Unless you mean something like "capabilities are always inherited, and there is no way to increase them", which would mean that sudo-like scripts are impossible, and you need to start all-new session as root user for admin actions. Good news, it's already possible in linux - just don't install "sudo", and maybe set up SELinux to disallow all escalation. Turns out no one wants to do this though.
there's no god-mode who can do everything. there's no universal kernel level. micro means only minimal things happen in the kernel or at root level, like routing messages.
even windows understood that those times, when they did split Administrator from System. linux followed then with system users for certain services. but capabilities only allow certain calls at certain times. there's no setuid 0, only cap this and cap that for this admin user for a certain time range.
BTW, SElinux is the default on a proper linux like Redhat. I use it daily. I also have to adjust the ssh caps, not just the firewall settings. Everybody wants that, just not the debian nobs.
It doesn't need to be possible.
>change system configurations
You can have an settings app to configure the system.
>then you have Android
Which is much farther ahead than Ubuntu on security. Ubuntu needs to play catch up.
>but then you have certainly not enabled everything a user can do with sudo.
The goal is not to be able to do everything. The average user doesn't need to be able to do anything. Especially with their regular account.
Anybody who finds themselves using sudo is already well off the beaten path, by their own choice. There's nothing wrong with that.
* The user may never perform the action (would require sudo, but the user doesn't have sudo rights)
* The user may sometimes perform the action (i.e. only after authenticating with sudo)
* The user may always perform the action (is always implicitly authenticated)
"Being root" is just another name for the last option.
What fourth alternative do you have in mind?
No, it's not. Take for example ping. If we want users to be able to always be able to use ping does that mean they need to be root? No, it doesn't. A privileged part of the OS can handle doing the raw socket and the unpriviledged user can talk to that part of the OS.
The key point is that some operations that require privileges are okay to expose to a user, but giving the user privileges for everything is dangerous.
