4 ms·
You can be more specific than that and allow only a specific user/program to bind a specific privileged port. This is accomplished with a combination of SELinux
by Godel_unicode 9y ago
You can be more specific than that and allow only a specific user/program to bind a specific privileged port. This is accomplished with a combination of SELinux and the capabilities API in 2.6.24 and newer.
- d4rti 9y agoOr alternatively, rewrite incoming traffic with iptables, https://www.cyberciti.biz/faq/linux-port-redirection-with-iptables/ https://www.cyberciti.biz/faq/linux-port-redirection-with-ip...
- geofft 9y agoEven if you do that, I think Apache still starts as root to do things like open SSL certificates and log files (and logging configuration is the thing exploited here). Is there a common config - e.g. an initscript / systemd unit on an SELinux distro - that starts Apache as a dedicated user? I know Apache supports being started as an unprivileged user (I do this myself a lot when I need something a little more featureful than SimpleHTTPServer) but my impression was that that's not very common for production deployments.