I've been working on a package called lcsync: https://issues.guix.gnu.org/55682
But lcsync needs CAP_NET_RAW... Normally, this is accomplished by running: setcap cap_net_raw=eip /path/to/bin/lcsync You could add lcsync to setuid-programs, but this would be a terrible idea, as it's a file syncing tool and you would have root access to writing any file in the filesystem... Upstream lcsync is considering how to rewrite it to drop privledges so that it would not be *terrible* to run setuid root, but ... ideally it could just use setcap to provide the very limited root privledges that it needs. It seems like something very similar to setuid-programs could work for programs that need particular capabilities... e.g. copy a binary from the store, set the appropriate capabilities with "setcap", add this special directory to PATH. But maybe there's a better way to do this already? :) live well, vagrant
signature.asc
Description: PGP signature
