A quick summation of key points regarding security as follows:
- Obviously, with all our discussion, as far as is possible, do not use the now-outdated root mode any longer; this includes the (non) usage of setuid-root programs. Rather, you should use capabilities and assign only the required capabilities to the process:
- directly or programmatically via the libcap(3) APIs ("capability-smart" binaries), or
- indirectly via the setcap(8) file capabilities on the binary ("capability-dumb" binaries).
- If the above has been done via the API route, you should consider dropping capabilities immediately once the need for that capability is done (and raising it only as and when required).
- Containers: a "hot" fairly recent technology (essentially, ...
