Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why GNU su does not support the `wheel' group (2002)

ftp.gnu.org

Post reply on HN
Print view View original

11–20 of 150 posts

Re: Why GNU su does not support the `wheel' group (2002)

#11

Post by segfaultbuserr »

dataflow wrote: post #6

I read the page and don't understand what's going on. What is special about the 'wheel' group and what is su even "checking" in the first place? Isn't it just supposed to switch user? And what are the implications of not-checking whatever it was supposed to check? And I also don't get: if someone has the root password, can't they change what groups they're a member of?

> What is special about the 'wheel' group and what is su even "checking" in the first place?

By convention, "wheel" is a special Unix user group that determines who can use "su" and "sudo". Most "su" and "sudo" implementations allow the sysadmin to make their use exclusive to the trusted users inside the "wheel" group. In most systems, it's the default setting of "su", and optional for "sudo" (given as an example in /etc/sudoers).

> if someone has the root password, can't they change what groups they're a member of?

No. If "su" is configured to be "wheel"-exclusive, you can't log in as root even if you have the password, because you cannot use "su" - unless you have direct access to the system console that allows you to type "username: root", which is almost never the case on servers that disable remote root login.

Re: Why GNU su does not support the `wheel' group (2002)

#12

Post by gorjusborg »

bell-cot wrote: post #2

Reaction: Mr. Stallman's idyllic worldview does not seem to admit that someone may actually own the computer system in question, or otherwise have legal rights to set limits on who uses the system, when, and for what purposes. And what was allowed by the social norms of the tiny 1980's *nix computing world, or what you can get away with when you're as famous as Mr. Stallman...those may not translate well to other con…

It does seem a very strange position when today's sensibilities are applied.

I do understand the point of view when I think back. Today, Unix-like systems are everywhere. Learning it and working with it is a given. Back then, having access to a unix system was not a given. It was very expensive for hardware and software. The idea that one would be so close to the system and could be denied enough access by an overzealous BOFH was too much to take.

It just goes to show that circumstances change, and things can get weird if we don't change with it.

Re: Why GNU su does not support the `wheel' group (2002)

#13

Post by [deleted] »

dataflow wrote: post #6

I read the page and don't understand what's going on. What is special about the 'wheel' group and what is su even "checking" in the first place? Isn't it just supposed to switch user? And what are the implications of not-checking whatever it was supposed to check? And I also don't get: if someone has the root password, can't they change what groups they're a member of?

[deleted]

Re: Why GNU su does not support the `wheel' group (2002)

#14

Post by cperciva »

dataflow wrote: post #6

I read the page and don't understand what's going on. What is special about the 'wheel' group and what is su even "checking" in the first place? Isn't it just supposed to switch user? And what are the implications of not-checking whatever it was supposed to check? And I also don't get: if someone has the root password, can't they change what groups they're a member of?

What is special about the 'wheel' group and what is su even "checking" in the first place?

Users who aren't in the wheel group aren't supposed to be able to become root, even if they have the password.

Isn't it just supposed to switch user? And what are the implications of not-checking whatever it was supposed to check?

Someone who steals the root password (say, by looking over the sysadmin's shoulder) would be able to become root.

And I also don't get: if someone has the root password, can't they change what groups they're a member of?

No, because they can't log in as root and (on non-broken systems) can't become root.

Re: Why GNU su does not support the `wheel' group (2002)

#15

Post by aquova »

ye-olde-sysrq wrote: post #8
bell-cot wrote: post #2

Reaction: Mr. Stallman's idyllic worldview does not seem to admit that someone may actually own the computer system in question, or otherwise have legal rights to set limits on who uses the system, when, and for what purposes. And what was allowed by the social norms of the tiny 1980's *nix computing world, or what you can get away with when you're as famous as Mr. Stallman...those may not translate well to other con…

> If you are used to supporting the bosses and sysadmins in whatever they do, you might find this idea strange at first. Should this be that far-fetched though? That employees might not be simple thralls of the capitalist, whose agency extends only as far as his master permits? It reminds me of something I'd read that one of the reasons modern capitalism is so borked is because the founding fathers weren't conceiving…

> It reminds me of something I'd read that one of the reasons modern capitalism is so borked is because the founding fathers weren't conceiving of things like "Amazon" existing, where one entity employs a staggeringly large number of employees. Or that a small number of companies would employ such a large percentage of workers.

I'm not quite sure I buy that argument. They lived in the time of the East India Company, which owned something like 50% of the world's trade at the time and ruled several nations.

Re: Why GNU su does not support the `wheel' group (2002)

#16

Post by jml7c5 »

nine_k wrote: post #3

It shows how old is that, and how things changed. Back in the day, it was about multiple OS users on one big machine, maintained by a university or a corporation. Now I'm the only human user of my several machines. I have more than one interactive user account on some of them. I put these accounts to the wheel group, to avoid ever using a root password. (Void Linux has it pre-configured in /etc/sudoers.)

Yes, Unix was designed to protect users from each other but the modern need is to protect applications/invocations from each other. It is unfortunate that Unix wasn't really designed for the modern use case.

Basically https://xkcd.com/1200/

Re: Why GNU su does not support the `wheel' group (2002)

#17

Post by klodolph »

rvnx wrote: post #9

There are little (to no?) situations where su has a good reason to check wheel. You either have the password, or you don't have it. But not something in-between. Outside of any ideology, in a scenario where you use su to become root, it's a very odd choice to link the wheel group to su; because if you know the password to the "root" user, and you have physical or remote access to the computer, you can likely just log…

You can disable direct root login and force users to login as their own account first. This way, any root login is tracked—you know who logged in as root, because they had to log in as their own account in order to run su.

Re: Why GNU su does not support the `wheel' group (2002)

#18

Post by rvnx »

klodolph wrote: post #17
rvnx wrote: post #9

There are little (to no?) situations where su has a good reason to check wheel. You either have the password, or you don't have it. But not something in-between. Outside of any ideology, in a scenario where you use su to become root, it's a very odd choice to link the wheel group to su; because if you know the password to the "root" user, and you have physical or remote access to the computer, you can likely just log…

You can disable direct root login and force users to login as their own account first. This way, any root login is tracked—you know who logged in as root, because they had to log in as their own account in order to run su.

In such case: sudo su, then.

and let sudo verify that the user belongs to the group of allowed sudoers.

No need for the password to the root account.

Re: Why GNU su does not support the `wheel' group (2002)

#19

Post by bell-cot »

hackan wrote: post #7
bell-cot wrote: post #2

Reaction: Mr. Stallman's idyllic worldview does not seem to admit that someone may actually own the computer system in question, or otherwise have legal rights to set limits on who uses the system, when, and for what purposes. And what was allowed by the social norms of the tiny 1980's *nix computing world, or what you can get away with when you're as famous as Mr. Stallman...those may not translate well to other con…

legal rights? "I'm on the side of the masses, not that of the rulers." He is pretty clear...

Reaction: How does that ideal play out, when a few kiddies start running fork bombs on a *nix system that Mr. Stallman wants to use?

Re: Why GNU su does not support the `wheel' group (2002)

#20

Post by fsflover »

jml7c5 wrote: post #16
nine_k wrote: post #3

It shows how old is that, and how things changed. Back in the day, it was about multiple OS users on one big machine, maintained by a university or a corporation. Now I'm the only human user of my several machines. I have more than one interactive user account on some of them. I put these accounts to the wheel group, to avoid ever using a root password. (Void Linux has it pre-configured in /etc/sudoers.)

Yes, Unix was designed to protect users from each other but the modern need is to protect applications/invocations from each other. It is unfortunate that Unix wasn't really designed for the modern use case. Basically https://xkcd.com/1200/

The solution is to use https://qubes-os.org. My daily driver, can't recommend it enough.
Post reply on HN