Jan Engelhardt wrote:
>>>The question is: when do you test for the PID? You would have to do it
>>>within send(), because anywhere else, you do not know. A socket may be
>>>shared among multiple processes (most simple way: fork()).
>>
>>I'm hooking in NF_IP_LOCAL_OUT of netfilter code using nf_register_hook() function.
>
>
> In sys_send(), I would have said you could use "current", but in netfilter
> I can't tell exactly whether it is going to work on SMP.
>
> Check net/ipv4/netfilter/ipt_owner.c, it provides a way to match packets vs
> pids, but it's not easy to find out.
In current 2.6 kernel, net/ipv4/netfilter/ipt_owner.c:checkentry() :
if (info->match & (IPT_OWNER_PID|IPT_OWNER_SID|IPT_OWNER_COMM)) {
printk("ipt_owner: pid, sid and command matching "
"not supported anymore\n");
return 0;
}
So... even netfilter, breaking backward compatibility, does not support
pid match anymore...
/mjt
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
