Hacker News Reader

This is technically an interesting bug, but the implications are very minor. The only situation where this can be exploited is when you allow a user to execute something as any other users except root. This seems pretty obscure and probably affects only an extremely small number of configurations.

Pretty much all the headlines I saw on this were overstating or stretching the impact.

View on HN

No question about the headlines overstating.

But I don't think this is a rare situation. For example you can allow a bunch of users to restart and change a buildbot infrastructure (which runs as its own user, not root).

But you are giving them access to that specific build user, not "ALL" followed by "!root".

Agreed it is not likely to hit many people in production, but the writeup on the oss-security post, linked to below is a fascinating reminder of deeply buried assumptions buried, that make security hard.

Reply on news.ycombinator.com