gsadmin/ziti
1
0
Fork 0
mirror of https://github.com/openziti/ziti.git synced 2026-10-15 00:22:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

only grant net bind kernel cap if less than 1024

Browse Source
This commit is contained in:
Kenneth Bingham
2024-04-15 16:40:00 -04:00
parent 852d6f41a9
commit a260295b19
3 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/dist-packages/linux/openziti-controller/postinstall.bash
Vendored
+1 -1
View File
@@ -160,7 +160,7 @@ promptCtrlPort() {
sed -Ei "s/^(ZITI_CTRL_ADVERTISED_PORT)=.*/\1=${ZITI_CTRL_ADVERTISED_PORT}/" "${ZITI_CTRL_BOOT_ENV_FILE}"
fi
fi
if [[ "${ZITI_CTRL_ADVERTISED_PORT}" -le 1024 ]]; then
if [[ "${ZITI_CTRL_ADVERTISED_PORT}" -lt 1024 ]]; then
grantNetBindService
fi
}
dist/dist-packages/linux/openziti-router/postinstall.bash
Vendored
+3 -3
View File
@@ -168,9 +168,9 @@ promptRouterMode() {
# grant kernel capability NET_ADMIN if tproxy mode
if [[ "${ZITI_ROUTER_MODE}" == tproxy ]]; then
grantNetAdmin
# also grant NET_BIND_SERVICE if resolver port is default 53 or defined <= 1024
# also grant NET_BIND_SERVICE if resolver port is default 53 or defined < 1024
RESOLVER_PORT="${ZITI_ROUTER_TPROXY_RESOLVER##*:}"
if [[ -z "${RESOLVER_PORT}" || "${RESOLVER_PORT}" -le 1024 ]]; then
if [[ -z "${RESOLVER_PORT}" || "${RESOLVER_PORT}" -lt 1024 ]]; then
grantNetBindService
fi
fi
@@ -209,7 +209,7 @@ promptRouterPort() {
sed -Ei "s/^(ZITI_ROUTER_PORT)=.*/\1=${ZITI_ROUTER_PORT}/" "${ZITI_ROUTER_BOOT_ENV_FILE}"
fi
fi
if [[ "${ZITI_ROUTER_PORT}" -le 1024 ]]; then
if [[ "${ZITI_ROUTER_PORT}" -lt 1024 ]]; then
grantNetBindService
fi
}
dist/docker-images/ziti-router/compose.yml
Vendored
+1 -1
View File
@@ -26,7 +26,7 @@ services:
ZITI_CTRL_ADVERTISED_PORT: ${ZITI_CTRL_ADVERTISED_PORT:-1280} # exposed port of the controller
ZITI_ENROLL_TOKEN: ${ZITI_ENROLL_TOKEN:-} # enrollment token for this router (required)
ZITI_ROUTER_ADVERTISED_ADDRESS: ${ZITI_ROUTER_ADVERTISED_ADDRESS:-ziti-router} # domain name for this router (default: the container ID [hostname -f])
ZITI_ROUTER_PORT: ${ZITI_ROUTER_PORT:-3022} # exposed port for this router
ZITI_ROUTER_PORT: ${ZITI_ROUTER_PORT:-3022} # exposed port for this router
ZITI_ROUTER_MODE: ${ZITI_ROUTER_MODE:-none} # none, host, tproxy, tproxy (default: none, tproxy requires additional config below)
# *** less relevant vars below ***