open https://gitlab.synchro.net/main/sbbs/-/issues/699

I'm going to paste in the text from a message I posted on DoveNet regarding this:

I've been off-and-on fighting with using 'setcap' to allow binding to +
low ports as a non-root user, and today found (I think) what might be +
causing my difficulties. +
+
I've been doing my updates with an automated script, and the setcap o
option on the make line didn't seem to work. So, I was trying to use it o
in the update script as a command (sudo setcap ...<blah>). That didn't o
work either, and I think it's because there are weird/complicated things o
with 'setuid' and 'inherited' permissions type things in a bash script. o
With both of those issues not working, I just manually did the setcap o
command after the build was complete, and that works as expected. o
o
So today I once again used the command on the make line, thus: o
o
cd /sbbs/repo/src/sbbs3; make RELEASE=1 setcap install o
o
That *appears* to work, as the relevant make output is this:
o
Linking gcc.linux.x64.exe.release/umonitor o
make[1]: Leaving directory '/sbbs/repo/src/sbbs3/umonitor' o
sudo `whereis -b setcap | cut -d" " -f2` 'cap_net_bind_service=+ep' o
gcc.linux.x64.exe.release/sbbs o
install gcc.linux.x64.exe.release/* /sbbs/exec +
install gcc.linux.x64.lib.release/* /sbbs/exec +
install */gcc.linux.x64.exe.release/* /sbbs/exec +
+
(side note: it doesn't prompt me for user password because I have my o
user allowed to run all sudo commands without a password). o
o
The problem is that it.... still doesn't work, 'sbbs' fails to bind to a o
low port number. So I started looking closer. In a Linux terminal o
window, my files appear in different colors depending on file o
extensions, when using the 'ls' command. The executable files in o
/sbbs/exec are green, for example. The 'sbbs' executable is green after running the build. If I manually use setcap to give it binding o
capabilities, it now shows as black text on a red background, which I'm o
sure means it is now considered some kind of "special" file. o
However.... the 'sbbs' executable in o
/sbbs/repo/src/sbbs3/gcc.linux.x64.exe.release/ is.... RED, even when o
the 'sbbs' executable in /sbbs/exec is green (not capable). What's o
happening is that the install commands there above that copy the newly o
compiled executables to /sbbs/exec remove the special capabilities. o
o
This problem isn't noticed by those that use 'symlinks' on their make +
line, only when a person uses 'install', because that copies the file +
somewhere else, which apparently breaks the capabilites that it's been +
given.
--- SBBSecho 3.20-Linux
* Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)