WithBindCapability assumed the kernel's privileged port range ends at
1024, but it is set by net.ipv4.ip_unprivileged_port_start, which can
be anywhere from 0 (Docker's default) to 65535. With a value above
1024, a non-root bind to e.g. :1500 failed even though the capability
was permitted.
Now listen is called normally first, and only if it fails with EACCES
on a TCP/UDP port, and CAP_NET_BIND_SERVICE is permitted but not
effective, the capability is raised and the bind retried. This also
skips raising it when the range starts lower than the port.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* core: Raise CAP_NET_BIND_SERVICE when binding privileged ports
When CAP_NET_BIND_SERVICE is in the permitted set but not the effective
set, raise it on a dedicated locked OS thread just for the bind, then
lower it again and let the thread exit.
This allows the binary to be granted the capability with
`setcap cap_net_bind_service=+p` instead of `=+ep`. With the effective
bit set, the kernel refuses to exec the binary at all when the
capability can't be granted (e.g. `docker run --cap-drop ALL`, or an
empty systemd CapabilityBoundingSet), even if no privileged port is
ever bound.
* core: Move bind capability helpers into internal package
