4 ms·

There's also the capabilities framework baked into the Linux kernel which can give more restricted privileges than just using setuid root on everything. http://

There's also the capabilities framework baked into the Linux kernel which can give more restricted privileges than just using setuid root on everything. http://man7.org/linux/man-pages/man7/capabilities.7.html http://man7.org/linux/man-pages/man7/capabilities.7.html

sciurus 10y ago
Capabilities have turned out to have a lot of shortcomings, though. https://lwn.net/Articles/632520/ https://lwn.net/Articles/632520/ Having CAP_SYS_ADMIN is effectively the same as running as root. https://lwn.net/Articles/486306/ https://lwn.net/Articles/486306/