How do I grant permission on port <1024 to a usr?

[RobinQi]

Guys: I'd like to run a web server on port 80, but would like not to use root. How do I do that?

[JohnVV]

port 80 is always open for all users .
That is unless YOU as root CLOSED it .

[pedromatiello]

Not really. Normal users can't listen any port under 1024.

[pedro@pmatiello ~]$ nc -l 80
nc: Permission denied

But you can listen on a higher port and user iptables to redirect the traffic. Open the firewall configuration tool (System->Config->Firewall) and then add a new rule on Port Forwarding section (something like from TCP port 80 to 127.0.0.1 port 8080).

[RobinQi]

Thank you guys. Port forwarding solved the problem. But still curious if there is a way to grant the permission?

[aleph]

They are called "privileged ports" for a reason...

[RobinQi]

Guys, Found another way:

login as root, then:
chmod +s mywebserver

[stevea]

In the good old days root could open the ports (<1024), so you could create a setuid program (see chmod +s for detail).

The capabilities (see man 7 capabilities) schema requires that you have CAP_NET_BIND_SERVICE capabilities to open ports <1024 for listening. Capabilities is currently in flux in Linux ... not fully implemented, the user space tools have changed recently. On F10 you'd use 'setcap' to set the 'forced' capability of the executable file - or else you'd use setpcap to set process capability (but setpcap is missing).

With SELinux the situation is as clear as mud - you must understand the policy wrt the socket objects. Generally under the Fedora SEL policy the root account runs processes with a sysadmin 'user' and appropriate role and domain to permit the 'mojo' needed to do rooty stuff. See that the typical service has this SEL context. "system_u:object_r:bin_t" (some vaying domains(types)) which may be sufficient.

I just looked (2.6.26.1 kernel - close enough) at the code and the <1024 test ONLY references the CAP_NET_BIND capability - so that is what you need. For example:
linux-2.6.26-1/net/ipv4/af_inet.c: if (snum && snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE))

==

To do this on F10 use the following command:
su -
setcap cap_net_bind_service=ep your-program-name

getcap program-name will show the program's capabilities.


This will give the program the specific "CAP_NET_BIND_SERVICE" regardless of who runs it.

[stevea]

Guys, Found another way:

login as root, then:
chmod +s mywebserver

That solution will work but be aware of two things ... EVERYTHING that program does is privileged as root(or whoever owns the file). So if the program writes or reads or executes files a sneaker might be able to use it gain system control. The other point is that once capabilities is fully implemented root will no longer be a privileged account and the file setuid bit will be mostly pointless.

[RobinQi]

Thanks Steve, This is the 2nd time you solved my problem.
Yeah, I realized the chmod is a bad idea since the binary will run as root. For now I will stay with port forwarding.
I have never used capabilities before, though heard it all the time, maybe that's the next step.