I have a Go program (acme-dns) that wants to bind 53, 80, and 443, and I’d rather have it run as a non-privileged user. The program doesn’t provide a facility to drop privs after binding the ports. I’m planning to run it in a jail.
After some googling, it appears that a couple of years ago I should have been able to do: sysctl net.inet.ip.portrange.reservedhigh=0 and allow all processes to bind to „low“ ports. This does not work in my jails on a 11-stable host. $ sudo sysctl net.inet.ip.portrange.reservedhigh=0 net.inet.ip.portrange.reservedhigh: 1023 sysctl: net.inet.ip.portrange.reservedhigh=0: Operation not permitted Securelevel should not interfere: $ sysctl kern.securelevel kern.securelevel: -1 Is there a way to allow regular processes to bind to low ports? Stefan -- Stefan Bethke <[email protected]> Fon +49 151 14070811 _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to "[email protected]"
