5 ms·
>You can't spin up a veth network device without a suid executable. Doesn't this just require CAP_NET_ADMIN?
by brobinson 5y ago
>You can't spin up a veth network device without a suid executable.
Doesn't this just require CAP_NET_ADMIN?
- the8472 5y agoYes, I should have said "without elevated privileges". That capability is still a pretty big hammer you want extracted into a helper that only does one thing.
- throwaway82652 5y agoI hope it's possible to relax that capability in the kernel somehow, that may be a next step for someone working on sandboxing.