Administrator/XenOrchestraInstallerUpdater-MIRROR
1
0
Fork 0
mirror of https://github.com/ronivay/XenOrchestraInstallerUpdater.git synced 2026-11-09 17:55:10 -06:00
Code Issues Packages Projects Releases Wiki Activity

Replace manual cap_net_bind_service setting with bounded capability setting the systemd service file

Browse Source
This commit is contained in:
Ben Erickson
2026-08-25 14:12:00 -07:00
parent 3c2a24b50c
commit f82b1d0f69
1 changed files with 2 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
xo-install.sh
View File

@@ -756,21 +756,8 @@ function InstallXO {
runcmd "sed -i \"/SyslogIdentifier=.*/a User=$XOUSER\" $INSTALLDIR/xo-builds/xen-orchestra-$TIME/packages/xo-server/xo-server.service" runcmd "sed -i \"/SyslogIdentifier=.*/a User=$XOUSER\" $INSTALLDIR/xo-builds/xen-orchestra-$TIME/packages/xo-server/xo-server.service"
if [ "$PORT" -le "1024" ]; then if [ "$PORT" -le "1024" ]; then
local NODEBINARY=$(runcmd_stdout "command -v node") printinfo "Adding CapabilityBoundingSet and AmbientCapabilities to systemd config"
if [[ -L "$NODEBINARY" ]]; then runcmd "sed -i \"/SyslogIdentifier=.*/a CapabilityBoundingSet=CAP_NET_BIND_SERVICE\nAmbientCapabilities=CAP_NET_BIND_SERVICE\" $INSTALLDIR/xo-builds/xen-orchestra-$TIME/packages/xo-server/xo-server.service"
local NODEBINARY=$(runcmd_stdout "readlink -e $NODEBINARY")
fi
if [[ -n "$NODEBINARY" ]]; then
printprog "Attempting to set cap_net_bind_service permission for $NODEBINARY"
runcmd "setcap 'cap_net_bind_service=+ep' $NODEBINARY" && printok "Attempting to set cap_net_bind_service permission for $NODEBINARY" ||
{
printfail "Attempting to set cap_net_bind_service permission for $NODEBINARY"
echo " Non-privileged user might not be able to bind to <1024 port. xo-server won't start most likely"
}
else
printfail "Can't find node executable, or it's a symlink to non existing file. Not trying to setcap. xo-server won't start most likely"
fi
fi fi
fi fi