Re: [Linux Diffserv] Need to be root to setsockopt() for EF?

[Alexey Kuznetsov <kuznet@xxxxxxxxxxxxx>]

Hello!

> A part of DSCP field was previously Precedence.
> 
> Linux has required that in order to use 'Critical' or higher Precedence,
> one must have CAP_NET_ADMIN capability, in most cases, root.
> 
> I'm not one to say whether this restriction should be removed.  Perhaps.

Not removed, but made _stronger_.

Essentially, allowing user to set an arbitrary DSCP is an evidence of security
hole and subject of CAP_NET_RAW or ADMIN. Actually, one of considered
variants was to allow to set by default only three values: 0 and those
which used to correspong low-delay and high-throghput.

Alexey