Re: [nft PATCH RFC] monitor: Support printing processes which caused the event

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, May 10, 2017 at 07:59:20PM +0200, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > > I don't find it ugly, but alternatively we could add a new type of info
> > > sent at the beginning of the commit phase (before all the table/rule etc
> > > updates) and include it there.
> > 
> > You mean as a separate netlink message? Then we would have to map that
> > message to the actual notification, no? Or do you think it's sufficient
> > to cache the last PID/name received and use it for the monitor messages
> > until an update to them comes in?
> 
> I didn't check yet but all the notifications should contain the current
> generation id and we also send a genid update after a transaction is
> done so I suspect its enough to emit the name once per transaction.

What is the usecase for this? Please don't tell me the obvious the
answer: I just want to know what process has modified what.

If the point is to know if someone else, not myself as a process, has
modified the ruleset, that is very easy to know with the netlink
infrastructure.