Linux Security Is More Than Root: Syscalls, Capabilities, Namespaces, eBPF and AI-Assisted Privilege Escalation For a long time, Linux security was explained with a simple model: user → process → root That model is still useful. It is also incomplete. A modern Linux application can interact with the kernel through syscalls, operate inside multiple namespaces, hold individual capabilities instead of full root privileges, be restricted by seccomp, pass through LSM controls, inter...