3 ms·
Wouldn't a temporary "iptables -j REJECT" had been easier? Or even maybe "iptables -m condition --condition <> -j REJECT", which would mean you could control t
by majke 11y ago
Wouldn't a temporary "iptables -j REJECT" had been easier?
Or even maybe "iptables -m condition --condition <> -j REJECT", which would mean you could control the reject by "echo 1 > file". Then a basic suid program (or sudo rule) that writes zero or one to the file, and you can control everything without a root. Like from the upgrade scripts.
- bartbes 11y agoThe rest of the blog post seems to imply the application needs to be aware this is happening anyway, so it can clear the backlog, so it may as well be in charge of this. Conveniently, this also means (setuid) root is never involved at any point, whereas it would be for your iptables solution.