> How do you do that if you're not root? > And if you are building an executable with that capability, how do you enable your Makefile to set it? The goal is

> How do you do that if you're not root? > And if you are building an executable with that capability, how do you enable your Makefile to set it? The goal is to bind without passing through root, not to never have root at all, so you could run the service with it as an ambient capability (supported by e.g. systemd). Or setcap as root after building. > In fact, I might want to allow a user to bind to port 200 only. Program with the capability on its file to check the user, bind the socket, drop the capability, and exec. (I’m sure something existing does that, but I don’t have one to recommend since I’ve never needed it.) But there’s also iptables and friends as alternative solutions to the same problem that still don’t require giving the process root at any point.