CAP_NET_ADMIN & nginx

SplitIce

Heyo,

I am stuck trying to get my nginx service which is launched via Systemd to give CAP_NET_ADMIN to its workers (required for IP_TRANSPARENT).

I have tried /etc/security/capability.conf & setcap. Systemd has the permission whitelisted:

CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
CAP_SYS_RESOURCE CAP_SETGID CAP_SETUID
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
CAP_SYS_RESOURCE CAP_SETGID CAP_SETUID

Thoughts? Ideas? Those workers just don't want to play game.

Tamerciaga

What are you trying to accomplish? If this is for traffic shaping check this out:
https://forum.nginx.org/read.php?29,255530

What about SELinux?

SplitIce

Qarizma said: What are you trying to accomplish?

We are needing CAP_NET_ADMIN at the worker (unprivileged user) level to facilitate usage of IP_TRANSPARENT.

Qarizma said: What about SELinux?

We arent using it.

SplitIce

Solvered after much debugging.

In systemd:

SecureBits=keep-caps no-setuid-fixup

Or using a utility:

capsh --keep=1 --secbits=6 -- -c "nginx"

Not the perfect solution, but acceptable for now.