Compare commits
1 Commits
5df308d140
...
full-text-
Author | SHA1 | Date | |
---|---|---|---|
2422df5db7
|
24
.drone.yml
24
.drone.yml
@ -1,24 +0,0 @@
|
|||||||
---
|
|
||||||
kind: pipeline
|
|
||||||
type: docker
|
|
||||||
name: Deploy to bbaovanc.com
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Build site
|
|
||||||
image: mapitman/docker-hugo
|
|
||||||
commands:
|
|
||||||
- hugo version
|
|
||||||
- hugo --minify
|
|
||||||
|
|
||||||
- name: Upload files
|
|
||||||
image: appleboy/drone-scp
|
|
||||||
aettings:
|
|
||||||
host: bbaovanc.com
|
|
||||||
port: 2222
|
|
||||||
username: droneci
|
|
||||||
key:
|
|
||||||
from_secret: SSH_KEY
|
|
||||||
target: /var/www/bbaovanc/blog
|
|
||||||
rm: true
|
|
||||||
source:
|
|
||||||
- public/*
|
|
11
config.toml
11
config.toml
@ -4,6 +4,17 @@ theme = "terminal"
|
|||||||
paginate = 5
|
paginate = 5
|
||||||
enableGitInfo = true
|
enableGitInfo = true
|
||||||
|
|
||||||
|
[mediaTypes]
|
||||||
|
[mediaTypes."text/sql"]
|
||||||
|
suffixes = ["sql"]
|
||||||
|
|
||||||
|
[outputFormats]
|
||||||
|
[outputFormats.SQL]
|
||||||
|
mediaType = "text/sql"
|
||||||
|
|
||||||
|
[outputs]
|
||||||
|
home = ["sql", "html"]
|
||||||
|
|
||||||
# [permalinks]
|
# [permalinks]
|
||||||
# posts = "/:year/:month/:title/"
|
# posts = "/:year/:month/:title/"
|
||||||
|
|
||||||
|
@ -1,68 +0,0 @@
|
|||||||
+++
|
|
||||||
title = "Allow Non Root Processes to Bind to Privileged Ports"
|
|
||||||
date = "2021-03-28T20:03:16-05:00"
|
|
||||||
author = "bbaovanc"
|
|
||||||
tags = ["guide", "linux", "systemd"]
|
|
||||||
keywords = ["linux", "privileged", "ports", "tutorial", "guide", "gitea",
|
|
||||||
"systemd"]
|
|
||||||
|
|
||||||
description = """
|
|
||||||
In Linux, processes cannot bind to privileged ports (<=1024) unless they are
|
|
||||||
running as root. Here's how to allow any process to bind to privileged ports.
|
|
||||||
"""
|
|
||||||
|
|
||||||
showFullContent = false
|
|
||||||
toc = true
|
|
||||||
+++
|
|
||||||
|
|
||||||
## Introduction
|
|
||||||
|
|
||||||
In Linux, processes cannot bind to privileged ports (<=1024) unless they are
|
|
||||||
running as root. I learned about this when I was trying to add SSH cloning to my
|
|
||||||
[Gitea](https://gitea.io) instance. This can be bypassed by giving
|
|
||||||
`CAP_NET_BIND_SERVICE` capabilities to either the systemd service, or the
|
|
||||||
executable itself.
|
|
||||||
|
|
||||||
## Giving `CAP_NET_BIND_SERVICE` capabilities
|
|
||||||
|
|
||||||
### Using systemd (preferred)
|
|
||||||
|
|
||||||
The best way is to tell systemd to give `CAP_NET_BIND_SERVICE`
|
|
||||||
capabilities to the service. In fact, the Gitea systemd service has two
|
|
||||||
lines[^1] that are commented out:
|
|
||||||
|
|
||||||
```systemd
|
|
||||||
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
|
||||||
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
||||||
```
|
|
||||||
|
|
||||||
Uncommenting these two lines was all I had to do for Gitea.
|
|
||||||
|
|
||||||
### Using `setcap`
|
|
||||||
|
|
||||||
You can add `CAP_NET_BIND_SERVICE` to the executable directly using `setcap`,
|
|
||||||
allowing it to bind to any port. Run the following command[^2]:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
setcap 'cap_net_bind_service=+ep' /path/to/program
|
|
||||||
```
|
|
||||||
|
|
||||||
Note that this means that anyone with permission to run this program will be
|
|
||||||
able to run it and bind to any privileged ports.
|
|
||||||
|
|
||||||
Other caveats[^2]:
|
|
||||||
|
|
||||||
> 1. You will need at least a 2.6.24 kernel
|
|
||||||
> 2. This won't work if your file is a script. (ie, uses a #! line to launch an
|
|
||||||
> interpreter). In this case, as far I as understand, you'd have to apply the
|
|
||||||
> capability to the interpreter executable itself, which of course is a
|
|
||||||
> security nightmare, since any program using that interpreter will have the
|
|
||||||
> capability. I wasn't able to find any clean, easy way to work around this
|
|
||||||
> problem.
|
|
||||||
> 3. Linux will disable LD\_LIBRARY\_PATH on any program that has elevated
|
|
||||||
> privileges like setcap or suid. So if your program uses its own .../lib/,
|
|
||||||
> you might have to look into another option like port forwarding.
|
|
||||||
|
|
||||||
[^1]: https://github.com/go-gitea/gitea/blob/3416e2a82586fca4cd452b93237b979300f55d62/contrib/systemd/gitea.service#L69
|
|
||||||
and https://stackoverflow.com/a/47065825
|
|
||||||
[^2]: https://stackoverflow.com/a/414258
|
|
@ -3,7 +3,7 @@ title = "Checkra1n GUI on Other Distros"
|
|||||||
date = "2021-03-25T21:19:51-05:00"
|
date = "2021-03-25T21:19:51-05:00"
|
||||||
author = "bbaovanc"
|
author = "bbaovanc"
|
||||||
cover = "/blog/media/checkra1n-gui-on-arch-linux.png"
|
cover = "/blog/media/checkra1n-gui-on-arch-linux.png"
|
||||||
tags = ["guide", "linux", "archlinux", "jailbreak", "checkra1n"]
|
tags = ["linux", "archlinux", "jailbreak", "checkra1n"]
|
||||||
keywords = ["checkra1n", "gui", "linux", "arch linux"]
|
keywords = ["checkra1n", "gui", "linux", "arch linux"]
|
||||||
|
|
||||||
description = """
|
description = """
|
||||||
|
@ -3,7 +3,7 @@ title = "Put (edited) in the middle of a message in Discord"
|
|||||||
date = "2021-03-25T18:48:34-05:00"
|
date = "2021-03-25T18:48:34-05:00"
|
||||||
author = "bbaovanc"
|
author = "bbaovanc"
|
||||||
cover = "media/discord-tricks/edited-in-middle-of-message.png"
|
cover = "media/discord-tricks/edited-in-middle-of-message.png"
|
||||||
tags = ["tutorial", "discord", "discord-tricks"]
|
tags = ["discord", "discord-tricks"]
|
||||||
keywords = ["discord", "edited"]
|
keywords = ["discord", "edited"]
|
||||||
|
|
||||||
description = """
|
description = """
|
||||||
|
@ -2,7 +2,7 @@
|
|||||||
title = "Text Substitution in Discord using `sed`"
|
title = "Text Substitution in Discord using `sed`"
|
||||||
date = "2021-03-25T18:48:15-05:00"
|
date = "2021-03-25T18:48:15-05:00"
|
||||||
author = "bbaovanc"
|
author = "bbaovanc"
|
||||||
tags = ["tutorial", "discord", "discord-tricks"]
|
tags = ["discord", "discord-tricks"]
|
||||||
keywords = ["discord", "sed", "text", "replacement"]
|
keywords = ["discord", "sed", "text", "replacement"]
|
||||||
|
|
||||||
description = """
|
description = """
|
||||||
@ -12,7 +12,7 @@ Discord has (very primitive) support for text replacement using `sed` syntax.
|
|||||||
showFullContent = false
|
showFullContent = false
|
||||||
+++
|
+++
|
||||||
|
|
||||||
## Tutorial
|
## How-to
|
||||||
|
|
||||||
[Example Video](/blog/media/discord-tricks/sed-text-replacement.mov)
|
[Example Video](/blog/media/discord-tricks/sed-text-replacement.mov)
|
||||||
|
|
||||||
|
17
layouts/_default/baseof.sql.sql
Normal file
17
layouts/_default/baseof.sql.sql
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
DROP TABLE IF EXISTS db.blog;
|
||||||
|
|
||||||
|
CREATE TABLE db.blog (
|
||||||
|
id INT NOT NULL AUTO_INCREMENT,
|
||||||
|
published DATE NOT NULL,
|
||||||
|
title TEXT NOT NULL,
|
||||||
|
body TEXT NOT NULL,
|
||||||
|
url varchar(2048) NOT NULL,
|
||||||
|
CONSTRAINT id_PK PRIMARY KEY (id)
|
||||||
|
)
|
||||||
|
ENGINE=InnoDB
|
||||||
|
DEFAULT CHARSET=utf8mb4
|
||||||
|
COLLATE=utf8mb4_general_ci;
|
||||||
|
CREATE FULLTEXT INDEX blog_body_IDX ON db.blog (body);
|
||||||
|
|
||||||
|
{{ block "main" .}}
|
||||||
|
{{ end }}
|
13
layouts/_default/home.sql.sql
Normal file
13
layouts/_default/home.sql.sql
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
{{ define "main" }}
|
||||||
|
{{ range (where .Pages "Section" "ne" "gist") }}
|
||||||
|
{{ range .Pages }}
|
||||||
|
INSERT INTO db.blog (published, title, body, url)
|
||||||
|
VALUES(
|
||||||
|
'{{ .Date.Format "2006-01-02" }}',
|
||||||
|
'{{ plainify .Title }}',
|
||||||
|
'{{ (plainify .Content) }}',
|
||||||
|
'{{ .Permalink }}'
|
||||||
|
);
|
||||||
|
{{ end }}
|
||||||
|
{{ end }}
|
||||||
|
{{ end }}
|
Reference in New Issue
Block a user