X-Git-Url: https://git.jtryba.com/browse/friidump.git/blobdiff_plain/de0c1a3eccb6f04bbfd23436b592fe7fc501fcf2..29417fff9ebac65b1cf60ea8951c687696302c55:/docs/BUILDING.md?ds=sidebyside

diff --git a/docs/BUILDING.md b/docs/BUILDING.md
index a9fb65a..ebe7926 100644
--- a/docs/BUILDING.md
+++ b/docs/BUILDING.md
@@ -26,13 +26,28 @@ cmake --build build
 ./build/src/friidump --help
 ```
 
-The standalone repository candidate was tested with GCC 14.2 and CMake. The
-build succeeded. The inherited `libfriidump/rs.c` shift-count warning remains
-open and should be corrected only as a separately reviewed source change.
+The Linux configure step prints an explicit warning: a normal build does not
+install `CAP_SYS_RAWIO`. This is intentional. Build systems must not silently
+invoke `sudo` or elevate their output.
+
+After validating the exact executable, install only the capability required for
+vendor-specific SCSI commands:
+
+```bash
+bash ./validation/friidump-linux-rawio-capability.sh install   ./build/src/friidump
+```
+
+Do not run FriiDump itself with `sudo`. Rebuilding, relinking, copying, or
+replacing the executable clears file capabilities; reapply and verify after
+every build intended for GC/Wii memory-dump or Xbox vendor-unlock hardware use.
+See [`LINUX.md`](LINUX.md) for the complete permission model.
+
+The inherited `libfriidump/rs.c` shift-count warning remains open and should be
+corrected only as a separately reviewed source change.
 
 ## External runtime requirements
 
-Dumping requires operating-system access to the selected optical drive.
-Privileges and device permissions vary by platform. Avoid broadly running
-unrelated tools with elevated privileges; grant only the access required for
-the optical device.
+Dumping requires operating-system access to the selected optical drive. Linux
+vendor-command paths require both device-node access and effective
+`CAP_SYS_RAWIO` on the exact validated executable. Grant only the minimum
+required authority.