Bind to port <1024 in jail

[Eugene Grosbein]

20.08.2018 21:47, Stefan Bethke wrote:

> I have a Go program (acme-dns) that wants to bind 53, 80, and 443, and I’d rather have it run as a non-privileged user.  The program doesn’t provide a facility to drop privs after binding the ports. I’m planning to run it in a jail.
> 
> After some googling, it appears that a couple of years ago I should have been able to do:
> sysctl net.inet.ip.portrange.reservedhigh=0
> and allow all processes to bind to „low“ ports. This does not work in my jails on a 11-stable host.
> 
> $ sudo sysctl net.inet.ip.portrange.reservedhigh=0
> net.inet.ip.portrange.reservedhigh: 1023
> sysctl: net.inet.ip.portrange.reservedhigh=0: Operation not permitted
> 
> Securelevel should not interfere:
> $ sysctl kern.securelevel
> kern.securelevel: -1
> 
> Is there a way to allow regular processes to bind to low ports?

Yes. Just use mac_portacl kernel module: kldload mac_portacl

Once loaded, it duplicates net.inet.ip.portrange.reservedhigh protection
with its own security.mac.portacl.port_high, so it's safe to disable
"reservedhigh" for whole system by running sysctl net.inet.ip.portrange.reservedhigh=0
for host.

The trick is that mac_portacl provides a way to selectively give permission for non-root UID
to bind low ports:

security.mac.portacl.rules=uid:88:tcp:80,uid:88:tcp:443,uid:53:tcp:53,uid:53:udp:53

It works just fine for a host and I use it for name servers utilizing port 53
for a box with dynamically created interfaces, so it may bind the port for distinct IP addresses
after it dropped privilegies when new interface is created and get new IP assigned.

I have not tried it for a jails, though. Please try and respond.