6 ms·

I am the owner and only user of the computer. Does that mean I should run everything with root? Of course not. It’s simply better to start with little privilege

by kccqzy 11mo ago

I am the owner and only user of the computer. Does that mean I should run everything with root? Of course not. It’s simply better to start with little privileges and then elevate when needed. Using any additional privileges should be an intentional act. I also do it the other way: reduce my privileges via sudo -u nobody.

charcircuit 11mo ago
The root account shouldn't exist either. Having god accounts is a bad idea security wise. Instead everything should follow the principle of least privilege.
- cyberax 11mo ago
  This sounds good in theory, but in practice it doesn't work. You always end up with an object that has all the privileges.
  - rurban 11mo ago
    Which is a well known anti-pattern. https://en.wikipedia.org/wiki/God_object https://en.wikipedia.org/wiki/God_object
    - lucketone 11mo ago
      That one seems unrelated with OS security model and root account. (One must squint really hard to see root and oop god object as same)
- nkrisc 11mo ago
  I own the computer. The least privilege I have encompasses every privilege.
  - charcircuit 11mo ago
    You could own a microwave, but there doesn't have to be a button that makes it run with the door open. The UI of devices doesn't let just anything happen. Similarly an operating system doesn't need to make accessible a way to do everything to the user.
    - esseph 11mo ago
      "an operating system doesn't need to make accessible a way to do everything to the user" Microsoft and Apple both seem to think this way. Questionable results.
    - crabmusket 11mo ago
      I instinctually agree with nkrisc, but this is an interesting line of thought. What's an example of something that nobody should be allowed to do e.g. on a laptop? If I buy a system with OS stuff set up from the get-go. What abilities do you withdraw from the user?
      - charcircuit 11mo ago
        >What's an example of something that nobody should be allowed to do e.g. on a laptop? Clearing required efi variables, bricking the motherboard. https://www.phoronix.com/news/UEFI-rm-root-directory https://www.phoronix.com/news/UEFI-rm-root-directory
    - inkyoto 11mo ago
      > You could own a microwave, but there doesn't have to be a button that makes it run with the door open. The UI of devices doesn't let just anything happen. And where is the UI capability that prevents microwave users from putting liquids (e.g. grape juice) that generate plasma storms inside the microwave and often result in fires? Or, as a bonus, crinkled foil. To state the matter bluntly – the entire diatribe concerning the system’s role in defining capabilities is as constructive as insisting that every computing device and appliance on the planet must implement B2-level RBAC and capability-based controls – an argument so unmoored from practical reality that one wonders whether its proponent has ever been burdened by implementation.
  - davexunit 11mo ago
    But do you want your web browser to have the privilege to read your SSH private key? That's the risk of running programs "as you".
- jandrese 11mo ago
  The problem is how do you set up those permissions without a god object? How do you fix ones that are broken on a running system? Ultimately the security systems that introduce high complexity in the name of fine grain permission controls end up being the most fragile and hardest to verify. People get stuff wrong then break it further trying to get their job done. The better system is sometimes the one that doesn’t have all of the features but is comprehensible to humans.
  - charcircuit 11mo ago
    >how do you set up those permissions without a god object Let the operating system define default granted permissions for OS apps. Have the OS let the user grant permissions at install / runtime for apps.
    - theamk 11mo ago
      If an app requires a permission, how does OS know that it's OK to grant it? For example, I want to backup my system, so I install app which needs a permission called "bypass any file access control and let me read every file". How does OS know it's legitimate and not malware trying to steal data? It could be "this requires special digital signature from OS manufacturer" -> then the private key of this digital signature is a "god object" It could be "this requires confirmation from the physically present user" -> then you basically have passwordless sudo It could be "this requires users pin/password/biometrics" -> then you have regular sudo Either way, there is some source of authority in here, even if it's called "root key" or "user pin" instead of "root account".
      - charcircuit 11mo ago
        >then the private key of this digital signature is a "god object" You could instead require the app to be part of the OS. The next gotcha would from you I imagine is that the build farm for the next OS update is a god object and at that point I think this is a meaningless tangent. I'll concede and say you have to trust your OS creator. But you always have to trust your OS creator for any OS. >then you basically have passwordless sudo If sudo couldn't be used from other programs / she'll scripts and doesn't give access to a god account, but instead did simple things like let you use ping, then that seems fine to me. But why require people to manually wrap programs when it could be handled automatically. >Either way, there is some source of authority in here Sure, but it's a system that's much better than sudo.
- esseph 11mo ago
  You should read over NIST 800-53 AC-2 and AC-6. They go over why privileged accounts are important, why they are used, and how they protect users and organizations. JIT access should be the goal. Scroll down to: Implementation Guidance https://csf.tools/reference/cloud-controls-matrix/v4-0/iam/iam-10/ https://csf.tools/reference/cloud-controls-matrix/v4-0/iam/i...
  - charcircuit 11mo ago
    >JIT access should be the goal. Individual privileges for specific things should be given access to instead of giving god access to a system.
    - esseph 11mo ago
      I hear what you are saying but many, many people who have dedicated their life to this topic disagree with you. Onions have layers for a reason. RBAC by nature requires a Creator. ZeroTrust networks still require gateways.
      - charcircuit 11mo ago
        I'm not saying there can't be an admin who can create roles, or do some extra authentication to gain that privilege. I am saying that it shouldn't require assuming an all powerful user to do it. You should be able to do it from your actual account. This is good for keeping accurate records too since all actions are done by the users themselves. Yes, technically sudo can be logged, but it's bypassable by starting a shell.
        esseph 11mo ago
        Elevated credentials for said users segment access while still allowing the same user to access more administrative function. Proper group / sudoers mappings can go a long way, but you still want that administrative break between access levels.
- Elucalidavah 11mo ago
  If you have a privilege to replace the kernel or bootloader, you effectively have all privileges on that system. Therefore, there's no need to complicate the access limitations when you get full access anyway.
- iberator 11mo ago
  There has been no such operating system in the past 60 years. All systems have root/admin/god accounts
Veserv 11mo ago
No, you should run every program with only the privileges it needs. The very concept of running your programs with all your privileges as a user by default is wrong-headed to begin with. To strain the "user" model you should have a distinct "user" for every single program which has only the resources and privileges needed by/allocated to that program. The actual user can allocate their resources to these "users" as needed. This is a fairly primitive version of the idea due to having to torture fundamentally incompatible insecure building blocks to fit, but points in the direction of the correct idea.
- cipherself 11mo ago
  I have used systemd services before to do this to run an application, I had a user created specifically for the application, and I defined the capabilities the application needed via CapabilityBoundingSet and AmbientCapabilities [0] and I used a lot of stuff from [1] to restrict the application e.g. the sandboxing facilities, restricting the allowed syscalls [2], ...etc. systemd also comes with a useful command systemd analyze security [3] [0] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#Capabilities https://www.freedesktop.org/software/systemd/man/latest/syst... [1] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html https://www.freedesktop.org/software/systemd/man/latest/syst... [2] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#System%20Call%20Filtering https://www.freedesktop.org/software/systemd/man/latest/syst... [3] https://www.freedesktop.org/software/systemd/man/latest/systemd-analyze.html#systemd-analyze%20security%20%5BUNIT...%5D https://www.freedesktop.org/software/systemd/man/latest/syst...
  - tcyrus 11mo ago
    Have you looked into using DynamicUser [0] with {Cache, Logs, State}Directory [1]? [0] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser= https://www.freedesktop.org/software/systemd/man/latest/syst... [1] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#RuntimeDirectory= https://www.freedesktop.org/software/systemd/man/latest/syst...
arialdomartini 11mo ago
Can you please elaborate on the use of sudo -u nobody? Do you use it interactively? I’m intrigued.
- kccqzy 11mo ago
  Yea I do. I use it for programs where I’m unsure whether it will read or modify my filesystem. I still allow the program to run arbitrary computation and use the network. It’s just the filesystem part that I want to isolate.

by kccqzy 11mo ago

charcircuit 11mo ago

The root account shouldn't exist either. Having god accounts is a bad idea security wise. Instead everything should follow the principle of least privilege.

cyberax 11mo ago
This sounds good in theory, but in practice it doesn't work. You always end up with an object that has all the privileges.
- rurban 11mo ago
  Which is a well known anti-pattern. https://en.wikipedia.org/wiki/God_object https://en.wikipedia.org/wiki/God_object
  - lucketone 11mo ago
    That one seems unrelated with OS security model and root account. (One must squint really hard to see root and oop god object as same)
nkrisc 11mo ago
I own the computer. The least privilege I have encompasses every privilege.
- charcircuit 11mo ago
  You could own a microwave, but there doesn't have to be a button that makes it run with the door open. The UI of devices doesn't let just anything happen. Similarly an operating system doesn't need to make accessible a way to do everything to the user.
  - esseph 11mo ago
    "an operating system doesn't need to make accessible a way to do everything to the user" Microsoft and Apple both seem to think this way. Questionable results.
  - crabmusket 11mo ago
    I instinctually agree with nkrisc, but this is an interesting line of thought. What's an example of something that nobody should be allowed to do e.g. on a laptop? If I buy a system with OS stuff set up from the get-go. What abilities do you withdraw from the user?
    - charcircuit 11mo ago
      >What's an example of something that nobody should be allowed to do e.g. on a laptop? Clearing required efi variables, bricking the motherboard. https://www.phoronix.com/news/UEFI-rm-root-directory https://www.phoronix.com/news/UEFI-rm-root-directory
  - inkyoto 11mo ago
    > You could own a microwave, but there doesn't have to be a button that makes it run with the door open. The UI of devices doesn't let just anything happen. And where is the UI capability that prevents microwave users from putting liquids (e.g. grape juice) that generate plasma storms inside the microwave and often result in fires? Or, as a bonus, crinkled foil. To state the matter bluntly – the entire diatribe concerning the system’s role in defining capabilities is as constructive as insisting that every computing device and appliance on the planet must implement B2-level RBAC and capability-based controls – an argument so unmoored from practical reality that one wonders whether its proponent has ever been burdened by implementation.
- davexunit 11mo ago
  But do you want your web browser to have the privilege to read your SSH private key? That's the risk of running programs "as you".
jandrese 11mo ago
The problem is how do you set up those permissions without a god object? How do you fix ones that are broken on a running system? Ultimately the security systems that introduce high complexity in the name of fine grain permission controls end up being the most fragile and hardest to verify. People get stuff wrong then break it further trying to get their job done. The better system is sometimes the one that doesn’t have all of the features but is comprehensible to humans.
- charcircuit 11mo ago
  >how do you set up those permissions without a god object Let the operating system define default granted permissions for OS apps. Have the OS let the user grant permissions at install / runtime for apps.
  - theamk 11mo ago
    If an app requires a permission, how does OS know that it's OK to grant it? For example, I want to backup my system, so I install app which needs a permission called "bypass any file access control and let me read every file". How does OS know it's legitimate and not malware trying to steal data? It could be "this requires special digital signature from OS manufacturer" -> then the private key of this digital signature is a "god object" It could be "this requires confirmation from the physically present user" -> then you basically have passwordless sudo It could be "this requires users pin/password/biometrics" -> then you have regular sudo Either way, there is some source of authority in here, even if it's called "root key" or "user pin" instead of "root account".
    - charcircuit 11mo ago
      >then the private key of this digital signature is a "god object" You could instead require the app to be part of the OS. The next gotcha would from you I imagine is that the build farm for the next OS update is a god object and at that point I think this is a meaningless tangent. I'll concede and say you have to trust your OS creator. But you always have to trust your OS creator for any OS. >then you basically have passwordless sudo If sudo couldn't be used from other programs / she'll scripts and doesn't give access to a god account, but instead did simple things like let you use ping, then that seems fine to me. But why require people to manually wrap programs when it could be handled automatically. >Either way, there is some source of authority in here Sure, but it's a system that's much better than sudo.
esseph 11mo ago
You should read over NIST 800-53 AC-2 and AC-6. They go over why privileged accounts are important, why they are used, and how they protect users and organizations. JIT access should be the goal. Scroll down to: Implementation Guidance https://csf.tools/reference/cloud-controls-matrix/v4-0/iam/iam-10/ https://csf.tools/reference/cloud-controls-matrix/v4-0/iam/i...
- charcircuit 11mo ago
  >JIT access should be the goal. Individual privileges for specific things should be given access to instead of giving god access to a system.
  - esseph 11mo ago
    I hear what you are saying but many, many people who have dedicated their life to this topic disagree with you. Onions have layers for a reason. RBAC by nature requires a Creator. ZeroTrust networks still require gateways.
    - charcircuit 11mo ago
      I'm not saying there can't be an admin who can create roles, or do some extra authentication to gain that privilege. I am saying that it shouldn't require assuming an all powerful user to do it. You should be able to do it from your actual account. This is good for keeping accurate records too since all actions are done by the users themselves. Yes, technically sudo can be logged, but it's bypassable by starting a shell.
      - esseph 11mo ago
        Elevated credentials for said users segment access while still allowing the same user to access more administrative function. Proper group / sudoers mappings can go a long way, but you still want that administrative break between access levels.
Elucalidavah 11mo ago
If you have a privilege to replace the kernel or bootloader, you effectively have all privileges on that system. Therefore, there's no need to complicate the access limitations when you get full access anyway.
iberator 11mo ago
There has been no such operating system in the past 60 years. All systems have root/admin/god accounts

Veserv 11mo ago

No, you should run every program with only the privileges it needs. The very concept of running your programs with all your privileges as a user by default is wrong-headed to begin with. To strain the "user" model you should have a distinct "user" for every single program which has only the resources and privileges needed by/allocated to that program. The actual user can allocate their resources to these "users" as needed. This is a fairly primitive version of the idea due to having to torture fundamentally incompatible insecure building blocks to fit, but points in the direction of the correct idea.

cipherself 11mo ago
I have used systemd services before to do this to run an application, I had a user created specifically for the application, and I defined the capabilities the application needed via CapabilityBoundingSet and AmbientCapabilities [0] and I used a lot of stuff from [1] to restrict the application e.g. the sandboxing facilities, restricting the allowed syscalls [2], ...etc. systemd also comes with a useful command systemd analyze security [3] [0] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#Capabilities https://www.freedesktop.org/software/systemd/man/latest/syst... [1] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html https://www.freedesktop.org/software/systemd/man/latest/syst... [2] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#System%20Call%20Filtering https://www.freedesktop.org/software/systemd/man/latest/syst... [3] https://www.freedesktop.org/software/systemd/man/latest/systemd-analyze.html#systemd-analyze%20security%20%5BUNIT...%5D https://www.freedesktop.org/software/systemd/man/latest/syst...
- tcyrus 11mo ago
  Have you looked into using DynamicUser [0] with {Cache, Logs, State}Directory [1]? [0] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser= https://www.freedesktop.org/software/systemd/man/latest/syst... [1] https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#RuntimeDirectory= https://www.freedesktop.org/software/systemd/man/latest/syst...

arialdomartini 11mo ago

Can you please elaborate on the use of sudo -u nobody? Do you use it interactively? I’m intrigued.

kccqzy 11mo ago
Yea I do. I use it for programs where I’m unsure whether it will read or modify my filesystem. I still allow the program to run arbitrary computation and use the network. It’s just the filesystem part that I want to isolate.