4 ms·
It only needs to root to bind to privileged ports I believe. You should be able to use a non-root user and give it CAP_NET_BIND_SERVICE: [Service] AmbientCap
by candiddevmike 5y ago
It only needs to root to bind to privileged ports I believe. You should be able to use a non-root user and give it CAP_NET_BIND_SERVICE:
[Service]
AmbientCapabilities=CAP_NET_BIND_SERVICE
- ape4 5y agoCool! But then I suppose the forked processes could then bind to a low numbered port - something they can't do now. So Apache would have to make sure to revoke that capability when forking.
- 5e92cb50239222b 5y agoYou could combine it with something like this SocketBindDeny=any SocketBindAllow=tcp:80 SocketBindAllow=tcp:443 These ports should be denied by the kernel because they're already taken by httpd, and all other will be denied by bpf filters installed by systemd. It feels like plugging holes in a dam, but that's what you do with popular operating systems.