3 ms·

I spent about an hour on this after your comment. Honestly, I was pretty lost in the filesystem for half of that time. I have never used either distro. My copy

I spent about an hour on this after your comment. Honestly, I was pretty lost in the filesystem for half of that time. I have never used either distro. My copy of NixOS had no password on the root user by default, which is not ideal but I assume most deployments aren't like that (right?). I was able to become other users on GuixSD using the SUID's the distro ships with, but not root. Not yet. The surface is much larger on both of those distros than the mainstream OS's. I may be able to pull of a root LPE, but I'd need to look for a full day at least.

nerdponx 6y ago
Thanks for the insight. I believe you are expected to set a root password in the installer :) but other than that I wouldn't know.
lfam 6y ago
Can you send a message to <guix-security@gnu.org>? https://guix.gnu.org/en/security/ https://guix.gnu.org/en/security/
Gaelan 6y ago
> My copy of NixOS had no password on the root user by default, which is not ideal but I assume most deployments aren't like that (right?). By no password, do you mean: - it is impossible to log in as root with a password (a good thing, I'd think, as people should be using sudo), or - it's possible to log in as root without any authentication (a bad thing, obviously)?
- nerdponx 6y ago
  I recall that by default it is impossible, and you are expected to use 'sudo'. Of course that means you can also use 'sudo su'.
soraminazuki 6y ago
> My copy of NixOS had no password on the root user by default That isn't the default behavior for NixOS. From the docs[1]: > If set to null (default) this user will not be able to log in using a password (i.e. via login command). The installer also asked for a root password when I installed NixOS years ago and it still does[2]. [1]: https://search.nixos.org/options?channel=20.09&show=users.extraUsers.%3Cname%3E.hashedPassword&from=0&size=50&sort=relevance&query=users.extrausers https://search.nixos.org/options?channel=20.09&show=users.ex... [2]: https://github.com/NixOS/nixpkgs/blob/a3a531071598cad0c604850ad68ea9bb7573612a/nixos/modules/installer/tools/nixos-install.sh#L200-L215 https://github.com/NixOS/nixpkgs/blob/a3a531071598cad0c60485...

nerdponx 6y ago

Thanks for the insight. I believe you are expected to set a root password in the installer :) but other than that I wouldn't know.

lfam 6y ago

Can you send a message to <guix-security@gnu.org>? https://guix.gnu.org/en/security/ https://guix.gnu.org/en/security/

Gaelan 6y ago

> My copy of NixOS had no password on the root user by default, which is not ideal but I assume most deployments aren't like that (right?). By no password, do you mean: - it is impossible to log in as root with a password (a good thing, I'd think, as people should be using sudo), or - it's possible to log in as root without any authentication (a bad thing, obviously)?

nerdponx 6y ago
I recall that by default it is impossible, and you are expected to use 'sudo'. Of course that means you can also use 'sudo su'.

soraminazuki 6y ago

> My copy of NixOS had no password on the root user by default That isn't the default behavior for NixOS. From the docs[1]: > If set to null (default) this user will not be able to log in using a password (i.e. via login command). The installer also asked for a root password when I installed NixOS years ago and it still does[2]. [1]: https://search.nixos.org/options?channel=20.09&show=users.extraUsers.%3Cname%3E.hashedPassword&from=0&size=50&sort=relevance&query=users.extrausers https://search.nixos.org/options?channel=20.09&show=users.ex... [2]: https://github.com/NixOS/nixpkgs/blob/a3a531071598cad0c604850ad68ea9bb7573612a/nixos/modules/installer/tools/nixos-install.sh#L200-L215 https://github.com/NixOS/nixpkgs/blob/a3a531071598cad0c60485...