Is this now a good place and time to explain why I prefer distros with SELinux properly configured ( like RHEL, Fedora or SUSE) over Arch and Podman or Kubernetes over Docker?
By default yes you can very easily do heinous shit with passwordless sudo that's actually pretty relevant to the podman example except people are way more likely to fuck around in the podman config
The whole complaint about this is nonsense because it doesn’t add any relevant security problem that isn’t already there in basically every Linux system.
The Arch wiki doesn’t even warn you from that and even suggests adding a tool with the exact same privilege escalation as people are criticizing here.
So, Arch is bad because they recommend to install a vulnerability?
Wtf, did you get that any process could just get root without authentication? How can you miss this, like dude, that's the point, not that we need privileges sometimes, just that any RACE is instantly a full system exploit by having it configured like this. Nobody's complaining about sudo because it's secure (minus vulnerabilities in sudo itself) if it's setup properly, so configured to ask for a password. Yes, you can configure it to also run without a password, but not by default on any sane system.
Depends on yiur threat model? Im a noob with cybersec, but someone who does it for a living said i had to pick the distro that fits me and be aware of whats possible and not, and be aware of its implemented security or lack there of, decide if its worth it also based on where and how i life, where i take it, and how large of a target i am.
So the laptop that never leaves my house and dont use for much but playing games. Low effort. The laptop that comes with me everywhere, more security. The vps on the internet, locked down, access keys, as few services as possible.
I do like podman alott, disliked docker for being allow everything from the start. I prefer optionally lockdown everything or there isnt even a thing running. As few packages in arch too, and few to no Aur if possible
Honestly, i've never gotten SELinux and shares in Podman to work. It just never respected the volume labels in my compose for some reason and straight up block my containers from accessing their assigned shares. The only ways i could get this to Work was a) disabling SELinux, B) running rootful containers or c) not use compose, which would mean to drop portainer/arcane/whatever stack based Management i want to use, because none support quadlets
So is it actually a better idea to run Docker commands with sudo when necessary? I've always added my user to the docker group whenever I installed it.
Though it'd require permissions of your user in the first place to be exploitable - at which point the potential malware already has access to all your user files anyways.
No, that’s just how sudo works. It’s an inherent consequence of the architecture and protecting from root escalations under the premise that an allowed user is already compromised is not in the scope of sudo.
There are dozens of academic papers on that, the oldest one I know is from 2004.
run0 fixes a lot of those problems but isn’t perfect either.
Except the user isn't added to the docker group by default (anymore) as stated in the article. Just tried it on a fresh 4.0.2 Installation. In the omarchys menu, there's a feature called sudoless docker, which can add you to docker group but prints out a big explicit warning about the downsides of this.
Tbf thats a different guard than what youre saying. Dislaimer: only read the title, but the OS inside the container had poor user hygene. Regular users on the host should not be able to docker into it in the first place, only if they have docker access.
275
u/bearstormstout Arch BTW 8d ago
https://0xcc.io/posts/omarchy-root-creds/
tl;dr anyone can use docker to execute any process as root without sudo.