4 ms·
There's a capabilities thing you can do to add the permission to a process without changing users. You can also have it bind to the port as root then drop permi
by f33d5173 3y ago
There's a capabilities thing you can do to add the permission to a process without changing users. You can also have it bind to the port as root then drop permissions afterwards.
- fiddlerwoaroof 3y agoYeah, but requiring the process to start as root adds a window of vulnerability and the process has to drop privileges correctly. You could also do it in the load balancer/router.
- superb_dev 3y agoSystemd can setup the privileges before starting the process
- greyface- 3y agoRun this as root once: setcap 'cap_net_bind_service=+ep' /path/to/executable Now, the process doesn't need to start as root and drop privs.