[mjmas]

Why not have your program just listen on port 80 on an address under 127.0.0.0/8?

You will need to run

  sysctl net.ipv4.ip_unprivileged_port_start=80

before you start, but after that you have 2 ** 24 addresses to choose from. And the browser will be happy to treat it as a secure page as well as do proper cookie isolation.

[neilalexander]

The CAP_NET_BIND_SERVICE capability on Linux is far less of a blunt instrument that applies to a single process rather than system-wide.

[c-hendricks]

Is that the only thing governing unprivileged ports, or do programs also implement their own rules?