sahlberg
commented
1 year ago Libnfs tries to bind the client port to a system port, if possible, exactly for the reason that the default configuration on many servers do not allow incoming connections from a non-system port.
On linux, it just means that as a non-root user you need to set the proper capabilities to allow the binary to bind to system ports:
ROOT vs NON-ROOT
When running as root, libnfs tries to allocate a system port for its connection to the NFS server. When running as non-root it will use a normal ephemeral port. Many NFS servers default to a mode where they do not allow non-system ports from connecting. These servers require you use the "insecure" export option in /etc/exports in order to allow libnfs clients to be able to connect.
On Linux we can get around this restriction by setting the NET_BIND_SERVICE capability for the application binary.
This is set up by running sudo setcap 'cap_net_bind_service=+ep' /path/to/executable This capability allows the binary to use systems ports like this even when not running as root. Thus if you set this capability for your application you no longer need to edit the export on the NFS server to set "insecure".
On Sat, 31 Dec 2022 at 14:05, vitmaubra @.***> wrote:
I've seen people saying that libnfs can't use standard NFS ports under all circumstances because those ports are privileged and only processes ran as root can use privileged ports. As it should be possible to run libnfs as a non-root process sometimes, it must use non-privileged ports when run in this way.
I don't find that argument sound though. The general rule is that only root processes can bind privileged ports. However, as libnfs is a NFS client library, it doesn't bind any port, right? Are there other reasons for libnfs to use non-privileged ports when run a non-root process?
— Reply to this email directly, view it on GitHub https://github.com/sahlberg/libnfs/issues/415, or unsubscribe https://github.com/notifications/unsubscribe-auth/AADY3EHAPR5FN4IW2U7DU2LWP6WKLANCNFSM6AAAAAATNKUAAI . You are receiving this because you are subscribed to this thread.Message ID: @.***>
vitmaubra
I've seen people saying that libnfs can't use standard NFS ports under all circumstances because those ports are privileged and only processes ran as root can use privileged ports. As it should be possible to run libnfs as a non-root process sometimes, it must use non-privileged ports when run in this way.
I don't find that argument sound though. The general rule is that only root processes can bind privileged ports. However, as libnfs is a NFS client library, it doesn't bind any port, right? In other words, as libnfs only make outbound connections, it should be able to use the standard NFS ports without any problems even when run non-root.
Are there other reasons for libnfs to use non-privileged ports when run a non-root process?