Omarchy: Any User Process Can Escalate to Root
74 points by ucirello
74 points by ucirello
docker: command not found looks like my computer is safe lol.
But tbh, I'm pretty meh on escalation to root for my computer. Everything I actually care about is my user-level account. If that gets pwned, even if purely read-only I'm a lot more trouble than some process being able to write to the generic files that came with the operating system.
Perhaps you use your computer in a single-user + single-OS manner, so everything valuable your computer has is accessible to your user, but consider the scenario where someone is using some other OS for, say, work, but switches to Omarchy for personal use. Or maybe they're just trying out Omarchy. A user-level exploit would be contained within their Omarchy environment, but a root-level exploit could easily access the other OSes on the same computer, or even leave permanent firmware infections on the hardware.
I would love to have a survey on how many people run docker without sudo. I would bet it's a lot. In fact, it has become such a trope that most AI models these days know that it's a way to get sudo if you fail to give it sudo permissions.
Don’t use Docker. Use Podman in rootless mode. Don’t trust containers to be a security boundary, though.
My experience has been generally that for a lot of stuff people are using Docker For Mac and basically leave a lot of issues around how Docker on Linux works more or less entirely unsolved (file permissions in particular....), at least if you're trying to use it for dev environments.
And yeah.... I've generally opted to leave the "sudo" behavior on Docker. I've found it's a good way to force myself to get rid of my Docker usage.
It's interesting how a lot of Linux users make their users effectively root
because they want to use docker without sudo. At laest the Arch
Wiki warns about it:
If you want to be able to run the
dockerCLI command as a non-root user, add your user to thedockeruser group, re-login and restartdocker.service.Warning: Anyone added to the
dockergroup is root equivalent because they can use thedocker run --privilegedcommand to start containers with root privileges.
Obvious in hindsight, but the discussions about this bug have me feeling like sudo is also a pretty weak form of protection: https://news.ycombinator.com/item?id=49500588.
I don’t think this means omarchy’s choice is harmless—the two weak forms of security have different characteristics.
I'm not a docker guy, so maybe i don't understand how people usually use docker. When I do use docker, I use it in rootless mode.
My question is why isn't rootless mode used more often? Wouldn't that stop a bunch of privesc stuff from happening?
Inertia: docker didn't originally have it, and this type of workflow change takes forever to land. Same reason things like UAC on Windows or the like took forever to land.
Does rootless mode let you run things as root within the container? I feel like in the past I tried rootless mode and ran into issues to that effect, but I might be misremembering
If you use Omarchy, the most important takeaway is simple: update to 4.0.1.
Or do yourself a favor and abandon it completely. Feels like reading about its lack of security every week…
NOmarchy.
And to be fair, I thought DHH stood for David Heil Hitler. Didn't pay much attention but saw that whole white person race and purity of culture stuff. Like, uhh, no?
Oh good, I always thought it was pesky to need a sysadmin to do what I want on my host!
You can decide for yourself whether it is ironic or not that this has ended up aligning with Stallman's vision of how the system should work:
Why GNU su does not support the `wheel' group
(This section is by Richard Stallman.)
Sometimes a few of the users try to hold total power over all the rest. For example, in 1984, a few users at the MIT AI lab decided to seize power by changing the operator password on the Twenex system and keeping it secret from everyone else. (I was able to thwart this coup and give power back to the users by patching the kernel, but I wouldn't know how to do that in Unix.)
However, occasionally the rulers do tell someone. Under the usual su mechanism, once someone learns the root password who sympathizes with the ordinary users, he or she can tell the rest. The "wheel group" feature would make this impossible, and thus cement the power of the rulers.
I'm on the side of the masses, not that of the rulers. If you are used to supporting the bosses and sysadmins in whatever they do, you might find this idea strange at first.
The timeline of commits from the introduction to resolution of this issue:
Would be nice to know when the bug was responsibly reported, too.
Although I kind of agree that people that ship these kind of tradeoffs (other might be granting passwordless sudo by default for user created on install) - have no business marketing their distribution as something suitable for general use.