Hello.
I've just found that on all my systems /dev/log has rw-rw-rw- permissions.
Is that Debian default?
If yes, any local user may bloat system logs by writing a simple program
like
#include <syslog.h>
int main()
{
while (1)
syslog(LOG_INFO, "TIME TO KILL /var FILESYSTEM");
}