Re: [PATCH 2.6 NETFILTER] new netfilter module ipt_program.c

Luke Kenneth Casson Leighton
2004-09-11T17:26:58Z

On Sat, Sep 11, 2004 at 03:49:35PM +0100, Gianni Tedesco wrote:
> On Sat, 2004-09-11 at 14:51 +0200, Patrick McHardy wrote:
> > Luke Kenneth Casson Leighton wrote:
> > > decided to put this into a separate module. based on ipt_owner.c.
> > > does full program's pathname. like ipt_owner, only suitable for
> > > outgoing connections.
> >
> > I agree that it would be useful to match the full path, but
> > the patch is broken, as are the owner match's pid-, sid- and
> > command-matching options. You can't grab files->file_lock
> > outside of process context. Besides, we want to consolidate
> > functionality, not add new matches that do basically the same
> > as existing ones.
>
> This is a binary compatibility issue, I don't think it's possible to add
> Lukes functionality to ipt_owner without breaking iptables
> compatibility.

weeeelllll... there's nothing to stop you adding a header file
ipt_owner_program.h instead :)

i know it breaks the convention but hey.

l.

--
--
Truth, honesty and respect are rare commodities that all spring from
the same well: Love. If you love yourself and everyone and everything
around you, funnily and coincidentally enough, life gets a lot better.
--
lkcl.net
lkcl@lkcl.net