Daniel Borkmann <dborkman@xxxxxxxxxx> writes: > Implementation of PID-based matching would not be appropriate > as they frequently change, and child tracking would make that > even more complex and ugly. Cgroups would be a perfect candidate > for accomplishing that as they associate a set of tasks with a > set of parameters for one or more subsystems, in our case the > netfilter subsystem, which, of course, can be combined with other > cgroup subsystems into something more complex. I am coming to this late. But two concrete suggestions. 1) process groups and sessions don't change as frequently as pids. 2) It is possible to put a set of processes in their own network namespace and pipe just the packets you want those processes to use into that network namespace. Using an ingress queueing filter makes that process very efficient even if you have to filter by port. So I don't think you need cgroups to solve this problem at all. Eric -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
