> I would like to see an option that does the folowing:
> 1) Let "normal user" programs bind to ports < 1024
> ONLY IF
> 2) that program was given this "capability" by root, for example
> by means of an file-system flag.
> This allows a lot of, currently, SUID-programs to run as non-root all the
> way, and thus, when used properly, enhances security of networked systems.
It's long story. You can do it NOW (more or less). Capabilities like this
are in kernel. So what you should do is just adding fie lines to the very
start of main() -- drop all capabilities there except of capability to bind
to ports < 1024 ... Where to store such capability in filesystem was discussed
year ago and no consensus was gotten :-((
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/