Hey all,
Just wanted to report what is either a documentation issur, or an
issue in `passt` proper. The `man` pages document the following for
binding to low numbered (i.e. service ports):
or the CAP_NET_BIND_SERVICE Linux capability is granted, see
services(5) and capabilities(7).
[...]
To grant this capability, you can issue, as root:
for p in $(which passt passt.avx2); do
setcap 'cap_net_bind_service=+ep' "${p}"
done
However, this does not work:
# setcap 'cap_net_bind_service=+ep' /usr/local/bin/passt
# setcap 'cap_net_bind_service=+ep' /usr/local/bin/passt.avx2
$ /usr/local/bin/passt -f -t 123
Listen failed for HOST TCP port */123: Permission denied
Couldn't listen on requsted ports
[1]
The reason I'm asking is that `krun` uses `passt` for port forwarding
and is having issues with service ports [1]. The current work-around is
to set the `net.ipv4.ip_unprivileged_port_start` sysctl to a lower
number in the container where `passt` is run, but since `passt` is
started already with `CAP_NET_BIND_SERVICE` it would be nice for that
to work and not require the `sysctl` work-around.
Anyway, curious to know if this is documentation issue or actually
something that should be working but isn't (or a local setup issue).
Regards,
Nick
[1]: <https://github.com/containers/crun/issues/2251>