4 ms·

I agree that multi-user should go away for modern server workloads, however, users are used as a blast door. Mainly because Linux's security model is lacking. s

by cedws 2y ago

I agree that multi-user should go away for modern server workloads, however, users are used as a blast door. Mainly because Linux's security model is lacking. systemd for example commonly runs services under separate users to make it more difficult for a compromised application to elevate privileges. Android does something similar AFAIK. Users should have never became a security boundary to isolate applications, but they unfortunately have, and there's not really an alternative.

weitendorf 2y ago
This is why I think multitenancy is the more important problem (though both are related), because it's the key to solving shared-kernel application permissions without "users". Containers were a step in the right direction but aren't a sufficient security boundary in themselves - what is currently handled by the "container runtime"/sandbox needs to be built into the kernel IMO.
goodpoint 2y ago
> Linux's security model is lacking It's not lacking at all. The root + users model is common not only across OSes but also all sort of physical devices.
- moring 2y ago
  Linux's security model doesn't become better just because everybody is doing it that way, and besides that, everybody is doing it because they are copying Linux.
  - goodpoint 2y ago
    > Linux's security model doesn't become better just because everybody is doing it that way I didn't claim it does. > everybody is doing it because they are copying Linux. This is not true. The model existed decades before Linux.
- stubish 2y ago
  Nah, its been lacking since inception, with people trying things like chroot jails and suid bits decades before Linux was a twinkle in an eye, and we still regularly fail at running untrusted code.
deleted 2y ago
[deleted]
e145bc455f1 2y ago
>systemd for example commonly runs services under separate users Doesn't this have to be manually setup. Can i make systemd to run a service under a temporary user automatically.
- zokier 2y ago
  Yes? https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser= https://www.freedesktop.org/software/systemd/man/latest/syst...

by cedws 2y ago

weitendorf 2y ago

This is why I think multitenancy is the more important problem (though both are related), because it's the key to solving shared-kernel application permissions without "users". Containers were a step in the right direction but aren't a sufficient security boundary in themselves - what is currently handled by the "container runtime"/sandbox needs to be built into the kernel IMO.

goodpoint 2y ago

> Linux's security model is lacking It's not lacking at all. The root + users model is common not only across OSes but also all sort of physical devices.

moring 2y ago
Linux's security model doesn't become better just because everybody is doing it that way, and besides that, everybody is doing it because they are copying Linux.
- goodpoint 2y ago
  > Linux's security model doesn't become better just because everybody is doing it that way I didn't claim it does. > everybody is doing it because they are copying Linux. This is not true. The model existed decades before Linux.
stubish 2y ago
Nah, its been lacking since inception, with people trying things like chroot jails and suid bits decades before Linux was a twinkle in an eye, and we still regularly fail at running untrusted code.

deleted 2y ago

[deleted]

e145bc455f1 2y ago

>systemd for example commonly runs services under separate users Doesn't this have to be manually setup. Can i make systemd to run a service under a temporary user automatically.

zokier 2y ago
Yes? https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser= https://www.freedesktop.org/software/systemd/man/latest/syst...