has been selected. Setting the default zone changes the zone for the connections or interfaces, that are using the default zone.
This is a runtime and permanent change.
--get-active-zones Print currently active zones altogether with interfaces and sources used in these zones. Active zones are zones, that have a binding to an interface or source. The output format is:
zone1 interfaces: interface1 interface2 .. sources: source1 .. zone2 interfaces: interface3 .. zone3 sources: source2 ..
If there are no interfaces or sources bound to the zone, the corresponding line will be omitted.
[--permanent] --get-zones Print predefined zones as a space separated list.
[--permanent] --get-services Print predefined services as a space separated list.
[--permanent] --get-icmptypes Print predefined icmptypes as a space separated list.
[--permanent] --get-zone-of-interface=interface Print the name of the zone the interface is bound to or no zone.
[--permanent] --get-zone-of-source=source[/mask]|MAC|ipset:ipset Print the name of the zone the source is bound to or no zone.
[--permanent] --info-zone=zone Print information about the zone zone. The output format is:
zone interfaces: interface1 .. sources: source1 .. services: service1 .. ports: port1 .. protocols: protocol1 .. forward-ports: forward-port1 .. source-ports: source-port1 .. icmp-blocks: icmp-type1 .. rich rules: rich-rule1 ..
[--permanent] --list-all-zones List everything added for or enabled in all zones. The output format is:
zone1 interfaces: interface1 .. sources: source1 .. services: service1 .. ports: port1 .. protocols: protocol1 .. forward-ports: forward-port1 .. icmp-blocks: icmp-type1 .. rich rules: rich-rule1 .. ..
--permanent --new-zone=zone Add a new permanent and empty zone.
Zone names must be alphanumeric and may additionally include characters: '_' and '-'.
--permanent --new-zone-from-file=filename [--name=zone] Add a new permanent zone from a prepared zone file with an optional name override.
--permanent --delete-zone=zone Delete an existing permanent zone.
--permanent --load-zone-defaults=zone Load zone default settings or report NO_DEFAULTS error.
--permanent --path-zone=zone Print path of the zone configuration file.
Policy Options [--permanent] --get-policies Print predefined policies as a space separated list.
[--permanent] --info-policy=policy Print information about the policy policy.
[--permanent] --list-all-policies List everything added for or enabled in all policies.
--permanent --new-policy=policy Add a new permanent policy.
Policy names must be alphanumeric and may additionally include characters: '_' and '-'.
--permanent --new-policy-from-file=filename [--name=policy] Add a new permanent policy from a prepared policy file with an optional name override.
--permanent --path-policy=policy Print path of the policy configuration file.
--permanent --delete-policy=policy Delete an existing permanent policy.
--permanent --load-policy-defaults=policy Load the shipped defaults for a policy. Only applies to policies shipped with firewalld. Does not apply to user defined policies.
Options to Adapt and Query Zones and Policies Options in this section affect only one particular zone or policy. If used with --zone=zone or --policy=policy option, they affect the specified zone or policy. If both options are omitted, they affect the default zone (see --get-default-zone).
[--permanent] [--zone=zone] [--policy=policy] --list-all List everything added or enabled.
--permanent [--zone=zone] [--policy=policy] --get-target Get the target.
--permanent [--zone=zone] [--policy=policy] --set-target=zone Set the target.
For zones target is one of: default, ACCEPT, DROP, REJECT
For policies target is one of: CONTINUE, ACCEPT, DROP, REJECT
default is similar to REJECT, but it implicitly allows ICMP packets.
--permanent [--zone=zone] [--policy=policy] --set-description=description Set description.
--permanent [--zone=zone] [--policy=policy] --get-description Print description.
--permanent [--zone=zone] [--policy=policy] --set-short=description Set short description.
--permanent [--zone=zone] [--policy=policy] --get-short Print short description.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-services List services added as a space separated list.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-service=service [--timeout=timeval] Add a service. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards.  timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.
The service is one of the firewalld provided services. To get a list of the supported services, use firewall-cmd --get-services.
The --timeout option is not combinable with the --permanent option.
Note: Some services define connection tracking helpers. Helpers that may operate in client mode (e.g. tftp) must be added to an outbound policy instead of a zone to take effect for clients. Otherwise the helper will not be applied to the outbound traffic. The related traffic, as defined by the connection tracking helper, on the return path (ingress) will be allowed by the stateful firewall rules.
An example of an outbound policy for connection tracking helpers:
# firewall-cmd --permanent --new-policy clientConntrack # firewall-cmd --permanent --policy clientConntrack --add-ingress-zone HOST # firewall-cmd --permanent --policy clientConntrack --add-egress-zone ANY # firewall-cmd --permanent --policy clientConntrack --add-service tftp
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-service=service Remove a service. This option can be specified multiple times.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-service=service Return whether service has been added. Returns 0 if true, 1 otherwise.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-ports List ports added as a space separated list. A port is of the form portid[-portid]/protocol, it can be either a port and protocol pair or a port range with a protocol.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-port=portid[-portid]/protocol [--timeout=timeval] Add the port. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards.  timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.
The port can either be a single port number or a port range portid-portid. The protocol can either be tcp, udp, sctp or dccp.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-port=portid[-portid]/protocol Remove the port. This option can be specified multiple times.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-port=portid[-portid]/protocol Return whether the port has been added. Returns 0 if true, 1 otherwise.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-protocols List protocols added as a space separated list.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-protocol=protocol [--timeout=timeval] Add the protocol. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards.  timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.
The protocol can be any protocol supported by the system. Please have a look at /etc/protocols for supported protocols.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-protocol=protocol Remove the protocol. This option can be specified multiple times.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-protocol=protocol Return whether the protocol has been added. Returns 0 if true, 1 otherwise.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-source-ports List source ports added as a space separated list. A port is of the form portid[-portid]/protocol.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-source-port=portid[-portid]/protocol [--timeout=timeval] Add the source port. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards.  timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-source-port=portid[-portid]/protocol Remove the source port. This option can be specified multiple times.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-source-port=portid[-portid]/protocol Return whether the source port has been added. Returns 0 if true, 1 otherwise.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-icmp-blocks List Internet Control Message Protocol (ICMP) type blocks added as a space separated list.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-icmp-block=icmptype [--timeout=timeval] Add an ICMP block for icmptype. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards.  timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.
The icmptype is the one of the icmp types firewalld supports. To get a listing of supported icmp types: firewall-cmd --get-icmptypes
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-icmp-block=icmptype Remove the ICMP block for icmptype. This option can be specified multiple times.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-icmp-block=icmptype Return whether an ICMP block for icmptype has been added. Returns 0 if true, 1 otherwise.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-forward-ports List IPv4 forward ports added as a space separated list.
For IPv6 forward ports, please use the rich language.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]] [--timeout=timeval] Add the IPv4 forward port. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards.  timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.
The port can either be a single port number portid or a port range portid-portid. The protocol can either be tcp, udp, sctp or dccp. The destination address is a simple IP address.
Note: IP forwarding will be implicitly enabled if toaddr is specified.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]] Remove the IPv4 forward port. This option can be specified multiple times.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]] Return whether the IPv4 forward port has been added. Returns 0 if true, 1 otherwise.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-masquerade [--timeout=timeval] Enable IPv4 masquerade. If a timeout is supplied, masquerading will be active for the specified amount of time.  timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h. Masquerading is useful if the machine is a router and machines connected over an interface in another zone should be able to use the first connection.
For IPv6 masquerading, please use the rich language.
Note: IP forwarding will be implicitly enabled.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-masquerade Disable IPv4 masquerade. If the masquerading was enabled with a timeout, it will be disabled also.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-masquerade Return whether IPv4 masquerading has been enabled. Returns 0 if true, 1 otherwise.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-rich-rules List rich language rules added as a newline separated list.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-rich-rule='rule' [--timeout=timeval] Add rich language rule 'rule'. This option can be specified multiple times. If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards.  timeval is either a number (of seconds) or number followed by one of characters s (seconds), m (minutes), h (hours), for example 20m or 1h.
For the rich language rule syntax, please have a look at firewalld.richlanguage(5).
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-rich-rule='rule' Remove rich language rule 'rule'. This option can be specified multiple times.
[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-rich-rule='rule' Return whether a rich language rule 'rule' has been added. Returns 0 if true, 1 otherwise.
Options to Adapt and Query Zones Options in this section affect only one particular zone. If used with --zone=zone option, they affect the specified zone. If the option is omitted, they affect default zone (see --get-default-zone).
[--permanent] [--zone=zone] --add-icmp-block-inversion Enable ICMP block inversion.
[--permanent] [--zone=zone] --remove-icmp-block-inversion Disable ICMP block inversion.
[--permanent] [--zone=zone] --query-icmp-block-inversion Return whether ICMP block inversion is enabled. Returns 0 if true, 1 otherwise.
[--permanent] [--zone=zone] --add-forward Enable intra zone forwarding.
[--permanent] [--zone=zone] --remove-forward Disable intra zone forwarding.
[--permanent] [--zone=zone] --query-forward Return whether intra zone forwarding is enabled. Returns 0 if true, 1 otherwise.
Options to Adapt and Query Policies Options in this section affect only one particular policy. It's required to specify --policy=policy with these options.
--permanent --policy=policy --get-priority Get the priority.
--permanent --policy=policy --set-prioritypriority Set the priority. The priority determines the relative ordering of policies. This is an integer value between -32768 and 32767 where -1 is the default value for new policies and 0 is reserved for internal use.
If a priority is < 0, then the policy's rules will execute before all rules in all zones.
If a priority is > 0, then the policy's rules will execute after all rules in all zones.
[--permanent] --policy=policy --list-ingress-zones List ingress zones added as a space separated list.
[--permanent] --policy=policy --add-ingress-zone=zone Add an ingress zone. This option can be specified multiple times.
The ingress zone is one of the firewalld provided zones or one of the pseudo-zones: HOST, ANY.
HOST is used for traffic originating from the host machine, i.e. the host running firewalld.
ANY is used for traffic originating from any zone. This can be thought of as a wild card for zones. However it does not include traffic originating from the host machine - use HOST for that.
[--permanent] --policy=policy --remove-ingress-zone=zone Remove an ingress zone. This option can be specified multiple times.
[--permanent] --policy=policy --query-ingress-zone=zone Return whether zone has been added. Returns 0 if true, 1 otherwise.
[--permanent] --policy=policy --list-egress-zones List egress zones added as a space separated list.
[--permanent] --policy=policy --add-egress-zone=zone Add an egress zone. This option can be specified multiple times.
The egress zone is one of the firewalld provided zones or one of the pseudo-zones: HOST, ANY.
For clarification on HOST and ANY see option --add-ingress-zone.
[--permanent] --policy=policy --remove-egress-zone=zone Remove an egress zone. This option can be specified multiple times.
[--permanent] --policy=policy --query-egress-zone=zone Return whether zone has been added. Returns 0 if true, 1 otherwise.
Options to Handle Bindings of Interfaces Binding an interface to a zone means that this zone settings are used to restrict traffic via the interface.
Options in this section affect only one particular zone. If used with --zone=zone option, they affect the zone zone. If the option is omitted, they affect default zone (see --get-default-zone).
For a list of predefined zones use firewall-cmd --get-zones.
An interface name is a string up to 16 characters long, that may not contain ' ', '/', '!' and '*'.
[--permanent] [--zone=zone] --list-interfaces List interfaces that are bound to zone zone as a space separated list. If zone is omitted, default zone will be used.
[--permanent] [--zone=zone] --add-interface=interface Bind interface interface to zone zone. If zone is omitted, default zone will be used.
If the interface is under control of NetworkManager, it is at first connected to change the zone for the connection that is using the interface. If this fails, the zone binding is created in firewalld and the limitations below apply. For interfaces that are not under control of NetworkManager, firewalld tries to change the ZONE setting in the ifcfg file, if the file exists.
As a end user you don't need this in most cases, because NetworkManager (or legacy network service) adds interfaces into zones automatically (according to ZONE= option from ifcfg-interface file) if NM_CONTROLLED=no is not set. You should do it only if there's no /etc/sysconfig/network-scripts/ifcfg-interface file. If there is such file and you add interface to zone with this --add-interface option, make sure the zone is the same in both cases, otherwise the behaviour would be undefined. Please also have a look at the firewalld(1) man page in the Concepts section. For permanent association of interface with a zone, see also 'How to set or change a zone for a connection?' in firewalld.zones(5).
[--permanent] [--zone=zone] --change-interface=interface If the interface is under control of NetworkManager, it is at first connected to change the zone for the connection that is using the interface. If this fails, the zone binding is created in firewalld and the limitations below apply. For interfaces that are not under control of NetworkManager, firewalld tries to change the ZONE setting in the ifcfg file, if the file exists.
Change zone the interface interface is bound to to zone zone. It's basically --remove-interface followed by --add-interface. If the interface has not been bound to a zone before, it behaves like --add-interface. If zone is omitted, default zone will be used.
[--permanent] [--zone=zone] --query-interface=interface Query whether interface interface is bound to zone zone. Returns 0 if true, 1 otherwise.
[--permanent] --remove-interface=interface If the interface is under control of NetworkManager, it is at first connected to change the zone for the connection that is using the interface. If this fails, the zone binding is created in firewalld and the limitations below apply.
For the addion or change of interfaces that are not under control of NetworkManager: firewalld tries to change the ZONE setting in the ifcfg file, if an ifcfg file exists that is using the interface.
Only for the removal of interfaces that are not under control of NetworkManager: firewalld is not trying to change the ZONE setting in the ifcfg file. This is needed to make sure that an ifdown of the interface will not result in a reset of the zone setting to the default zone. Only the zone binding is then removed in firewalld then.
Remove binding of interface interface from zone it was previously added to.
Options to Handle Bindings of Sources Binding a source to a zone means that this zone settings will be used to restrict traffic from this source.
A source address or address range is either an IP address or a network IP address with a mask for IPv4 or IPv6 or a MAC address or an ipset with the ipset: prefix. For IPv4, the mask can be a network mask or a plain number. For IPv6 the mask is a plain number. The use of host names is not supported.
For a list of predefined zones use firewall-cmd [--permanent] --get-zones.
[--permanent] [--zone=zone] --list-sources List sources that are bound to zone zone as a space separated list. If zone is omitted, default zone will be used.
[--permanent] [--zone=zone] --add-source=source[/mask]|MAC|ipset:ipset Bind the source to zone zone. If zone is omitted, default zone will be used.
[--zone=zone] --change-source=source[/mask]|MAC|ipset:ipset Change zone the source is bound to to zone zone. It's basically --remove-source followed by --add-source. If the source has not been bound to a zone before, it behaves like --add-source. If zone is omitted, default zone will be used.
[--permanent] [--zone=zone] --query-source=source[/mask]|MAC|ipset:ipset Query whether the source is bound to the zone zone. Returns 0 if true, 1 otherwise.
[--permanent] --remove-source=source[/mask]|MAC|ipset:ipset Remove binding of the source from zone it was previously added to.
IPSet Options --get-ipset-types Print the supported ipset types.
--permanent --new-ipset=ipset --type=type [--family=inet|inet6] [--option=key[=value]] Add a new permanent and empty ipset with specifying the type and optional the family and options like timeout, hashsize and maxelem. For more information please have a look at ipset(8) man page.
ipset names must be alphanumeric and may additionally include characters: '_' and '-'.
--permanent --new-ipset-from-file=filename [--name=ipset] Add a new permanent ipset from a prepared ipset file with an optional name override.
--permanent --delete-ipset=ipset Delete an existing permanent ipset.
--permanent --load-ipset-defaults=ipset Load ipset default settings or report NO_DEFAULTS error.
[--permanent] --info-ipset=ipset Print information about the ipset ipset. The output format is:
ipset type: type options: option1[=value1] .. entries: entry1 ..
[--permanent] --get-ipsets Print predefined ipsets as a space separated list.
--permanent --ipset=ipset --set-description=description Set new description to ipset
--permanent --ipset=ipset --get-description Print description for ipset
--permanent --ipset=ipset --set-short=description Set short description to ipset
--permanent --ipset=ipset --get-short Print short description for ipset
[--permanent] --ipset=ipset --add-entry=entry Add a new entry to the ipset.
Adding an entry to an ipset with option timeout is permitted, but these entries are not tracked by firewalld.
[--permanent] --ipset=ipset --remove-entry=entry Remove an entry from the ipset.