1. only root can write to /etc/hosts (it's root-owned, 644, with no ACLs) 2. authopen(1) grants privileges for a particular action If gaining a right you did

1. only root can write to /etc/hosts (it's root-owned, 644, with no ACLs) 2. authopen(1) grants privileges for a particular action If gaining a right you did not have before is not privilege escalation, I don't know what "privilege escalation" could possibly mean. So using authopen(1) to write to /etc/hosts qualifies as "escalation to root privileges". The rule states: > 2.27 Apps that request escalation to root privileges [...] will be rejected Therefore the app is non-conformant. Besides, the author is extrapolating intent behind the rule to risks taken by an application takeover: > "As they stated, it does not matter that none of the code I wrote ever runs as root, thereby neutralizing any security risk" An example from the top of my head: adding an entry for say, google.com and MITM'ing stuff.