Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> writes: > The following patchset provides a socket filtering alternative to BPF > which allows you to define your filter using the nf_tables expressions. > > Similarly to BPF, you can attach filters via setsockopt() > SO_ATTACH_NFT_FILTER. The filter that is passed to the kernel is > expressed in netlink TLV format which looks like: Could you explain how you validted and tested the nf engine to make it safe for non root without any security problems? -andi -- ak@xxxxxxxxxxxxxxx -- Speaking for myself only -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
