main: Enable active capability dropping

1 files changed, 4 insertions, 0 deletions

diff --git a/src/main.c b/src/main.c
index 33bfa0e2..93149bcf 100644
--- a/src/main.c
+++ b/src/main.c
@@ -138,6 +138,10 @@ int main(int argc, char **argv)
 
 #ifdef HAVE_CAPNG
 	/* Drop capabilities */
+	capng_clear(CAPNG_SELECT_BOTH);
+	capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,
+				CAP_NET_BIND_SERVICE, CAP_NET_ADMIN, -1);
+	capng_apply(CAPNG_SELECT_BOTH);
 #endif
 
 	sigemptyset(&mask);