Subject: Re: [PATCH RFC 0/9] socket filtering using nf_tables

From: Andi Kleen <[email-masked]>
Date: Tue, 11 Mar 2014 05:57:39 -0700

Pablo Neira Ayuso <[email-masked]> writes:

> The following patchset provides a socket filtering alternative to BPF
> which allows you to define your filter using the nf_tables expressions.
>
> Similarly to BPF, you can attach filters via setsockopt()
> SO_ATTACH_NFT_FILTER. The filter that is passed to the kernel is
> expressed in netlink TLV format which looks like:

Could you explain how you validted and tested the nf engine to make it safe for
non root without any security problems?

-andi 

-- 
[email-masked] -- Speaking for myself only