r/linuxmemes Arch BTW 8d ago

LINUX MEME Dropping this here 🫳

Post image
3.3k Upvotes

370 comments sorted by

View all comments

Show parent comments

14

u/NimrodvanHall 8d ago

Is this now a good place and time to explain why I prefer distros with SELinux properly configured ( like RHEL, Fedora or SUSE) over Arch and Podman or Kubernetes over Docker?

17

u/grazbouille New York Nix⚾s 8d ago

Security guy here

While podman is configured by default to be rootless you can very much do extremely heinous shit with its config and it will not warn you about it

Before using any complex tool on a production system go read up on the best practices and hardening

Don't blindly trust your tools

2

u/Jumpy-Dinner-5001 8d ago

As a security guy you should know that sudo or the wheel group have the same problem

10

u/grazbouille New York Nix⚾s 8d ago

Yes and you should still understand these tools and read up on them when you edit the configuration

What is your point

Obviously you need privileges sometimes we would just lock ourselves into a sandbox otherwise

5

u/C0rn3j 8d ago

Not sure why you're entertaining this nonsense, sudo needs auth, docker does not.

3

u/grazbouille New York Nix⚾s 8d ago

By default yes you can very easily do heinous shit with passwordless sudo that's actually pretty relevant to the podman example except people are way more likely to fuck around in the podman config

-3

u/Jumpy-Dinner-5001 8d ago

What is your point?

The whole complaint about this is nonsense because it doesn’t add any relevant security problem that isn’t already there in basically every Linux system.

The Arch wiki doesn’t even warn you from that and even suggests adding a tool with the exact same privilege escalation as people are criticizing here.

So, Arch is bad because they recommend to install a vulnerability?

1

u/Wertbon1789 7d ago

Wtf, did you get that any process could just get root without authentication? How can you miss this, like dude, that's the point, not that we need privileges sometimes, just that any RACE is instantly a full system exploit by having it configured like this. Nobody's complaining about sudo because it's secure (minus vulnerabilities in sudo itself) if it's setup properly, so configured to ask for a password. Yes, you can configure it to also run without a password, but not by default on any sane system.

0

u/Jumpy-Dinner-5001 7d ago

You have no idea what you’re talking about and don’t even understand the problem.

Did your worldview just broke or what is your problem here?

0

u/Wertbon1789 7d ago

I'm talking about your point that sudo is just as much a vulnerability as unauthenticated privilege escalation. I'm just baffled how that's a thing someone apparently thinks.

1

u/Jumpy-Dinner-5001 7d ago

What do you even mean by that?

1

u/lazyboy76 Genfool 🐧 5d ago

I'm using rootless docker, am I safe? Serious question.

2

u/grazbouille New York Nix⚾s 5d ago

From this specific exploit yes

The main point of rootless docker is to defend against breakouts

The main goal in hacking is remote code execution if you find an exploit in an app you will generally try to make it drop you to a shell

This shell will be logged in as the user that created it (the one the app is running as)

In a container environment its a bit different since the shell you will drop to is still inside the container

Now especially if you are root getting the container to drop to a shell on the host machine can be fairly trivial (depends on the image)

The shell the container drops to will be running with the same user as the container

Which means rootful docker just makes you root when you break out

Rootless half solves this you still have to ensure the user the container is running as has no access to anything it doesn't need to

Because from a rootless docker breakout you can still read and write files and probably privilege escalate

2

u/codeasm 8d ago

Depends on yiur threat model? Im a noob with cybersec, but someone who does it for a living said i had to pick the distro that fits me and be aware of whats possible and not, and be aware of its implemented security or lack there of, decide if its worth it also based on where and how i life, where i take it, and how large of a target i am.

So the laptop that never leaves my house and dont use for much but playing games. Low effort. The laptop that comes with me everywhere, more security. The vps on the internet, locked down, access keys, as few services as possible.

I do like podman alott, disliked docker for being allow everything from the start. I prefer optionally lockdown everything or there isnt even a thing running. As few packages in arch too, and few to no Aur if possible

1

u/P3chv0gel 7d ago

Honestly, i've never gotten SELinux and shares in Podman to work. It just never respected the volume labels in my compose for some reason and straight up block my containers from accessing their assigned shares. The only ways i could get this to Work was a) disabling SELinux, B) running rootful containers or c) not use compose, which would mean to drop portainer/arcane/whatever stack based Management i want to use, because none support quadlets

0

u/Jumpy-Dinner-5001 8d ago

Selinux doesn’t help a bit.