/usr/bin/setpriv

Usage:
 setpriv [options] <program> [<argument>...]

Run a program with different privilege settings.

Options:
 -d, --dump                  show current state (and do not exec)
 --nnp, --no-new-privs       disallow granting new privileges
 --ambient-caps <caps>       set ambient capabilities
 --inh-caps <caps>           set inheritable capabilities
 --bounding-set <caps>       set capability bounding set
 --ruid <uid|user>           set real uid
 --euid <uid|user>           set effective uid
 --rgid <gid|group>          set real gid
 --egid <gid|group>          set effective gid
 --reuid <uid|user>          set real and effective uid
 --regid <gid|group>         set real and effective gid
 --clear-groups              clear supplementary groups
 --keep-groups               keep supplementary groups
 --init-groups               initialize supplementary groups
 --list-caps                 list all known capabilities
 --groups <group>[,...]      set supplementary group(s) by GID or name
 --securebits <bits>         set securebits
 --pdeathsig keep|clear|<signame>
                             set or clear parent death signal
 --ptracer <pid>|any|none    allow ptracing from the given process
 --selinux-label <label>     set SELinux label
 --apparmor-profile <pr>     set AppArmor profile
 --landlock-access <access>  add Landlock access
 --landlock-rule <rule>      add Landlock rule
 --seccomp-filter <file>     load seccomp filter from file
 --reset-env                 clear all environment and initialize
                               HOME, SHELL, USER, LOGNAME and PATH

 -h, --help                  display this help
 -V, --version               display version

Arguments:
 <access> is a landlock access; syntax is fs[:<right>, ...>]
 <rule> is a landlock rule; syntax is <type>:<right>:<argument>

 available landlock rule types are:
  path-beneath - filesystem based rule; <argument> is a path

 available landlock filesystems rights are:
       execute - execute a file
    write-file - open a file with write access
     read-file - open a file with read access
      read-dir - open a directory or list its content
    remove-dir - remove an empty directory or rename one
   remove-file - unlink (or rename) a file
     make-char - create (or rename or link) a character device
      make-dir - create (or rename) a directory
      make-reg - create (or rename or link) a regular file
     make-sock - create (or rename or link) a UNIX domain socket
     make-fifo - create (or rename or link) a named pipe
    make-block - create (or rename or link) a block device
      make-sym - create (or rename or link) a symbolic link
         refer - link or rename a file from or to a different directory
      truncate - truncate a file with truncate(2)
     ioctl-dev - invoke ioctl(2) on an opened character or block device

This tool can be dangerous.  Read the manpage, and be careful.
For more details see setpriv(1).