Listing 1. Wrapper to Execute a Program with Unprivileged Root

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/prctl.h>
#include <sys/capability.h>

int main(int argc, char * argv[])
{
    int   i, ret;
    char  *cmd;
    char  **argvp;
    cap_t cap = cap_get_proc();
    int   v[CAP_LAST_CAP+1];

    if (!cap)
        return -1;

    for (i=0; i<=CAP_LAST_CAP; i++)
        v[i] = i;

    if (cap_set_flag(cap, CAP_INHERITABLE,
                     CAP_LAST_CAP+1, v, CAP_SET))
        return -1;

    if (cap_set_proc(cap))
        return -1;

    cap_free(cap);

    ret = prctl(PR_SET_SECUREBITS, 0xf);
    if (ret) {
        perror("prctl securebits");
        exit(ret);
    }
    argvp = &argv[1];
    cmd   = argvp[0];
    ret   = execv(cmd, argvp);
    perror("execv");
    return ret;
}

