News for hackers. Stuff that matters.

A comment on Dear Linux, Privileged Ports Must Die. Parent comment

Re:Dear Linux, Privileged Ports Must Die by im3w1l on Thursday September 01, 2022 @02:43AM (#32672838)
> The minor issue with privileges is already solved by CAP_NET_BIND_SERVICE, the init system could just give this capability to every system service, instead of disabling privileged ports system-wide.

This is one of the better suggestions here, but an issue I see is that users are now only able to get ports through the init system. What if some user wants to restart a server they own? Only root can restart a systemd service right?

[ Parent | on HN ]
Re:Dear Linux, Privileged Ports Must Die by kj4ips on Thursday September 01, 2022 @09:07AM (#32675741)
> but an issue I see is that users are now only able to get ports through the init system

The capabilities can also be specified by a fs attribute using setcap(8). This works like setuid, in the the capability is set whenever the file in question is exec'd. *

> Only root can restart a systemd service right

By default, only root can manage system-level systemd services, however, you can add policykit rules to allow specific users (or groups) to perform actions on specific services.

* Certain sandboxing techniques will break this (like no_new_privs)

[ Parent | on HN ]