I am looking for a software - preferably packaged - which allows me to execute a program with fewer capabilities than a full superuser context would grant. Yes, this is mainly about dropping capabilities.
Capabilities are a way to hand out superuser rights "in slices". And while capsh fits the bill, it does not provide a way to declare a policy similar to what /etc/sudoers
allows.
So: is there a tool which can drop capabilities and is configurable via files?
runuser -l username -c 'command'
sudoers
, no?