0

I found that, in normal user previlege, I cant make a program listen on port which is lower than 1024. Is there any way I can make it ? (Im using hardened gentoo with grsec).

flag

1 Answer

1

You can do it by setting CAP_NET_BIND_SERVICE capability to the application in order to allow non-root service to listen on privileged ports. This can be done with setcap which uses setxattr to change security.capability extended attributes of the file.

For Gentoo:

  • Install libcap

    USE=pam emerge -av libcap

  • Use setcap to set CAP_NET_BIND_SERVICE capability to the service binary

    setcap cap_net_bind_service=+ep /path/to/service

You may also want to edit /etc/security/capability.conf file to restrict a specific user for the capability (you need to enable pam USE flag for libcap).

HTH

--rd

P/S: you can also bind the service on a non-privileged port (ex: 8080) and use iptables to do port forwarding from port 80 to 8080.

link|flag
oh yeah, i got it, thank you. – leen Jan 22 at 19:05

Your Answer

Get an OpenID
or

Not the answer you're looking for? Browse other questions tagged or ask your own question.