Re: nfqueue library setup requires root

["U.Mutlu" <for-gmane@mutluit.com>]

Pablo Neira Ayuso wrote, On 02/02/12 19:49:
> On Wed, Feb 01, 2012 at 05:26:07PM +0100, U.Mutlu wrote:
>> abirvalg@lavabit.com wrote, On 12/29/11 15:00:
>>> Hi,
>>> I launched my application with CAP_NET_ADMIN capability, yet both nfq_unbind_pf and nfq_bind_pf produce an error.
>>> When I setuid(0) no error is produced and everything works as expected.
>>> Could you please confirm that Library setup operations require root.
>>> Isn't it a bit misleading that libnetfilter_queue docu states that CAP_NET_ADMIN is required without mentioning root permissions.
>>> Would it be possible to do Library Setup with only CAP_NET_ADMIN and without root priviliges in future versions?
>>
>> On a host node I didn't need CAP_NET_ADMIN when starting it as root
>> (ie. maybe on my system root already has that cap by default; would make sense).
>
> Yes, root is fine. You should also get it running with CAP_NET_ADMIN.
>
>> But on a VPS on the same host node I couldn't get it working yet.
>> It always gives errno=111 (ECONNREFUSED; "Connection refused").
>
> This has nothing to do with permissions (in that case you'll hit
> -EPERM).

So then why does it bring ECONNREFUSED in the VM,
but works fine on the host node?

>> Does yours work in a virtual machine, ie. on a VPS ?
>
> By "virtual machine" you mean one linux container (lxc)?

Yes, exactly. Have you tested it in such a container like LXC or openvz?