From cinder/os-brick perspective, I discussed this with the core-sec team and we think the user from which we performed method#2 already had sudo priviledges and a normal user can't perform it.
Given the language of the issue, it doesn't look good to make it public since it doesn't convey the right information and might scare someone if they don't have proper context.
Though I agree on the hardening part that we should work on the privsep migration in os-brick.
From cinder/os-brick perspective, I discussed this with the core-sec team and we think the user from which we performed method#2 already had sudo priviledges and a normal user can't perform it.
Given the language of the issue, it doesn't look good to make it public since it doesn't convey the right information and might scare someone if they don't have proper context.
Though I agree on the hardening part that we should work on the privsep migration in os-brick.