[btilly]

The use of a fd for access to a file is one of the places where Linux follows a capability model. Not coincidentally, this is a part of the Linux API which is has not proven a good target for attacks.