Hi, On Wed, Mar 30, 2022 at 01:31:24PM +0200, Timo Rothenpieler wrote: > > It is possible to argue that sitnl does low-level calls to the kernel as > > well. But potential libraries had an API which was making everything > > far more complex on the OpenVPN side. For libcap-ng at least, that is > > not the case; as the API it provides is pretty simple. > > Shouldn't caps support also be enabled when sitnl is in use? > Given it also needs CAP_NET_ADMIN.
That was a misunderstanding. David explained why we are not using a
library but directly talk to the netlink socket for SITNL.
And yes, we want CAP_NET_ADMIN for sitnl+--user as well ;-)
Thanks for your help on this,
gert
--
"If was one thing all people took for granted, was conviction that if you
feed honest figures into a computer, honest figures come out. Never doubted
it myself till I met a computer with a sense of humor."
Robert A. Heinlein, The Moon is a Harsh Mistress
Gert Doering - Munich, Germany g...@greenie.muc.de
signature.asc
Description: PGP signature
_______________________________________________ Openvpn-devel mailing list Openvpn-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-devel
