Whenever the Windows UAC pop-up shows up to grant a program administrator rights there is just a Yes/No answer.
Is there any way to limit what a program can do when run as administrator. Most programs do not need all priviledges, but just a little bit, that a standard user cannot do.
In Linux there a multiple ways, i can think of right now:
Root capabilities: partition the root priviledge into smaller capabilities
fakeroot: when the program checks for
root but does not really need it
SELinux and similar tools: Everything must be explicitly granted
Another way of asking: Can i limit the amount of damage a program can cause while giving access to administrator rights.
Example: Give a program the right to see one specific programs adress space, but not all of them.