capabilities(7) is pretty useless in practice because most of those capabilities can be escalated into full root access. The man page does a terrible job of exp

capabilities(7) is pretty useless in practice because most of those capabilities can be escalated into full root access. The man page does a terrible job of explaining the security implications. I'm pretty sure he was taking about something completely unrelated to the stuff you're thinking of (capabilities(7), selinux, and apparmor): https://en.m.wikipedia.org/wiki/Capability-based_security https://en.m.wikipedia.org/wiki/Capability-based_security Here's what an implementation of capabilities looks like: https://capnproto.org/rpc.html https://capnproto.org/rpc.html