It appears to use capabilities: $ ps u 561 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND ntp 561 0.0 0.0 5856 780

It appears to use capabilities: $ ps u 561 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND ntp 561 0.0 0.0 5856 780 ? Ss Jul14 22:37 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 103:107 $ /sbin/getpcaps 561 Capabilities for `561': = cap_net_bind_service,cap_sys_time+ep