Allow to listen on privileged ports when running without root #197

New Issue

saavagebueno · 2025-11-20T04:21:23-05:00

saavagebueno commented

2025-11-20 04:21:23 -05:00

Originally created by @the-maldridge on GitHub (Jun 1, 2022).

Some part of the code base is naively checking the effective UID and is dissallowing bind of system ports when not running as root. This ignores the case where CAP_NET_BIND is available in the current context.

I can't find in a cursory search where the check happens in the code, otherwise I would have sent a patch.

Originally created by @the-maldridge on GitHub (Jun 1, 2022). Some part of the code base is naively checking the effective UID and is dissallowing bind of system ports when not running as root. This ignores the case where CAP_NET_BIND is available in the current context. I can't find in a cursory search where the check happens in the code, otherwise I would have sent a patch.

saavagebueno added the Status: 🗯️ Waiting for feedback Priority: 🚨 Urgent Category: Foolproof settings 👼 labels 2025-11-20 04:21:23 -05:00

saavagebueno closed this issue

2025-11-20 04:21:23 -05:00

saavagebueno commented

2025-11-20 04:21:24 -05:00

@brzd commented on GitHub (Sep 1, 2022):

Is this the reason that I am not able to change webUI port to other than 8000?

@brzd commented on GitHub (Sep 1, 2022): Is this the reason that I am not able to change webUI port to other than 8000?

saavagebueno commented

2025-11-20 04:21:24 -05:00

@qdm12 commented on GitHub (Jun 12, 2023):

@the-maldridge sure but what's your use case really? Why would you want to listen on privileged ports?

@brzd no, you can set the listening port between 1024 and 65535

@qdm12 commented on GitHub (Jun 12, 2023): @the-maldridge sure but what's your use case really? Why would you want to listen on privileged ports? @brzd no, you can set the listening port between 1024 and 65535

saavagebueno commented

2025-11-20 04:21:24 -05:00

@drewstopherlee commented on GitHub (Jun 12, 2023):

Not sure if it's directly related, but I'm running into a similar issue when starting the container since updating to latest:
(EDIT: my bug is only present in the 'latest' image, but when I manually set version 2.5.0, this bug goes away.)

ERROR settings validation: resolver settings: splitting host and port from address: cannot use privileged ports (1 to 1023) when running without root: 53

Due to split DNS, I have to use the RESOLVER_ADDRESS environment variable and it kicks this error every time I restart the container. It's currently running on a Ubuntu Server 22.04 on a Raspberry Pi, so when I try to add user: root to the docker-compose, it fails to deploy.
If this needs to be a separate issue, please let me know and I'll open one.

@drewstopherlee commented on GitHub (Jun 12, 2023): Not sure if it's directly related, but I'm running into a similar issue when starting the container since updating to latest: (EDIT: my bug is only present in the 'latest' image, but when I manually set version 2.5.0, this bug goes away.) ``` ERROR settings validation: resolver settings: splitting host and port from address: cannot use privileged ports (1 to 1023) when running without root: 53 ``` Due to split DNS, I have to use the `RESOLVER_ADDRESS` environment variable and it kicks this error every time I restart the container. It's currently running on a Ubuntu Server 22.04 on a Raspberry Pi, so when I try to add `user: root` to the docker-compose, it fails to deploy. If this needs to be a separate issue, please let me know and I'll open one.

saavagebueno commented

2025-11-20 04:21:25 -05:00

@qdm12 commented on GitHub (Jun 12, 2023):

@drewstopherlee unrelated-ish, but that's a bug that got introduced after v2.5.0 (on the latest image, you can check your logs for the version you're running). I just fixed it in 4922b1db0b since the resolver address should NOT be validated as a listening address anyway.

@qdm12 commented on GitHub (Jun 12, 2023): @drewstopherlee unrelated-ish, but that's a bug that got introduced **after** v2.5.0 (on the latest image, you can check your logs for the version you're running). I just fixed it in 4922b1db0bf21cd9e78eb58a78d2ee6232f0e071 since the resolver address should NOT be validated as a listening address anyway.

saavagebueno commented

2025-11-20 04:21:25 -05:00

@drewstopherlee commented on GitHub (Jun 12, 2023):

@drewstopherlee unrelated-ish, but that's a bug that got introduced after v2.5.0 (on the latest image, you can check your logs for the version you're running).

Yep, I noticed it and edited my comment right before you replied. Thanks so much!

@drewstopherlee commented on GitHub (Jun 12, 2023): > @drewstopherlee unrelated-ish, but that's a bug that got introduced **after** v2.5.0 (on the latest image, you can check your logs for the version you're running). Yep, I noticed it and edited my comment right before you replied. Thanks so much!

saavagebueno commented

2025-11-20 04:21:25 -05:00

@the-maldridge commented on GitHub (Dec 23, 2023):

Been a while since I looked back into this since I worked around the bug via other means, but I'm refactoring some things and ran back into this. At its core that this is a bug due to incorrect assumptions around bind permissions. A service need not be root nor even have any capabilities to bind "privileged" ports, and given that its entirely feasible to adjust the port boundary or remove it entirely, the check is flawed at best.

Since you wanted a use case though I can explain what I'm currently refactoring to, which is that I have containers using a dynamic macvlan architecture for networking where BGP is announcing a service VIP per-host per-container based on wherever the container happens to be at the moment. This is the one container in my entire fleet which does not put a webserver on port 80, and it is the last one I have notes for that I have to access it on a non-standard port. I guess I can kludge around it by running an nginx sidecar and having that map the traffic, but that's pretty clunky.

Edit: For those curious how to adjust the start of privileged ports on your system, the tunable you're looking for is net.ipv4.ip_unprivileged_port_start, which takes a port number inclusive of the lower bound you desire.

@the-maldridge commented on GitHub (Dec 23, 2023): Been a while since I looked back into this since I worked around the bug via other means, but I'm refactoring some things and ran back into this. At its core that this is a bug due to incorrect assumptions around bind permissions. A service need not be root nor even have any capabilities to bind "privileged" ports, and given that its entirely feasible to adjust the port boundary or remove it entirely, the check is flawed at best. Since you wanted a use case though I can explain what I'm currently refactoring to, which is that I have containers using a dynamic macvlan architecture for networking where BGP is announcing a service VIP per-host per-container based on wherever the container happens to be at the moment. This is the one container in my entire fleet which does not put a webserver on port 80, and it is the last one I have notes for that I have to access it on a non-standard port. I guess I can kludge around it by running an nginx sidecar and having that map the traffic, but that's pretty clunky. Edit: For those curious how to adjust the start of privileged ports on your system, the tunable you're looking for is `net.ipv4.ip_unprivileged_port_start`, which takes a port number inclusive of the lower bound you desire.

saavagebueno commented

2025-11-20 04:21:25 -05:00

@qdm12 commented on GitHub (Jan 19, 2024):

This makes sense, thanks for sharing! I'll get to it right now, sorry for the delay.

@qdm12 commented on GitHub (Jan 19, 2024): This makes sense, thanks for sharing! I'll get to it right now, sorry for the delay.

saavagebueno commented

2025-11-20 04:21:25 -05:00

@qdm12 commented on GitHub (Jan 19, 2024):

Hi @the-maldridge c51a41e1a4 has fixes for the settings validation library (juicy details at 75485e040f) such that:

it reads the start of unprivileged ports from /proc/sys/net/ipv4/ip_unprivileged_port_start on Linux platforms
it checks for the running program having effective and permitted net_bind_service capability

Let me know how it goes 😉 !

@qdm12 commented on GitHub (Jan 19, 2024): Hi @the-maldridge c51a41e1a4be9e364ef0f2ab3186fed501e24b2f has fixes for the settings validation library (juicy details at https://github.com/qdm12/gosettings/commit/75485e040faabcbfa542a1381d6074fe99cc0ce4) such that: - it reads the start of unprivileged ports from `/proc/sys/net/ipv4/ip_unprivileged_port_start` on Linux platforms - it checks for the running program having effective and permitted net_bind_service capability Let me know how it goes 😉 !

saavagebueno commented

2025-11-20 04:21:25 -05:00

@xiaoxiyao commented on GitHub (Aug 27, 2024):

ERROR settings validation: server settings: listening address: getting unprivileged port start: opening file: open /proc/sys/net/ipv4/ip_unprivileged_port_start: permission denied

Run in Termux throw this error，any one know about it？

@xiaoxiyao commented on GitHub (Aug 27, 2024): ERROR settings validation: server settings: listening address: getting unprivileged port start: opening file: open /proc/sys/net/ipv4/ip_unprivileged_port_start: permission denied Run in Termux throw this error，any one know about it？

saavagebueno commented

2025-11-20 04:21:25 -05:00

@qdm12 commented on GitHub (Aug 27, 2024):

Interesting; I guess I can change the validation library to just assume it's 1024 if we get a permission denied. Have you tried cat /proc/sys/net/ipv4/ip_unprivileged_port_start on your host?

@qdm12 commented on GitHub (Aug 27, 2024): Interesting; I guess I can change the validation library to just assume it's 1024 if we get a permission denied. Have you tried `cat /proc/sys/net/ipv4/ip_unprivileged_port_start` on your host?

saavagebueno commented

2025-11-20 04:21:26 -05:00

@xiaoxiyao commented on GitHub (Aug 27, 2024):

Have you tried cat /proc/sys/net/ipv4/ip_unprivileged_port_start on your host?

Permission denied too

@xiaoxiyao commented on GitHub (Aug 27, 2024): > Have you tried `cat /proc/sys/net/ipv4/ip_unprivileged_port_start` on your host? Permission denied too

saavagebueno commented

2025-11-20 04:21:26 -05:00

@qdm12 commented on GitHub (Aug 28, 2024):

Even as root, for example using sudo?

@qdm12 commented on GitHub (Aug 28, 2024): Even as root, for example using `sudo`?

saavagebueno commented

2025-11-20 04:21:26 -05:00

@qdm12 commented on GitHub (Aug 28, 2024):

Also what does this command give

ls -l /proc/sys/net/ipv4/ip_unprivileged_port_start

@qdm12 commented on GitHub (Aug 28, 2024): Also what does this command give ``` ls -l /proc/sys/net/ipv4/ip_unprivileged_port_start ```

saavagebueno commented

2025-11-20 04:21:26 -05:00

@xiaoxiyao commented on GitHub (Aug 28, 2024):

I can't use sudo without rooting my phone，and ls also denied

@xiaoxiyao commented on GitHub (Aug 28, 2024): I can't use sudo without rooting my phone，and `ls` also denied

saavagebueno commented

2025-11-20 04:21:26 -05:00

@qdm12 commented on GitHub (Aug 28, 2024):

I can't use sudo without rooting my phone

This makes sense; I've updated the settings library to handle "permission denied" as just assume the start is 1024, can you please confirm it's working:

if you're using a container, just pull the latest image qmcgaw/ddns-updater and restart the container
if you're using the binary program, build the latest program using go build -o ddns-updater github.com/qdm12/ddns-updater/cmd/ddns-updater, and you can cross compile it by prefixing the go build command for example with GOARCH=arm64 or GOARCH=arm GOARM=7 , depending on your phone CPU architecture.

@qdm12 commented on GitHub (Aug 28, 2024): > I can't use sudo without rooting my phone This makes sense; I've updated the settings library to handle "permission denied" as just assume the start is `1024`, can you please confirm it's working: - if you're using a container, just pull the latest image `qmcgaw/ddns-updater` and restart the container - if you're using the binary program, build the latest program using `go build -o ddns-updater github.com/qdm12/ddns-updater/cmd/ddns-updater`, and you can cross compile it by prefixing the `go build` command for example with `GOARCH=arm64 ` or `GOARCH=arm GOARM=7 `, depending on your phone CPU architecture.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/ddns-updater#197