Does Authbind's helper really need setuid root, or can it run with the CAP_NET_BIND_SERVICES capability and still work?
1 Answer
I found this excerpt in this thread titled: Bind to ports less than 1024 without root access.
excerpt
I dimly remember a library called "authbind" that does what you need, by wrapping the
bind()
system call (via aLD_PRELOAD
library), and, if a privileged port is requested, spawning a setuid root program that receives a copy of the file descriptor, then verifies the application is indeed permitted to bind to the port, performs thebind()
and exits.
-
serverfault.com/questions/268099/… | From the actual Stack Exchange site Feb 14, 2014 at 14:14
-
@user314104 - ha, that's funny, I thought the posts in the thread looked like a SE site but didn't think to search for the quote to find it. Nice sleuthing.– slm ♦Feb 14, 2014 at 14:19
authbind
. I've never even heard of this and I've been in the business for 20+ years so it's hardly a surprise that this tag doesn't exist. This is similar functionality tocapabilities
which is pretty widespread.authbind
is similar to that of capabilities, butauthbind
existed before the support for capabilities in Linux... or so the Wikipedia article says. :) Unfortunately, Linux capabilities are a bit too ... /damaged/ for me to use directly. Combining authbind and capabilities, however, seems like the best of both worlds: I get to set permissions by uid (authbind) and I don't need set(e)uid root.