Dnscrypt-proxy: can dnscrypt-proxy drop it's privilege

[publicarray]

In other words how can I bind dnscrypt-proxy to port 53 and not run as root?

[zenofile]

It should work out of the box when using systemd after the dnscrypt-proxy service install.

If you do not want to use the default systemd socket-based activation, or this doesn't work for you for some reason, this can be accomplished by adding the CAP_NET_BIND_SERVICE capability as a drop-in service file or by applying it directly to the binary.

You may want to mask dnscrypt-proxy.socket when doing this:

sudo systemctl mask dnscrypt-proxy.socket
sudo systemctl edit dnscrypt-proxy.service

[Service]
AmbientCapabilities=CAP_NET_BIND_SERVICE

Don't forget to start/enable the service afterwards.

Alternative way see here:

sudo setcap 'cap_net_bind_service=+pe' /usr/bin/dnscrypt-proxy

[publicarray]

Thanks I'm trying to do this on a router and it doesn't have systemd. Thanks I didn't find that in the documentation when I looked earlier. Unfortunately setcap is not available on the device.

[zenofile]

Since kernel 4.11 you can set net.ipv4.ip_unprivileged_port_start=0 for allowing to bind to any port as non-root in that namespace.
So if your kernel is 4.11+ you may want to give that a try.

[publicarray]

Thanks, no luck as it seems:

SynologyRouter> uname -a 
Linux SynologyRouter 3.4.103 #6931 SMP Mon Dec 25 13:25:28 CST 2017 armv7l GNU/Linux synology_ipq806x_rt2600ac

I guess I could attempt to compile the setcap program: git://git.kernel.org/pub/scm/linux/kernel/git/morgan/libcap.git

[zenofile]

setcap sets the capability through extended attributes (xattr(7)) in the security namespace.

So it may be possible to mimic the behaviour of setcap through setfattr if that is available to you (something like setfattr -n security.capability -v 0sAQAAAgAEAAAAAAAAAAAAAAAAAAA= dnscrypt-proxy).

Also make sure that your filesystem supports extended attributes and is mounted with the corresponding flag before going that manual compilation route, otherwise it won't work.

[publicarray]

Thanks for your help,

Unfortunatly setfattr is also missing on the system.

The file system does indeed support extended attributes. I'll just need to remember to mount them with the user_xattr flag. Currently they are mounted using the defaults flag.

[jedisct1]

setfattr may be in the attr package.

[publicarray]

There is no package manager... besides the packages that I compile or the 'official' ones from Synology. There are packages in https://github.com/SynoCommunity/spksrc but must be compiled first and there is a way to install debian-chroot, but I don't want to do that.

[zenofile]

And there is Entware-ng (using opkg as package manager) which has indeed an attr package. But I guess you are looking for something more portable/something you can bundle with the spksrc package, in which case I don't know anything else other than compiling it by yourself and making it a dependency.

[publicarray]

Thanks for your help, Yes Indeed I'm trying to package dnscrypt-proxy to Synology devices. Here is what I have so far: https://github.com/publicarray/spksrc/commits/master + documentation https://github.com/SynoCommunity/spksrc/wiki/DNSCrypt-proxy (work in progress) I'll try to compile it tomorrow 😅

[publicarray]

I've successfully cross compiled setcap but due to the fact it requires editing /etc/fstab and remounting of volumes it is not a viable option for packaging. 😢