Subject: Re: [vserver] Vserver and localhost sniffing
From: "Daniel Hokka Zakrisson" <daniel@hozac.com>
Date: Tue, 26 Feb 2008 15:43:22 +0100 (CET)

Alejandro Cabrera wrote:
> <snip previous messages due to formatting>
> Just CAP_NET_RAW capability ??? Or in group with CAP_NET_ADMIN capability
> ???

CAP_NET_RAW is what governs raw sockets. If you give a guest that, it will
be able to able sniff/generate traffic as it sees fit.

CAP_NET_ADMIN "only" lets the guest do network setup, such as configuring
interfaces, routes, etc. See /usr/include/linux/capability.h or
http://linux-vserver.org/Capabilities_and_Flags for descriptions of the
capabilities.

> Thanks

-- 
Daniel Hokka Zakrisson