21 ms·
OpenBSD: Shutdown/reboot now require membership of group _shutdown
- mike_hock 3y agoThe headline kinda makes it sound backwards. They did this to allow users to shutdown without also giving them a bunch of unrelated privileges.
- MuffinFlavored 3y agoNew title: OpenBSD: Unprivileged users can now shutdown/reboot via _shutdown group
- blitzar 3y agoYet its a free-for-all when it comes to power on?
- nesarkvechnep 3y agoPower ain't free
- paradaux 3y agoWith physical access, sure. The same could be said for shutdown with physical access. Nothing stopping the user without group membership from holding down the power button or unplugging the kettle cable.
- implements 3y agoGrumbles something about standard computer power cables (IEC 60320 C13) not being ‘kettle leads’ (IEC 60320 C15) … Though you can use actual high-temp rated kettle leads if you like - they fit and are safe in C14 sockets.
- Gordonjcp 3y agoYou mean your computer's PSU doesn't need a 120°C rated plug? Bro do you even CUDA?
- bayindirh 3y agoWhen you "CUDA" the heat is the least of your problems. Did you ever see a single core copper cable become brittle like crackers?
- didroe 3y agoIn the UK and Ireland (and maybe elsewhere?), a kettle lead is actually C13. I guess you need a beefier cable/pins in the US, as you're drawing more current at a lower voltage. Most kettles now have a base with an integrated cable though, so the name doesn't really correspond with the cable's most common usage any more.
- deleted 3y ago[deleted]
- JdeBP 3y agoI had a friend who was easily teased by this, but he was quite right, and you are wrong. Kettle leads in the U.K. have never been C13, and "kettle lead" for a C13 power lead is a misnomer just as much in the U.K. as it is elsewhere. When kettle power cords weren't captive, as they are nowadays, they weren't C13. Non-captive kettle cords from the middle 20th century were round pin, for starters, and not like the (later) IEC standard at all. Here's a round-pin electric kettle from the 1960s, for example: https://www.modip.ac.uk/artefact/aibdc-02510 https://www.modip.ac.uk/artefact/aibdc-02510 And "hot condition" or "high current" leads for other devices are not C13 now. Here's a high current power lead from Toolstation, for example: https://www.toolstation.com/uk-plug-to-hot-iec-lead/p21431?utm_source=hackernews https://www.toolstation.com/uk-plug-to-hot-iec-lead/p21431?u... It's mis-labelled "C13" but it's clearly a C15 with a notch. Contrast with an actual C13 lead from Toolstation: https://www.toolstation.com/uk-plug-to-iec-lead/p29256?utm_source=hackernews https://www.toolstation.com/uk-plug-to-iec-lead/p29256?utm_s... Here's a hot condition power lead from BKA, for another example, which is again a C15: https://www.bka.co.uk/iec-c15-hot-condition-power-leads https://www.bka.co.uk/iec-c15-hot-condition-power-leads
- derkades 3y agoWhat do you mean? Pressing the physical power button?
- jraph 3y agoYou've been downvoted, but you managed to make me smile.
- _V_ 3y agoJudging by all the downvotes and comments that there are quite a lot of people without sense of humor :-D
- irjustin 3y ago"Login required before powering on"
- olgeni 3y agoSCO OpenDesktop installation manual had something to this tune about booting and drivers :D
- akira2501 3y agoIsn't this essentially what full disk encryption demands?
- doubled112 3y agoIs the machine on or off at the point of the prompt?
- macintux 3y agoYes.
- sillywalk 3y agoBeOS had this: int32 is_computer_on(void) Returns 1 if the computer is on. If the computer isn't on, the value returned by this function is undefined.
- Cloudef 3y agoshould ping local electric company and check that the daily quota isn't filled
- sgjohnson 3y agoWith physical access, if you can touch it, you can own it.
- cpach 3y agoIt was a joke (:
- msla 3y agoI was going to mention something about PXE, but according to Intel it has no security at all: https://www.intel.com/content/www/us/en/developer/articles/technical/network-boot-in-a-zero-trust-environment.html https://www.intel.com/content/www/us/en/developer/articles/t... > As network technology has improved, the limitations of PXE Boot are more apparent. PXE has no mechanism for encryption or authentication, is susceptible to man-in-the-middle attacks, does not scale outside of local networks, and has reliability issues associated with TFTP time-outs and UDP packet loss. [snip] > One of the key issues with PXE is a lack of security. The TFTP & UDP transactions associated with PXE may be the last unencrypted traffic on your network and are trivial to intercept. This boot process goes against the “zero trust” concept applied to today’s networks. However, UEFI to the rescue: > The UEFI Specification introduced HTTP(S) Boot in in version 2.5. HTTP Boot combines the Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), and Hypertext Transfer Protocol (HTTP) to provide system deployment and configuration capabilities over the network. Compared to PXE Boot, HTTP Boot can handle much larger files than TFTP, and scale to much larger distances. PXE depends on UDP broadcast You can easily download multi-megabyte files, such as a Linux kernel and a root file system, from servers that are not on your local area network. Because HTTP is now a layer of the network stack.
- AndyMcConachie 3y agoSo I might not be able to turn on my computer because an X.509 certificate expired ;)
- abofh 3y agoYes, but more likely because of clock skew because the battery long ago died. Not that I've ever seen that...
- tinus_hn 3y agoBut how is the network securely going to tell the computer which https server to use? I can get a certificate for any server I put on the network.
- 3y ago
- deleted 3y ago[deleted]
- mewmew07 3y agoreal users get power, few get _shutdown
- unixhero 3y agoHahaha hillarious
- throwawaylinux 3y agoNo, power on already requires membership of group _startup so no security problems there AFAIKS.
- daneel_w 3y agoAs well as _localpresence and _finger.
- bandrami 3y agoI always thought the one-group-per-privileged-action-or-device model could have been taken farther than it was rather than diving into ACLs and capabilities (which IIRC OpenBSD doesn't support anyways) or the various -kits. Is it just that it's an absolute pain to administer, or is there a deeper problem lurking there?
- creshal 3y ago> or is there a deeper problem lurking there? The problem is that organizations don't want to be told by computers to just use sane and logical structures for their meatbags, they'd rather spend billions on making the computers compatible with every single deranged edge organizational case that only exists because of 20 years of unmitigated office politics and/or warfare. On the plus side, most of IT would be redundant if they ever smartened up, so let's hope they continue to wage their little wars through IT procurement.
- deltarholamda 3y agoContrast that to how OpenBSD handled this. There was a thing, disk access, that shouldn't be allowed to those who could shutdown/reboot, so they bounced it around internally for a while, then de Raadt submitted a patch that said, "we're doing it this way, our users will figure it out, it's not a complex thing." No massive re-architecting, just add a group, done. Businesses could learn a lot from the way the *BSDs and Linux do things. They're all different, but you can't argue with the results.
- nvy 3y agoI actually think, given how the usage share of the BSDs is a fraction of that of Linux or Windows, that OpenBSD is a textbook example of how "good enough" almost always trumps technical excellence. Linux is unquestionably less "cohesive" and "organized" than BSD but I can't think of any reason to reach for BSD given Linux exists.
- linksnapzz 3y ago
- zokier 3y agoI wonder if the endgame is that each suid binariy will have separate group associated with them. I don't have obsd at hand, what the situation is like currently?
- daneel_w 3y agoI believe the current tally of suid executables having their own separate group is: crontab, ssh-agent, authpf, and smtpctl (smtp-queue).
- veave 3y ago>The xfce port has already been modified to accommodate this. Where are the diffs?
- SuperSandro2000 3y agoThe links also don't contain it. Mailing list based workflows....
- 5e92cb50239222b 3y agoOh, the irony of linking to GitHub. https://github.com/openbsd/ports/commit/bf33ea5f3ff390d8cde3887a48948e8acef43335 https://github.com/openbsd/ports/commit/bf33ea5f3ff390d8cde3... https://github.com/openbsd/ports/commit/469b0a4b0a1152576d93f5797a3208c1efdc80cc https://github.com/openbsd/ports/commit/469b0a4b0a1152576d93...
- kouteiheika 3y ago> https://github.com/openbsd/ports/commit/bf33ea5f3ff390d8cde3887a48948e8acef43335 https://github.com/openbsd/ports/commit/bf33ea5f3ff390d8cde3... Now, this is surprising. I randomly clicked on that link and I immediately see that the code and the patch has a bug. It only checks the first 8 characters: - if (gr != NULL && strncmp(gr->gr_name, "operator", 8) == 0) + if (gr != NULL && strncmp(gr->gr_name, "_shutdown", 8) == 0) so it will also match a group named "_shutdow" or "_shutdow1234" because only the first 8 characters matter. A trivial silly mistake like this is... not what I expected considering OpenBSD's reputation for security.
- deleted 3y ago[deleted]
- smcl 3y agoIt's a long-shot but I wonder if OpenBSD has specified that groups are only unique up to 8 characters. Like it certainly looks like a bug to my eyes too, but my default when I see something like this in OpenBSD code is "maybe I just don't get it".
- NoZebra120vClip 3y agoWhat's with the leading underscore? That seems rather unprecedented. Is there some standard that BSD is setting for this?
- qalmakka 3y agoIt's probably to avoid conflicting with potentially existing user-defined groups. The underscore in the C/UNIX world has an intrinsic meaning of "implementation reserved", so it's your fault if the new group conflicts with one you improperly created yourself.
- SuperSandro2000 3y agoSome other software can think the exact same thing.
- deleted 3y ago[deleted]
- Canada 3y agoAll of the system group names that own resources for specific applications have been underscore prefixed for years... like ... _bgpd:*:75: _tcpdump:*:76: _dhcp:*:77: _mopd:*:78: _tftpd:*:79: _rbootd:*:80: _ppp:*:82: _ntp:*:83: _ftp:*:84: _ospfd:*:85: _hostapd:*:86: ... but not the general ones like wheel, sys, daemon, tty, nobody, etc.
- 3y ago
- 2b3a51 3y agoI've always liked how the OpenBSD project just makes pragmatic changes and then documents them. The various window manager/DE package maintainers will be modifying the pkg-readmes for 7.4 now I suppose. /usr/local/share/doc/pkg-readmes
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- hamasho 3y agoI thought this was something similar to Microsoft mandating membership to update OS
- amatecha 3y agoOh wait, I always shut down by running `doas halt`, is that incorrect? >_>
- Freaky 3y agoOpenBSD is unique amongst the BSDs in that its halt(8) and reboot(8) commands use the rc(8) system to shut down services gracefully, so the only thing you're missing is scheduling and shutdown message broadcasts. Elsewhere those commands simply broadcast SIGTERM/SIGKILL to all processes, so you should use shutdown(8) unless you're in single user mode. poweroff(8) has halt/reboot semantics on NetBSD, but shutdown semantics on FreeBSD/etc.
- 634636346 3y agoFor those unaware, Undeadly.org is a very unusually engineered site. It's written in C, and it runs under FastCGI on OpenBSD's (edit: home-grown) httpd.
- wahern 3y ago> it runs under FastCGI on OpenBSD's fork of httpd. FWIW, OpenBSD hasn't used [a fork of] Apache in nearly 10 years. Since OpenBSD 5.6 /usr/sbin/httpd has been a homegrown HTTP server, originally based in part on relayd, an HTTP proxy and another bespoke OpenBSD project. OpenBSD httpd can only serve static files or forward requests to a FastCGI handler.
- juped 3y agoAnother success story for the BCHS stack. https://learnbchs.org https://learnbchs.org