How does passwd temporarily become root? What is the SUID bit actually doing at the kernel level? And why can giving a program one privileged operation expose far more authority than it actually needs? We trace the mechanism, then break it with PwnKit.
What does it actually mean to have privilege on Linux? This first article traces how the kernel checks permissions, why processes carry multiple UIDs, and where the traditional DAC model starts to crack.
