I'm trying to use Linux Capabilities to allow a program (httpd) to bind to a privileged port (443) as a non-privileged user.
I set the capabilities for the program using this command:
setcap CAP_NET_BIND_SERVICE+eip httpd
Then I verified that the capability was successfully set with...
httpd = cap_net_bind_service+eip
When I attempt to start the program, it exits because it cannot bind to the required port. I discovered this using
strace -f httpd reveals "permission denied, can't bind, shutting down":
... write(2, "(13)Permission denied: AH00072: "..., 85(13)Permission denied: AH00072: make_sock: could not bind to address [redacted X.X.X.X]:443) = 85 close(3) = 0 write(2, "no listening sockets available, "..., 46no listening sockets available, shutting down ...
What should I do to make Linux Capabilities work correctly and allow the program to bind to a privileged port?
A quick search suggests that a mount with the
nosuid flag can prevent Capabilities from functioning, and I verified that it's not interfering in this case.