authbind, libcap problemy

[Pavel Kankovsky]

On Tue, 10 Apr 2001, iko wrote:

> mam problemy prinutit program beziaci pod normalnym pouzivatelom, aby 
> bol schopny bindnut port 80. 
...
> na volanie pouzivam: 
> notes na disco:/var/local/lotus$ authbind --deep 
> /usr/local/lotus/bin/server 
> 
> odmietne bindnut port 80 

V zivote jsem authbind nezkousel, ale jestli jsem to dobre pochopil, tak
zpusobi, ze bind() v libc nahradi vyvolanim pomocneho programu, co musi
mit setuid (resp. jinou metodou byt opravnen to provest). V prvni rade
bych zkusil strace resp. strace -f.

> notes na disco:/var/local/lotus$ /sbin/execcap "cap_net_bind_service=all" 
> /uar/local/lotus/bin/server 
> 
> requested capabilities were not recognized 
> usage: execcap <caps> <command-path> [command-args...] 

/sbin/execcap cap_net_bind_service=eip ...

Az na to, ze to bud spustite pod rootem, pak to bude mit stejne
capability vsechny, nebo ne, a pak ji nebudete schopen pridelit.
A sucap nefunguje, pokud se neopatchuje jadro, aby rootovske procesy
mely CAP_SETPCAP. Hlava 22.

(Ja to ted experimentalne zkousim resit jadernym modulem, ktery prideluje
capabilities podle toho, jaky ma proces euid/egid/grupy, protoze chci
byt schopen spoustet nmap, aniz bych musel delat su. :> )

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."