3 ms·
I'll bet you don't. The natural extension of that logic is that you don't bother with UID separation for running processes (since you don't believe it provides
by ajross 4y ago
I'll bet you don't. The natural extension of that logic is that you don't bother with UID separation for running processes (since you don't believe it provides any protection), so for convenience all your software runs as root and all your ssh logins are directly to root, etc... No one does that, and I'll bet anything you don't either.
In fact the Unix uid/gid does provide real security value in practice. It is not absolute, and relative to other barriers commonly used (LSM, cgroup containers, VMs, firewalls, BPF syscall filtering, etc...) it's comparatively weak and porous. But it's not something to dismiss either.
The nature of "defense in depth" security analysis is that you have to embrace that depth and not throw bits out. UID separation has the distinct advantage of being dirt simple to understand and extremely cheap to deploy. Use it.
- yjftsjthsd-h 4y ago>> The normal way I use machines these days is that anyone with login access has some ability to become root. > I'll bet you don't I'll... bet they do? You realize that description most trivially matches "I give people sudo access", right? So they say they do something and you promptly say that you don't think they do that, because "nobody" does a more extreme version of the same idea that they never suggested? That's a classic straw man.
- ajross 4y agoThat seems like a maximally uncharitable way of interpreting what I thought was a pretty uncontroversial point. The point was that when deploying software for use, best practice says "don't run it as root", and not "assume all software has root access". Do you really disagree? Because the grandparent poster definitely seems to, and I think that's pretty clearly wrong.
- jeltz 4y agoLike your maximally uncharitable interpretation of the original comment.
- ajross 4y agoThat still seems senselessly combative. I wasn't being mean, at least re-reading my comment it doesn't seem so to me. What's the deal here? Who did I offend, and how? To repeat a third time: don't run stuff as root simply because you assume root elevation exploits exist. I stand by that, and don't really think anyone here disagrees.
- tremon 4y agoI don't think you were being mean, but you are being dense. This is the OP's statement: > anyone with login access has some ability to become root If you take that to mean "I run all my software as root", then you're being maximally uncharitable. And when people point out to you that your interpretation isn't the only one available (nor the most logical one), you accuse others of being senselessly combative?
- kelnos 4y ago> I wasn't being mean, at least re-reading my comment it doesn't seem so to me. I don't have a dog in this race, but you started your comment with "I bet you don't", which, to me, is unnecessarily combative and/or snarky. Right out of the gate I was predisposed to think ill of whatever you had to say.
- ajross 4y agoFWIW: the grandparent has editted the comment to remove the framing I was responding to (something along the lines of "root access is inevitable"), which explains why everyone is being so outrageously touchy. I guess I should have quoted. My apologies for seeming "snarky", but the conversation you read isn't the one I was engaged in. But let me repeat for a fourth time that you shouldn't be running processes as root, whether or not you have worries about undiscovered vulnerabilities and especially regardless of whether you are "predisposed to think ill" of the people telling you that. UID separation isn't a perfect model, but it's a good one, and you should use it.