[lug] iptables redirection

[George Sexton]

Sean Reifschneider wrote:
> On Sun, Jan 07, 2007 at 11:05:37AM -0700, George Sexton wrote:
>   
>> just be pure overhead. It would be simpler and more efficient to just 
>> remove the requirement from the kernel, and run a custom kernel.
>>     
>
> More efficient, probably, but simpler?  As someone who has tracked custom
> kernels with my patches in them, I'm a skeptic.  This always seems to be a
> big can of worms, particularly when the code you are patching changes.
>
>   
Sometimes you get lucky. From net/ipv4/af_inet.c inet_bind()

    err = -EACCES;
    if (snum && snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE))
        goto out;

In general though, I agree. I have a patch for Samba that I use. If you 
specify a force create mode, samba won't let you later change the file 
to read-only. I've got a patch that fixes this. It's a pain to add the 
patch and re-compile it.

If, on the other hand, the choices were this or introducing Apache 
HTTPD/mod_jk, or some similarly bad thing, then it would look pretty good.

> You can probably do it with SELinux.  However, on one box I have running
> it, I'm not getting SELinux alerts about it if I try to bind to <1024 as a
> user.
>   

The jsvc approach seems to be working.

> Sean
>   

-- 
George Sexton
MH Software, Inc.
Voice: +1 303 438 9585
URL:   http://www.mhsoftware.com/