How to give an ordinary user privileged access to a particular syscall in FreeBSD?

Question

I want to give an ordinary user the ability to fchown() files arbitrarily (as if they were the superuser) on FreeBSD. Generally speaking, is there a right way to change the privilege-checking of a given syscall?

I investigated Capsicum, but for all the articles on the topic, there is a real lack of practical examples out there.

Answer 1

One solution would be to create your own program that calls fchown(), chown it to root:wheel and set the setuid bit (chmod +s), files run with the setuid bit will be run as the owner the the executable.

Warning You didn't give any specific context, but be aware that allowing a user to run fchown() as root is a foot in the door to gain access to the entire system. For example, one might change the owner of /etc/{passwd,group,shadow}, change the contents, change the owner back, and presto! Instant root.