>Hi > >Would it be possible to somehow disable changing iptables rules from scripts >and enable changing only from config file, which loading would be protected >by special password defined in kernel? Or even better, your could preset >iptables rules in kernel. That rules would be unchangeable. Just remove CAP_NET_RAW and CAP_NET_ADMIN from your capability set ;-) Jan Engelhardt -- | Alphagate Systems, http://alphagate.hopto.org/
