Unverified50% confidenceConceptExact time
The nftables nft rule draws the enforcement boundary by uid only, and docker group membership is equivalent to root in most Linux configurations, so the nft rule is defense in depth, not enforcement.
1
Sources
50%
Confidence
Long-term
Relevance
10/12/2026
First Seen
Sources
Related Entities
Related Claims
Unverified在 Linux 系统中 root（UID 0）能绕过几乎所有访问控制，包括读写任意文件、加载内核模块60% similarUnverifiedThe audit found that the enforcement boundary was not where the author claimed: the nft rule blocked only one uid, while the channel that spawns the worker processes runs under another uid that has passwordless sudo and docker group membership, and can directly reach the provider hosts and read the real key.59% similarUnverified基于训练的防御（如RLHF对齐、指令微调）属于软约束，无法提供密码学意义上的安全保证56% similarUnverifiedKernel-level anti-cheat programs run at the lowest layer of the operating system with the highest privileges, conflicting with Linux's security model, and Wine and Proton cannot provide the privileged access they require.56% similarUnverifiedThe vulnerability can allow a restricted user to escalate privileges and gain root superuser access (vertical privilege escalation to UID 0) on the target host.56% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1012578API
curl https://kongchang.com/api/v1/knowledge/claims/1012578MCP
get_claim(id=1012578)