Linux功能是否适用于binfmt_misc？

Question

I'm potentially interested in using Linux capabilities for a program (specifically, cap_net_bind_service to allow a program to bind to a TCP port less than 1024).

However, I'd like to do it for a program that is C# running under Mono. Normally, I think that would mean the Mono interpreter itself would need to have the capabilities set on it, rather than the whatever.exe program that it runs.

However, Linux also can have Mono binary kernel support , via the kernel binfmt_misc mechanism.

So, does the kernel binfmt_misc mechanism work with capabilities? That is, so that a particular binfmt_misc-enabled executable file can run with particular capabilities set.

Answer 1

Normally, I think that would mean the Mono interpreter itself would need to have the capabilities set on it[...]

It would take binfmt_misc out of the question if you set capabilities on the process tree in question, rather than on the files.

See cap_set_proc() , and tooling for manipulating it. For instance, if you were using systemd:

[Service]
ExecStart=/usr/bin/mono /path/to/your/executable.exe
User=your_service_account
Capabilities=CAP_NET_BIND_SERVICE