pub fn drop_privileges(
user: &str,
argv: &[String],
) -> Result<Infallible, String>Expand description
drop-privileges --user USER -- program args... (run as root, once, before the long-lived
node starts). The program runs as USER with: no_new_privs (no su/sudo/setuid escalation), a
capability bounding set of only CAP_SETUID and CAP_SETGID (so it can start sessions as another
user with exec-as, but can never gain CAP_NET_ADMIN, so the tunnel and the kill-switch
installed earlier by net-up stay out of its reach), and those two capabilities as ambient.