Stop Using setuid for Everything: Practical Linux File Capabilities with getcap, setcap, and systemd

Stop Using setuid for Everything: Practical Linux File Capabilities with getcap, setcap, and systemd A lot of Linux software does not actually need full root power. It needs one specific privilege. Maybe it only needs to bind to port 80. Maybe it needs raw sockets. Maybe it needs one network admin action during startup. Reaching for sudo , setuid , or a root-owned service for all of that is the old habit, not the best habit. Linux capabilities split root's all-or-nothing privilege model into sma