Nagios has a plugin,
check_dhcp, that does exactly what you'd think. It's widely suggested to install it setuid root, because it uses
SO_BINDTODEVICE, which usually only root can do. Of course a similar thing can be accomplished with
sudo as well, but it remains that
check_dhcp would be executing with the whole of root privileges when it doesn't need them.
check_dhcp seems to be rather stupidly written for this usage, and does not make any attempt to drop root privileges after doing what it needs to do. This leads to at least one known security problem, but just generally is bad practice and I'd like to not do it.
So I'm wondering, is there some way I can enable
check_dhcp to do its necessary network interface frobbing, without granting it outright all root privileges? Perhaps something with capabilities, SELinux, AppArmor, or similar? Looking for a Linux solution -- Ubuntu 14.04 in particular.