I know that ports below 1024 are protected and can't be opened by a user without sufficient permission.

However, I'm wondering how daemons such as bind or apache can do so, though they aren't running as root.

So, my question is the following : how do servers such as bind or apache manage to open ports such as 80, 443, etc.?

  • The serving process drops its privileges after the socket is open. – user86969 Mar 2 '15 at 15:36

Apache is an example of a daemon that supports dropping privileges. Apache is started as root, and it binds to the ports as root. After it has binded, it uses the setuid and setgid system call to drop to lesser privileges. The user that it changes to is determined by it's "User" and "Group" configuration options.

  • Thanks for your answer, it didn't even think about that but now you've said it, it seems to be a very clean and straight-forward way to proceed. – mimipc Mar 2 '15 at 15:42
  • 3
    The important addition to make here is that the root-running portion of Apache does NO parsing. All it does is do the socket business and spawning children. Children (that dropped privs) are the ones that deal with URL's, contents, and all that potentially dangerous operations happen with normal user privs. I call it the 'one crime at a time' principle: if you're running as root, don't be parsing. If you're parsing, don't be running as root. – Marcin Mar 2 '15 at 15:43
  • 1
    I also read something interesting on another related question: "In order to drop all privileges (user and group), you need to drop the group before the user.". Source: stackoverflow.com/questions/3357737/dropping-root-privileges – mimipc Mar 2 '15 at 15:48
  • good point, mimipc – Skaperen Mar 3 '15 at 11:21

Any application can be allowed a set of root capabilities using setcap.
Opening port below 1024 if one of them.
You can run the application as a non-root user, and if the capabilities you need are set, there will no problem.
Read about the possible capabilities: http://linux.die.net/man/7/capabilities.

For example, running apache-tomcat as non-root:
setcap <your needed caps> <java_home>/<java_executable>

To see what caps are set for an executable:
getcap /path/to/the/executable

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.