Hi,
On 30/03/2022 13:57, Gert Doering wrote:
Hi,
On Wed, Mar 30, 2022 at 01:31:24PM +0200, Timo Rothenpieler wrote:
It is possible to argue that sitnl does low-level calls to the kernel as
well. But potential libraries had an API which was making everything
far more complex on the OpenVPN side. For libcap-ng at least, that is
not the case; as the API it provides is pretty simple.
Shouldn't caps support also be enabled when sitnl is in use?
Given it also needs CAP_NET_ADMIN.
That was a misunderstanding. David explained why we are not using a
library but directly talk to the netlink socket for SITNL.
And yes, we want CAP_NET_ADMIN for sitnl+--user as well ;-)
One detail: using SITNL is a compile time decision, while using DCO is a
runtime decision (assuming it was compiled in)
Thanks!
--
Antonio Quartulli
_______________________________________________
Openvpn-devel mailing list
Openvpn-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
