setpriv

Run a program with restricted privileges (caps, uid/gid, no-new-privs).

$ sudo setpriv --reuid=nobody --regid=nogroup --clear-groups -- ./prog
$ sudo setpriv --no-new-privs -- ./prog