su user_name programstarts some program with other uid;
chroot path programstarts some program with other
( ulimit -v 80000; program)limits program memory...
How to limit program's capabilities(7)?
I only see setcap(8) tool that sets file cabapilities; how to do something like this:
root# start_program_with_capabilities_dropped_except_of CAP_NET_RAW,CAP_NET_ADMIN program
How to start a program with my set of capabilities without using file capabilities?
For example I am root and want to start
- As non-root
- With PR_SET_NO_NEW_PRIVS flag (so all setuid-bit and file capabilities go away)
- With only CAP_NET_RAW active and everything else deniced
pingbeing aware that it is in unprivileged mode (
ping: cannot flood; minimal interval, allowed for user, is 200ms)