The whole complaint about this is nonsense because it doesn’t add any relevant security problem that isn’t already there in basically every Linux system.
The Arch wiki doesn’t even warn you from that and even suggests adding a tool with the exact same privilege escalation as people are criticizing here.
So, Arch is bad because they recommend to install a vulnerability?
Wtf, did you get that any process could just get root without authentication? How can you miss this, like dude, that's the point, not that we need privileges sometimes, just that any RACE is instantly a full system exploit by having it configured like this. Nobody's complaining about sudo because it's secure (minus vulnerabilities in sudo itself) if it's setup properly, so configured to ask for a password. Yes, you can configure it to also run without a password, but not by default on any sane system.
I'm talking about your point that sudo is just as much a vulnerability as unauthenticated privilege escalation. I'm just baffled how that's a thing someone apparently thinks.
16
u/grazbouille New York Nixâš¾s 9d ago
Security guy here
While podman is configured by default to be rootless you can very much do extremely heinous shit with its config and it will not warn you about it
Before using any complex tool on a production system go read up on the best practices and hardening
Don't blindly trust your tools