Spender's point is that a capabilities-based approach does not really work for real-world scenarios, and he probably has a point. The setuid thing was more an e

Spender's point is that a capabilities-based approach does not really work for real-world scenarios, and he probably has a point. The setuid thing was more an example as I understood it. While Spender's criticism isn't usually very diplomatic, he's often right. Here's an example, this is QEMU's seccomp whitelist: http://git.qemu.org/?p=qemu.git;a=blob_plain;f=qemu-seccomp.c;hb=HEAD http://git.qemu.org/?p=qemu.git;a=blob_plain;f=qemu-seccomp.... As you can see, it's mostly worthless since QEMU has to do lots of potentially-dangerous operations by design (even reading/writing to raw devices). A proper mandatory access control framework actually restricts which device files it can access, for example - as implemented in the AppArmor/SELinux sVirt drivers. Theo's approach is similarly flawed.