* Are iptables or ipset file capabilities aware?
@ 2011-12-16 11:04 Mickey Nordstrom
2011-12-16 14:20 ` Jan Engelhardt
0 siblings, 1 reply; 2+ messages in thread
From: Mickey Nordstrom @ 2011-12-16 11:04 UTC (permalink / raw)
To: netfilter
Hi,
I'm trying to devise a scheme where I need to give an unpriviliged user the ability
to add ip addresses to a blocklist used by iptables. Sudo is not an option in
this case.
I have understood that I should be able to do this with the CAP_NET_ADMIN
capability but so far during my testing with ipset 4.5 I have not been successful.
Could anyone please tell me if these utilities are in fact capabilities aware and
if not, if there are any plans to implement it?
Cheers,
/Mikael
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Are iptables or ipset file capabilities aware?
2011-12-16 11:04 Are iptables or ipset file capabilities aware? Mickey Nordstrom
@ 2011-12-16 14:20 ` Jan Engelhardt
0 siblings, 0 replies; 2+ messages in thread
From: Jan Engelhardt @ 2011-12-16 14:20 UTC (permalink / raw)
To: Mickey Nordstrom; +Cc: netfilter
On Friday 2011-12-16 12:04, Mickey Nordstrom wrote:
>I have understood that I should be able to do this with the
>CAP_NET_ADMIN capability but so far during my testing with ipset 4.5
>I have not been successful.
Just how is CAP_NET_ADMIN any better than sudo? (The application
would have full network control in either case.)
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-12-16 14:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-12-16 11:04 Are iptables or ipset file capabilities aware? Mickey Nordstrom
2011-12-16 14:20 ` Jan Engelhardt
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.