4 ms·

There is. Simply do not install sudo and do not allow access to root at runtime. I am serious. There is absolutely nothing you cannot run unprivileged these day

by lrvick 1mo ago

There is. Simply do not install sudo and do not allow access to root at runtime. I am serious. There is absolutely nothing you cannot run unprivileged these days. Can even run sshd from a systemd user unit in your home folder, and even assign port 22 to it if needed with Linux Capabilities.

inigyou 1mo ago
How do you update the kernel?
- cute_boi 1mo ago
  Idk why we need to use sudo to update kernel. In macos, we don't need sudo access?
  - NekkoDroid 1mo ago
    You do need some root process to be able to write the updated kernel image to a root owned directory. On macos that is presumably their update daemon, while on something like ParticleOS[0] IIRC it is the systemd-sysupdated daemon, though I don't know if you can initiate the update as an unprivileged user or if its done on a timer or only root initiated (sysupdate has had a lot of changes not too long ago that reworked it extensively. It use to be something only root invoked transiently with a possible timer to "update all", but now it has a full on daemon). Basically the reason we "need sudo access" (or anything to elevate privs to root) is because how the system is architected and changing that is mostly only possible on new distros which can decide to change the architecture. [0]: https://github.com/systemd/particleos https://github.com/systemd/particleos
- lrvick 1mo ago
  See my reply here: https://news.ycombinator.com/item?id=49504775 https://news.ycombinator.com/item?id=49504775
utopiah 1mo ago
Just don't be in the sudo group.
- declan_roberts 1mo ago
  So the solution is to make your computer basically unusable. I guess that's one way to secure things.
  - lrvick 1mo ago
    On a modern Linux system you do not need sudo to compile software, install it, or even run it as an unprivileged system service in a User Namespace bound to port 22 (if you give your user the correct Linux Capabilities). The only thing you cannot do as an unprivileged user is update kernels, but that requires a reboot anyway and the risk of letting an unprivileged user do that is mitigated with hardware enforced secure boot. Most distros are holding onto 90s designs that are very hard to change once established.
  - utopiah 1mo ago
    Did you actually try or are you provocatively speculating? I do have non sudoers groups devices and I also have shared devices with non sudoers users. It works. It's not necessarily for everyone, e.g. not for powerusers who want to go fast very often, but it's definitely usable for most users still.
dist-epoch 1mo ago
But what exactly are you protecting then? Linux root/regular-user model comes from an ancient time with multi-user architecture where you defended against one user taking over a big machine they didn't own. But today on personal computers all the good stuff is inside regular users accounts, and there is nothing valuable to be gained by becoming root. So the whole security model is broken, it protects the OS system files that nobody cares about, while allowing any piece of software complete access to valuable user files.
- lrvick 1mo ago
  Well you of course want to sub-divide every application in user space either with gvisor or a hypervisor, like QubesOS. If someone pwns your personal browser they should pop out into an environment where nothing exists but that browser, with no idea the work browser is in a sibling vm.

by lrvick 1mo ago

inigyou 1mo ago

How do you update the kernel?

cute_boi 1mo ago
Idk why we need to use sudo to update kernel. In macos, we don't need sudo access?
- NekkoDroid 1mo ago
  You do need some root process to be able to write the updated kernel image to a root owned directory. On macos that is presumably their update daemon, while on something like ParticleOS[0] IIRC it is the systemd-sysupdated daemon, though I don't know if you can initiate the update as an unprivileged user or if its done on a timer or only root initiated (sysupdate has had a lot of changes not too long ago that reworked it extensively. It use to be something only root invoked transiently with a possible timer to "update all", but now it has a full on daemon). Basically the reason we "need sudo access" (or anything to elevate privs to root) is because how the system is architected and changing that is mostly only possible on new distros which can decide to change the architecture. [0]: https://github.com/systemd/particleos https://github.com/systemd/particleos
lrvick 1mo ago
See my reply here: https://news.ycombinator.com/item?id=49504775 https://news.ycombinator.com/item?id=49504775

utopiah 1mo ago

Just don't be in the sudo group.

declan_roberts 1mo ago
So the solution is to make your computer basically unusable. I guess that's one way to secure things.
- lrvick 1mo ago
  On a modern Linux system you do not need sudo to compile software, install it, or even run it as an unprivileged system service in a User Namespace bound to port 22 (if you give your user the correct Linux Capabilities). The only thing you cannot do as an unprivileged user is update kernels, but that requires a reboot anyway and the risk of letting an unprivileged user do that is mitigated with hardware enforced secure boot. Most distros are holding onto 90s designs that are very hard to change once established.
- utopiah 1mo ago
  Did you actually try or are you provocatively speculating? I do have non sudoers groups devices and I also have shared devices with non sudoers users. It works. It's not necessarily for everyone, e.g. not for powerusers who want to go fast very often, but it's definitely usable for most users still.

dist-epoch 1mo ago

But what exactly are you protecting then? Linux root/regular-user model comes from an ancient time with multi-user architecture where you defended against one user taking over a big machine they didn't own. But today on personal computers all the good stuff is inside regular users accounts, and there is nothing valuable to be gained by becoming root. So the whole security model is broken, it protects the OS system files that nobody cares about, while allowing any piece of software complete access to valuable user files.

lrvick 1mo ago
Well you of course want to sub-divide every application in user space either with gvisor or a hypervisor, like QubesOS. If someone pwns your personal browser they should pop out into an environment where nothing exists but that browser, with no idea the work browser is in a sibling vm.