5 ms·

What should you do instead?

by z3t4 1y ago

charcircuit 1y ago
Design the system so that you do not need users to escalate to root. Find each use case where a user may want to use sudo and then come up with an alternate way to accomplish that action from a regular account.
- lupusreal 1y ago
  We have that, it's called android. Anybody who finds themselves using sudo is already well off the beaten path, by their own choice. There's nothing wrong with that.
  - charcircuit 1y ago
    Doing system updates is not off the beaten path.
    - theamk 1y ago
      And system updates don't need sudo on desktops, it is not 1990's anymore... GUI apps like software-properties-gtk use dbus with polkit auth to upgrade software without any involvement of "sudo" or giving root access to users.
    - lupusreal 1y ago
      Using GNU/Linux at all is. Choosing to use such an operating system and then also choosing to do your updates from a terminal emulator is even further off the beaten path. The beaten path is the defaults. Windows and MacOS particularly.
- onli 1y ago
  That would just elevate each regular account to be a root account. There is no other way to make things like modifying files directly under / possible, or to change system configurations. You can lock everything down instead, then you have Android, but then you have certainly not enabled everything a user can do with sudo.
  - charcircuit 1y ago
    >There is no other way to make things like modifying files directly under / possible It doesn't need to be possible. >change system configurations You can have an settings app to configure the system. >then you have Android Which is much farther ahead than Ubuntu on security. Ubuntu needs to play catch up. >but then you have certainly not enabled everything a user can do with sudo. The goal is not to be able to do everything. The average user doesn't need to be able to do anything. Especially with their regular account.
    - butlike 1y ago
      > The average user doesn't need to be able to do anything.
    - theamk 1y ago
      Sounds like you don't want a Linux system, but rather a Chromebook. Have you seen https://chromeos.google/products/chromeos-flex/ https://chromeos.google/products/chromeos-flex/ ? Install it on your computer and you get Android-like security model, including only verified software and lack of "sudo" or any sort of root access.
      - charcircuit 1y ago
        A Chromebook is a Linux system. My concern is with Ubuntu improving their security posture. Telling Canonical to give up on Ubuntu and switch everyone over to ChromeOS is not something that I predict would work.
- zahlman 1y ago
  Currently, for any given action, the following possibilities are implemented: * The user may never perform the action (would require sudo, but the user doesn't have sudo rights) * The user may sometimes perform the action (i.e. only after authenticating with sudo) * The user may always perform the action (is always implicitly authenticated) "Being root" is just another name for the last option. What fourth alternative do you have in mind?
  - charcircuit 1y ago
    >"Being root" is just another name for the last option. No, it's not. Take for example ping. If we want users to be able to always be able to use ping does that mean they need to be root? No, it doesn't. A privileged part of the OS can handle doing the raw socket and the unpriviledged user can talk to that part of the OS. The key point is that some operations that require privileges are okay to expose to a user, but giving the user privileges for everything is dangerous.
    - theamk 1y ago
      Examples please? Modern desktop OSes are pretty good at exposing safe operations to users so that no "sudo" is required.
rurban 1y ago
Capabilities. Proper microkernels already do that
- theamk 1y ago
  how do they solve sudo's problems though? Exchanging "sudo" with "require-root-capability" or "start-privileged-session" will still have many of the same logic problems. Unless you mean something like "capabilities are always inherited, and there is no way to increase them", which would mean that sudo-like scripts are impossible, and you need to start all-new session as root user for admin actions. Good news, it's already possible in linux - just don't install "sudo", and maybe set up SELinux to disallow all escalation. Turns out no one wants to do this though.
  - rurban 1y ago
    fine grained. there's no god-mode who can do everything. there's no universal kernel level. micro means only minimal things happen in the kernel or at root level, like routing messages. even windows understood that those times, when they did split Administrator from System. linux followed then with system users for certain services. but capabilities only allow certain calls at certain times. there's no setuid 0, only cap this and cap that for this admin user for a certain time range. BTW, SElinux is the default on a proper linux like Redhat. I use it daily. I also have to adjust the ssh caps, not just the firewall settings. Everybody wants that, just not the debian nobs.
    - vacuity 1y ago
      There is omitted detail here. Capabilities are a great way to determine access control (IMO, they are essential in general as a user-facing model too). However, that still leaves the question of who gets what capabilities. For the network service to be able to hand out network capabilities, it itself must have at least as much authority, and it had to get that authority from some other source of capabilities. There must be some privileged component that forges all capabilities, and actually distributes enough authority to make the system usable. For example, as soon as a human user becomes relevant, the system's user-avatar must be able to command authority, in a way that may seem sweeping. This could mean directly or indirectly changing which program is the network service, which means the ability to influence all networking activities, which is no small authority. An agent logically has all the capabilities necessary to do what the agent should be able to do. The sum of capabilities of an agent indicates "the worst that can happen" if the agent is malicious. It makes sense that if a network service is malicious, all networking activities can be subverted. Still, the storage activities shouldn't be subverted, and of course the network service wouldn't have the storage service capability. However, if a user is malicious, anything could go wrong that the user is normally trusted to not make go wrong. Correspondingly, the user must have an expansive sum of capabilities. Capabilities are themselves simple, but that is the mechanism perspective. Access control policy is an entirely different beast, and any mechanism at best minimizes the risks.

What should you do instead?

by z3t4 1y ago

What should you do instead?

Design the system so that you do not need users to escalate to root. Find each use case where a user may want to use sudo and then come up with an alternate way to accomplish that action from a regular account.

lupusreal 1y ago
We have that, it's called android. Anybody who finds themselves using sudo is already well off the beaten path, by their own choice. There's nothing wrong with that.
- charcircuit 1y ago
  Doing system updates is not off the beaten path.
  - theamk 1y ago
    And system updates don't need sudo on desktops, it is not 1990's anymore... GUI apps like software-properties-gtk use dbus with polkit auth to upgrade software without any involvement of "sudo" or giving root access to users.
  - lupusreal 1y ago
    Using GNU/Linux at all is. Choosing to use such an operating system and then also choosing to do your updates from a terminal emulator is even further off the beaten path. The beaten path is the defaults. Windows and MacOS particularly.
onli 1y ago
That would just elevate each regular account to be a root account. There is no other way to make things like modifying files directly under / possible, or to change system configurations. You can lock everything down instead, then you have Android, but then you have certainly not enabled everything a user can do with sudo.
- charcircuit 1y ago
  >There is no other way to make things like modifying files directly under / possible It doesn't need to be possible. >change system configurations You can have an settings app to configure the system. >then you have Android Which is much farther ahead than Ubuntu on security. Ubuntu needs to play catch up. >but then you have certainly not enabled everything a user can do with sudo. The goal is not to be able to do everything. The average user doesn't need to be able to do anything. Especially with their regular account.
  - butlike 1y ago
    > The average user doesn't need to be able to do anything.
  - theamk 1y ago
    Sounds like you don't want a Linux system, but rather a Chromebook. Have you seen https://chromeos.google/products/chromeos-flex/ https://chromeos.google/products/chromeos-flex/ ? Install it on your computer and you get Android-like security model, including only verified software and lack of "sudo" or any sort of root access.
    - charcircuit 1y ago
      A Chromebook is a Linux system. My concern is with Ubuntu improving their security posture. Telling Canonical to give up on Ubuntu and switch everyone over to ChromeOS is not something that I predict would work.
zahlman 1y ago
Currently, for any given action, the following possibilities are implemented: * The user may never perform the action (would require sudo, but the user doesn't have sudo rights) * The user may sometimes perform the action (i.e. only after authenticating with sudo) * The user may always perform the action (is always implicitly authenticated) "Being root" is just another name for the last option. What fourth alternative do you have in mind?
- charcircuit 1y ago
  >"Being root" is just another name for the last option. No, it's not. Take for example ping. If we want users to be able to always be able to use ping does that mean they need to be root? No, it doesn't. A privileged part of the OS can handle doing the raw socket and the unpriviledged user can talk to that part of the OS. The key point is that some operations that require privileges are okay to expose to a user, but giving the user privileges for everything is dangerous.
  - theamk 1y ago
    Examples please? Modern desktop OSes are pretty good at exposing safe operations to users so that no "sudo" is required.

rurban 1y ago

Capabilities. Proper microkernels already do that

theamk 1y ago
how do they solve sudo's problems though? Exchanging "sudo" with "require-root-capability" or "start-privileged-session" will still have many of the same logic problems. Unless you mean something like "capabilities are always inherited, and there is no way to increase them", which would mean that sudo-like scripts are impossible, and you need to start all-new session as root user for admin actions. Good news, it's already possible in linux - just don't install "sudo", and maybe set up SELinux to disallow all escalation. Turns out no one wants to do this though.
- rurban 1y ago
  fine grained. there's no god-mode who can do everything. there's no universal kernel level. micro means only minimal things happen in the kernel or at root level, like routing messages. even windows understood that those times, when they did split Administrator from System. linux followed then with system users for certain services. but capabilities only allow certain calls at certain times. there's no setuid 0, only cap this and cap that for this admin user for a certain time range. BTW, SElinux is the default on a proper linux like Redhat. I use it daily. I also have to adjust the ssh caps, not just the firewall settings. Everybody wants that, just not the debian nobs.
  - vacuity 1y ago
    There is omitted detail here. Capabilities are a great way to determine access control (IMO, they are essential in general as a user-facing model too). However, that still leaves the question of who gets what capabilities. For the network service to be able to hand out network capabilities, it itself must have at least as much authority, and it had to get that authority from some other source of capabilities. There must be some privileged component that forges all capabilities, and actually distributes enough authority to make the system usable. For example, as soon as a human user becomes relevant, the system's user-avatar must be able to command authority, in a way that may seem sweeping. This could mean directly or indirectly changing which program is the network service, which means the ability to influence all networking activities, which is no small authority. An agent logically has all the capabilities necessary to do what the agent should be able to do. The sum of capabilities of an agent indicates "the worst that can happen" if the agent is malicious. It makes sense that if a network service is malicious, all networking activities can be subverted. Still, the storage activities shouldn't be subverted, and of course the network service wouldn't have the storage service capability. However, if a user is malicious, anything could go wrong that the user is normally trusted to not make go wrong. Correspondingly, the user must have an expansive sum of capabilities. Capabilities are themselves simple, but that is the mechanism perspective. Access control policy is an entirely different beast, and any mechanism at best minimizes the risks.