| commit | ed77de9fc69076e6e7c85edf7c1b70650f53121a | [log] [tgz] |
|---|---|---|
| author | Harald Welte <laforge@netfilter.org> | Wed Nov 09 13:02:16 2005 -0800 |
| committer | David S. Miller <davem@davemloft.net> | Wed Nov 09 13:02:16 2005 -0800 |
| tree | eb75bc1a632003f97d50920023e7802f5e2ae169 | |
| parent | 5978a9b82c55b82a1087bd86e0ae8b00f94d0d0b [diff] |
[NETFILTER] nfnetlink: only load subsystems if CAP_NET_ADMIN is set Without this patch, any user can cause nfnetlink subsystems to be autoloaded. Those subsystems however could add significant processing overhead to packet processing, and would refuse any configuration messages from non-CAP_NET_ADMIN processes anyway. This patch follows a suggestion from Patrick McHardy. Signed-off-by: Harald Welte <laforge@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net>