From FreeBSD 9.0 tcpdump is sandboxed with Capsicum. Are there any solutions for sandboxing tcpdump under OpenBSD? Just want to secure a running:
tcpdump -w output.pcap
because it can be only used with root :(
Privilege revocation is similar and involves a program performing any necessary operations with the privileges it starts with then dropping them. Chrooting involves restricting an application to one section of the file system, prohibiting it from accessing areas that contain private or system files. Developers have applied these features to OpenBSD versions of common applications, including tcpdump and the Apache web server.
Long story short, OpenBSD's
tcpdump from the base system is privilege separated already. (And I can't comment on their solution vs. Capsicum.)