Omarchy: Any User Process Can Escalate to Root

a month ago by inari to c/linux

A security issue in Omarchy’s default Docker configuration meant that essentially every program running in the user’s desktop session could escalate to root without a password, sudo, or a privilege prompt. If you use Omarchy, the most important takeaway is simple: update to 4.0.1. I reported this issue privately through the project’s responsible-disclosure process. The underlying configuration has since been patched, so I’m publishing the details now to explain what the issue is and let users know to update their systems.
alastel 197 points a month ago

If you use Omarchy, the most important takeaway is simple

stop using a system made by fascist?

path: 0 25573572, hotness: undefined, score: 197, children: 33
disorderly 132 points a month ago

I wasn't sure what to make of claims that this random techbro is a fascist, so I decided to look for clues. I found this article from last month in minutes, and after reading it, I require no further convincing. Guy's a Nazi whether he knows it or not.

path: 0 25573572 25574044, hotness: undefined, score: 132, children: 30
thingsiplay 91 points a month ago

Quote from end of your linked article. Note he talks about humans:

When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them.

path: 0 25573572 25574044 25574158, hotness: undefined, score: 91, children: 10
distal 27 points a month ago

This guy is complete trash. Does excessive coding rip holes into people's brains?

path: 0 25573572 25574044 25574158 25575695, hotness: undefined, score: 27, children: 8
grue 56 points a month ago path: 0 25573572 25574044 25574158 25575695 25575938, hotness: undefined, score: 56, children: 6
A_norny_mousse 8 points a month ago

There seems to be a notable amount of FOSS coders of the old guard (90s til 00s) that are like that.

I long frequented a place called linuxquestions.org. You wouldn't believe how right-wing to libertarian most of the people there were. Still are I guess.

Some gained status (Ruby on Rails was a big thing 1 or 2 decades back) and started spouting things because they knew people were listening.

Some people in such communities recognize that there's something off here, and they have this excuse ready: all coders/nerds are basically on the spectrum (they don't phrase it like this though) and don't know how to phrase things politely, they just blurt it out.

As if that makes things better when you think like that guy.

path: 0 25573572 25574044 25574158 25575695 25581039, hotness: undefined, score: 8, children: 0
Cris_Citrus 13 points a month ago

😬😬😬😬😬😬😬

EUGHH.. fuckin gross...

path: 0 25573572 25574044 25574158 25578700, hotness: undefined, score: 13, children: 0
geneva_convenience 40 points a month ago

Guy's a Nazi whether he knows it or not.

He knows it. He just doesn't admit it.

path: 0 25573572 25574044 25574388, hotness: undefined, score: 40, children: 1
clmbmb 8 points a month ago

He just doesn’t admit it...

publicly.

path: 0 25573572 25574044 25574388 25580488, hotness: undefined, score: 8, children: 0
A_norny_mousse 32 points a month ago

Ugh, I stopped reading when he segued from wolves being a danger to humans straight into the "gypsy problem" 🤮

Also had a look at the site for this distro, he really seems to like cars and seems to be pretty full of himself about some neither-new-nor-original arch+tiling_wm distro.

path: 0 25573572 25574044 25574248, hotness: undefined, score: 32, children: 2
chloroken 5 points a month ago

segue my friend

path: 0 25573572 25574044 25574248 25578171, hotness: undefined, score: 5, children: 1
A_norny_mousse 2 points a month ago

Thanks, fixed

path: 0 25573572 25574044 25574248 25578171 25580957, hotness: undefined, score: 2, children: 0
NotSteve_ 28 points a month ago

The creator and maintainer of NeoVim was also really against removing a DHH endorsement from the NeoVim website and called it cancel culture.

path: 0 25573572 25574044 25575908, hotness: undefined, score: 28, children: 3
VeganCheesecake 11 points a month ago

Made me look at helix, which actually works better for my usecase. So I guess I gotta thank him for that?

path: 0 25573572 25574044 25575908 25584064, hotness: undefined, score: 11, children: 2
BigJohnnyHines 7 points a month ago

Helix is amazing anyway.

path: 0 25573572 25574044 25575908 25584064 25588002, hotness: undefined, score: 7, children: 0
NotSteve_ 5 points a month ago

I'm in the exact same boat as I also switched to helix haha

path: 0 25573572 25574044 25575908 25584064 25584335, hotness: undefined, score: 5, children: 0
Jayjader 23 points a month ago

If anyone is interested in a more thorough and recent write-up of why many of us call DHH fash, this gnome blog post is pretty good: https://blogs.gnome.org/...

path: 0 25573572 25574044 25581317, hotness: undefined, score: 23, children: 1
wilmo 5 points a month ago

You either log off a hero, or you see yourself create another linux distribution, and having failed the first part, DHH has been pouring his energy into creating a new project.

That line sent me.

path: 0 25573572 25574044 25581317 25594891, hotness: undefined, score: 5, children: 0
just_another_person 10 points a month ago

WHOA. Bombastic claim there, brah.

He's a Eugenics aficionado, and racist-ADJACENT

path: 0 25573572 25574044 25574487, hotness: undefined, score: 10, children: 0
BigJohnnyHines 9 points a month ago

They don’t actually understand what Nazis or fascism even are. They treat it all like a weird sports team thing where everything is just a derogatory word for things you don’t like. They’ll never see they are the bad guys. Not capable of it or they wouldn’t be this way to begin with.

path: 0 25573572 25574044 25587979, hotness: undefined, score: 9, children: 0
tutter 7 points a month ago

as a fellow dane, david is the corniest type of danish guy.. a dork turned fascist because of built up resentment.

He has 100% been a Assmongold viewer if he isnt still, and probably knows wayy too much about trans people in womens sports despite not knowing a single shit about medically transitioning

ive had my share of encounters with his type.

path: 0 25573572 25574044 25597990, hotness: undefined, score: 7, children: 0
coltn 4 points a month ago

also if you listen to 10 seconds of any podcast with him you'll hear him say the r slur like 20 times. when I first heard about him two or so years ago, this was my first red flag. I immediately paused and checked his blog... yep fucking nazi piece of shit

path: 0 25573572 25574044 25585711, hotness: undefined, score: 4, children: 4
Naich 6 points a month ago

Not sure I want to ask this - What's the "r" slur?

path: 0 25573572 25574044 25585711 25586213, hotness: undefined, score: 6, children: 3
Prior_Industry 3 points a month ago

To use WSB slang - Regard I assume.

path: 0 25573572 25574044 25585711 25586213 25588577, hotness: undefined, score: 3, children: 2
Kirk 2 points a month ago

The hard question becomes is it better for Linux (where anyone can contribute labor) to get the attention and donations or for commercial software where only nonhuman corporations benefit.

path: 0 25573572 25574327, hotness: undefined, score: 2, children: 1
thingsiplay 17 points a month ago

The more power such people have in such positions, the more money they get, the worse it gets. And the bigger the cult might get, which could suck people into the views and so on. Do not underestimate that.

path: 0 25573572 25574327 25574372, hotness: undefined, score: 17, children: 0
mlfh 126 points a month ago

Omarchy is just a bunch of dotfiles in a Hugo Boss trenchcoat pretending to be a linux distribution.

path: 0 25574176, hotness: undefined, score: 126, children: 9
asudox 76 points a month ago

I don't get how this project just received 8 million dollars. It really is just a preconfigured arch linux.

path: 0 25574176 25574510, hotness: undefined, score: 76, children: 7
voytrekk 52 points a month ago

It was all just a bunch of rich tech bros that made that $8M investment, with $1M from DHH himself.

Its not the standard investment from another company where they do some due diligence. This was just a "we think this is the future of Linux" vibe investment.

path: 0 25574176 25574510 25575663, hotness: undefined, score: 52, children: 4
distal 33 points a month ago

Future of Linux my ass. I want something that works.

path: 0 25574176 25574510 25575663 25575733, hotness: undefined, score: 33, children: 2
voytrekk 30 points a month ago

Its not the future of Linux, most likely a fad. The most it will be is a cult OS used by people on the far right.

The only thing good I can say about it is that it has interested some people into Linux because of how all of the components are unique compared to Mac and Windows. Cosmic could be the main stream option for those users once it becomes more stable.

path: 0 25574176 25574510 25575663 25575733 25575778, hotness: undefined, score: 30, children: 1
DeadSquirrel 2 points a month ago
path: 0 25574176 25574510 25575663 25576154, hotness: undefined, score: 2, children: 0
Skullgrid 11 points a month ago

because it's not about a quality OS, it's about being a hive for people to take advantage of others, and because the founder personally made connections to the people that publically gave him money.

path: 0 25574176 25574510 25576213, hotness: undefined, score: 11, children: 0
sudo 8 points a month ago

$8 mil is pocket change for the investors. It's like eight dudes all giving their bro $100 for his art project.

path: 0 25574176 25574510 25586778, hotness: undefined, score: 8, children: 0
chortle_tortle 2 points a month ago

Omarchy is just a bunch of dotfiles in a Hugo Boss trenchcoat pretending to be a linux distribution.

Utterly untrue, it's also an AI slop website with a dumb little icon bouncing around listing his insecurities.

path: 0 25574176 25591656, hotness: undefined, score: 2, children: 0
thingsiplay 59 points a month ago

Its time to let go of Ubuntu and Manjaro as meme distros. Omarchy is the new meme.

path: 0 25573554, hotness: undefined, score: 59, children: 6
Pika 63 points a month ago

Honestly it's not even worth ridiculing, just forget it already

path: 0 25573554 25573585, hotness: undefined, score: 63, children: 1
thingsiplay 21 points a month ago

Easier than said, if it gets this much attention, recommendation and money support. We should not ignore it, but tell people (like the linked post). So they can make an informed decision.

path: 0 25573554 25573585 25573602, hotness: undefined, score: 21, children: 0
maxprime 8 points a month ago

Why is Ubuntu a meme distro?

iusearchbtw

path: 0 25573554 25573567, hotness: undefined, score: 8, children: 3
thingsiplay 11 points a month ago

I use the word "meme" very lightly here, which is a mixture of hate, second-hand embarrassment, making fun of the distro and its users and so on. For the issues it had in the past and being no longer trustworthy for many. Also people meme about Ubuntu for the Snaps, and the focus on Rust (I personally like Rust...), being best friend with Microsoft and so on.

path: 0 25573554 25573567 25573641, hotness: undefined, score: 11, children: 0
admin 5 points a month ago

I wouldn't take that statement too seriously, some people really like to gatekeep. The simple fact is that Ubuntu has done a lot to make Linux more accessible to a lot of people who otherwise would still be using another OS. That also makes it an easy target for ridicule.

Having said that, they also made a lot of unpopular decisions, especially amongst Linux purists.

path: 0 25573554 25573567 25577490, hotness: undefined, score: 5, children: 0
communism 3 points a month ago

Ubuntu was my first Linux distro and I liked it back then. I would've recommended the old Ubuntu to non-tech-savvy people, or people who want a Linux that "just works" (although back then no Linux "just worked", there was always at least a bit of debugging for me). However it's enshittified a lot. A lot of basic software is only available as snaps. It generally feels quite corporate these days.

path: 0 25573554 25573567 25584426, hotness: undefined, score: 3, children: 0
Ashrakal 51 points a month ago

Oligarchy Linux likely has so many government-backed backdoors that this one was perhaps a consequence of them.

path: 0 25579490, hotness: undefined, score: 51, children: 0
uairhahs 46 points a month ago

Man I love this thread, I was starting to think I was the unreasonable one for thinking Omarchy is a hyped PoS dotfile skin. To learn it goes deeper into a fascists plaything is wild to me, I got some good intuition I guess.

path: 0 25587538, hotness: undefined, score: 46, children: 0
orbituary 45 points a month ago

When I explained X11 on FreeBSD to Windows users 25 years ago, I said, "you start from the pretty side and work towards the ugly. I start on the ugly side and make it pretty."

Omarchy is turning a perfectly decent OS and putting a pig outfit on it and giving it lipstick, then calling it pretty.

path: 0 25576464, hotness: undefined, score: 45, children: 2
mazzilius_marsti 8 points a month ago

hows BSD for everyday use compare to linux?

path: 0 25576464 25581827, hotness: undefined, score: 8, children: 1
orbituary 7 points a month ago

Relatively the same.

path: 0 25576464 25581827 25583676, hotness: undefined, score: 7, children: 0
distal 42 points a month ago

That's fucking delicious. I am so not surprised that people who focus only on aesthetics (by that I mean those behind omarchy and hyprland) would fuck up the most basic things where substance has any importance. Aesthetics is for idiots! I will never want the Linux desktop to take over because of coolness, I want the software that attacks important questions to take over. These reactionaries have proven themselves to be utterly incompetent once again, and they will continue to prove their incompetence because they all lack insight and think of themselves as being god's chosen ones.

path: 0 25575688, hotness: undefined, score: 42, children: 10
story 6 points a month ago

this is why openBSD will run the spaceships 20000 years from now if we make it as a species

path: 0 25575688 25577425, hotness: undefined, score: 6, children: 2
provectus 4 points a month ago

NetBSD already runs a lot of the satellites out there.

path: 0 25575688 25577425 25587353, hotness: undefined, score: 4, children: 1
story 1 point a month ago

close enough. even proximity to perfection is perfect in a way

path: 0 25575688 25577425 25587353 25591942, hotness: undefined, score: 1, children: 0
dRLY 5 points a month ago

Are there any hard forks or similar to Hyperland that are for Wayland? I was going to try it on my Pi5 (it is my main "messing with random Linux stuff" device that I don't care if I break something), but then I saw people talking about the far-right/fascist stuff and didn't bother. It looked nice when I saw people in random videos running it (wasn't the focus of the videos and just stood-out).

I know there are other well known tiled window managers which I might end up trying since I keep meaning to see how I take to them. The look of Hyperland is nice with some stacked window manager elements if needed (which I imagine other projects also have). I just don't know which TWM projects are "better" (for starting with coming from only using SWM). Some level of aesthetics would be nice but am fine with adding after install.

path: 0 25575688 25577590, hotness: undefined, score: 5, children: 5
0_o7 15 points a month ago path: 0 25575688 25577590 25578874, hotness: undefined, score: 15, children: 2
BlackSam 4 points a month ago

Combine it with Noctalia and you really have a nice eyecandy experience out of the box

path: 0 25575688 25577590 25578874 25587092, hotness: undefined, score: 4, children: 0
dRLY 1 point a month ago

I hadn't, but it certainly has some aesthetics that look cool! Will for sure try it out since it the other two commenters seem to like it. Really happy to have a few options to know about so quickly. Thank you!

path: 0 25575688 25577590 25578874 25596291, hotness: undefined, score: 1, children: 0
communism 5 points a month ago

Seconding Niri, but also I've seen swayfx setups that have Hyprland-like aesthetics.

If you don't care about fancy effects, I've been a river user for years and I like it. Nowadays it is just a compositor and the WM is separate, but river-classic (which includes a WM) has a dwm-like tag system, is programmatically configured (ie you speak to the river IPC in any language of your choosing—by default it's a shell script but the WM just executes ~/.config/river/init on startup, so that file can be any executable), and is simple and lightweight. The new 0.4.x release separates the compositor and WM, so you can pick or write your own WM that suits your own workflow/use-case, if that's your thing—it might not be if you don't want customisability and you just want something that makes the decisions for you to a good enough standard.

path: 0 25575688 25577590 25584351, hotness: undefined, score: 5, children: 1
dRLY 1 point a month ago

Thank you for such a good overview! I will likely hop between three advised (Niri, swayfx, and river) since it will be fun to get the feel of TWM options.

path: 0 25575688 25577590 25584351 25596243, hotness: undefined, score: 1, children: 0
dreamy 4 points a month ago

My favourite WM has always been dwm. The default keybinds are absolutely awesome, and its default looks are just fine for me. Though it's not really all that usable without patches/other suckless tools.

path: 0 25575688 25580353, hotness: undefined, score: 4, children: 0
KingThrillgore 30 points a month ago

Omarchy is AI coded slop made by a white supremacist. lol. Lmao even

path: 0 25596791, hotness: undefined, score: 30, children: 0
ColdWater 23 points a month ago

Lol lmfao even

path: 0 25579196, hotness: undefined, score: 23, children: 0
vala 22 points a month ago

If you use Omarchy, the most important takeaway is simple: update to 4.0.1 STOP.

path: 0 25591133, hotness: undefined, score: 22, children: 1
MousePotatoDoesStuff 2 points a month ago

If you use Omarchy, remove the Om and the y to get an actually good distro :P

path: 0 25591133 25598887, hotness: undefined, score: 2, children: 0
BaraCoded 14 points a month ago

Shhh, never tell the nazis their weaknesses, just grab some popcorn and arm yourself with patience.

path: 0 25596420, hotness: undefined, score: 14, children: 0
Jayjader 11 points a month ago

lol

lmao, even

path: 0 25588556, hotness: undefined, score: 11, children: 0
son_of_darkness 9 points a month ago

The tech world is already filled with fascists, let's not allow one more to crawl in. Don't use tools from that human shaped turd

path: 0 25598975, hotness: undefined, score: 9, children: 0
PabloSexcrowbar 2 points a month ago

This isn't limited to Omarchy. It's part of the way Docker works.

path: 0 25575097, hotness: undefined, score: 2, children: 4
MangoPenguin 33 points a month ago

Do other distros default to placing your user in the docker group though? That's the issue here.

path: 0 25575097 25575223, hotness: undefined, score: 33, children: 3
PabloSexcrowbar 2 points a month ago

That I'm not sure about. It's part of the official install docs for docker, though there is a big scary warning saying that that group gives you root permissions. Either way, I place the fault on docker more than Omarchy directly since it's a group that gets automatically when you install it on any distro.

path: 0 25575097 25575223 25575855, hotness: undefined, score: 2, children: 2
talkingpumpkin 11 points a month ago

It’s part of the official install docs for docker

Not true.

The "add user to docker group" thing is not part of the install instructions (also, there is no official install docs for arch - but that's a moot point), it's in a separate document that literally starts with [emphasis mine] "These optional post-installation procedures describe how to configure your Linux host machine to work better with Docker" and contains a big orange box warning about that being part of the docker group is equivalent to being root.

Even if you think the docker doc could trick a newbie into thinking it's ok to make your user part of the docker group (which I'd argue it doesn't), you have to consider that:

  1. distros should be made by people who actually know what they are doing
  2. people who package something for an arch-based distro should at least read the arch wiki (which also clearly warns about the docker group)
  3. this whole thing is a very well known issue of a very well known software package, something that anyone who ever used docker with any seriousness (and most of the people who chose podman instead) knows very well

You can say that the whole "docker group" thing is a very stupid idea and that it's existence is squarely on the docker's devs, and you could even argue that it's a trap, but there cannot be any doubt that falling for this trap (that has big "this is a trap!" signs all over) is a major blunder for a distro.

it’s a group that gets automatically when you install it on any distro.

The issue is not the group existing, the issue is your user being part of that group.

Yes, you can make your user part of the docker group if you so chose, but distros should not make that very unwise choice for you per default (just as they shouldn't set things up to encourage you logging in as root or configure passwordless sudo for your user).

path: 0 25575097 25575223 25575855 25580465, hotness: undefined, score: 11, children: 0
MangoPenguin 0 points a month ago

The fault isn't with docker though, they don't add your user to the docker group, it's an optional step the user needs to take.

path: 0 25575097 25575223 25575855 25587819, hotness: undefined, score: 0, children: 0
linux
linux

@lemmy.ml

login for more options
68043
9438
5656

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

  • Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
  • No misinformation
  • No NSFW content
  • No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

go to feed...