2 commits

Author	SHA1	Message	Date
Francis Lavoie	0e392c89ba	core: Retry privileged binds on EACCES instead of checking port < 1024 (#8253) ... WithBindCapability assumed the kernel's privileged port range ends at 1024, but it is set by net.ipv4.ip_unprivileged_port_start, which can be anywhere from 0 (Docker's default) to 65535. With a value above 1024, a non-root bind to e.g. :1500 failed even though the capability was permitted. Now listen is called normally first, and only if it fails with EACCES on a TCP/UDP port, and CAP_NET_BIND_SERVICE is permitted but not effective, the capability is raised and the bind retried. This also skips raising it when the range starts lower than the port. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 19:19:28 +10:00
Francis Lavoie	c8341d5b69	core: Raise CAP_NET_BIND_SERVICE when binding privileged ports (#8102) ... * core: Raise CAP_NET_BIND_SERVICE when binding privileged ports When CAP_NET_BIND_SERVICE is in the permitted set but not the effective set, raise it on a dedicated locked OS thread just for the bind, then lower it again and let the thread exit. This allows the binary to be granted the capability with `setcap cap_net_bind_service=+p` instead of `=+ep`. With the effective bit set, the kernel refuses to exec the binary at all when the capability can't be granted (e.g. `docker run --cap-drop ALL`, or an empty systemd CapabilityBoundingSet), even if no privileged port is ever bound. * core: Move bind capability helpers into internal package	2026-10-03 19:10:02 +10:00