Targeted unprivileged port configuration

Inventors: Yuval Kashtan (Newton, MA); Mario Vazquez Cebrian (Valencia, ES)

Assignee: Red Hat, Inc.

G06F9/545 G06F9/44505 G06F9/4451 G06F21/44

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12675346
App. No.: 18/786,025
Granted: Jul 7, 2026
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Systems and methods for implementing a targeted port allowance for unprivileged processes are presented. The systems and methods determine, from a plurality of ports, a first set of ports from which a process is configured to receive information. The systems and methods configure the first set of ports to be unprivileged, and then configure a second set of the plurality of ports to be privileged. The second set of ports includes each one of the plurality of ports that is absent from the first set of ports. In turn, the systems and methods bind the process to the first set of ports.

Claims (34)

1 . A method comprising:

determining, from a plurality of ports, a first set of ports from which a process is configured to receive information based on an unprivileged port list system control command, wherein the plurality of ports are between 0 and 1023 and the unprivileged port list system control command is included in a configuration file and comprises an unprivileged port list corresponding to the first set of ports from which the process is configured to receive the information;

configuring, by a processing device using a kernel, the first set of ports to be unprivileged and accessible by the process;

configuring a second set of the plurality of ports to be privileged and accessible by the process when the process has a root privilege, wherein the second set of ports comprises each one of the plurality of ports that is absent from the first set of ports; and

binding the process to the first set of ports.

2 . The method of claim 1 , wherein the process is an unprivileged process, and wherein the plurality of ports are between 0 and 65535.

3 . The method of claim 1 , wherein the first set of ports are numbered non-contiguously.

4 . The method of claim 1 , further comprising:

determining, from the plurality of ports, a third set of ports from which a subsequent process is configured to receive subsequent information, wherein the third set of ports comprises one or more different ports from the first set of ports;

configuring the third set of ports to be unprivileged;

configuring a fourth set of the plurality of ports to be privileged, wherein the fourth set of ports comprises each one of the plurality of ports absent from the third set of ports; and

binding the process to the third set of ports.

5 . The method of claim 4 , wherein the kernel executes both the process in a first namespace and the subsequent process in a second namespace.

6 . A system comprising:

a memory; and

a processing device operatively coupled with the memory, the processing device to:

determine, from a plurality of ports, a first set of ports from which a process is configured to receive information based on an unprivileged port list system control command, wherein the plurality of ports are between 0 and 1023 and the unprivileged port list system control command is included in a configuration file and comprises an unprivileged port list corresponding to the first set of ports from which the process is configured to receive the information;

configure, using a kernel, the first set of ports to be unprivileged and accessible by the process;

configure, using the kernel, a second set of the plurality of ports to be privileged and accessible by the process when the process has a root privilege, wherein the second set of ports comprises each one of the plurality of ports that is absent from the first set of ports; and

bind the process to the first set of ports.

7 . The system of claim 6 , wherein the process is an unprivileged process, and wherein the plurality of ports are between 0 and 65535.

8 . The system of claim 6 , wherein the first set of ports are numbered non-contiguously.

9 . The system of claim 6 , wherein the processing device is further to:

determine, from the plurality of ports, a third set of ports from which a subsequent process is configured to receive subsequent information, wherein the third set of ports comprises one or more different ports from the first set of ports;

configure the third set of ports to be unprivileged;

configure a fourth set of the plurality of ports to be privileged, wherein the fourth set of ports comprises each one of the plurality of ports absent from the third set of ports; and

bind the process to the third set of ports, wherein the kernel executes both the process in a first namespace and the subsequent process in a second namespace.

10 . A non-transitory computer readable medium, having instructions stored thereon which, when executed by a processing device, cause the processing device to:

configure, by the processing device, the first set of ports to be unprivileged and accessible by the process;

configure a second set of the plurality of ports to be privileged and accessible by the process when the process has a root privilege, wherein the second set of ports comprises each one of the plurality of ports that is absent from the first set of ports; and

bind the process to the first set of ports.

11 . The non-transitory computer readable medium of claim 10 , wherein the process is an unprivileged process, and wherein the plurality of ports are between 0 and 65535.

12 . The non-transitory computer readable medium of claim 10 , wherein the first set of ports are numbered non-contiguously.