Re: [PATCH 2.6.18 try 2] net/ipv4: sysctl to allow non-superuser to bypass CAP_NET_BIND_SERVICE requirement

[daw@cs.berkeley.edu (David Wagner)]

William Pitcock  wrote:
>Additionally, with your solution, the program would still need to be  
>extensively modified.

I suspect "extensively" may be a little bit of an overstatement, though
it sure would take some doing.  With some work, it may be possible to
write an alternative implementation of bind() that creates a Unix domain
socket, forks, execs a copy of the setuid-root program, recieves a copy
of the newly opened fd passed over the Unix domain socket, and returns
that to the caller of bind().  In this way, it might be possible to
build a solution that requires only minimal modifications to the app
(just change how it is linked).  It'd be messy and thoroughly unportable
(because it would only work on systems where that setuid program was
installed), but maybe doable.

>However, that's really not a bad idea (what you proposed). But, I  
>still believe that the sysctl patch is more flexible, especially in  
>cases where you might not have the source-code to what you are trying  
>to run (common with enterprise apps, gameserver admin panels, etc.).

Ok.  Understandable.  I leave it to others to comment further.  I'm not
advocating anything either way.