> If these conditions are met, it is argued, it is safe to allow a process to call chroot(). It is safe only insofar some other software with elevated privileg

> If these conditions are met, it is argued, it is safe to allow a process to call chroot(). It is safe only insofar some other software with elevated privileges whose security model assumes that only root can chroot, not run. This is an issue with security that is had to avoid; some software is written on the assumption that certain things are impossible that may become possible in the future. It is also why most capabilities are in practice useless as a tool of granularity on the average system and that all capabilities can often be constructed from a subset that is often as large as a single one, as so much software was written and designed before such capabilities existed, under the assumption that, if one have one, one have all.