[GH-ISSUE #376] –caps.keep and --user #268

New issue

Closed

opened 2026-05-05 05:28:25 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 05:28:25 -06:00

Owner

Originally created by @netblue30 on GitHub (Mar 22, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/376

From wordpress:

Hi, if I want to run a server using the port 80 and I see that I need CAP_NET_BIND_SERVICE, but I also want to run it under a non-root user, how can I make firejail allow that capability to that program?
For example:

root@srv1#firejail --noprofile --caps.keep=net_bind_service,net_admin --user=webserver — ./myWebServer

I get a socker bind error. Invalid permission. I guess because I am setting the user a webserver firejail running as root is not inheriting its capabilities to the child webserver.

Originally created by @netblue30 on GitHub (Mar 22, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/376 From wordpress: Hi, if I want to run a server using the port 80 and I see that I need CAP_NET_BIND_SERVICE, but I also want to run it under a non-root user, how can I make firejail allow that capability to that program? For example: ``` root@srv1#firejail --noprofile --caps.keep=net_bind_service,net_admin --user=webserver — ./myWebServer ``` I get a socker bind error. Invalid permission. I guess because I am setting the user a webserver firejail running as root is not inheriting its capabilities to the child webserver.

gitea-mirror

2026-05-05 05:28:25 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 05:28:31 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 10, 2016):

I had to drop --user option. It is basically equivalent with a "sudo -u username firejail ..."

@netblue30 commented on GitHub (Jul 10, 2016): I had to drop --user option. It is basically equivalent with a "sudo -u username firejail ..."

gitea-mirror referenced this issue

2026-05-05 10:04:02 -06:00

[PR #268] [MERGED] Fix for systems that don't have CAP_SYSLOG #3580

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#268

No description provided.

Rows
Columns