6 ms·

Wow. This never crossed my mind but of course that's so simple. There really needs to be a better solution.

lrvick 17d ago
There is. Simply do not install sudo and do not allow access to root at runtime. I am serious. There is absolutely nothing you cannot run unprivileged these days. Can even run sshd from a systemd user unit in your home folder, and even assign port 22 to it if needed with Linux Capabilities.
- inigyou 17d ago
  How do you update the kernel?
  - cute_boi 17d ago
    Idk why we need to use sudo to update kernel. In macos, we don't need sudo access?
    - NekkoDroid 16d ago
      You do need some root process to be able to write the updated kernel image to a root owned directory. On macos that is presumably their update daemon, while on something like ParticleOS[0] IIRC it is the systemd-sysupdated daemon, though I don't know if you can initiate the update as an unprivileged user or if its done on a timer or only root initiated (sysupdate has had a lot of changes not too long ago that reworked it extensively. It use to be something only root invoked transiently with a possible timer to "update all", but now it has a full on daemon). Basically the reason we "need sudo access" (or anything to elevate privs to root) is because how the system is architected and changing that is mostly only possible on new distros which can decide to change the architecture. [0]: https://github.com/systemd/particleos https://github.com/systemd/particleos
  - lrvick 17d ago
    See my reply here: https://news.ycombinator.com/item?id=49504775 https://news.ycombinator.com/item?id=49504775
- utopiah 17d ago
  Just don't be in the sudo group.
  - declan_roberts 17d ago
    So the solution is to make your computer basically unusable. I guess that's one way to secure things.
    - lrvick 17d ago
      On a modern Linux system you do not need sudo to compile software, install it, or even run it as an unprivileged system service in a User Namespace bound to port 22 (if you give your user the correct Linux Capabilities). The only thing you cannot do as an unprivileged user is update kernels, but that requires a reboot anyway and the risk of letting an unprivileged user do that is mitigated with hardware enforced secure boot. Most distros are holding onto 90s designs that are very hard to change once established.
    - utopiah 17d ago
      Did you actually try or are you provocatively speculating? I do have non sudoers groups devices and I also have shared devices with non sudoers users. It works. It's not necessarily for everyone, e.g. not for powerusers who want to go fast very often, but it's definitely usable for most users still.
- dist-epoch 17d ago
  But what exactly are you protecting then? Linux root/regular-user model comes from an ancient time with multi-user architecture where you defended against one user taking over a big machine they didn't own. But today on personal computers all the good stuff is inside regular users accounts, and there is nothing valuable to be gained by becoming root. So the whole security model is broken, it protects the OS system files that nobody cares about, while allowing any piece of software complete access to valuable user files.
  - lrvick 17d ago
    Well you of course want to sub-divide every application in user space either with gvisor or a hypervisor, like QubesOS. If someone pwns your personal browser they should pop out into an environment where nothing exists but that browser, with no idea the work browser is in a sibling vm.
dist-epoch 17d ago
on Windows the UAC (GUI sudo equivalent) requires actual user input (keyboard, mouse) on a dialog presented in a secure way (can't be faked by malware)
- declan_roberts 17d ago
  Windows and Mac each have well thought through and secure solutions to these problems. It just doesn't exist on Linux without serious sacrifice of UX.
- jasomill 17d ago
  UAC is only a sudo equivalent when running under a non-admin user account, at which point it's nearly as convenient to simply run admin commands from a command prompt running as a separate user, or a separate desktop session entirely.
- pritambaral 16d ago
  The Desktop Linux equivalent to that would be Polkit. Psst. There's also this, in typical KDE style: https://github.com/aeroshell-desktop/uac-polkit-agent https://github.com/aeroshell-desktop/uac-polkit-agent

There is. Simply do not install sudo and do not allow access to root at runtime. I am serious. There is absolutely nothing you cannot run unprivileged these days. Can even run sshd from a systemd user unit in your home folder, and even assign port 22 to it if needed with Linux Capabilities.

inigyou 17d ago
How do you update the kernel?
- cute_boi 17d ago
  Idk why we need to use sudo to update kernel. In macos, we don't need sudo access?
  - NekkoDroid 16d ago
    You do need some root process to be able to write the updated kernel image to a root owned directory. On macos that is presumably their update daemon, while on something like ParticleOS[0] IIRC it is the systemd-sysupdated daemon, though I don't know if you can initiate the update as an unprivileged user or if its done on a timer or only root initiated (sysupdate has had a lot of changes not too long ago that reworked it extensively. It use to be something only root invoked transiently with a possible timer to "update all", but now it has a full on daemon). Basically the reason we "need sudo access" (or anything to elevate privs to root) is because how the system is architected and changing that is mostly only possible on new distros which can decide to change the architecture. [0]: https://github.com/systemd/particleos https://github.com/systemd/particleos
- lrvick 17d ago
  See my reply here: https://news.ycombinator.com/item?id=49504775 https://news.ycombinator.com/item?id=49504775
utopiah 17d ago
Just don't be in the sudo group.
- declan_roberts 17d ago
  So the solution is to make your computer basically unusable. I guess that's one way to secure things.
  - lrvick 17d ago
    On a modern Linux system you do not need sudo to compile software, install it, or even run it as an unprivileged system service in a User Namespace bound to port 22 (if you give your user the correct Linux Capabilities). The only thing you cannot do as an unprivileged user is update kernels, but that requires a reboot anyway and the risk of letting an unprivileged user do that is mitigated with hardware enforced secure boot. Most distros are holding onto 90s designs that are very hard to change once established.
  - utopiah 17d ago
    Did you actually try or are you provocatively speculating? I do have non sudoers groups devices and I also have shared devices with non sudoers users. It works. It's not necessarily for everyone, e.g. not for powerusers who want to go fast very often, but it's definitely usable for most users still.
dist-epoch 17d ago
But what exactly are you protecting then? Linux root/regular-user model comes from an ancient time with multi-user architecture where you defended against one user taking over a big machine they didn't own. But today on personal computers all the good stuff is inside regular users accounts, and there is nothing valuable to be gained by becoming root. So the whole security model is broken, it protects the OS system files that nobody cares about, while allowing any piece of software complete access to valuable user files.
- lrvick 17d ago
  Well you of course want to sub-divide every application in user space either with gvisor or a hypervisor, like QubesOS. If someone pwns your personal browser they should pop out into an environment where nothing exists but that browser, with no idea the work browser is in a sibling vm.

dist-epoch 17d ago

on Windows the UAC (GUI sudo equivalent) requires actual user input (keyboard, mouse) on a dialog presented in a secure way (can't be faked by malware)

declan_roberts 17d ago
Windows and Mac each have well thought through and secure solutions to these problems. It just doesn't exist on Linux without serious sacrifice of UX.
jasomill 17d ago
UAC is only a sudo equivalent when running under a non-admin user account, at which point it's nearly as convenient to simply run admin commands from a command prompt running as a separate user, or a separate desktop session entirely.
pritambaral 16d ago
The Desktop Linux equivalent to that would be Polkit. Psst. There's also this, in typical KDE style: https://github.com/aeroshell-desktop/uac-polkit-agent https://github.com/aeroshell-desktop/uac-polkit-agent