From: Nick Craig-Wood <ncw1@axis.demon.co.uk>
To: Sven K <skoehler@upb.de>
Cc: linux-kernel@vger.kernel.org
Subject: Re: allow process or user to listen on priviledged ports?
Date: Thu, 25 Dec 2003 10:45:26 +0000 [thread overview]
Message-ID: <20031225104526.GA10239@axis.demon.co.uk> (raw)
In-Reply-To: <bscg1m$1eg$1@sea.gmane.org>
On Wed, Dec 24, 2003 at 05:43:09PM +0100, Sven K?hler wrote:
> my problem is, that i want an application to listen on a priviledged
> port (e.g. port 80) and to run as a "normal" unpriviledged user
I would give your application this capability (from #include "linux/capability.h")
/* Allows binding to TCP/UDP sockets below 1024 */
/* Allows binding to ATM VCIs below 32 */
#define CAP_NET_BIND_SERVICE 10
You do this with a setuid wrapper which drops all capabilities but
that one and then runs your application.
One day there will be a way of doing this in the filing system, so
instead of doing a chmod u+s you do a chmod +CAP_NET_BIND_SERVICE or
something! Until then use a setuid wrapper....
Here is a FAQ
http://ftp.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.4/capfaq-0.2.txt
Actually the FAQ mentions sucap which seems to be a fairly standard
program (its in Debian anyway!). You could use this too...
--
Nick Craig-Wood
ncw1@axis.demon.co.uk
next prev parent reply other threads:[~2003-12-25 10:45 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-12-24 16:43 allow process or user to listen on priviledged ports? Sven Köhler
2003-12-24 17:02 ` Michael Buesch
2003-12-24 17:23 ` Olaf Dietsche
2003-12-24 21:34 ` Adam Sampson
2003-12-24 21:59 ` Thomas Zehetbauer
2003-12-24 22:00 ` Eric
2003-12-25 10:45 ` Nick Craig-Wood [this message]
2003-12-25 12:18 ` Sven Köhler
2003-12-25 17:46 ` Sven Köhler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20031225104526.GA10239@axis.demon.co.uk \
--to=ncw1@axis.demon.co.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=skoehler@upb.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.