4 ms·
Cool! But then I suppose the forked processes could then bind to a low numbered port - something they can't do now. So Apache would have to make sure to revok
by ape4 5y ago
Cool! But then I suppose the forked processes could then bind to a low numbered port - something they can't do now. So Apache would have to make sure to revoke that capability when forking.
- 5e92cb50239222b 5y agoYou could combine it with something like this SocketBindDeny=any SocketBindAllow=tcp:80 SocketBindAllow=tcp:443 These ports should be denied by the kernel because they're already taken by httpd, and all other will be denied by bpf filters installed by systemd. It feels like plugging holes in a dam, but that's what you do with popular operating systems.