c8341d5b69
* core: Raise CAP_NET_BIND_SERVICE when binding privileged ports When CAP_NET_BIND_SERVICE is in the permitted set but not the effective set, raise it on a dedicated locked OS thread just for the bind, then lower it again and let the thread exit. This allows the binary to be granted the capability with `setcap cap_net_bind_service=+p` instead of `=+ep`. With the effective bit set, the kernel refuses to exec the binary at all when the capability can't be granted (e.g. `docker run --cap-drop ALL`, or an empty systemd CapabilityBoundingSet), even if no privileged port is ever bound. * core: Move bind capability helpers into internal package |
||
|---|---|---|
| .. | ||
| filesystems | ||
| metrics | ||
| testmocks | ||
| bindcap_linux.go | ||
| bindcap_linux_test.go | ||
| bindcap_other.go | ||
| logbuffer.go | ||
| logmarshalers.go | ||
| logs.go | ||
| logs_test.go | ||
| ranges.go | ||
| sockets.go | ||