How Linux Capabilities and the LSM Framework Work: Fine-Grained Privilege, Hook Points, and Why Root Is No Longer All-or-Nothing
A process that needs to bind a low-numbered TCP port, or to change the system clock, does not need the power to rewrite arbitrary files, kil...