In order to get around the 'problem' of applications requiring root privileges to run, I'm using:
sudo setcap CAP_NET_ADMIN+ep "$(readlink -f /usr/sbin/app)"
sudo setcap CAP_NET_RAW+ep "$(readlink -f /usr/sbin/app)"
to be able to use the required raw net functionality (In this case so python can use
SOCK_RAW) without having to use sudo. What are the security implications of doing this in a customer facing environment? Could this be abused in an unforeseen way?
This is running on a Ubuntu server.