A city Linux host grants broad capabilities to a Python interpreter used by operators. How should the tester treat this finding class?
Select an answer to reveal the explanation.
Short Explanation
Handing a full-power capability set to Python is like giving a Swiss Army knife that also opens the vault. Scripting languages plus dangerous capabilities often equal a short path to high privilege.
Full Explanation
Linux capabilities assigned to interpreters such as Python can allow actions equivalent to substantial privilege escalation without a traditional setuid binary. Assessors should identify dangerous capability assignments, explain the trust-boundary break, and recommend removing unnecessary capabilities or isolating privileged tasks. Owners need clear remediation: least privilege, dedicated helpers instead of capable interpreters, and monitoring. Avoid delivering a ready-made exploit script in the public finding text.