A security issue in Omarchy’s default Docker configuration meant that essentially every program running in the user’s desktop session could escalate to root without a password, sudo, or a privilege prompt. If you use Omarchy, the most important takeaway is simple: update to 4.0.1. I reported this issue privately through the project’s responsible-disclosure process. The underlying configuration has since been patched, so I’m publishing the details now to explain what the issue is and let users know to update their systems.
    • PabloSexcrowbar@piefed.socialEnglish
      53·
      18 hours ago

      That I’m not sure about. It’s part of the official install docs for docker, though there is a big scary warning saying that that group gives you root permissions. Either way, I place the fault on docker more than Omarchy directly since it’s a group that gets automatically when you install it on any distro.

      • Taasz/Woof@piefed.socialEnglish
        1·
        47 minutes ago

        The fault isn’t with docker though, they don’t add your user to the docker group, it’s an optional step the user needs to take.

      • talkingpumpkin@lemmy.world
        9·
        9 hours ago

        It’s part of the official install docs for docker

        Not true.

        The “add user to docker group” thing is not part of the install instructions (also, there is no official install docs for arch - but that’s a moot point), it’s in a separate document that literally starts with [emphasis mine] “These optional post-installation procedures describe how to configure your Linux host machine to work better with Docker” and contains a big orange box warning about that being part of the docker group is equivalent to being root.

        Even if you think the docker doc could trick a newbie into thinking it’s ok to make your user part of the docker group (which I’d argue it doesn’t), you have to consider that:

        1. distros should be made by people who actually know what they are doing
        2. people who package something for an arch-based distro should at least read the arch wiki (which also clearly warns about the docker group)
        3. this whole thing is a very well known issue of a very well known software package, something that anyone who ever used docker with any seriousness (and most of the people who chose podman instead) knows very well

        You can say that the whole “docker group” thing is a very stupid idea and that it’s existence is squarely on the docker’s devs, and you could even argue that it’s a trap, but there cannot be any doubt that falling for this trap (that has big “this is a trap!” signs all over) is a major blunder for a distro.

        it’s a group that gets automatically when you install it on any distro.

        The issue is not the group existing, the issue is your user being part of that group.

        Yes, you can make your user part of the docker group if you so chose, but distros should not make that very unwise choice for you per default (just as they shouldn’t set things up to encourage you logging in as root or configure passwordless sudo for your user).