Bind and drop privileges

[hashicorp]

Bind and drop privileges

[armon]

@mitchellh This is special. Apparently linux only applies setuid to the current thread... https://groups.google.com/forum/?fromgroups=#!topic/golang-nuts/BZWXqv3YSg4

Not sure of a sane way to do this, since the runtime has at least like 9 threads...

[andrewwatson]

Maybe it's best to just run bind on 53 and have it forward *.consul to consul instead. It would simplify things a bit and also provides a little insulation / scalability.

[armon]

@andrewwatson Great point. bind can also be used as a recursor instead of consul

[mitchellh]

Agreed that that is the best course of action. CLOSING!

[shibumi]

I strongly advise not to use setuid for this. It will give the process too much permissions. You should stick to a saner solution like giving the process the kernel capability CAP_NET_BIND_SERVICE. This will only allow binding on port 1023, nothing else. You can easily set this capability via systemd service files.