I'm trying to run a web server from a headless, NAT'd VirtualBox guest. VirtualBox needs to bind to port 80, but the only way to do so is by running VirtualBox as root. To get around this, I tried using
setcap, but the VirtualBox process is SUID root, meaning it drops all user privileges, including setcap settings.
Since VirtualBox runs with SUID root, why can't non-root users bind to privileged ports with it?
The guest cannot be bridged, it must use NAT. Rerouting traffic with iptables or running VirtualBox as root is also unfortunately not an option, but I may have to settle if there are no other options.
kern.log also confirms this:
warning: /usr/lib/virtualbox/VBoxHeadless' has both setuid-root and effective capabilities. Therefore not raising all capabilities.
EDIT: The capabilities manpage also touches on this:
If the effective user ID is changed from 0 to nonzero, then all capabilities are cleared from the effective set.