4 ms·

I have to try Haiku, but the last time I used BeOS everything effectively ran as root. Not that Unix-style user permissions are the epitome of OS security, but

I have to try Haiku, but the last time I used BeOS everything effectively ran as root. Not that Unix-style user permissions are the epitome of OS security, but at least an RCE vulnerability in the browser doesn't allow for persistent root or whatever.

lagniappe 3y ago
It's a bit different, in that it's a single user system for the most part, whereas the Unix and Linux family are typically geared toward multi user environments.
em-bee 3y ago
haiku devs are working on some form of multiuser support
yjftsjthsd-h 3y ago
I mean, it depends on your threat model, but https://xkcd.com/1200/ https://xkcd.com/1200/ applies; for a single user machine what's the difference between the user and root?
- tadfisher 3y ago
  I have to type a password to perform actions as root, for one.
  - yjftsjthsd-h 3y ago
    You probably have to type a password to perform actions as your normal user, unless you've disabled the login screen for your system. But if you do enter that root password, what exactly can you do that you couldn't do as your own user that actually matters? Sure, root can ex. inject drivers to the kernel, but that's just an intermediate step. The real damage is typically in running a keylogger, getting access to your online accounts, sending DDoS traffic for a botnet, etc. - all actions that can be done with just your non-root user.
bigpeopleareold 3y ago
I am not an expert, just remembering what I saw. I tinker with it a little (and am writing this in a Haiku OS VM, through Falkon.) There is a daemon running when I call `ps` that I see is called package_daemon. I think it is this one: I think it has exclusive access to a set of directories where software and such is installed. There is no sudo, su, etc. because you don't need it. hpkg files are loaded by the package daemon into the correct paths. I looked at this a few months ago just to get what it is doing. It has to have some security model that protects certain paths at least. This looked like it.

lagniappe 3y ago

It's a bit different, in that it's a single user system for the most part, whereas the Unix and Linux family are typically geared toward multi user environments.

em-bee 3y ago

haiku devs are working on some form of multiuser support

yjftsjthsd-h 3y ago

I mean, it depends on your threat model, but https://xkcd.com/1200/ https://xkcd.com/1200/ applies; for a single user machine what's the difference between the user and root?

tadfisher 3y ago
I have to type a password to perform actions as root, for one.
- yjftsjthsd-h 3y ago
  You probably have to type a password to perform actions as your normal user, unless you've disabled the login screen for your system. But if you do enter that root password, what exactly can you do that you couldn't do as your own user that actually matters? Sure, root can ex. inject drivers to the kernel, but that's just an intermediate step. The real damage is typically in running a keylogger, getting access to your online accounts, sending DDoS traffic for a botnet, etc. - all actions that can be done with just your non-root user.

bigpeopleareold 3y ago

I am not an expert, just remembering what I saw. I tinker with it a little (and am writing this in a Haiku OS VM, through Falkon.) There is a daemon running when I call `ps` that I see is called package_daemon. I think it is this one: I think it has exclusive access to a set of directories where software and such is installed. There is no sudo, su, etc. because you don't need it. hpkg files are loaded by the package daemon into the correct paths. I looked at this a few months ago just to get what it is doing. It has to have some security model that protects certain paths at least. This looked like it.