I am developing a daemon started by upstart (Ubuntu 14.04) which needs to run as a non-privileged user (for security), but bind privileged port 443.
I am using
setcap to set the
CAP_NET_BIND_SERVICE capability for the executable (it's not a script). I am setting it in Permitted, Effective, and Inherited sets (
setcap 'cap_net_bind_service+eip' EXEC).
su to the non-privileged user, and run it directly, and it works perfectly. It correctly binds the port, and
/proc/PID/status shows the proper capabilities masks with
0x400 bit set.
But when I start the service via upstart it does not run with the capabilities specified for the binary, and the
bind() fails (EPERM).
/proc/PID/status shows capabilities masks are all 0.