Re: [PATCH 2.6.18 try 2] net/ipv4: sysctl to allow non-superuser to bypass CAP_NET_BIND_SERVICE requirement

[daw@cs.berkeley.edu (David Wagner)]

William Pitcock  wrote:
>This patch allows for a user to disable the requirement to meet the  
>CAP_NET_BIND_SERVICE capability for a non-superuser. It is toggled by  
>the net.ipv4.allow_lowport_bind_nonsuperuser sysctl value.

Can't you provide this functionality (in a non-transparent way) through
user-space code alone?  I'm thinking of a setuid-root program that
takes a port number as argv[1], binds to that port, dup()s the new
file descriptor onto fd 0 (say), drops root, and then forks and execs
a program specified on argv[2].  If you want to get fancy, instead of
exec-ing, you could use the standard trick to pass the file descriptor
over a Unix domain socket to some other process.  Seems like you should
be able to make something like this work, as long as you're willing to
make small modifications to the program that uses the low port.  Does
that work?