What it means
Linux capabilities and controlled privilege delegation split broad superuser power into narrower rights so services and administrators receive only the authority required for a task.
Why it matters
Replacing all-or-nothing root access with smaller privileges reduces the consequences of mistakes, stolen credentials, and vulnerable services.
Practical focus
- Define administrative and service privileges on Linux hosts and the identities, roles, and resources it covers
- Implement capability-aware service design, scoped delegation, and explicit elevation paths through least-privilege, reviewable policy
- Use effective capabilities, privileged commands, and elevation records to confirm that effective access matches intended access
- Plan for a delegated task needing more access or an overbroad grant being abused, including safe recovery and break-glass handling
Common mistakes
- Granting broad access because it is easier to administer
- Changing policy without testing the effective identity context
- Allowing exceptions to persist without an owner or expiration
- Treating a delegated task needing more access or an overbroad grant being abused as a user problem instead of a control failure
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: