This is a really great paper that described the concept: http://www.citi.umich.edu/u/provos/papers/privsep.pdf http://www.citi.umich.edu/u/provos/papers/privsep

This is a really great paper that described the concept: http://www.citi.umich.edu/u/provos/papers/privsep.pdf http://www.citi.umich.edu/u/provos/papers/privsep.pdf You got the gist of it: you can have a privileged process that can access resources and pass them to an unprivileged process upon request. The unprivileged process runs as nobody and is chroot into an empty directory, so the file descriptors are capabilities. It doesn't really matter if the unprivileged process is a child of the root one, so long as it discards all inherited resources/privileges other than its end of the socket before real work begins. The advantage over merely inheriting resources is that you can grant new resources later on and decide whether to grant them in the stateful manner.