From: "Sven Köhler" <skoehler@upb.de>
To: linux-kernel@vger.kernel.org
Subject: Re: allow process or user to listen on priviledged ports?
Date: Thu, 25 Dec 2003 18:46:10 +0100 [thread overview]
Message-ID: <bsf83s$f23$1@sea.gmane.org> (raw)
In-Reply-To: <3FEAD582.10908@upb.de>
>> I would give your application this capability (from #include
>> "linux/capability.h")
>>
>> /* Allows binding to TCP/UDP sockets below 1024 */
>> /* Allows binding to ATM VCIs below 32 */
>>
>> #define CAP_NET_BIND_SERVICE 10
>>
>> You do this with a setuid wrapper which drops all capabilities but
>> that one and then runs your application.
>
> Thx for the answer! That's exactly what i search for.
Unfortunatly my gladness didn't last long. The FAQ at
http://ftp.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.4/capfaq-0.2.txt
states that CAP_SETPCAP is disabled, but it doesn't say why it is
disapled. That capability is needed by sucap to work.
So why is CAP_SETPCAP disabled by default?
prev parent reply other threads:[~2003-12-25 17:52 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-12-24 16:43 allow process or user to listen on priviledged ports? Sven Köhler
2003-12-24 17:02 ` Michael Buesch
2003-12-24 17:23 ` Olaf Dietsche
2003-12-24 21:34 ` Adam Sampson
2003-12-24 21:59 ` Thomas Zehetbauer
2003-12-24 22:00 ` Eric
2003-12-25 10:45 ` Nick Craig-Wood
2003-12-25 12:18 ` Sven Köhler
2003-12-25 17:46 ` Sven Köhler [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='bsf83s$f23$1@sea.gmane.org' \
--to=skoehler@upb.de \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.