How to start a program explicitly specifying it's capabilities?

Question

• su user_name program starts some program with other uid;
• chroot path program starts some program with other /;
• ( ulimit -v 80000; program) limits program memory...

How to limit program's capabilities(7)?

I only see setcap(8) tool that sets file cabapilities; how to do something like this:

root# start_program_with_capabilities_dropped_except_of CAP_NET_RAW,CAP_NET_ADMIN program

How to start a program with my set of capabilities without using file capabilities?

For example I am root and want to start ping:

• As non-root
• With PR_SET_NO_NEW_PRIVS flag (so all setuid-bit and file capabilities go away)
• With only CAP_NET_RAW active and everything else deniced
• With ping being aware that it is in unprivileged mode (ping: cannot flood; minimal interval, allowed for user, is 200ms)

Answer 1

The capsh program seems to be designed for it.

Additionally I've implemented this as a mode in my dived program.

I still don't know how to explicitly specify caps in spite of the filesystem capabilities.

Answer 2

System rights and MAC (Mandatory Access Control) sub-layers exist for these purposes. to constrain the capabilities as your link has defined them, use a user account that has exactly the rights you desire. combine with SU and file permissions to ensure that your app runs only for that user.

For MACs, common examples include Selinux (NSA/Redhat) and AppArmor(Novell). They limit the resources that an application can access. remember in linux, everything is a file, so by locking out the needed files, you can constrain an apps capabilities. MAC systems use a white-list to allow apps to access only specified resources, and as such, by default all access is denied. I use an app armor for firefox for instance that restricts it to its app/cache area in my $HOME and stuff like my downloads folder.