Comment on Podman rootless containers and the Copy Fail exploitparentComments−tingletech4mois that no longer true?−bhaney4moNo, now you have the option of using CAP_NET_BIND_SERVICE−63stack4moThere is also net.ipv4.ip_unprivileged_port_start−jcgl4moIf the application supports it, there’s also systemd socket activation (or traditional inetd sorta stuff too if that fits)−jcgl4moForgot to mention: you can use systemd-socket-proxyd to bridge to an application that doesn't support socket activation too: https://www.man7.org/linux/man-pages/man8/systemd-socket-pro...
Comments
is that no longer true?
No, now you have the option of using CAP_NET_BIND_SERVICE
There is also net.ipv4.ip_unprivileged_port_start
If the application supports it, there’s also systemd socket activation (or traditional inetd sorta stuff too if that fits)
Forgot to mention: you can use systemd-socket-proxyd to bridge to an application that doesn't support socket activation too: https://www.man7.org/linux/man-pages/man8/systemd-socket-pro...