dan sounds super confident and experienced (his profile seems to indicate so as well) but I am pretty sure he is not correct.
0 Boosts
0 Likes
AutumnOut Boy
@feld@friedcheese.us
·
activity timestamp
29 min. ago
@sun the top response seems to have been written by someone (Doc) who thinks that uid 0 == root == all access to everything which is not true. there are many ways to have a uid 0 / root user that can't do fuck all. their understanding of what is possible in a unix-like system is literally stuck in the 70s.
@feld you're correct but he's also correct that generally the mitigation for uid0 total control is MAC, which, as he mentioned, is a ton of code to do that, which is an increase in attack surface. the other mitigation is dropping privileges which isn't as bad I admit.
@sun @feld A good first step would be making seccomp-bpf usable without losing one's hair. So far only OpenBSD did syscall filtering in a sane although a partially limiting way. Capsicum failed and seccomp is hard to implement to the point of developers giving up on it. And landlock is even less used despite being way better. Linux has 4 LSMs (AppArmor, SELinux, seccomp and landlock) all competing for similar field at this point.
@feld if you drop privs it's not really root anymore right, I am not sure where that leaves anybody in the debate. it's true it's more complex than just god-mode account which is in your favor. but also again, it's a bolt-on to the model.
@feld there are two things he says and one is much more defensible than the other. the first is he says stuff about linux/unix that is out of date. but it is true that it's insanely harder to prove a posix system safe because of its fundamental design. this is exactly why it's been troublesome for some C programmers in the Linux kernel when they bolted on Rust code, because Rust code requires discipline and boundaries to interact with the C code that the Linux system couldn't initially provide.
