Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why GNU su does not support the `wheel' group (2002)

ftp.gnu.org

Post reply on HN
Print view View original

131–140 of 150 posts

Re: Why GNU su does not support the `wheel' group (2002)

#131

Post by skissane »

aragilar wrote: post #129
skissane wrote: post #124

Earlier quoted context omitted.

> The irony behind it is that one could argue that we are using UNIX wrong, because technically each program should run as its own user with its own groups. I think one problem with the UNIX design is that UIDs/GIDs are a flat namespace, and commonly only 32-bits in size (even on 64-bit systems), when what is really needed to meet contemporary requirements is a hierarchy, either with an unlimited number of levels, or…

Have you heard of user namespaces? They would match all your requirements it seems.

I have but I don’t agree that they do.

From what I understand, Linux user namespaces require you to reserve a UID range for each namespace to be mapped to its parent. Since you only have 32-bits to play with, you are forced to map multiple UIDs in the child namespace to the same UID in the parent, while many security decisions are based on the root user namespace UID only. So this is actually a lot more limiting and inflexible than Windows-style variable length UIDs would be.

Re: Why GNU su does not support the `wheel' group (2002)

#132

Post by rvnx »

mcpackieh wrote: post #118
rvnx wrote: post #23

Earlier quoted context omitted.

Some people are so dazzled by singing and dancing skills, that they consider their singer to be a hero and a nice guy. Similarly, Stallman's coding expertise can sometimes overshadow any potential shortcomings in the non-IT subjects.

Personally, I'm dazzled by Stallman's singing and dancing skills. Join us now and share the software, You'lll be free, hackers, you'll be freee Also by his uncanny tendency to be proven correct in matters concerning software freedom. His coding expertise are tertiary at most. Honestly, I never see people praise RMS's coding expertise, where are you even getting that idea from? I don't think you get it why people like…

You just pinpointed the problem.

He is good at one domain, and then by cognitive bias people think he is right on everything.

It’s not true at all, and I think you have to take a bit of distance with glorifying IT personalities.

Like Bill Gates, Elon Musk, Stallman, and many others (especially in the VC world) it’s important to take them with a grain of salt, and not accept them as perfect nice guys because they have money (Musk) or influence (Stallman).

Otherwise they can spread dangerous ideas that normally should 100% be challenged, but that are not, due to blind acceptance.

Re: Why GNU su does not support the `wheel' group (2002)

#133

Post by mcpackieh »

rvnx wrote: post #132
mcpackieh wrote: post #118

Earlier quoted context omitted.

Personally, I'm dazzled by Stallman's singing and dancing skills. Join us now and share the software, You'lll be free, hackers, you'll be freee Also by his uncanny tendency to be proven correct in matters concerning software freedom. His coding expertise are tertiary at most. Honestly, I never see people praise RMS's coding expertise, where are you even getting that idea from? I don't think you get it why people like…

You just pinpointed the problem. He is good at one domain, and then by cognitive bias people think he is right on everything. It’s not true at all, and I think you have to take a bit of distance with glorifying IT personalities. Like Bill Gates, Elon Musk, Stallman, and many others (especially in the VC world) it’s important to take them with a grain of salt, and not accept them as perfect nice guys because they have…

> He is good at one domain, and then by cognitive bias people think he is right on everything.

You really don't get it at all. You're out of touch. People think that Stallman is right about one thing only, software freedom, and think he's out of touch with virtually everything else.

Re: Why GNU su does not support the `wheel' group (2002)

#134

Post by flangola7 »

thayne wrote: post #117
Someone wrote: post #87

Earlier quoted context omitted.

> You might want to allow graphical editor to open any graphical file, regardless of location. More likely, you want to temporarily give them permission to specific files you indicate. A graphical editor doesn’t have reason to read any file that the user didn’t explicitly picked for editing/viewing. That’s how Mac OS works nowadays (possibly except for the ‘temporarily’; I don’t know the details): applications can on…

That limits your application though. It means you have to use the system file picker. For many apps that might be fine. But it means you can't have something like vim or emacs where you open files with a command. Or have an option that does something like open a sibling .h file when you are editing a .c file. Or search up the directory to find the applicable .editorconfig file.

So why does it work for Mac, Android, and iOS?

Re: Why GNU su does not support the `wheel' group (2002)

#135

Post by rcxdude »

flangola7 wrote: post #134
thayne wrote: post #117

Earlier quoted context omitted.

That limits your application though. It means you have to use the system file picker. For many apps that might be fine. But it means you can't have something like vim or emacs where you open files with a command. Or have an option that does something like open a sibling .h file when you are editing a .c file. Or search up the directory to find the applicable .editorconfig file.

So why does it work for Mac, Android, and iOS?

Well, the examples given don't, generally speaking. For stuff like compiling you can do things like have the permission apply to an entire folder, though.

Re: Why GNU su does not support the `wheel' group (2002)

#136

Post by rcxdude »

fiddlerwoaroof wrote: post #92
Someone wrote: post #87

Earlier quoted context omitted.

> You might want to allow graphical editor to open any graphical file, regardless of location. More likely, you want to temporarily give them permission to specific files you indicate. A graphical editor doesn’t have reason to read any file that the user didn’t explicitly picked for editing/viewing. That’s how Mac OS works nowadays (possibly except for the ‘temporarily’; I don’t know the details): applications can on…

You can do this on basically any modern unix by passing file descriptors over a unix socket: the “graphical editor” server would launch as a user that can’t access anything except a socket and then users would open files by pushing an open fd to the editor over its socket.

You can express most of this using the existing capabilities in linux, the issue is that the interfaces you use to do stuff need to change in order to actually make it usable (as opposed to just instantly disabled as soon as it becomes a problem, like apparmor).

Re: Why GNU su does not support the `wheel' group (2002)

#137

Post by Lindby »

cookiengineer wrote: post #21
jml7c5 wrote: post #16

Earlier quoted context omitted.

Yes, Unix was designed to protect users from each other but the modern need is to protect applications/invocations from each other. It is unfortunate that Unix wasn't really designed for the modern use case. Basically https://xkcd.com/1200/

The irony behind it is that one could argue that we are using UNIX wrong, because technically each program should run as its own user with its own groups. Which is what apparmor and firejail/sandboxes kind of want to embrace but in practice people just care too less.

That is what Android does. Each application (by default) gets its own user id.

Re: Why GNU su does not support the `wheel' group (2002)

#138

Post by effie »

fsflover wrote: post #125
effie wrote: post #96

Earlier quoted context omitted.

If you're targeted by state, Qubes on a PC isn't secure enough. It sits at a weird place, where it is stronger than your regular Linux, and showcases interesting ideas, but is quite restrictive in what you can do and doesn't provide any real security guarrantees. It's an open-source small shop project. Xen bugs and kernel bugs are too frequent, big boys know them/buy them/make them/exploit them, surely silently for y…

Snowden is using and recommending Qubes [0]. Only 25% of Xen bugs on average affect Qubes [1] and never lead to escapes. What is restrictive about Qubes? I do everything I need on it. [0] https://twitter.com/Snowden/status/781493632293605376 [1] https://www.qubes-os.org/security/xsa/

Don't do things just because twitter persona says so. Is there an independent security audit of Qubes that checks its factual capabilities in security?

> Never lead to escapes

Escape is the highest form of security failure. I'm talking about data access and exfiltration.

Do you store all your important data on a VM with no internet access? Even Qubes users don't, it's hard to work with. Then it's Firefox/ kernel bug away from being accessed remotely.

XSAs are publicly known vulnerabilities discovered by someone who wanted to make it public and later were published by the Xen developers. There very probably are publicly unknown vulnerabilities, both in HW and Xen, discovered/created by people who want to profit from exploiting them. There are whole teams focused on this kind of work, payed by states and criminal-enablers like NSO.

> What is restrictive about Qubes?

No GPU acceleration for video in a VM, legacy OS on dom0. Xen development in support of modern CPUs has fallen behind, didn't even boot on modern Zen X570 platform last time I tried, dysfunctional nested virtualization, using KVM from Linux does not work, can't run Android Studio with phone emulator.

Re: Why GNU su does not support the `wheel' group (2002)

#139

Post by rvnx »

mcpackieh wrote: post #133
rvnx wrote: post #132

Earlier quoted context omitted.

You just pinpointed the problem. He is good at one domain, and then by cognitive bias people think he is right on everything. It’s not true at all, and I think you have to take a bit of distance with glorifying IT personalities. Like Bill Gates, Elon Musk, Stallman, and many others (especially in the VC world) it’s important to take them with a grain of salt, and not accept them as perfect nice guys because they have…

> He is good at one domain, and then by cognitive bias people think he is right on everything. You really don't get it at all. You're out of touch. People think that Stallman is right about one thing only, software freedom, and think he's out of touch with virtually everything else.

Well we actually somehow agree, but for different reasons.

It's good, for a second I thought you were supporting his views on non-IT topics.

The problem is that the political speeches are part of the person, and the scope way way beyond software.

They are really interleaved with (supposed) IT topics, like if IT was a bait.

Once I went to one of his conference, and I had "learnt" more about "sex" and "facism" than software engineering or freedom.

Re: Why GNU su does not support the `wheel' group (2002)

#140

Post by ciupicri »

Someone wrote: post #87
ilyt wrote: post #79

Earlier quoted context omitted.

Only sounds like "irony" if you don't understand problem. The problem is not isolation or lack of it. The problem is that app require complex set of permissions for both users files and other apps. App might want to send notification to notification daemon. But app should not be able to pretend to be another app, whether by name or icon. And good luck trying to stop malicious app from just making same/similar enough…

> You might want to allow graphical editor to open any graphical file, regardless of location. More likely, you want to temporarily give them permission to specific files you indicate. A graphical editor doesn’t have reason to read any file that the user didn’t explicitly picked for editing/viewing. That’s how Mac OS works nowadays (possibly except for the ‘temporarily’; I don’t know the details): applications can on…

Flatpak [1] offers something similar on Linux:

> The FileChooser portal allows sandboxed applications to ask the user for access to files outside the sandbox. The portal backend will present the user with a file chooser dialog.

> The selected files will be made accessible to the application via the document portal, and the returned URI will point into the document portal fuse filesystem in /run/user/$UID/doc/.

[1]: https://docs.flatpak.org/en/latest/portal-api-reference.html...

Post reply on HN