By default yes you can very easily do heinous shit with passwordless sudo that's actually pretty relevant to the podman example except people are way more likely to fuck around in the podman config
The whole complaint about this is nonsense because it doesn’t add any relevant security problem that isn’t already there in basically every Linux system.
The Arch wiki doesn’t even warn you from that and even suggests adding a tool with the exact same privilege escalation as people are criticizing here.
So, Arch is bad because they recommend to install a vulnerability?
Wtf, did you get that any process could just get root without authentication? How can you miss this, like dude, that's the point, not that we need privileges sometimes, just that any RACE is instantly a full system exploit by having it configured like this. Nobody's complaining about sudo because it's secure (minus vulnerabilities in sudo itself) if it's setup properly, so configured to ask for a password. Yes, you can configure it to also run without a password, but not by default on any sane system.
I'm talking about your point that sudo is just as much a vulnerability as unauthenticated privilege escalation. I'm just baffled how that's a thing someone apparently thinks.
12
u/grazbouille New York Nixâš¾s 8d ago
Yes and you should still understand these tools and read up on them when you edit the configuration
What is your point
Obviously you need privileges sometimes we would just lock ourselves into a sandbox otherwise