Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

src: allow CAP_NET_BIND_SERVICE in SafeGetenv #37727

Closed
wants to merge 2 commits into from
Closed

src: allow CAP_NET_BIND_SERVICE in SafeGetenv #37727

wants to merge 2 commits into from

Commits on Sep 22, 2021

  1. src: allow CAP_NET_BIND_SERVICE in SafeGetenv 

    This commit updates SafeGetenv to check if the current process has the
effective capability cap_net_bind_service set, and if so allows
environment variables to be read.

The motivation for this change is a use-case where Node is run in a
container, and the is a requirement to be able to listen to ports
below 1024. This is done by setting the capability of
cap_net_bind_service. In addition there is a need to set the
environment variable `NODE_EXTRA_CA_CERTS`. But currently this
environment variable will not be read when the capability has been set
on the executable.
    @danbev
    danbev committed Sep 22, 2021
    Configuration menu
    Copy the full SHA
    c48b6e1 View commit details
    Browse the repository at this point in the history

  2. squash! src: allow CAP_NET_BIND_SERVICE in SafeGetenv 

    This commit updates the capabilities check to use the permitted set
instead of the effective. And it also checks the second element of
cap_data which can contain 64 bit capability masks.
    @danbev
    danbev committed Sep 22, 2021
    Configuration menu
    Copy the full SHA
    501026c View commit details
    Browse the repository at this point in the history