I want to spawn a user process which can use low (< 1024) ports. Googling
around, I've determined that I need to spawn the process and grant it the
"capability" of CAP_NET_BIND_SERVICE (from
/usr/include/linux/capability.h). It looks like I need to use sucap,
execcap, or setpcaps. I haven't found any good examples showing how to
actually do this. (The binary is commercial with no source so I can't
compile in code to do this. At best I can write a wrapper.)
I tried using setpcaps to give the capability to a known bash process
running in a second window from a su session, and I get this:
# setpcaps CAP_NET_BIND_SERVICE=eip 11516
[caps set to:
= cap_net_bind_service+eip
]
Failed to set cap's on process `11516': (Operation not permitted)
What's going wrong? I see from some googling that the kernel may be
compiled to not give init the CAP_SETPCAP capability. Is that the situation
with Fedora kernels? Do I need a custom kernel? (I tried the latest kernel
on FC4 and also on a FC2 box.)
