Omarchy: Any User Process Can Escalate to Root • Hacker News Board

Re: Omarchy: Any User Process Can Escalate to Root

#441

Post by mandeepj » Mon, Aug 31, 2026, 1:38 AM UTC

esskay wrote: post #55

thehamkercat wrote: post #24

I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does. (example: NetworkChuck, Primeagen? and a few others) also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it [1] - https://wiki.archlinux.org/title/Archinstall

Add that annoying theo guy to that list. Cant stand these people, they confidently push out videos like they're experts, a week later it turns out whatever they were talking about was total crap and they've already abandoned it - case in point OpenClaw. Look at the mess of videos those named above put out about it, not a single one uses it anymore.

> they confidently push out videos like they're experts, a week later it turns out whatever they were talking about was total crap

100%! When the US attacked Iran, they became experts on wars; when Iran closed the strait, they turned experts on foreign policy, diplomacy, and negotiation; they were doctors during COVID; now they are SME in flooding and disaster control after the Nepal incident.

Re: Omarchy: Any User Process Can Escalate to Root

#442

Post by jasomill » Mon, Aug 31, 2026, 1:38 AM UTC

rick_dalton wrote: post #304

jorvi wrote: post #143

Earlier quoted context omitted.

You do realize you can do the exact same thing on macOS? Just alias sudo to whatever you want. BSD I assume you can do the same with doas. No desktop system is safe from your attack, unless you take specific precautions like chattr on the file or chmodding your home directory, but that can lead to weird breakage.

You basically don’t use sudo on macOS though. Maybe once in a blue moon

You're making a big assumption about how other people use their computers. If you're running mostly desktop applications on Linux, you wouldn't use sudo much either. And if anything, I use sudoish-to-actual-rootlike on Windows more than on Linux, because more things are gated behind elevated privileges (some papered over by default UAC settings, but only when manipulated through built-in GUI tools) and there's nothing as simple as Distrobox and rootless Podman to set up isolated non-root environments.

Re: Omarchy: Any User Process Can Escalate to Root

#443

Post by mandeepj » Mon, Aug 31, 2026, 1:39 AM UTC

kennywinker wrote: post #66

bundie wrote: post #36

Earlier quoted context omitted.

Just use Fedora. It just werks (most times).

I like the very non-windows very non-mac ui of omarchy.

So you need a new theme, and not a new OS :-)

Re: Omarchy: Any User Process Can Escalate to Root

#444

Post by lrvick » Mon, Aug 31, 2026, 1:42 AM UTC

nickjj wrote: post #340

silver_sun wrote: post #184

Earlier quoted context omitted.

But if an attacker can put arbitrary code into your .bashrc, you are already executing arbitrary malicious code.

Yep, but pretty much every single piece of software you've installed on your system can read and write files to your home directory in a silent way without root, and that's where your most important files are on a desktop machine (API tokens, secrets, client projects, etc.). I have my own opinionated Arch / niri set up and there's 1155 packages installed. That's 1155 opportunities for a package to be compromised. Thi…

Arch at least mandates author signed packages which is unfortunately rare these days, but keys do not need to be on smartcards, and code review is not enforced. You compromise the right arch maintainer and you could do some real damage.

Arch is second only to Guix in terms of supply chain security for desktop distributions, but both still have a threat model that cannot tolerate a single laptop compromise.

Stay tuned for stagex for workstations. https://stagex.tools

Re: Omarchy: Any User Process Can Escalate to Root

#445

Post by lrvick » Mon, Aug 31, 2026, 1:56 AM UTC

stickynotememo wrote: post #383

lrvick wrote: post #124

Earlier quoted context omitted.

I challenge anyone to name even one thing that requires sudo on a Linux desktop not better handled with systemd user units, Linux Capabilities, rootless docker, etc.

How would you install packages (or update the kernel)?

For root filesystems I am recently favoring EROFS which is read only, fast, and can run from ram.

On workstations I install almost all software to ~/.local as the home partition is writable. I also put all my systemd user units there, so I can run any binaries I compile as a system service to survive reboots as I like all without root.

The system root partition should contain a kernel, init system, and run any essential shared services unprivileged and fully/mostly stateless. Given that, I like to compile them all into a single UEFI uki image that contains efi shim, kernel, init all in a single binary that lives in the FAT32 UEFI partition.

The only reason to touch it is when you need to update your init system or kernel, which were always going to require a reboot anyway unless you get really creative with kexec. In an ideal situation the uki bundle is so generic that it is built deterministically in multiple locations and signed with a secure boot key. Then you can just straight up allow users to write to the boot partition, knowing any unsigned image that is not newer than the current one will be detected and also not allow access to the encrypted disk. The permission for that one update path can and should be external, and the result of a deterministic build matching a known hash, so you can prove it is not compromised. This could of course be automated by a distro with a UEFI wrapper or coreboot so users with no desire to customize their kernels do not have to think about it.

I am pursuing these ideas in stagex, first for secure enclaves and servers where we need it most, then for desktop. Until then Qubes is the least bad option.

Re: Omarchy: Any User Process Can Escalate to Root

#446

Post by Dylan16807 » Mon, Aug 31, 2026, 2:01 AM UTC

matheusmoreira wrote: post #321

jadar wrote: post #308

Earlier quoted context omitted.

Couldn’t you say that about any Arch spinoff? Seems to be the no true scotsman fallacy.

> Couldn’t you say that about any Arch spinoff? I can, and I do. https://wiki.archlinux.org/title/Arch_Linux#User_centrality > It is targeted at the proficient GNU/Linux user, or anyone with a do-it-yourself attitude who is willing to read the documentation, and solve their own problems.

Assuming you mean "they don't actually want to use Arch" as a criticism (rather than a truism), I think that's fair for a distro described as "Arch linux but configured X way". I don't think it's a good criticism for something like SteamOS which is configurable but is aiming hard for "it just works".

Re: Omarchy: Any User Process Can Escalate to Root

#447

Post by lrvick » Mon, Aug 31, 2026, 2:03 AM UTC

inigyou wrote: post #218

lrvick wrote: post #121

Earlier quoted context omitted.

There is. Simply do not install sudo and do not allow access to root at runtime. I am serious. There is absolutely nothing you cannot run unprivileged these days. Can even run sshd from a systemd user unit in your home folder, and even assign port 22 to it if needed with Linux Capabilities.

How do you update the kernel?

See my reply here: https://news.ycombinator.com/item?id=49504775

Re: Omarchy: Any User Process Can Escalate to Root

#448

Post by lrvick » Mon, Aug 31, 2026, 2:07 AM UTC

declan_roberts wrote: post #345

utopiah wrote: post #256

Earlier quoted context omitted.

Just don't be in the sudo group.

So the solution is to make your computer basically unusable. I guess that's one way to secure things.

On a modern Linux system you do not need sudo to compile software, install it, or even run it as an unprivileged system service in a User Namespace bound to port 22 (if you give your user the correct Linux Capabilities).

The only thing you cannot do as an unprivileged user is update kernels, but that requires a reboot anyway and the risk of letting an unprivileged user do that is mitigated with hardware enforced secure boot.

Most distros are holding onto 90s designs that are very hard to change once established.

Re: Omarchy: Any User Process Can Escalate to Root

#449

Post by mandeepj » Mon, Aug 31, 2026, 2:09 AM UTC

lobofta wrote: post #44

qweqwe14 wrote: post #12

OK... and? This doesn't matter for a desktop, because: 1. Having access to the user's home directory is way more serious than being able to install drivers or whatever 2. There are a million other ways to escalate to root by obtaining the user's password I also don't understand the point of these distros, just install Arch with KDE via archinstall, it literally takes 15 minutes. Why is it that people feel the need to…

Because it looks cool and DHH makes a lot noises that sounds like you should listen to him.

Lol! He's gordon ramsay of tech, who's frequently contradictory himself. On Round 2 with lex, he said something like no one lost recently due to using digital Maps. Well, check this one - https://youtu.be/z5ElIor-oXk?si=XfcS1UtC2OWReVXr

He's bashing and insulting all engineers and then asking for their contributions and complaining that not many people are committing code in open source repos.

Re: Omarchy: Any User Process Can Escalate to Root

#450

Post by sashank_1509 » Mon, Aug 31, 2026, 2:10 AM UTC

Ubuntu is good enough. I never got the point of tiling window managers, because the most important part of daily computing, browsing the web requires you to use the mouse. I’ve tried keyboard only browsers, none of them are as intuitive as just using a mouse and they can’t be, especially considering the prevalence of hyperlinks.

I guess while coding it is nice, but I can switch between the terminal and my editor in a single key in Ubuntu itself so I don’t see the point of this.