CAP_NET_BIND_SERVICE does not allow binding to low ports

[Nicholas Rodrigues Lordello <n@lordello.net>]

Hey all,

Just wanted to report what is either a documentation issur, or an
issue in `passt` proper. The `man` pages document the following for
binding to low numbered (i.e. service ports):

    or the CAP_NET_BIND_SERVICE Linux capability is granted, see
    services(5) and capabilities(7).

    [...]

    To grant this capability, you can issue, as root:

        for p in $(which passt passt.avx2); do
            setcap 'cap_net_bind_service=+ep' "${p}"
        done

However, this does not work:

    # setcap 'cap_net_bind_service=+ep' /usr/local/bin/passt
    # setcap 'cap_net_bind_service=+ep' /usr/local/bin/passt.avx2
    $ /usr/local/bin/passt -f -t 123
    Listen failed for HOST TCP port */123: Permission denied
    Couldn't listen on requsted ports
    [1]

The reason I'm asking is that `krun` uses `passt` for port forwarding
and is having issues with service ports [1]. The current work-around is
to set the `net.ipv4.ip_unprivileged_port_start` sysctl to a lower
number in the container where `passt` is run, but since `passt` is
started already with `CAP_NET_BIND_SERVICE` it would be nice for that
to work and not require the `sysctl` work-around.

Anyway, curious to know if this is documentation issue or actually
something that should be working but isn't (or a local setup issue).


Regards,
Nick

[1]: <https://github.com/containers/crun/issues/2251>