2 ms·
the lack of access control in traditional bsd sockets has been a pain point and the concept of privileged port range is utterly useless, especially as you gener
by zokier 2y ago
the lack of access control in traditional bsd sockets has been a pain point and the concept of privileged port range is utterly useless, especially as you generally don't want to run your services as root anyways.
that being said, didn't selinux resolve that problem decades ago?
- linschn 2y agoAuthor here :) I'm not aware of how selinux can solve this but I will look into it if only just to mention it as an alternative.
- zokier 2y agothe typical way to allow something to bind to specific ports in selinux would be something like allow foo_t http_port_t : tcp_socket name_bind ; the biggest problems are that you need to a) confine your users b) label everything
- linschn 2y agoAlso, indeee, the lack of access control for ports in bsd socket when the file API was RIGHT THERE is driving me crazy.