3 ms·
No. `root` should always have _full_ capabilities. Capabilities are there to allow non-root users access to some root systems
by inetknght 6y ago
No. `root` should always have _full_ capabilities. Capabilities are there to allow non-root users access to some root systems
- great22221 6y agoYou are right I think. No idea why you're getting downvoted.
- spijdar 6y agoYou own the hardware, which means you have the ability to boot the system into diagnostic or repair modes for extended privileges. This doesn't mean that during normal operation there should be a superuser account with 100% access. Plan9 from Bell Labs pioneered (edit: they probably weren't the first, but it's the first OS I can think of that does this pervasively -- I bet mainframe systems are similar but that ain't my cup of tea) the idea back in the 90s, where certain processes (like the credential store factotum) were sealed off even from the root equivalent. If you had physical access, you could add a flag at boot to enable access to these services, but this was not enabled by default, which is good.
- pjmlp 6y agoVMS is one example, not only mainframes. Which is why NT was designed from the ground up with capabilities.
- megous 6y agoHad you actually read the manpage you'd realize that "root" has full capabilities, except where you configure it not to for specific processes or under specific conditions that are under your control, which is mostly for situations around setuid-0 marked binaries.