Welcome! Log In Create A New Profile

Advanced

Re: [PATCH] Start use capabilities on linux

March 18, 2009 02:30AM
On Wed, Mar 18, 2009 at 04:23:48AM +0300, Maxim Dounin wrote:

> Hello!
>
> On Wed, Mar 18, 2009 at 12:36:47AM +0300, Kirill A. Korinskiy wrote:
>
> > From: Kirill A. Korinskiy <catap@catap.ru>
> >
> > The nginx required privilege mode only on master process and only bind
> > ports <1024. In linux proccess can bind ports <1024 in not privilege
> > mode if the process does capset(CAP_NET_BIND_SERVICE).
>
> Note that using root for master process needed not only for
> bind(), but also to access restricted configuration files (e.g.
> private keys) during reconfiguration. So dropping root from
> master should be at least configurable.
>
> It's also not clear what will happen on binary upgrade. Looks
> like with current code capabilities will be lost on exec() and
> upgraded binary won't be able to bind() privileged ports anymore.
> But I'm not really familiar will linux capabilites interface, so I
> may be wrong.
>
> Not even mentioning you are dropping root before writing pidfile.
> :)

The root privileges is also required to rotate logs if they are in
a directories where workers can not write: master opens files and
chown/chmod() them.

> Also there is a couple of unrelated changes and some whitespace
> damage/style violations, but it doesn't really matter.
>
> Maxim Dounin


--
Igor Sysoev
http://sysoev.ru/en/
Subject Author Posted

[PATCH] Start use capabilities on linux

Kirill A. Korinskiy March 17, 2009 05:59PM

Re: [PATCH] Start use capabilities on linux

Maxim Dounin March 17, 2009 09:43PM

Re: [PATCH] Start use capabilities on linux

Igor Sysoev March 18, 2009 02:30AM

[PATCH 2/2] Setting more capabilities(CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH and CAP_SETUID).

Kirill A. Korinskiy March 18, 2009 12:03PM

[PATCH] Setting more capabilities(CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_DAC_READ_SEARCH and CAP_SETUID).

Kirill A. Korinskiy March 18, 2009 12:45PM

[PATCH 3/3] Add support libcap1

Kirill A. Korinskiy March 18, 2009 09:02PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 80
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready