Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Omarchy: Any User Process Can Escalate to Root

0xcc.io

Post reply on HN
Print view View original

351–360 of 590 posts

Re: Omarchy: Any User Process Can Escalate to Root

#351

Post by bigyabai »

trentnix wrote: post #190

The Docker configuration issue was reported and changes were made quickly to address it. Sounds like this is a great example of the system working well. Omarchy looks like a simple way for a developer like me to test drive hyprland and write code. It also looks like a great way for my kids to get into computers as there's an agent harness ready to help them manage their machine and use free software, even the stuff t…

It's easy to disable rootful Docker support in an ISO, but much harder to fix the vulnerable installations. That is not the system working as intended.

And sadly, this stuff isn't bewildering at all. We saw it happen with LARBS, we saw it happen with Manjaro, then Archlabs, and now Omarchy too. All of them endangered themselves by shipping dotfiles that none of their users understood, and few of their developers would justify. When Manjaro's repos conflicted with AUR pkgbuilds, thousands of their users didn't understand that Manjaro had a special repo override for system packages that lags 2 weeks behind upstream. Omarchy tempts the same fate by stacking custom packaging channels and pacman scripts on-top of a system that gets advertised as "regular" Arch Linux.

Distro variety is always a good thing, but there has always been different levels of commitment to it. If I was putting together a Linux system for a kid or someone elderly, I'd just give them Fedora/GNOME instead of trying to get them into larping r/unixporn.

Re: Omarchy: Any User Process Can Escalate to Root

#352

Post by drnick1 »

hemlock4593 wrote: post #269
darkwi11ow wrote: post #2

Why not use rootless podman? It is 2026 not 2016, Podman works much better than Docker today.

Rootless docker is also an option. > Podman works much better than Docker today. Nah absolutely not. Especially compose files and networking can be an absolute nightmare with podman.

Compose files work just fine. The gap with Docker has basically closed, and the few things you can't do or that behave differently are precisely the things Docker shouldn't be doing.

Re: Omarchy: Any User Process Can Escalate to Root

#353

Post by bigyabai »

quadrifoliate wrote: post #250
bigyabai wrote: post #67

Earlier quoted context omitted.

> In a different way you can see this in this thread where instead of discussing why Omarchy has the bug There's nothing interesting to discuss. Rootless OCI-compliant containers exist, and Omarchy ignored them. The "convenience" of the solution they chose simultaneously opens an enormous attack surface that the maintainers didn't consider. This is why I don't believe the "give me a macOS distro" people - even Apple…

> There's nothing interesting to discuss. Rootless OCI-compliant containers exist, and Omarchy ignored them. Why Omarchy chose to ignore all the rootless OCI-compliant containers; and also why docker itself isn't rootless yet is a pretty interesting thing to discuss. I'm not aware of the specifics being a Mac user myself, but others in the thread (e.g. here https://news.ycombinator.com/item?id=49500186 ) say that pod…

If you're not going to use rootless containers, then you simply cannot ship the rootful solution as default in a desktop operating system.

There's absolutely meat on the bones regarding root/rootlessness, but that's not the problem at-hand. The problem is shipping vulnerable defaults, and the case is closed.

Re: Omarchy: Any User Process Can Escalate to Root

#354

Post by xyzsparetimexyz »

matheusmoreira wrote: post #294
JeremyNT wrote: post #289

Earlier quoted context omitted.

The whole point of Omarchy is for people who want to use Arch Linux but have it configured the way DHH does. So I think it's a little different. Anybody using an opinionated respin should understand what they're getting.

> people who want to use Arch Linux but have it configured the way DHH does Then they don't actually want to use Arch Linux. The Arch Linux way is to read the excellent wiki documentation, learn about all the choices available, and then make all of those choices so the system is configured the user's way instead of some celebrity's way.

installing arch is enough of a pain that I've been putting off installing it on my desktop for months.

Re: Omarchy: Any User Process Can Escalate to Root

#355

Post by mjmas »

jijijijij wrote: post #332
hogs_get_fat wrote: post #222

Earlier quoted context omitted.

> I always use sudo to manage the few docker containers I need I'm afraid that isn't really any better. If the attacker is in position to exploit membership in the docker group, he already has access to the user's .bashrc. He can simply write a function called sudo that wraps the real command and records your password[1]. Unless the user always invokes sudo with /usr/bin/sudo, docker group membership doesn't really m…

Does 'chattr +i .bashrc' reliably prevent this? Always seemed sensible to me. Then again, there are a few files getting sourced by the shell and I am not sure I could spontaneously name them all.

The attacker could use `chattr -i .bashrc` with the same privileges before editing your bashrc. A better way would probably be to use `sudo chown 0:0 .bashrc`.

Also you will want to do the same to .profile (because of LD_PRELOAD etc). And also do the same to any directories in your $PATH (~/.local/bin etc)

Re: Omarchy: Any User Process Can Escalate to Root

#356

Post by rixed »

mike_hearn wrote: post #33

Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. So this is kind of security theatre. If you run a malicious program it can do stuff like tamper with your PATH or exploit local vulns in apps to get to the point where it can control anything that matters (which root generally doesn't). For instance it can just drop a custom shell into ~/.bin/.hidden-shell an…

The issue is not that Linux lacks a central authority that holds some encryption keys and controls what software you can run. The issue is that you should not run any software from a source that can't be trusted. When we used to run only software from community distros or that we compile ourselves, launching a malicious program was a non issue.

Re: Omarchy: Any User Process Can Escalate to Root

#357

Post by treebeard901 »

troupo wrote: post #277
Aurornis wrote: post #196

Earlier quoted context omitted.

I hope this was an attempt at sarcasm. The Omarchy team immediately fixed this because it was a security oversight, not an intentional opinionated choice.

There was no oversight and no security. It's vibe-coders pushing unvetted shell scripts and dotfiles. They "immediately fixed it" after it blew up on X/Twitter. Just like all the other issues they've had in the past few weeks. And now they formed a "security team" lol.

DHH was on the Lex Fridman podcast talking about this recent release of Omarchy in that most of it is "vibe coded". It is mostly just a bash script to configure Linux, but his approach is interesting.

AI as a core part of the OS that can just change or add anything you want. Linux is great for this because it has access to the source code for everything.

He said he didnt review the code line by line, just looked at the shape of it. Whatever that means.

Re: Omarchy: Any User Process Can Escalate to Root

#358

Post by smohare »

sergiotapia wrote: post #261
concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

On the flipside, once you use an OS that is totally open to agentic stuff, there's no going back really. I can open Pi and ask it to fix some window tiling issue, help me install shortcuts, help me figure out how to install flatpak vs appimage, etc. the list is endless. I cannot see myself going back to a legacy OS unless I'm forced to by my job for compliance reasons.

[dead]

Re: Omarchy: Any User Process Can Escalate to Root

#359

Post by christophilus »

kennywinker wrote: post #66
bundie wrote: post #36

Earlier quoted context omitted.

Just use Fedora. It just werks (most times).

I like the very non-windows very non-mac ui of omarchy.

I run Niri and Dank Material Sell on Fedora. It’s perfect, and better than Omarchy from what I’ve seen. I much prefer scrolling window managers to tilers.

Re: Omarchy: Any User Process Can Escalate to Root

#360

Post by AuthAuth »

matheusmoreira wrote: post #294
JeremyNT wrote: post #289

Earlier quoted context omitted.

The whole point of Omarchy is for people who want to use Arch Linux but have it configured the way DHH does. So I think it's a little different. Anybody using an opinionated respin should understand what they're getting.

> people who want to use Arch Linux but have it configured the way DHH does Then they don't actually want to use Arch Linux. The Arch Linux way is to read the excellent wiki documentation, learn about all the choices available, and then make all of those choices so the system is configured the user's way instead of some celebrity's way.

Thats the old arch way. New arch is archinstall + AI
Post reply on HN