mgr/worker interface and extensions use case

[Nils Goroll]

Hi,

a while back we were discussing a generalization of the mgr/worker interface and 
potential uses from extensions.

Over the past days I have been handling a DoS and it became apparent that being 
able to directly control Linux nftables from VCL (via an extension/vmod) would 
have been helpful.

For obvious reasons, the kernel interface to manipulate nftables requires 
elevated privileges, calling nft_ctx_new() from libnftables as an unprivileged 
user results in

socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 3
sendto(3,..)
recvmsg(3,..)
sendto(3,..)
recvmsg(3,..)
write(2, "Operation not permitted..")

I have not implemented a prototype, but my understanding is that this use case 
would actually need a CAP_NET_ADMIN capable process sending the messages via the 
AF_NETLINK socket.

So either my understanding is wrong and there is a better way, or we could, for 
this potential use case, make good use of the "syscall proxy" idea we had 
discussed in a different context.

Nils
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x1DCD8F57A3868BD7.asc
Type: application/pgp-keys
Size: 4845 bytes
Desc: OpenPGP public key
URL: <https://vinyl-cache.org/lists/pipermail/vinyl-dev/attachments/20260617/ebb38824/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <https://vinyl-cache.org/lists/pipermail/vinyl-dev/attachments/20260617/ebb38824/attachment-0003.bin>