[cap-talk] Yikes

[Matt Rice]

Coarse (filesystem mounted read-only vs read-write) permissions
ambient authority
writing to the bios/storage that doesn't appear able to be checkpointed

what could go wrong?

https://github.com/systemd/systemd/issues/2402

all so that an enumerable number of programs that install bootloaders
can write to them...

the 'storage that cannot apparently be checkpointed' aspect, makes
this a particularly dangerous capability even on cap systems which can
grant access to the enumerable programs.
_______________________________________________
cap-talk mailing list
cap-...@mail.eros-os.org
http://www.eros-os.org/mailman/listinfo/cap-talk