Not an Omarchy user and use podman rather then docker. But is this not a docker issue rather then a Omarchy issue, docker should verify user permissions through the socket, it's quite bad that it does not no?
Omarchy: Any User Process Can Escalate to Root
301–310 of 590 posts
Re: Omarchy: Any User Process Can Escalate to Root
#302And here it begins…
Been using Linux on and off for 30+ years and I’ve always always had second thoughts about using anything outside the main 3-4 distros, and I mean forks, blends etc. let alone vibe coded distros, even *buntu feels like a stretch.
I really like DHH’s enthusiasm and what he’s trying to do but I will never touch that “distro”.
Debian/Devuan, Fedora/RHEL/Alma/Rocky, Arch/Artix, FreeBSD/OpenBS/NetBSD are all anyone will ever need.
You feel more adventurous? NixOS, Gentoo, Slackware, Void.
That’s it. No forks, no blends.
I keep Xebian and LMDE ISOs in my flash drive to show people but I don’t personally use even those.
People jumping all around these new distros that only seem to change a wallpaper without knowing the basics is a bad choice, like the first comment says, isn’t this the reason you wanted to move away from Windows in the first place?
Just take your time and enjoy learning, they are all so simple today compared to decades ago it’s crazy.
Thank you for listening to my TED talk.
Re: Omarchy: Any User Process Can Escalate to Root
#303The scenario of running any agent on the host raw seems far fetched for most users. I think everyone is running these things in at least a container, I know I never trusted running claude code or any agent for that matter, but I might be a little paranoid on that front.
Re: Omarchy: Any User Process Can Escalate to Root
#304Earlier quoted context omitted.
Because it is trivial for unprivileged malware to phish the password and escalate to root. No production system should ever ship with sudo.
You do realize you can do the exact same thing on macOS? Just alias sudo to whatever you want. BSD I assume you can do the same with doas. No desktop system is safe from your attack, unless you take specific precautions like chattr on the file or chmodding your home directory, but that can lead to weird breakage.
You basically don’t use sudo on macOS though. Maybe once in a blue moon
Re: Omarchy: Any User Process Can Escalate to Root
#305A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?
On the flipside, once you use an OS that is totally open to agentic stuff, there's no going back really. I can open Pi and ask it to fix some window tiling issue, help me install shortcuts, help me figure out how to install flatpak vs appimage, etc. the list is endless. I cannot see myself going back to a legacy OS unless I'm forced to by my job for compliance reasons.
> etc. the list is endless.
Why is the list endless? I don’t even remember the last time I check or change any on my mac settings. And my unix things haven’t been touched in months. My debian server is basically frozen at this point.
Re: Omarchy: Any User Process Can Escalate to Root
#306A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?
But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions o…
It depends on what distinction you’re making…
If you are asking concerning security, the answer is that it’s an insecure default that should have protected an unwitting user.
If you are asking concerning consistency with real world situations, then there is no difference and it feels like the fit is over a somewhat controversial figure (DHH) and how he created the distro’s recent release without reading any of the code himself. The counter is that no one installing a distro actually understands how their distro is configured, and trusts someone else’s judgement. Here that judgment was farmed out to AI, and while that is controversial, the uncomfortable truth is that this is how an awful lot of real people are told to configure their Docker installations.
IMO Docker running as a root daemon is a bad idea in the first place and I’d much rather use Podman’s rootless containers.
Re: Omarchy: Any User Process Can Escalate to Root
#307Earlier quoted context omitted.
> Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. As a QubesOS user, I beg to differ. Just because most Linux distros are negligent with sandboxing does not mean all of them are.
Funny because there is a 101 level Qubes RCE on front page right now.
Eh. That happens sometimes, but its design and track record is really good.
Re: Omarchy: Any User Process Can Escalate to Root
#308Earlier quoted context omitted.
The whole point of Omarchy is for people who want to use Arch Linux but have it configured the way DHH does. So I think it's a little different. Anybody using an opinionated respin should understand what they're getting.
> people who want to use Arch Linux but have it configured the way DHH does Then they don't actually want to use Arch Linux. The Arch Linux way is to read the excellent wiki documentation, learn about all the choices available, and then make all of those choices so the system is configured the user's way instead of some celebrity's way.
Couldn’t you say that about any Arch spinoff? Seems to be the no true scotsman fallacy.
Re: Omarchy: Any User Process Can Escalate to Root
#309Earlier quoted context omitted.
But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here? Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions o…
> I always make my user part of the docker group I don't, and I migrated to Podman because Docker is poorly designed and full of footguns. For example, it it will silently overwrite iptables rules and punch holes in your firewall.
This. It’s easy to let happen too. If you’re on a machine that’s not behind NAT then it’s really easy to pwn yourself.
Re: Omarchy: Any User Process Can Escalate to Root
#310Earlier quoted context omitted.
Rootless Podman (and rootless Docker for that matter) is not difficult to set up automatically. There is a little complexity involved, namely in configuring subuid and subgid mappings, but not much. That said, I think Arch Linux itself has a culture that values the wrong kind of simplicity (implementation simplicity) that perversely leads to a failure to adequately grapple with inherent complexity. This leads to brit…
I was not referring to the setup complexity. Setup is performed just once. I was referring to the runtime complexity that comes naturally from having to take into account non-root user permissions and lack thereof. These peculiarities are quite a low bar, but they are still a non-trivial hurdle in the way of devex. I am a fedora/opensuse user and happily use podman with selinux.
IME it's not too bad, but I see what you're saying. I guess we're mostly in agreement.