From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=fail (p=none dis=none) header.from=lordello.net Received: from mail-106100.protonmail.ch (mail-106100.protonmail.ch [79.135.106.100]) by passt.top (Postfix) with ESMTPS id 9BEFB5A0269 for ; Wed, 14 Oct 2026 16:32:50 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lordello.net; s=protonmail2; t=1791988367; x=1792247567; bh=A+Lh24ecKbvms/KK0fxAQ5AW3ENaPJaV0VkX7p1GJiM=; h=Date:To:From:Subject:Message-ID:Feedback-ID:From:To:Cc:Date: Subject:Reply-To:Feedback-ID:Message-ID:BIMI-Selector; b=Q0kkWmzf0fnEL5vvOIbXS7VmGI514QR/Noj8AkP0NEEqClswFNOD72jWdwjjT/9/N gq7Ggkaaze/iamLw4vwXEqGCD/XV4w1eHG+CUEPBXWmmKYQ2ON0LzhCCjb3+/JnVJg hqqTtrtLuIhu0+ECP20vcF8ksbsyC38cj7XEbfOG8fDG5QHX0BkFYtBNML/Gpkssc2 Nszws1ORtyLtdYy9ufspGJ19457+JNMm6EZPZI9aBOla7h4dGMK233I7hBh2TcolFd dxEz9lXAkbA/M2taJho3JlCbpVKrhJ42aALKLVxx8JVCWsowQa8Jk3n8KFUeXiUqaA xW9XYys3jQjIQ== Date: Wed, 14 Oct 2026 14:32:43 +0000 To: passt-user@passt.top From: Nicholas Rodrigues Lordello Subject: CAP_NET_BIND_SERVICE does not allow binding to low ports Message-ID: Feedback-ID: 70986037:user:proton X-Pm-Message-ID: 94b0a1c5e0dde5097b5dae9b66bb4124dce14568 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-MailFrom: n@lordello.net X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation Message-ID-Hash: UDXJZI2XTYAW7GM5AEZ3CVUTTEELO5ZK X-Message-ID-Hash: UDXJZI2XTYAW7GM5AEZ3CVUTTEELO5ZK X-Mailman-Approved-At: Wed, 14 Oct 2026 17:07:42 +0200 X-Mailman-Version: 3.3.8 Precedence: list List-Id: "For passt users: support, questions and answers" Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Hey all, Just wanted to report what is either a documentation issur, or an issue in `passt` proper. The `man` pages document the following for binding to low numbered (i.e. service ports): or the CAP_NET_BIND_SERVICE Linux capability is granted, see services(5) and capabilities(7). [...] To grant this capability, you can issue, as root: for p in $(which passt passt.avx2); do setcap 'cap_net_bind_service=3D+ep' "${p}" done However, this does not work: # setcap 'cap_net_bind_service=3D+ep' /usr/local/bin/passt # setcap 'cap_net_bind_service=3D+ep' /usr/local/bin/passt.avx2 $ /usr/local/bin/passt -f -t 123 Listen failed for HOST TCP port */123: Permission denied Couldn't listen on requsted ports [1] The reason I'm asking is that `krun` uses `passt` for port forwarding and is having issues with service ports [1]. The current work-around is to set the `net.ipv4.ip_unprivileged_port_start` sysctl to a lower number in the container where `passt` is run, but since `passt` is started already with `CAP_NET_BIND_SERVICE` it would be nice for that to work and not require the `sysctl` work-around. Anyway, curious to know if this is documentation issue or actually something that should be working but isn't (or a local setup issue). Regards, Nick [1]: