Live data from Hacker News

New Linux udisks flaw lets attackers get root on major Linux distros

bleepingcomputer.com

41–50 of 287 posts

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#41

Earlier quoted context omitted.

I'm pretty sure, that the BSD family is pretty mature and secure. Linux is just good enough for most people.

>is pretty mature and secure They are still missing something like capability based security like iOS and Android have where apps have to be granted access to use things like files or the camera. It may have been considered secure a couple decades ago, but they have fallen behind the competiton.

FreeBSD literally has Capsicum: https://en.wikipedia.org/wiki/Capsicum_(Unix) That might be the most pure capability system out of all of them, though it's not something that works without application modification (yet). Android and iOS applications can automatically work with the native capability framework because they rely on higher-level SDK APIs. But AFAIU those capability systems are very coarse-grained, in the sense that it's difficult leverage the capability system internally within a single application. And keeping lower-level APIs (e.g. for C and POSIX filesystem I/O) nominally working (if at all) requires some impure hacks. All of which makes them very similar to FreeBSD Jails or Linux containers in that respect.

I wouldn't consider any of these systems "secure", though, as a practical matter. In terms of preventing a breakout, I'd trust an application on OpenBSD with strict pledge and unveil limits, or a Linux process in a classic seccomp sandbox (i.e. only read, write, and exit syscalls), more than any of those other systems. Maybe Capsicum, too, but I'm not familiar enough with the implementation to know how well it limits kernel code surface area. But any application that can poke at (directly or indirectly) complicated hardware, like the GPU, is highly problematic unless there are proofs of correctness for any series of inputs that can be sent by the process (which I don't think is the case).

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#42

Earlier quoted context omitted.

I'm pretty sure, that the BSD family is pretty mature and secure. Linux is just good enough for most people.

A big part of the difference is that the BSDs are designed by a governing committee. They usually don't have 15 different solutions for the same problem, but instead 2-3 solutions that work well. Take filesystems, the official filesystems are UFS(1/2) and ZFS. They have GEOM as LVM and LUKS and more. That being said, the majority of money and development goes into Linux, which by itself may make it a better system (e…

UFS is not deprecated on FreeBSD.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#43

Earlier quoted context omitted.

I'm pretty sure, that the BSD family is pretty mature and secure. Linux is just good enough for most people.

A big part of the difference is that the BSDs are designed by a governing committee. They usually don't have 15 different solutions for the same problem, but instead 2-3 solutions that work well. Take filesystems, the official filesystems are UFS(1/2) and ZFS. They have GEOM as LVM and LUKS and more. That being said, the majority of money and development goes into Linux, which by itself may make it a better system (e…

> A big part of the difference is that the BSDs are designed by a governing committee. They usually don't have 15 different solutions for the same problem, but instead 2-3 solutions that work well.

The right comparison is not between a particular BSD and Linux, its between a particular BSD and a Linux distro.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#44
post #2

As someone who has been using linux quite happily on the desktop for more than 20 years now, I have to say it remains an eternal experiment, feature wise as well as security wise.

That's certainly an interesting standpoint. I use both privately and professionally and while I accept that security-wise (even with selinux) they feel lacking , feature-wise they far exceed Windows I use as my other is except in gaming experience. I wish I had something like GrapheneOS on desktops (yes I know about Qubes)

Chromium OS gets very close, they also have fully-functional VM-based isolation for Linux applications with GPU acceleration.

Unfortunately, there's no popular non-Google distro of it.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#45

Earlier quoted context omitted.

>is pretty mature and secure They are still missing something like capability based security like iOS and Android have where apps have to be granted access to use things like files or the camera. It may have been considered secure a couple decades ago, but they have fallen behind the competiton.

> They are still missing something like capability based security ...like Capsicum? https://wiki.freebsd.org/Capsicum

No, that requires explicit changes by programs to use meaning that malware can ignore it and steal your browser's cookies and take secret photos with your webcam.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#46

Earlier quoted context omitted.

>is pretty mature and secure They are still missing something like capability based security like iOS and Android have where apps have to be granted access to use things like files or the camera. It may have been considered secure a couple decades ago, but they have fallen behind the competiton.

You can use Jails and limit access to hardware resources for each jail. Still not as dynamic, but will get the job done.

Sure, but this is not done automatically for the user.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#47

Earlier quoted context omitted.

A big part of the difference is that the BSDs are designed by a governing committee. They usually don't have 15 different solutions for the same problem, but instead 2-3 solutions that work well. Take filesystems, the official filesystems are UFS(1/2) and ZFS. They have GEOM as LVM and LUKS and more. That being said, the majority of money and development goes into Linux, which by itself may make it a better system (e…

UFS is not deprecated on FreeBSD.

I believe it is the default on netBSD

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#48
post #2

As someone who has been using linux quite happily on the desktop for more than 20 years now, I have to say it remains an eternal experiment, feature wise as well as security wise.

That goes for all (active) software really. Otherwise people call it obsolete or abandoned.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#49
post #43

Earlier quoted context omitted.

A big part of the difference is that the BSDs are designed by a governing committee. They usually don't have 15 different solutions for the same problem, but instead 2-3 solutions that work well. Take filesystems, the official filesystems are UFS(1/2) and ZFS. They have GEOM as LVM and LUKS and more. That being said, the majority of money and development goes into Linux, which by itself may make it a better system (e…

> A big part of the difference is that the BSDs are designed by a governing committee. They usually don't have 15 different solutions for the same problem, but instead 2-3 solutions that work well. The right comparison is not between a particular BSD and Linux, its between a particular BSD and a Linux distro.

I feel the BSDs are much more different from each other than the average Linux distros are.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#50
post #2

As someone who has been using linux quite happily on the desktop for more than 20 years now, I have to say it remains an eternal experiment, feature wise as well as security wise.

We're talking about a local privilege escalation here.

That assumes:

1) Attacker already have an account on the system

2) The app `udisks` is installed on the system.

Everyone is fighting the same battle and it's a good thing. It is happening because the rest of the system is hard enough to attack these days. This is true for all major OS:es.

Only fanboys bend reality to make this into a good-vs-bad argument.

Post reply on HN