Escalating from root to kernel

Posted Jun 1, 2026 9:06 UTC (Mon) by farnz (subscriber, #17727)
In reply to: Escalating from root to kernel by intelfx
Parent article: Policies for merging new filesystems

No - the owner is the legitimate purchaser of the device. Apple reserve, as OS developer, privileges that the device owner is not permitted to have (kernel-level access).

As a result, on an Apple system, there is a reason why a device owner cannot run a process that can get kernel privileges - Apple prohibit you from having kernel privileges on your device that you purchased from them. On Linux, it's more nuanced; the owner of the device is permitted to replace any part of the system, including the kernel, and thus you have to be aware that a subset of root processes are always going to be allowed to elevate themselves to kernel privileges.

In other words, on iOS, it's a bug if you can change the bootloader configuration (at all), or load a kernel module that you wrote (at all). On Linux, it's only a bug in some cases, and in other cases, that's the system as designed.

---

The LWN site is currently under high scraper load, so comment display has been suppressed for anonymous users. If you are a human, you may read the comments by clicking the button below:

Note: you can avoid this step in the future by logging into your LWN account.