4 ms·

This sounds like it’s doing something similar to system integrity protection on mac+iOS where the security model is “root cannot write to kernel memory”. Becaus

by olliej 3y ago

This sounds like it’s doing something similar to system integrity protection on mac+iOS where the security model is “root cannot write to kernel memory”. Because otherwise all you have to do is get root access to control a system, which is pretty easy given that getting root generally just means tricking the user into entering their password (because they’re generally in the sudoers group), or spying on other user processes (like xterm or whatever). Gaining root on a normal user machine is not hard if that’s your goal, and given a security model that depends entirely on not getting root it’s the obvious first step.

josephcsible 3y ago
This reminds me of https://xkcd.com/1200/ https://xkcd.com/1200/ - what would someone who gets into a normal user machine like that care about kernel access for? This type of "protection" feels like it only hurts legitimate users without even slightly inconveniencing actual bad guys.
- exe34 3y ago
  It's to prevent the user from dumping the DRM keys.
- Karellen 3y ago
  Even on a single-user system, if an attacker can't elevate to root then at least you don't have to reinstall the whole computer from scratch. You can just wipe the home directory, log in to a fresh account, and start putting your digital life back together. If they get root, you can't trust anything on the system any more. You have to do 10x the work just to get to the point of having a system you can even start to use. (Do you have a bootable install ISO handy anywhere? Is it current?)
  - mschuster91 3y ago
    > If they get root, you can't trust anything on the system any more. ... and that includes the firmware of all components involved.
  - walteweiss 3y ago
    Not to argue, but the reinstalling part isn’t so difficult these days. I don’t have a current bootable ISO, but I have a bunch of old 8…16 Gb USB drives just for that. Also, there is Ventoy that makes it even easier. So making an installer is a trivial task these days. For me, it’s either downloading Arch Linux media, which is 400 MB or something. Or it’s downloading a Fedora installer, which is 3…4 Gb and takes minutes to do. If I go the Fedora way (which I would, if I need a working computer right away), it’ll take up to an hour to get back to work. I understand that for an average user that could be a serious issue, but if that user is managed by someone competent, it’s really the non-issue. The only thing that needs to be done is a proper backup system for the data of that user. Recently, I had a case with some distant friend whom I help with his computer. He needs just a ‘Word’ and a browser, so he uses Debian and LibreOffice. I haven’t paid him visits for years, so the Debian was 10 or even 9, while the current one is 12. He wanted to install something, and as the system was very obsolete, I insisted on updating it first. I did the proper way (from version to version), but at some point the installation just broke for no reason. I tried to fix it, but even the help of ChatGPT didn’t allow me to do the job quickly. So I just nuked everything on his ssd (his data was on a separate hdd), went all-in Fedora and went talking and drinking tea with him. I was surprised how easy the whole reinstatement was. I’m talking Linux, which is very easy when you know what you do. But macOS or Windows not that difficult these days, when all you need to do is to reinstall. Again, considering the data is saved separately. Preferably beforehand.
    - DEADMINCE 3y ago
      Why not setup your system the way you like it and take regular Clonezilla snapshots, so you can just restore from a known good ISO with all your programs and settings?
      - walteweiss 3y ago
        Personally, I don’t know. Although, a friend of mine does exactly that with his Windows install. The first time he described this to me was like 15 years ago! I never went that way, maybe because I don’t need the exact same system most of the times. When I reinstall, that happens voluntarily these days. And I just reconsider what I need. But overall that’s a great idea.
  - osmano807 3y ago
    Maybe someone have NixOS configs with all the settings, generating live ISO based on those configs. So the matter is just generating/booting those ISOs and you have a clean system with your configs. Put in some impermanence, and you have a clear separation of irreplaceable user and OS data, and replaceable data. Regularly back up the irreplaceable data, boot the ISO and mount this data (or an assumed not compromised version), and you effectively have your system back.

by olliej 3y ago

josephcsible 3y ago

This reminds me of https://xkcd.com/1200/ https://xkcd.com/1200/ - what would someone who gets into a normal user machine like that care about kernel access for? This type of "protection" feels like it only hurts legitimate users without even slightly inconveniencing actual bad guys.

exe34 3y ago
It's to prevent the user from dumping the DRM keys.
Karellen 3y ago
Even on a single-user system, if an attacker can't elevate to root then at least you don't have to reinstall the whole computer from scratch. You can just wipe the home directory, log in to a fresh account, and start putting your digital life back together. If they get root, you can't trust anything on the system any more. You have to do 10x the work just to get to the point of having a system you can even start to use. (Do you have a bootable install ISO handy anywhere? Is it current?)
- mschuster91 3y ago
  > If they get root, you can't trust anything on the system any more. ... and that includes the firmware of all components involved.
- walteweiss 3y ago
  Not to argue, but the reinstalling part isn’t so difficult these days. I don’t have a current bootable ISO, but I have a bunch of old 8…16 Gb USB drives just for that. Also, there is Ventoy that makes it even easier. So making an installer is a trivial task these days. For me, it’s either downloading Arch Linux media, which is 400 MB or something. Or it’s downloading a Fedora installer, which is 3…4 Gb and takes minutes to do. If I go the Fedora way (which I would, if I need a working computer right away), it’ll take up to an hour to get back to work. I understand that for an average user that could be a serious issue, but if that user is managed by someone competent, it’s really the non-issue. The only thing that needs to be done is a proper backup system for the data of that user. Recently, I had a case with some distant friend whom I help with his computer. He needs just a ‘Word’ and a browser, so he uses Debian and LibreOffice. I haven’t paid him visits for years, so the Debian was 10 or even 9, while the current one is 12. He wanted to install something, and as the system was very obsolete, I insisted on updating it first. I did the proper way (from version to version), but at some point the installation just broke for no reason. I tried to fix it, but even the help of ChatGPT didn’t allow me to do the job quickly. So I just nuked everything on his ssd (his data was on a separate hdd), went all-in Fedora and went talking and drinking tea with him. I was surprised how easy the whole reinstatement was. I’m talking Linux, which is very easy when you know what you do. But macOS or Windows not that difficult these days, when all you need to do is to reinstall. Again, considering the data is saved separately. Preferably beforehand.
  - DEADMINCE 3y ago
    Why not setup your system the way you like it and take regular Clonezilla snapshots, so you can just restore from a known good ISO with all your programs and settings?
    - walteweiss 3y ago
      Personally, I don’t know. Although, a friend of mine does exactly that with his Windows install. The first time he described this to me was like 15 years ago! I never went that way, maybe because I don’t need the exact same system most of the times. When I reinstall, that happens voluntarily these days. And I just reconsider what I need. But overall that’s a great idea.
- osmano807 3y ago
  Maybe someone have NixOS configs with all the settings, generating live ISO based on those configs. So the matter is just generating/booting those ISOs and you have a clean system with your configs. Put in some impermanence, and you have a clear separation of irreplaceable user and OS data, and replaceable data. Regularly back up the irreplaceable data, boot the ISO and mount this data (or an assumed not compromised version), and you effectively have your system back.