Re: Filesystem Capabilities in 2.6?

[Alan Cox]

On Sun, 2002-11-03 at 03:35, Linus Torvalds wrote:
> With a simple extended binfmt_misc.c or binfmt_script.c, we could do a
> capability escape (that only removes capabilities, but allows for suid
> shells) fairly easily if people really want it. And it would work on any
> almost-UNIXy filesystem, including NFS etc.
> 
> But I like Al's idea of mount binds even more, although it requires maybe
> a bit more administration.

The two are seperate things IMHO

Namespaces is a way to inherit revocation of rights on a large scale (or
a small one true). #! is a way to handle program specific revocation of
rights which _is_ filesystem persistent.

The former is a database view, the latter is an actual database change