From a260295b1925d247398ef90c884f4ba625831167 Mon Sep 17 00:00:00 2001
From: Kenneth Bingham <kenneth.bingham@netfoundry.io>
Date: Mon, 15 Apr 2024 16:40:00 -0400
Subject: [PATCH] only grant net bind kernel cap if less than 1024

---
 .../linux/openziti-controller/postinstall.bash              | 2 +-
 dist/dist-packages/linux/openziti-router/postinstall.bash   | 6 +++---
 dist/docker-images/ziti-router/compose.yml                  | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/dist/dist-packages/linux/openziti-controller/postinstall.bash b/dist/dist-packages/linux/openziti-controller/postinstall.bash
index 4d27cde7a..fa2345f62 100755
--- a/dist/dist-packages/linux/openziti-controller/postinstall.bash
+++ b/dist/dist-packages/linux/openziti-controller/postinstall.bash
@@ -160,7 +160,7 @@ promptCtrlPort() {
             sed -Ei "s/^(ZITI_CTRL_ADVERTISED_PORT)=.*/\1=${ZITI_CTRL_ADVERTISED_PORT}/" "${ZITI_CTRL_BOOT_ENV_FILE}"
         fi
     fi
-    if [[ "${ZITI_CTRL_ADVERTISED_PORT}" -le 1024 ]]; then
+    if [[ "${ZITI_CTRL_ADVERTISED_PORT}" -lt 1024 ]]; then
         grantNetBindService
     fi
 }
diff --git a/dist/dist-packages/linux/openziti-router/postinstall.bash b/dist/dist-packages/linux/openziti-router/postinstall.bash
index 4947ef97a..9c0bf9ab1 100755
--- a/dist/dist-packages/linux/openziti-router/postinstall.bash
+++ b/dist/dist-packages/linux/openziti-router/postinstall.bash
@@ -168,9 +168,9 @@ promptRouterMode() {
     # grant kernel capability NET_ADMIN if tproxy mode
     if [[ "${ZITI_ROUTER_MODE}" == tproxy ]]; then
         grantNetAdmin
-        # also grant NET_BIND_SERVICE if resolver port is default 53 or defined <= 1024
+        # also grant NET_BIND_SERVICE if resolver port is default 53 or defined < 1024
         RESOLVER_PORT="${ZITI_ROUTER_TPROXY_RESOLVER##*:}"
-        if [[ -z "${RESOLVER_PORT}" || "${RESOLVER_PORT}" -le 1024 ]]; then
+        if [[ -z "${RESOLVER_PORT}" || "${RESOLVER_PORT}" -lt 1024 ]]; then
             grantNetBindService
         fi
     fi
@@ -209,7 +209,7 @@ promptRouterPort() {
             sed -Ei "s/^(ZITI_ROUTER_PORT)=.*/\1=${ZITI_ROUTER_PORT}/" "${ZITI_ROUTER_BOOT_ENV_FILE}"
         fi
     fi
-    if [[ "${ZITI_ROUTER_PORT}" -le 1024 ]]; then
+    if [[ "${ZITI_ROUTER_PORT}" -lt 1024 ]]; then
         grantNetBindService
     fi
 }
diff --git a/dist/docker-images/ziti-router/compose.yml b/dist/docker-images/ziti-router/compose.yml
index 37adafab5..be9cb2c6e 100644
--- a/dist/docker-images/ziti-router/compose.yml
+++ b/dist/docker-images/ziti-router/compose.yml
@@ -26,7 +26,7 @@ services:
       ZITI_CTRL_ADVERTISED_PORT: ${ZITI_CTRL_ADVERTISED_PORT:-1280}                   # exposed port of the controller
       ZITI_ENROLL_TOKEN: ${ZITI_ENROLL_TOKEN:-}                                       # enrollment token for this router (required)
       ZITI_ROUTER_ADVERTISED_ADDRESS: ${ZITI_ROUTER_ADVERTISED_ADDRESS:-ziti-router}  # domain name for this router (default: the container ID [hostname -f])
-      ZITI_ROUTER_PORT: ${ZITI_ROUTER_PORT:-3022}                                      # exposed port for this router
+      ZITI_ROUTER_PORT: ${ZITI_ROUTER_PORT:-3022}                                     # exposed port for this router
       ZITI_ROUTER_MODE: ${ZITI_ROUTER_MODE:-none}                                     # none, host, tproxy, tproxy (default: none, tproxy requires additional config below)
 
       # *** less relevant vars below ***