[MUSIC]
Now, root or administrator privileges usually work a little bit differently,
especially on Linux.
What happens with Linux is the designers of Linux realized early
on that when someone became the administrator, they could do anything.
So they adopted a technique from very high assurance systems in which these rights or
privileges are parceled out separately.
So, for example, if I am root, and
I have the capability to delete files, I can't go and read your files.
I can only delete certain files.
This is called capabilities and
there's a technical definition, which I won't go into.
But basically, capability in this context is something that allows
a process to do an action that it would not normally be allowed to do.
For example, if I want to read a file a certain file,
if I have a capability to read that file, I can do it as myself.
I don't need, say, your ID privileges at all to do it.
So the capabilities, first of all,
provide a very tight restriction on what privilege the user is given.
And secondly,
they allow me to remain with everything else at my usual privilege level.
And Linux FreeBSD and a number of other systems have these capabilities,
and the exact nature of the capabilities differs from system to system.
But, in general, they're for file manipulation, or
inter-process communication, or things like that.
Okay, now how do capabilities work?
Well, there are many different implementations.
For example, with Linux, when a process runs, it has three sets of capabilities,
permitted ones, effective ones, and inheritable ones.
The permitted ones are the set of capabilities it starts up with.
When it spawns a sub-process, some of those capabilities are inheritable.
And those capabilities will be inherited by the sub-process, some of them aren't.
The effective capabilities are the ones that the process is actually using.
So the difference between permitted and effective is permitted means you can do
it, effective means you are doing it, and inheritable means you're passing them on.
FreeBSD is Unix that uses capabilities as well.
By default, those capabilities are turned off, so you have to turn them on yourself.
The administrator has to turn them on.
And they are inherited by the child process.
There is no notion of an inheritable set.
All of the capabilities that the parent has go to the child.
So the bottom line is if your system supports capabilities,
read the manual pages very carefully so you know how they work.