On Wed, Feb 01, 2012 at 05:26:07PM +0100, U.Mutlu wrote: > abirvalg@xxxxxxxxxxx wrote, On 12/29/11 15:00: > >Hi, > >I launched my application with CAP_NET_ADMIN capability, yet both nfq_unbind_pf and nfq_bind_pf produce an error. > >When I setuid(0) no error is produced and everything works as expected. > >Could you please confirm that Library setup operations require root. > >Isn't it a bit misleading that libnetfilter_queue docu states that CAP_NET_ADMIN is required without mentioning root permissions. > >Would it be possible to do Library Setup with only CAP_NET_ADMIN and without root priviliges in future versions? > > On a host node I didn't need CAP_NET_ADMIN when starting it as root > (ie. maybe on my system root already has that cap by default; would make sense). Yes, root is fine. You should also get it running with CAP_NET_ADMIN. > But on a VPS on the same host node I couldn't get it working yet. > It always gives errno=111 (ECONNREFUSED; "Connection refused"). This has nothing to do with permissions (in that case you'll hit -EPERM). > Does yours work in a virtual machine, ie. on a VPS ? By "virtual machine" you mean one linux container (lxc)? -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
