Cannot Expose Privileged Port

[ShadowM0nkey]

I've seen numerous posts on getting around this issue however my understanding is MacOS (& Windows?) have eliminated privileged ports altogether (https://developer.apple.com/forums/thread/674179) since Mojave.

There's an arguable stance on why privileged ports are an outdated setting to begin with:
https://ar.al/2022/08/30/dear-linux-privileged-ports-must-die/#:~:text=Privileged%20ports%20lead%20to%20dangerous,apparently%20even%20cause%20climate%20change.

So is Podman's check necessary? Especially in the case of MacOS?

[Luap99]

What check are you talking about? Podman doesn't decide which ports are privileged that kernel does.

[ShadowM0nkey]

I'm talking about this error if one tries to expose a port deemed "privileged"...
rootlessport cannot expose privileged port 123, you can add 'net.ipv4.ip_unprivileged_port_start=123' to /etc/sysctl.conf (currently 1024), or choose a larger port number (>= 1024): listen udp 0.0.0.0:123: bind: permission denied

[Luap99]

Yes this is a error thrown within the podman linux VM because you cannot bind < 1024 in linux by default.

But yes I tend to agree that this limit in the VM is a bit pointless and we could configure the sysctl by default. @baude @ashley-cui WDYT?

[rhatdan]

Well if you build a container image with that assumption, and later run it on Linux it would potentially blow up.
A rootless quadlet with 80:80 exposed as a port for example.

[rhatdan]

Yes this is a kernel issue, and a distribution issue. There is a sysctl that can be set to modify the start of the privilege ports, you can set them as low as port 0, I believe to give you the same affect.

[ShadowM0nkey]

Understood and I have done that however isn't the check that podman does irrelevant (at least for MacOS => Mojave) as the OS doesn't have privileged ports anymore?