Messages in this thread |  | | | Date | Fri, 22 Sep 2006 16:41:09 +0900 (JST) | | Subject | Re: [PATCH 2.6.18 try 2] net/ipv4: sysctl to allow non-superuser to bypass CAP_NET_BIND_SERVICE requirement | | From | YOSHIFUJI Hideaki / 吉藤英明 <> |
In article <736CE60D-FB88-4246-8728-B7AC7880B28E@atheme.org> (at Fri, 22 Sep 2006 02:31:59 -0500), William Pitcock <nenolod@atheme.org> says:
> This patch allows for a user to disable the requirement to meet the > CAP_NET_BIND_SERVICE capability for a non-superuser. It is toggled by > the net.ipv4.allow_lowport_bind_nonsuperuser sysctl value.
Why? I don't think this is a good idea.
> diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h > index e4b1a4d..c3f7c3c 100644 > --- a/include/linux/sysctl.h > +++ b/include/linux/sysctl.h > @@ -411,6 +411,7 @@ enum > NET_IPV4_TCP_WORKAROUND_SIGNED_WINDOWS=115, > NET_TCP_DMA_COPYBREAK=116, > NET_TCP_SLOW_START_AFTER_IDLE=117, > + NET_IPV4_ALLOW_LOWPORT_BIND_NONSUPERUSER=118, > }; > > enum {
This implies all IPv4 protocols including other protocols such as UDP, SCTP, ...
> @@ -1412,3 +1418,4 @@ EXPORT_SYMBOL(inet_stream_ops); > EXPORT_SYMBOL(inet_unregister_protosw); > EXPORT_SYMBOL(net_statistics); > EXPORT_SYMBOL(sysctl_ip_nonlocal_bind); > +EXPORT_SYMBOL(sysctl_ip_allow_lowport_bind_nonsuperuser);
Please be aware about indent.
--yoshfuji - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |