75
Omarchy: Any User Process Can Escalate to Root (0xcc.io)
submitted 1 month ago by to c/linux@programming.dev
12 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 37 points 1 month ago (6 children)

Once more for the people in the back:

CONTAINERS ARE NOT A SECURITY BARRIER

If you are relying on the container system to isolate and protect the OS from containerized apps, you are wrong.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 21 points 1 month ago (4 children)

    FWIW this isn't a container escape. It's just the distro shipping a shitty default that lets the users on the host access root.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 1 month ago (3 children)

    On affected Omarchy systems, this means that the default user and all processes launched in that user session have access to root.

    Hmm, maybe I'm misunderstanding. Does "all processes launched in that user session" not include containerized apps?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 6 points 1 month ago (1 child)

    The issue is that the docker service runs as root and their defaults added the user to a group that allows them to control that service without sudo

    So, the root filesystem can just be passed as a volume to a container and then do whatever you want from there.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] -1 points 1 month ago

    OK, so if you can pass the host root filesystem to a container and then write files or execute code with root privileges on that filesystem, I would definitely consider that a container escape. You're executing arbitrary code on the host from within a container.

  • permalink
  • fedilink
  • source
  • parent