I tried to create my own s6 service for coredns by copy pasting some stuff, but in the log it says it doesn't have enough permissions:
2021-12-02 14:24:28.804505739 Listen: listen tcp :53: bind: permission denied
In systemd it was solved like this:
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
My srv-run file looks like this:
#!/bin/execlineb -P
fdmove -c 2 1
s6-setuidgid coredns exec coredns -conf=/etc/coredns/Corefile
If needed, I can provide more information.
Any other DNS resolver is running in your system? If you use connmand, the DNS cacher is up by default.
I use connman, but I disabled the DNS resolver with OPTS="--nodnsproxy" in /etc/s6/config/connman.conf.
sudo ss -tulpn | grep LISTEN
also didn't show that the port 53 is used.
The log says "permission denied", so I guess it's a permission issue.
I am not using s6, so I can not check it for you. Logically, you could check dnsmasq's service file to see how it manages to run on port 53.
The only difference I'm not sure about is that coredns's sysusers.d file looks like this
u coredns - "CoreDNS is a DNS server that chains plugins "
and that of dnsmasq has a / at the end:
https://gitea.artixlinux.org/packagesD/dnsmasq/src/branch/master/x86_64/extra/dnsmasq-sysusers.conf
But I can't really believe that this would be the reason for the missing permissions.
DNSmasq can do because it starts as root, binds port 53, and then drops root (notice the run (https://gitea.artixlinux.org/artix/s6-services/src/branch/master/dnsmasq/dnsmasq-srv/run) file has dnsmasq -u dnsmasq rather than s6-setuidgid dnsmasq dnsmasq - the user is an option to dnsmasq, not to s6-setuidgid).
On the other hand, your coredns service drops root with s6-setuidgid before even starting coredns itself.
Maybe CoreDNS can do the same thing as dnsmasq but you haven't looked into the right part of the documentation yet.
If it really can't start as root, then change to a normal user on its own, you can:
1. Run sudo setcap cap_net_bind_service+eip /path/to/coredns so it acquires net_bind_service powers. This will make your current script work unchanged.
2. replace s6-setuidgid with setpriv (different syntax, though). My forum post at https://forum.artixlinux.org/index.php/topic,3360.new.html has more details.
Both will give you a similar effect to what you've done on systemd (adding capabilities).
Thanks! This explanation makes a lot of sense. :) I decided to go with the setpriv solution, and it works like a charm.