Linux capabilities, root ownership and so on

[benohb]

MarkMLl

You can redirect the low port to a high port and listen on the high port.

Code: Pascal  [Select][+][-]

1. iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 1080

[MarkMLl]

Which requires root to set up.

I can assure you that I am /intimately/ familiar with the capabilities of iptables and related commands, thank you very much :-|

MarkMLl

[benohb]

Which requires root to set up.

Yes ... for one time only ... when installing the package on the customer's machine (systemd script/ not systemd daemon)
This method is safer than requiring root privileges every time
I do not think you will get a low-numbered UDP socket without "admin privileges " _at all
So…  do it once and get rid of adventure with system permissions


There is another way that I think is a little complicated …Using  Fpgui as gksu and memfd_create+ exec + shmem
An application inside an application in one executable file and they have different privileges

[benohb]

If you find a mistake, it is because of Google Translate
I am no more English than my other friend

[MarkMLl]

I intend to take a look later at setting capabilities directly from the IDE. I'm unsure of the exact incantation, but in principle it should be possible to bless the IDE with the capability of running setcap which could then assign capabilities to a newly-built program without a password prompt. An IDE extension could obviously do it more cleanly.

https://unix.stackexchange.com/questions/106336/unable-to-set-capability-cap-setfcap-by-user

https://unix.stackexchange.com/questions/128394/passing-capabilities-through-exec

(Later)

If a copy of setcap is blessed with CAP_SETFCAP, then any user that can run it (e.g. controlled by group membership) can set arbitrary privileges on other binaries:

Code: [Select]

$ sudo setcap CAP_SETFCAP=p+e ./setcap2
$ rm scratch
$ cp -p Watch-x86_64-linux-gtk2 scratch
$ /usr/sbin/getcap scratch
$ ./setcap2 CAP_DAC_OVERRIDE,CAP_NET_BIND_SERVICE=p+e scratch
$ /usr/sbin/getcap scratch
scratch = cap_dac_override,cap_net_bind_service+ep

The two capabilities that I've assigned to the scratch binary will allow it to create a unix domain socket in /var/run, and to create a low-numbered UDP socket.

I think that it should be possible to fudge something like blessing both the Lazarus IDE and setcap with an inheritable CAP_SETFCAP, but I haven't worked the detail out yet. To be honest I think I'm more comfortable with the idea that there should be a blessed copy of setcap runnable by only development users than I am with the idea of having the main copy semi-blessed and at risk of compromising the system if run by anybody who can himself gain a bit of extra privilege by subterfuge.

But the best solution might still be running under kdesudo/gksu provided that it's available, since prompting the developer occasionally for confirmation that this is actually what he wants is probably no bad thing.

MarkMLl