[koprulusector]

This part is so cool:

>Please note that network namespaces, actually Linux namespaces in general, have no influence on existing file handles. Therefore, if your application possesses a file handle to a socket from another network namespace, it can use it in the new network namespace smoothly.

>This is a useful feature as it allows creating network servers that can serve a listening socket but are disconnected from the outside world. If an attacker manages to overtake the application, they are unable to create a new socket. Here you can find a sample application that outlines the idea.

[LoganDark]

I always find stuff like this cool. Being able to still use the resources you acquired before you dropped privileges. Some related concepts I also love are capabilities and CHERI[0].

[0]: https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/