4 ms·
Or just giving relevant users CAP_NET_BIND_SERVICE.
by smw 9y ago
Or just giving relevant users CAP_NET_BIND_SERVICE.
- blibble 9y agoor do it to the binaries: > setcap 'cap_net_bind_service=+ep' /path/to/executable huge blog post for what is literally a one line fix
- jerf 9y agoUnprivileged user accounts can't do that, so it changes nothing about the blog post.
- tyingq 9y agoAlso only works for actual binaries, not scripts. Well, you can write a short exec wrapper I suppose.
- voltagex_ 9y agoHm. Why doesn't it work for scripts? I thought the capabilities were stored in the filesystem?
- ClashTheBunny 9y agoBecause the script is probably not what is actually opening the port. It is going to execute something else that will open the port.
- tetromino_ 9y agoAn OS that allows shebang scripts to have setuid or capabilities ends up allowing security holes, as seen in traditional Unix variants; see http://www.faqs.org/faqs/unix-faq/faq/part4/section-7.html http://www.faqs.org/faqs/unix-faq/faq/part4/section-7.html and https://www.in-ulm.de/~mascheck/various/shebang/#setuid https://www.in-ulm.de/~mascheck/various/shebang/#setuid Therefore, Linux simply doesn't allow it.
- deleted 9y ago[deleted]
- reacweb 9y agosudo setcap 'cap_net_bind_service=+ep' /usr/bin/nodejs then all users benefits from it.
- yjftsjthsd-h 9y agoA lot of good blog posts end up as one line fixes :-)
- psadauskas 9y agoHow does that solve the problem? How to 100 users bind their locally-installed web server to port 80? How do you make it so that only my user can bind to only my IP?