4 ms·

I can't speak for DSLR, but I can say why Puppy Linux runs as root without disaster. (Spent a couple of years writing utilities for them.) Basically you desig

by keenerd 12y ago

I can't speak for DSLR, but I can say why Puppy Linux runs as root without disaster. (Spent a couple of years writing utilities for them.) Basically you design the system so that root has no special powers. Imagine if all of your storage was write-once, like a CD-R. What damage could root do? Almost none. Maybe there is a union file system for /usr and /home. Disregard all changes to /usr, when you reboot a fresh /usr is extracted from disk. Stuff like /home is incrementally saved. You can re-wind to any point in history. That is how Puppy (in CD-R mode) works. About the only real threat that root poses is accidentally dd-ing over the OS boot partition. With some kernel patching you could simply hide the /dev node after the boot is done with it. Though that makes updating harder. Any threat can be neutralized, but the whole OS gets slightly more byzantine as a downside. The root/user distinction places all your faith in octal permission bits. In some ways a properly designed run-as-root system is less risky, because the safeties are baked into the OS at a much deeper level. It is the difference between a dangerous machine having physical safety interlocks and paper-thin "for your safety" policies.

kbenson 12y ago
> With some kernel patching you could simply hide the /dev node after the boot is done with it. At some point we have to make the call on diminishing returns. It will always be possible for root to bork a system (without a rewrite of many, many utilities that rely on root permissiveness), it's just a matter of how hard we can make it to do that accidentally. To be clear, I think this work is very useful and appreciated though. As someone that spends almost all of every working day in terminals on remote systems, often as root, I applaud any effort to reduce catastrophic mistakes. Every time I have to rm -rf as root there's that little after-I-hit-enter-panic, where I have to assure myself I double checked and didn't accidentally just delete /bin. The root is protected from the errant rm mistake, but there's oh so many more ways to reduce a perfectly fine system to an unbooting heap of hardware. > The root/user distinction places all your faith in octal permission bits. In some ways a properly designed run-as-root system is less risky, because the safeties are baked into the OS at a much deeper level. It is the difference between a dangerous machine having physical safety interlocks and paper-thin "for your safety" policies. Give me both. Please.

by keenerd 12y ago

kbenson 12y ago

> With some kernel patching you could simply hide the /dev node after the boot is done with it. At some point we have to make the call on diminishing returns. It will always be possible for root to bork a system (without a rewrite of many, many utilities that rely on root permissiveness), it's just a matter of how hard we can make it to do that accidentally. To be clear, I think this work is very useful and appreciated though. As someone that spends almost all of every working day in terminals on remote systems, often as root, I applaud any effort to reduce catastrophic mistakes. Every time I have to rm -rf as root there's that little after-I-hit-enter-panic, where I have to assure myself I double checked and didn't accidentally just delete /bin. The root is protected from the errant rm mistake, but there's oh so many more ways to reduce a perfectly fine system to an unbooting heap of hardware. > The root/user distinction places all your faith in octal permission bits. In some ways a properly designed run-as-root system is less risky, because the safeties are baked into the OS at a much deeper level. It is the difference between a dangerous machine having physical safety interlocks and paper-thin "for your safety" policies. Give me both. Please.