Re: take 2 WAS(Re: PATCH: IPSEC xfrm events

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

On Sun, Apr 03, 2005 at 10:39:56PM -0400, jamal wrote:
> On Sun, 2005-04-03 at 22:26, Herbert Xu wrote:
>
> > I think that decision should be made by the KM.  So you wouldn't do it
> > for PFKEY, but netlink should definitely do it.
> 
> Is it possible to have non-root privileged pfkey sockets. If yes,
> then it makes sense.

Currently Linux requires CAP_NET_ADMIN for PFKEY.  However, this
may not be the case on other systems.  That's the reason why the
RFC requires that the keys not be sent via PFKEY.

However for netlink there is no such issue.

Even if we do eventually open up netlink for non-root listeners
(this will actually require structural changes to netlink itself),
we can create a new multicast group for non-privileged users that
don't get the keys.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt