xenial (1) privbind.1.gz

NAME

       privbind - allow an unprivileged application to bind with reserved ports.

SYNOPSIS

       privbind -u user [ -g group] [ -n num] [ -l path] command [ arguments ... ]

DESCRIPTION

       Normally in Linux, only a superuser process can bind an Internet domain socket with a reserved port (port
       numbers less than 1024). Accordingly, server processes are typically run with superuser privileges, which
       can be dropped after binding the reserved port.

       privbind can execute an application as an unprivileged user with just one extra privilege: it can bind to
       reserved ports.

       privbind is useful in several situations. It can be used when the application is not trusted  enough;  It
       can  be  used when the server is written in a language without the setuid(2) feature (e.g., Java(TM)); It
       can also be used to run applications which don't manipulate their own user id and need to be able to bind
       to a reserved port without needing any other root privileges.

OPTIONS

       -u     The -u option is mandatory, and specifies under which user to run the given command.  The user can
              be specified using either a username or a numeric user id.  It should  be  an  unprivileged  (non-
              root) user.

       -g     Specifies  the  group to switch to when running the given command. If this option is missing, then
              the given user's default group is used.

       -n     privbind's default behaviour is to allow the application to call bind(2) with  reserved  ports  an
              unlimited  number  of  times.  In order to do that (see "HOW IT WORKS" below), the privbind helper
              process needs to wait for the application to exit before it terminates.

              The -n num option tells privbind that it can assume that only num binds need to be given  elevated
              privileges.  After this number of bind(2) calls have been executed, privbind's helper process will
              exit, leaving behind only the unprivileged application running.

       -l     Mostly for internal use during build. Gives the explicit path to the LD_PRELOAD library.

       -h     Shows a short help screen, and exits.

EXIT STATUS

       Using technical jargon, privbind execs command as its main process, running itself in the background  (as
       a  child of the application's process). The practical upshot of this, in layman's terms, is that the user
       never sees privbind's exit status. When running privbind,  the  process  will  exit  whenever,  and  with
       whatever exit status, command does.

       The above point should be particularly noted when using privbind to run daemons.

SECURITY CONSIDERATIONS

       privbind  has  no  SUID parts, and runs within the confines of a single process.  This serves to minimize
       the security implications of using it. It is strongly advised that privbind not be  made  SUID,  as  this
       would  allow  any  user  that  can  run it to run any process as any other (non-root) user. At the moment
       privbind detects such a situation and warns about it, but will continue with the execution.

HOW IT WORKS

       In a nutshell, privbind works by starting two processes. One drops  privileges  and  runs  (exec(2))  the
       command,  the other remains as root.  Privbind makes sure to keep a unix domain socket connecting the two
       processes.

       Privbind uses LD_PRELOAD to intercept every call to bind(2) made  by  the  program.  Calls  that  can  be
       completed  non-privileged  are  done  so.   Calls  that require root privileges are forwarded to the root
       process, that carry them out on the program's behalf.

       A more detailed explanation is available in the README file.

BUGS

       privbind  currently  uses  "SOCK_SEQPACKET"  for  communication  between  privileged  and  non-privileged
       processes.  This  socket  type  is only implemented on Linux kernel 2.6.4 and later, which makes privbind
       none portable to older Linux kernels and many other non-Linux platforms.

VERSION

       The version of privbind described by this manual page is 1.0 (June 12, 2007)

COPYRIGHT

       Copyright (C) 2006-2007, Shachar Shemesh plus others. See the AUTHORS file.

       privbind was written by Shachar Shemesh, with contributions from Amos Shapira and Nadav Har'El.

       privbind is free software, released under the GNU General Public License (GPL).  See the COPYING file for
       more information and the exact license terms.

       The latest version of this software can be found in

           http://sourceforge.net/projects/privbind

       Java is a registered trademark of Sun Microsystems.

SEE ALSO

       su(1), sudo(8), capabilities(7), bind(2), setuid(2), ld.so(8), unix(7)