[systemd-devel] Portable service binding a system port

[Lennart Poettering]

On Fr, 07.02.20 11:05, François (francois+systemd at kubler.org) wrote:

> Hi,
>
> I’m finally answering my own question - well at least partially.
>
> I managed to identify the culprit : the `PrivateUsers=yes` directive.
>
> If I override it with a drop-in and set it to `no`, it works as expected and I can successfully bind to port 53.
>
> But I still don’t understand why, especially since it’s part of the
> default profile.

Ideally unbound would support socket activation, so that PID 1 can
bind the socket and pass it in pre-bound.

PrivateUsers=yes means userns, and only processes that have
CAP_NET_BIND_SERVICE in the host user ns can bind on ports <
1024. PrivateUsers= user namespace do not have that, and hence cannot
bind the port on the host.

Portable service profiles are best combined with socket activation to
limit the privileged surface...

Lennart

--
Lennart Poettering, Berlin