1

I'm trying to use Linux Capabilities to allow a program (httpd) to bind to a privileged port (443) as a non-privileged user.

I set the capabilities for the program using this command:

setcap CAP_NET_BIND_SERVICE+eip httpd

Then I verified that the capability was successfully set with...

getcap httpd

which prints...

httpd = cap_net_bind_service+eip

When I attempt to start the program, it exits because it cannot bind to the required port. I discovered this using strace:

strace -f httpd reveals "permission denied, can't bind, shutting down":

...
write(2, "(13)Permission denied: AH00072: "..., 85(13)Permission denied: AH00072: make_sock: could not bind to address [redacted X.X.X.X]:443) = 85
close(3) = 0
write(2, "no listening sockets available, "..., 46no listening sockets available, shutting down
...

What should I do to make Linux Capabilities work correctly and allow the program to bind to a privileged port?

A quick search suggests that a mount with the nosuid flag can prevent Capabilities from functioning, and I verified that it's not interfering in this case.

3
  • 1
    This seems like unnecessary work for apache specifically. Apache has been able to run as non-root for years before capabilities were introduced in Linux. It does this by starting as root, binding to the port, and then dropping privileges to the intended user. You may want to check SELinux audit logs if enabled. – jordanm Feb 23 '17 at 20:51
  • SELinux is set to permissive for this test machine, so that's not interfering either. – Dylan Klomparens Feb 23 '17 at 21:06
  • I always use absolute paths rather than relative paths with setcap but I'm uncertain if that is an actual requirement. – HBruijn Feb 24 '17 at 9:04
0

You need to set the capabilities to the absolute path of httpd app.

setcap CAP_NET_BIND_SERVICE+eip <path/to/executable>

Example: Here I will be using java, which tomcat uses to run our application.

java location:

/opt/java/bin/java

Setting capabilities:

setcap CAP_NET_BIND_SERVICE+eip /opt/java/bin/java

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.