On Tuesday 2010-04-13 13:56, Patrick McHardy wrote: >>> Yeah. We could allow just the creating rule to specify permissions. >>> But its not necessary. >> >> Well, don't forget that adding a rule means creating a new table >> adding two rules and throwing away the old one. > >That doesn't matter. The condition either exists or it doesn't. >In the later case you could specify permissions. That would not work either, because the reference count of the condition variable won't go below 1 when a table with a single -m condition rule changes its UID. Let's just leave it as it is right now. If root can run iptables, so can he chown. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
