4 ms·
this is a really great project. if you haven’t heard of libnetfilterqueue, this is what it’s for. it’s really good. tremendous thanks to the author for introdu
by nathants 4y ago
this is a really great project.
if you haven’t heard of libnetfilterqueue, this is what it’s for. it’s really good. tremendous thanks to the author for introducing me to it via this project.
the main problem with libnetfilterqueue is that it doesn’t have pid information. you have to look that up in /proc or via a hashmap maintained by ebpf. either method has issues.
an unexplored alternative, afaik, is seccomp with userspace filtering[1]. then you get pid information and direct control of syscalls. this may still need to be paired with libnetfilterqueue depending on implementation.
1. https://lwn.net/Articles/756233/ https://lwn.net/Articles/756233/