CAP_SYS_ADMIN: the new root
Posted Mar 17, 2012 17:55 UTC (Sat) by giraffedata
In reply to: CAP_SYS_ADMIN: the new root
Parent article: CAP_SYS_ADMIN: the new root
Splitting privileges that are each equal to root into their own capability doesn't seem to achieve much, at least from a security point of view.
I agree, but the non-security point of view is also important, which is why I like the present situation.
I use capabilities mainly to prevent a process from accidentally exercising privilege I never meant it to have. For example, it's extremely useful to have a process forbidden to update a file owned by someone else even if the process has the ability to change its UID to the owner's.
to post comments)