Francis Lavoie c8341d5b69 core: Raise CAP_NET_BIND_SERVICE when binding privileged ports (#8102) ...

* core: Raise CAP_NET_BIND_SERVICE when binding privileged ports

When CAP_NET_BIND_SERVICE is in the permitted set but not the effective
set, raise it on a dedicated locked OS thread just for the bind, then
lower it again and let the thread exit.

This allows the binary to be granted the capability with
`setcap cap_net_bind_service=+p` instead of `=+ep`. With the effective
bit set, the kernel refuses to exec the binary at all when the
capability can't be granted (e.g. `docker run --cap-drop ALL`, or an
empty systemd CapabilityBoundingSet), even if no privileged port is
ever bound.

* core: Move bind capability helpers into internal package

2026-10-03 19:10:02 +10:00

..

filesystems

…

metrics

…

testmocks

…

bindcap_linux_test.go

…

bindcap_linux.go

…

bindcap_other.go

…

logbuffer.go

…

logmarshalers.go

…

logs_test.go

…

logs.go

…

ranges.go

…

sockets.go

…