All of lore.kernel.org
 help / color / mirror / Atom feed
From: Nick Craig-Wood <ncw1@axis.demon.co.uk>
To: Sven K <skoehler@upb.de>
Cc: linux-kernel@vger.kernel.org
Subject: Re: allow process or user to listen on priviledged ports?
Date: Thu, 25 Dec 2003 10:45:26 +0000	[thread overview]
Message-ID: <20031225104526.GA10239@axis.demon.co.uk> (raw)
In-Reply-To: <bscg1m$1eg$1@sea.gmane.org>

On Wed, Dec 24, 2003 at 05:43:09PM +0100, Sven K?hler wrote:
> my problem is, that i want an application to listen on a priviledged 
> port (e.g. port 80) and to run as a "normal" unpriviledged user

I would give your application this capability (from #include "linux/capability.h")

  /* Allows binding to TCP/UDP sockets below 1024 */
  /* Allows binding to ATM VCIs below 32 */

  #define CAP_NET_BIND_SERVICE 10

You do this with a setuid wrapper which drops all capabilities but
that one and then runs your application.

One day there will be a way of doing this in the filing system, so
instead of doing a chmod u+s you do a chmod +CAP_NET_BIND_SERVICE or
something!  Until then use a setuid wrapper....

Here is a FAQ

  http://ftp.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.4/capfaq-0.2.txt

Actually the FAQ mentions sucap which seems to be a fairly standard
program (its in Debian anyway!).  You could use this too...

-- 
Nick Craig-Wood
ncw1@axis.demon.co.uk

  parent reply	other threads:[~2003-12-25 10:45 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2003-12-24 16:43 allow process or user to listen on priviledged ports? Sven Köhler
2003-12-24 17:02 ` Michael Buesch
2003-12-24 17:23 ` Olaf Dietsche
2003-12-24 21:34 ` Adam Sampson
2003-12-24 21:59   ` Thomas Zehetbauer
2003-12-24 22:00   ` Eric
2003-12-25 10:45 ` Nick Craig-Wood [this message]
2003-12-25 12:18   ` Sven Köhler
2003-12-25 17:46     ` Sven Köhler

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20031225104526.GA10239@axis.demon.co.uk \
    --to=ncw1@axis.demon.co.uk \
    --cc=linux-kernel@vger.kernel.org \
    --cc=skoehler@upb.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.