(The paragraph that follows is just FYI and optional; if interested in deeper details then take a look, or feel free to skip it.)

Within the Linux kernel, all task (process and thread) metadata is kept within a data structure called the task_struct (also known as the process descriptor). The information on what Linux calls the security context of a task is kept within this task structure, embedded inside another data structure called cred (short for credentials). This structure, cred, contains everything we've discussed: The modern POSIX capabilities bitmasks (or capability sets) as well as the traditional-style process privileges: the RUID, EUID, RGID, EGID (as well as the set[u|g]id and fs[u|g]id bits).

The procfs method we saw earlier actually looks up the credential information from here. Hackers are obviously interested in accessing the cred structure and being able to modify it on the fly: filling it with zeros in the appropriate places gets them root! Does this sound far-fetched? Check out the (Some) Linux Kernel Exploits in the Further reading section on the GitHub repository. Unfortunately, it happens more often than anyone would like.