A security issue in Omarchy’s default Docker configuration meant that essentially every program running in the user’s desktop session could escalate to root without a password, sudo, or a privilege prompt. If you use Omarchy, the most important takeaway is simple: update to 4.0.1. I reported this issue privately through the project’s responsible-disclosure process. The underlying configuration has since been patched, so I’m publishing the details now to explain what the issue is and let users know to update their systems.
  • traxex@lemmy.dbzer0.com
    61·
    21 hours ago

    If you use Omarchy, the most important takeaway is simple: update to 4.0.1.

    Or just delete that racist shitware.

  • NaibofTabr@infosec.pubEnglish
    32·
    21 hours ago

    Once more for the people in the back:

    CONTAINERS ARE NOT A SECURITY BARRIER

    If you are relying on the container system to isolate and protect the OS from containerized apps, you are wrong.

    • ColonelThirtyTwo@pawb.social
      18·
      17 hours ago

      FWIW this isn’t a container escape. It’s just the distro shipping a shitty default that lets the users on the host access root.

      • NaibofTabr@infosec.pubEnglish
        2·
        13 hours ago

        On affected Omarchy systems, this means that the default user and all processes launched in that user session have access to root.

        Hmm, maybe I’m misunderstanding. Does “all processes launched in that user session” not include containerized apps?

        • ColonelThirtyTwo@pawb.social
          1·
          2 hours ago

          The issue isn’t that the containers have permissions they weren’t assigned. It’s that the system configuration allows any (host) user to make a container with any permissions, without sudo.

        • equivocal@piefed.socialEnglish
          4·
          12 hours ago

          The issue is that the docker service runs as root and their defaults added the user to a group that allows them to control that service without sudo

          So, the root filesystem can just be passed as a volume to a container and then do whatever you want from there.

          • NaibofTabr@infosec.pubEnglish
            1·
            12 hours ago

            OK, so if you can pass the host root filesystem to a container and then write files or execute code with root privileges on that filesystem, I would definitely consider that a container escape. You’re executing arbitrary code on the host from within a container.

    • mlg@lemmy.worldEnglish
      3·
      12 hours ago

      I ain’t got enuff hardware for qubesos

      Go go gadget rootless podman UID mapping and cgroups black magic!