I've been working on a package called lcsync:

  https://issues.guix.gnu.org/55682

But lcsync needs CAP_NET_RAW... Normally, this is accomplished by
running:

  setcap cap_net_raw=eip /path/to/bin/lcsync

You could add lcsync to setuid-programs, but this would be a terrible
idea, as it's a file syncing tool and you would have root access to
writing any file in the filesystem...

Upstream lcsync is considering how to rewrite it to drop privledges so
that it would not be *terrible* to run setuid root, but ... ideally it
could just use setcap to provide the very limited root privledges that
it needs.

It seems like something very similar to setuid-programs could work for
programs that need particular capabilities... e.g. copy a binary from
the store, set the appropriate capabilities with "setcap", add this
special directory to PATH.

But maybe there's a better way to do this already? :)


live well,
  vagrant