Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

/bin/sh: the biggest Unix security loophole (1984) [pdf]

tuhs.org

Post reply on HN
Print view View original

51–57 of 57 posts

Re: /bin/sh: the biggest Unix security loophole (1984) [pdf]

#51

Post by ErikBjare »

IshKebab wrote: post #50
Vogtinator wrote: post #23

Earlier quoted context omitted.

For multiple users on the same server it was IMO well designed. Everyone had their ~ and could place whatever libraries/binaries/etc. in there and do whatever they wanted. Package managers are way more modern than that and their design does by itself not require root (see pip). You can in fact run most package managers without root, you just won't be able to modify system files. You can use them to install a chroot a…

Oh yeah? How can I install Clang using Apt without root?

You don't need to install it with apt

Re: /bin/sh: the biggest Unix security loophole (1984) [pdf]

#52

Post by s1gsegv »

IshKebab wrote: post #50
Vogtinator wrote: post #23

Earlier quoted context omitted.

For multiple users on the same server it was IMO well designed. Everyone had their ~ and could place whatever libraries/binaries/etc. in there and do whatever they wanted. Package managers are way more modern than that and their design does by itself not require root (see pip). You can in fact run most package managers without root, you just won't be able to modify system files. You can use them to install a chroot a…

Oh yeah? How can I install Clang using Apt without root?

This is largely a package manager problem. There is a way to run Homebrew (the package manager widely used on macOS) on Linux in a rootless mode, and it will install packages into your home directory no problem.

It’s a good trick to have in your back pocket if you’re given an unprivileged user on a compute node and want to make use of modern tools.

Re: /bin/sh: the biggest Unix security loophole (1984) [pdf]

#53

Post by IshKebab »

ErikBjare wrote: post #51
IshKebab wrote: post #50

Earlier quoted context omitted.

Oh yeah? How can I install Clang using Apt without root?

You don't need to install it with apt

Indeed but the claim was:

> You can in fact run most package managers without root

It is very clear from the context that dehrmann was talking about Linux distro package managers (Apt, Yum, Dnf, Apk, etc.) and as far as I know they all require root, or at least I have never once seen someone use them without root.

Re: /bin/sh: the biggest Unix security loophole (1984) [pdf]

#54

Post by ErikBjare »

IshKebab wrote: post #53
ErikBjare wrote: post #51

Earlier quoted context omitted.

You don't need to install it with apt

Indeed but the claim was: > You can in fact run most package managers without root It is very clear from the context that dehrmann was talking about Linux distro package managers (Apt, Yum, Dnf, Apk, etc.) and as far as I know they all require root, or at least I have never once seen someone use them without root.

I figured most package managers (brew, pip, nix, npm, etc.) are not actually one of the few Linux distro package managers. You listed them almost exhaustively after all (excepting pacman).

Re: /bin/sh: the biggest Unix security loophole (1984) [pdf]

#55

Post by IshKebab »

ErikBjare wrote: post #54
IshKebab wrote: post #53

Earlier quoted context omitted.

Indeed but the claim was: > You can in fact run most package managers without root It is very clear from the context that dehrmann was talking about Linux distro package managers (Apt, Yum, Dnf, Apk, etc.) and as far as I know they all require root, or at least I have never once seen someone use them without root.

I figured most package managers (brew, pip, nix, npm, etc.) are not actually one of the few Linux distro package managers. You listed them almost exhaustively after all (excepting pacman).

Right but as I said from the context it was clear he was talking about distro package managers, not language package managers.

Nix requires root (at least by default). Brew I'll give you - I didn't know you can use it on Linux. Do people actually do that enough that it works reliably?

Re: /bin/sh: the biggest Unix security loophole (1984) [pdf]

#56

Post by ErikBjare »

IshKebab wrote: post #55
ErikBjare wrote: post #54

Earlier quoted context omitted.

I figured most package managers (brew, pip, nix, npm, etc.) are not actually one of the few Linux distro package managers. You listed them almost exhaustively after all (excepting pacman).

Right but as I said from the context it was clear he was talking about distro package managers, not language package managers. Nix requires root (at least by default). Brew I'll give you - I didn't know you can use it on Linux. Do people actually do that enough that it works reliably?

I don't think that was clear. If they really meant that, which I honestly doubt because it would be so obviously false, then I agree with you.

Re: /bin/sh: the biggest Unix security loophole (1984) [pdf]

#57

Post by IshKebab »

ErikBjare wrote: post #56
IshKebab wrote: post #55

Earlier quoted context omitted.

Right but as I said from the context it was clear he was talking about distro package managers, not language package managers. Nix requires root (at least by default). Brew I'll give you - I didn't know you can use it on Linux. Do people actually do that enough that it works reliably?

I don't think that was clear. If they really meant that, which I honestly doubt because it would be so obviously false, then I agree with you.

> We love to praise Unix, but it wasn't built for modern multi-user use. FUSE was an after-thought. So were package managers, and they got added, but they require root.

Clearly talking about OS level package managers.

Post reply on HN