Quiz: confinement and audit

One correct answer

A service listens on port 80 and runs as root only for that port. How do you give it the port without leaving root?

• A Change the permissions on /usr/bin to 777.
• B Run it as an ordinary user and grant one capability, CAP_NET_BIND_SERVICE.
• C Move the service to a port above 1024.