Let's say I have some java application running on the host and do different things, and now I have built a jar that captures network traffic. While reading What's a least-privilege way to allow node.js to access network adapters on Linux?, it seems to me that the best way to apply the least privilege is to do use setcap:
setcap 'cap_net_raw,cap_net_admin=eip' /usr/local/bin/java
But here is the problem, if I setcap to Java, it then gives all java application to have ability to capture traffic. Is there a better way to do it?