Bind to port <1024 in jail

[Stefan Bethke]

I have a Go program (acme-dns) that wants to bind 53, 80, and 443, and I’d rather have it run as a non-privileged user.  The program doesn’t provide a facility to drop privs after binding the ports. I’m planning to run it in a jail.

After some googling, it appears that a couple of years ago I should have been able to do:
sysctl net.inet.ip.portrange.reservedhigh=0
and allow all processes to bind to „low“ ports. This does not work in my jails on a 11-stable host.

$ sudo sysctl net.inet.ip.portrange.reservedhigh=0
net.inet.ip.portrange.reservedhigh: 1023
sysctl: net.inet.ip.portrange.reservedhigh=0: Operation not permitted

Securelevel should not interfere:
$ sysctl kern.securelevel
kern.securelevel: -1

Is there a way to allow regular processes to bind to low ports?


Stefan

-- 
Stefan Bethke <stb at lassitu.de>   Fon +49 151 14070811