> They're using the fact that you can become "root" in a new namespace That privilege can actually be taken away. But probably no one will do that unless you a

> They're using the fact that you can become "root" in a new namespace That privilege can actually be taken away. But probably no one will do that unless you are hardening against specific situation. The linux caps has many level of access of a certain cap. For example: is it activated now? can it be activated by me? Will that be inherited by my children process? Can i regain it by su or creating new namespace? If you take away the last one. Then the process and any child process of specific process won't be able to regain the cap ever again. See also: capabilities(7) > Capabilities and execution of programs by root