Then, you'll need some software for setting capabilities. This is easy with programs like ping , but it may be pretty hard for programs like sendmail . Notice that I'm not trying to give you maximum security possible. I want to give you good security, but compatibility with unix and usability of system are very importantant to me.
Elf capabilities hack From now on, there's support for capabilities in elf executable.
But it has been done. Notice that this system is very nice, but as described has limited use. It only lowers capabilities, and raising capabilities is what causes problems. By setuid0, process gets all capabilities, and elfcap is free to drop that capabilities it does not want. So, along with existing setuid mechanism, this hack can be used to grant subset of capabilities to executables.