6 ms·

The existence of the root user is bad security. Any distro serious about security should disable it and strip it of as much power as possible. It is such a juic

The existence of the root user is bad security. Any distro serious about security should disable it and strip it of as much power as possible. It is such a juicy target for attackers due to how much power it has and most distros protect it poorly by having programs such as sudo installed allowing an attacker to easily escalate their privileges.

josephcsible 3y ago
How do you propose that the owner of a system should be able to administer it?
- charcircuit 3y ago
  The distro maintainers should make sure the operating system works well on its own. For what needs to be customized there can be a settings application and individual applications can expose ways for themselves to be customized.
  - josephcsible 3y ago
    You want distro maintainers to have final control instead of hardware owners? Isn't that arguing for the iOS-ification of Linux?
    - charcircuit 3y ago
      I want distros to make an operating system that actually works and doesn't need to be fiddled with. Hardware owners shouldn't have to be the ones fixing the operating system. Most people just want their computer to work and don't want to learn about the internals of how it works. If a user really cares about changing the internals he can make his own operating system. >Isn't that arguing for the iOS-ification of Linux? Linux distros could learn a thing or two (or 100) from how iOS handles security.
      - josephcsible 3y ago
        > I want distros to make an operating system that actually works and doesn't need to be fiddled with. Doesn't need to be fiddled with? Sure. Can't be fiddled with? No way. > Hardware owners shouldn't have to be the ones fixing the operating system. Ditto. Owners shouldn't have to fix it, but they should be able to. > Most people just want their computer to work and don't want to learn about the internals of how it works. Most people, sure. So don't make them learn. But don't prevent people from learning if they want to. > If a user really cares about changing the internals he can make his own operating system. Wouldn't this mean that incremental improvements wouldn't be possible anymore? > Linux distros could learn a thing or two (or 100) from how iOS handles security. How so specifically?
        charcircuit 3y ago
        >Wouldn't this mean that incremental improvements wouldn't be possible anymore? One can make a fork of the distro and then make the change you want to incrementally improve it. >How so specifically? Reading the documentation and reading information about its internals.
        DaSHacka 3y ago
        Why though? How is that better than what we have now, where a system can be easily modified in-place without every distro needing dozens of forks for each slight preference change? What exactly is it you're advocating for?
        charcircuit 3y ago
        >Why though? Because most Linux distros have terrible security. >How is that better than what we have now, where a system can be easily modified in-place without every distro needing dozens of forks for each slight preference change? Preferences can be done via configuration. Most people do not actually want or need to modify the operating system. >What exactly is it you're advocating for? The root user to be effectively removed.
      - 3y ago
  - yjftsjthsd-h 3y ago
    > individual applications can expose ways for themselves to be customized. They do. That way is exposing files in /etc that the administrator account can edit.
    - charcircuit 3y ago
      Unfortunately these files in /etc usually can only be edited by root. What could be done is allow a user from the administrator group to edit such files.
      - thaumasiotes 3y ago
        A user from the administrator group has all the same power that the root user does. Or, labeled differently, the root user is the administrator group.
        charcircuit 3y ago
        No, for example the root user can read any file on the system. If someone gains access to the root user they shouldn't also gain the ability to read and write to every file on the system.
        josephcsible 3y ago
        How should I be able to read any file on the system on a device I own, if not with the root user?
        charcircuit 3y ago
        I don't think this makes much sense to have to avoid empowering stealer malware. It would be better to find what the actual user need is and make a proper API to expose that functionality.
  - bee_rider 3y ago
    I don’t think anybody would use or develop a system like that. It would put too much responsibility in the hands of the (volunteer) maintainers. Trying to guess what use-case everybody will have is a horrible tooth-pulling and bikesheding exercise that nobody would do for fun. That said there’s nothing stopping you from trying it. It just seems unlikely to succeed.
    - charcircuit 3y ago
      It's no more responsibility than what already exists. Telling end users to go and fix the operating system themselves was never acceptable to do. >Trying to guess what use-case everybody will have is a horrible tooth-pulling and bikesheding exercise that nobody would do for fun. You seem to be misunderstanding what I am saying. People could still install new applications, or uninstall preexisting applications just like how it works now.
      - bee_rider 3y ago
        I guess I don’t know what you are suggesting
  - mort96 3y ago
    How do I install a custom kernel module in your model
    - DEADMINCE 3y ago
      Using something like sudo. Parent is not saying remove root entirely but that it should be super locked down and maybe broken up into different accounts.
      - mort96 3y ago
        I think they are saying to remove root entirely? If the solution is just "use sudo" then what's the difference compared to today's model?
        DEADMINCE 3y ago
        Instead of sudoing to the root account, you would sudo to the network account that could only do network admin, or sudo to the software-install account that could only install packages, etc.
    - charcircuit 3y ago
      You should install it from the distro's package manager. If it's not cryptographically signed by the distro you have to fork the operating system to add another key to trust. A custom kernel module has immense security implications so it shouldn't be easy to do as an attacker shouldn't be able to trick someone into installing one for free vbucks.
      - mort96 3y ago
        My distro's repositories don't contain my newly written custom kernel module
        charcircuit 3y ago
        Most users aren't writing their own custom kernel modules and using them on their current install instead of qemu. This is a niche use case that the average user's security shouldn't be compromised for.
teo_zero 3y ago
I think sudo done well could be exactly what you're advocating for: configure all possible commands that a user should be allowed to execute as superuser for ordinary and extra-ordinary maintenance and prohibit everything else (especially sudo -i).
- Dalewyn 3y ago
  I make liberal use of sudo -i on my personal Linux machines, because otherwise I have to prefix sudo to 99% of my commands and be arsed to enter passwords if I dilly dally too long between commands.
  - thfuran 3y ago
    If you have to prefix almost all of your commands with sudo, either your usage is highly irregular or your problem is mostly caused by poor file permissions resulting from overuse of sudo.
- charcircuit 3y ago
  I don't as doing that is as bad as suid binaries except now the binaries aren't even hardened. suid binaries shouldn't exist either.
  - josephcsible 3y ago
    What would you replace suid binaries with? Just getting rid of suid without replacement would totally break your system.
    - charcircuit 3y ago
      Normal binaries that talk to services running as other users who have the minimal possible permissions. For example instead having users run ping as the root user using suid, you instead have a ping client talk to a ping service on the system. The ping service runs as a user with the raw sockets capability and nothing else.
znpy 3y ago
Nah. Root user actual capabilities can be limited in a number of ways. On RHEL this is done by default via SELinux. If you define a policy that prevents anyone from doing kexec, and enable the boolean to prevent root from disabling enforcing mode for selinux, there you go, done with tools that have been available for ~15-20 years.
- kbolino 3y ago
  Has SELinux become configurable on the command-line with well documented tools? Does it still occasionally decide to "relabel files" for 10 hours on a random reboot? It's a great mechanism in theory, but the practice leaves much to be desired.
  - DEADMINCE 3y ago
    It's a great mechanism in practice, it just has a bad rep because too many were scared by the complexity.
    - kbolino 3y ago
      The complexity is a self-inflicted problem. This is a rake that many computer security people refuse to stop stepping on. If it's not usable then it doesn't work. FWIW it does look like Gentoo stepped up and filled in the gaps since I last looked. Their Wiki has good docs starting from https://wiki.gentoo.org/wiki/SELinux https://wiki.gentoo.org/wiki/SELinux.
  - znpy 3y ago
    Yes and no. But the thing is... SELinux does complex stuff. You can simplify that, but only to a certain point. If you dumb it down too much it becomes useless. Simple tools usually get their simplicity by making some choices for you. You don't always want that. SELinux is one of those things where you don't want that. That being said, without diving too much, I have configured many custom services to run under SELinux by just running them in a dev/staging environment, collecting violations and creating policies via the audit2allow tool. So yeah, things have improved I guess.

josephcsible 3y ago

How do you propose that the owner of a system should be able to administer it?

charcircuit 3y ago
The distro maintainers should make sure the operating system works well on its own. For what needs to be customized there can be a settings application and individual applications can expose ways for themselves to be customized.
- josephcsible 3y ago
  You want distro maintainers to have final control instead of hardware owners? Isn't that arguing for the iOS-ification of Linux?
  - charcircuit 3y ago
    I want distros to make an operating system that actually works and doesn't need to be fiddled with. Hardware owners shouldn't have to be the ones fixing the operating system. Most people just want their computer to work and don't want to learn about the internals of how it works. If a user really cares about changing the internals he can make his own operating system. >Isn't that arguing for the iOS-ification of Linux? Linux distros could learn a thing or two (or 100) from how iOS handles security.
    - josephcsible 3y ago
      > I want distros to make an operating system that actually works and doesn't need to be fiddled with. Doesn't need to be fiddled with? Sure. Can't be fiddled with? No way. > Hardware owners shouldn't have to be the ones fixing the operating system. Ditto. Owners shouldn't have to fix it, but they should be able to. > Most people just want their computer to work and don't want to learn about the internals of how it works. Most people, sure. So don't make them learn. But don't prevent people from learning if they want to. > If a user really cares about changing the internals he can make his own operating system. Wouldn't this mean that incremental improvements wouldn't be possible anymore? > Linux distros could learn a thing or two (or 100) from how iOS handles security. How so specifically?
      - charcircuit 3y ago
        >Wouldn't this mean that incremental improvements wouldn't be possible anymore? One can make a fork of the distro and then make the change you want to incrementally improve it. >How so specifically? Reading the documentation and reading information about its internals.
        DaSHacka 3y ago
        Why though? How is that better than what we have now, where a system can be easily modified in-place without every distro needing dozens of forks for each slight preference change? What exactly is it you're advocating for?
        charcircuit 3y ago
        >Why though? Because most Linux distros have terrible security. >How is that better than what we have now, where a system can be easily modified in-place without every distro needing dozens of forks for each slight preference change? Preferences can be done via configuration. Most people do not actually want or need to modify the operating system. >What exactly is it you're advocating for? The root user to be effectively removed.
    - 3y ago
- yjftsjthsd-h 3y ago
  > individual applications can expose ways for themselves to be customized. They do. That way is exposing files in /etc that the administrator account can edit.
  - charcircuit 3y ago
    Unfortunately these files in /etc usually can only be edited by root. What could be done is allow a user from the administrator group to edit such files.
    - thaumasiotes 3y ago
      A user from the administrator group has all the same power that the root user does. Or, labeled differently, the root user is the administrator group.
      - charcircuit 3y ago
        No, for example the root user can read any file on the system. If someone gains access to the root user they shouldn't also gain the ability to read and write to every file on the system.
        josephcsible 3y ago
        How should I be able to read any file on the system on a device I own, if not with the root user?
        charcircuit 3y ago
        I don't think this makes much sense to have to avoid empowering stealer malware. It would be better to find what the actual user need is and make a proper API to expose that functionality.
- bee_rider 3y ago
  I don’t think anybody would use or develop a system like that. It would put too much responsibility in the hands of the (volunteer) maintainers. Trying to guess what use-case everybody will have is a horrible tooth-pulling and bikesheding exercise that nobody would do for fun. That said there’s nothing stopping you from trying it. It just seems unlikely to succeed.
  - charcircuit 3y ago
    It's no more responsibility than what already exists. Telling end users to go and fix the operating system themselves was never acceptable to do. >Trying to guess what use-case everybody will have is a horrible tooth-pulling and bikesheding exercise that nobody would do for fun. You seem to be misunderstanding what I am saying. People could still install new applications, or uninstall preexisting applications just like how it works now.
    - bee_rider 3y ago
      I guess I don’t know what you are suggesting
- mort96 3y ago
  How do I install a custom kernel module in your model
  - DEADMINCE 3y ago
    Using something like sudo. Parent is not saying remove root entirely but that it should be super locked down and maybe broken up into different accounts.
    - mort96 3y ago
      I think they are saying to remove root entirely? If the solution is just "use sudo" then what's the difference compared to today's model?
      - DEADMINCE 3y ago
        Instead of sudoing to the root account, you would sudo to the network account that could only do network admin, or sudo to the software-install account that could only install packages, etc.
  - charcircuit 3y ago
    You should install it from the distro's package manager. If it's not cryptographically signed by the distro you have to fork the operating system to add another key to trust. A custom kernel module has immense security implications so it shouldn't be easy to do as an attacker shouldn't be able to trick someone into installing one for free vbucks.
    - mort96 3y ago
      My distro's repositories don't contain my newly written custom kernel module
      - charcircuit 3y ago
        Most users aren't writing their own custom kernel modules and using them on their current install instead of qemu. This is a niche use case that the average user's security shouldn't be compromised for.

teo_zero 3y ago

I think sudo done well could be exactly what you're advocating for: configure all possible commands that a user should be allowed to execute as superuser for ordinary and extra-ordinary maintenance and prohibit everything else (especially sudo -i).

Dalewyn 3y ago
I make liberal use of sudo -i on my personal Linux machines, because otherwise I have to prefix sudo to 99% of my commands and be arsed to enter passwords if I dilly dally too long between commands.
- thfuran 3y ago
  If you have to prefix almost all of your commands with sudo, either your usage is highly irregular or your problem is mostly caused by poor file permissions resulting from overuse of sudo.
charcircuit 3y ago
I don't as doing that is as bad as suid binaries except now the binaries aren't even hardened. suid binaries shouldn't exist either.
- josephcsible 3y ago
  What would you replace suid binaries with? Just getting rid of suid without replacement would totally break your system.
  - charcircuit 3y ago
    Normal binaries that talk to services running as other users who have the minimal possible permissions. For example instead having users run ping as the root user using suid, you instead have a ping client talk to a ping service on the system. The ping service runs as a user with the raw sockets capability and nothing else.

znpy 3y ago

Nah. Root user actual capabilities can be limited in a number of ways. On RHEL this is done by default via SELinux. If you define a policy that prevents anyone from doing kexec, and enable the boolean to prevent root from disabling enforcing mode for selinux, there you go, done with tools that have been available for ~15-20 years.

kbolino 3y ago
Has SELinux become configurable on the command-line with well documented tools? Does it still occasionally decide to "relabel files" for 10 hours on a random reboot? It's a great mechanism in theory, but the practice leaves much to be desired.
- DEADMINCE 3y ago
  It's a great mechanism in practice, it just has a bad rep because too many were scared by the complexity.
  - kbolino 3y ago
    The complexity is a self-inflicted problem. This is a rake that many computer security people refuse to stop stepping on. If it's not usable then it doesn't work. FWIW it does look like Gentoo stepped up and filled in the gaps since I last looked. Their Wiki has good docs starting from https://wiki.gentoo.org/wiki/SELinux https://wiki.gentoo.org/wiki/SELinux.
- znpy 3y ago
  Yes and no. But the thing is... SELinux does complex stuff. You can simplify that, but only to a certain point. If you dumb it down too much it becomes useless. Simple tools usually get their simplicity by making some choices for you. You don't always want that. SELinux is one of those things where you don't want that. That being said, without diving too much, I have configured many custom services to run under SELinux by just running them in a dev/staging environment, collecting violations and creating policies via the audit2allow tool. So yeah, things have improved I guess.