Apparently, the whole things needs to be run as root, since it's all one huge blob.
Hopefully, this'll eventually get separated into a daemon which does all the superuser bits and exposes a single API for a client GUI to consume.
Hopefully, this'll eventually get separated into a daemon which does all the superuser bits and exposes a single API for a client GUI to consume.
As far as nfqueue, I googled around but I wasn't able to find out what perms you need in order to communicate with netlink. I assumed you could open an fd and drop perms but it looks like it might not allow that. I agree that eventually you'd need a pretty robust multithreaded app to handle large packet flows without adding too much latency... it seems like quite a big burden just to authorize specific applications to make specific network connections.
Kudos on what's been done so far! ^_^