* bug#64862: [feature request] [shepherd] Specifying POSIX capabilities on services
@ 2023-07-25 21:04 Maxim Cournoyer
2024-11-12 6:08 ` Maxim Cournoyer
0 siblings, 1 reply; 2+ messages in thread
From: Maxim Cournoyer @ 2023-07-25 21:04 UTC (permalink / raw)
To: 64862
Hello,
It'd be useful to be able to specify POSIX capabilities a Shepherd
service should have, for example for an unprivileged process to be able
to bind to ports lower than 1024.
This came up while reviewing #63082, which patch 10/16 (now dropped
because of loss of functionality) suggested to let the user/group change
be effected by Shepherd instead of by MPD itself (see:
https://issues.guix.gnu.org/63082#98).
I know that NixOS has some mechanism to do that; I think it was a simple
shell script wrapper setting the capabilities, but that's all I
remember.
--
Thanks,
Maxim
^ permalink raw reply [flat|nested] 2+ messages in thread
* bug#64862: [feature request] [shepherd] Specifying POSIX capabilities on services
2023-07-25 21:04 bug#64862: [feature request] [shepherd] Specifying POSIX capabilities on services Maxim Cournoyer
@ 2024-11-12 6:08 ` Maxim Cournoyer
0 siblings, 0 replies; 2+ messages in thread
From: Maxim Cournoyer @ 2024-11-12 6:08 UTC (permalink / raw)
To: 64862-done; +Cc: Tobias Geerinckx-Rice
Hello,
Maxim Cournoyer <maxim.cournoyer@gmail.com> writes:
> Hello,
>
> It'd be useful to be able to specify POSIX capabilities a Shepherd
> service should have, for example for an unprivileged process to be able
> to bind to ports lower than 1024.
>
> This came up while reviewing #63082, which patch 10/16 (now dropped
> because of loss of functionality) suggested to let the user/group change
> be effected by Shepherd instead of by MPD itself (see:
> https://issues.guix.gnu.org/63082#98).
>
> I know that NixOS has some mechanism to do that; I think it was a simple
> shell script wrapper setting the capabilities, but that's all I
> remember.
I believe that's now possible since commit 71f0676a29 ("privilege: Add
POSIX capabilities(7) support."). Thank you, Tobias!
Closing.
--
Thanks,
Maxim
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-11-12 6:10 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-07-25 21:04 bug#64862: [feature request] [shepherd] Specifying POSIX capabilities on services Maxim Cournoyer
2024-11-12 6:08 ` Maxim Cournoyer
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).