linneman
labs
building
breaking
observing
content
···
verified
home
/ polkit
Polkit
2026.09.02
NetworkManager-l2tp: A Newline to Root
An unprivileged D-Bus call writes a root-parsed VPN config value. One newline, root code execution, confinement escape.
2026.08.12
Confined Root Is Still Root
A compromised root daemon can’t change its own SELinux domain. It doesn’t need to - it recruits something already unconfined.