Embed Notice

@dalias @froge @sparklepanic I think you are confusing how WireGuard works on Android with how it works on other desktop Linux.

On desktop Linux, WireGuard is run with CAP_NET_ADMIN privileges, so it configure the kernel WireGuard implementation. However, on non-rooted Android, WireGuard cannot do that, because Android does not allow apps to run with CAP_NET_ADMIN! Instead, WireGuard implements the entire protocol in userspace, and that implementation could have security-relevant bugs. For instance, the initial implementation pushed to FreeBSD was horrifically insecure.