On Fri, Aug 23, 2013 at 10:23:32AM +0000, Anders Broman wrote:
> > before we change it, should we remember the previous setting and restore it when dumpcap exits?
>
> Preferably yes but I'm not sure it's possible as I think root privileges are required to write to the file and I think dumpcap
> Drops those after starting to capture.
I've not looked at kernel sources, but isn't JITing done when attaching filter to socket?
And later this sysctl variable takes no effect?
so we could do:
- enable JIT if not enabled
- pcap_setfilter(pcap, program)
- disable JIT if enabled
- drop privilages
It's a little racy, but well...
