On Wed, May 31, 2017 at 06:15:59PM -0700, Chenbo Feng wrote: > From: Chenbo Feng <fe...@google.com> > > This allows cgroup eBPF program to classify packet based on their > protocol or other detail information. Currently program need > CAP_NET_ADMIN privilege to attach a cgroup eBPF program, and A > process with CAP_NET_ADMIN can already see all packets on the system, > for example, by creating an iptables rules that causes the packet to > be passed to userspace via NFLOG. > > Signed-off-by: Chenbo Feng <fe...@google.com>
Acked-by: Alexei Starovoitov <a...@kernel.org>
