upvote

points

by lrvick12 hours ago |
comments
upvoteby inigyou11 hours ago|
next
[-]
How do you update the kernel?
reply
upvoteby cute_boi6 hours ago|
parent|
prev|
[-]
Idk why we need to use sudo to update kernel. In macos, we don't need sudo access?
reply
upvoteby utopiah10 hours ago|
prev|
next
[-]
Just don't be in the sudo group.
reply
upvoteby declan_roberts7 hours ago|
parent|
[-]
So the solution is to make your computer basically unusable. I guess that's one way to secure things.
reply
upvoteby lrvick3 hours ago|
parent|
[-]
On a modern Linux system you do not need sudo to compile software, install it, or even run it as an unprivileged system service in a User Namespace bound to port 22 (if you give your user the correct Linux Capabilities).

The only thing you cannot do as an unprivileged user is update kernels, but that requires a reboot anyway and the risk of letting an unprivileged user do that is mitigated with hardware enforced secure boot.

Most distros are holding onto 90s designs that are very hard to change once established.

reply
upvoteby dist-epoch8 hours ago|
prev|
[-]
But what exactly are you protecting then?

Linux root/regular-user model comes from an ancient time with multi-user architecture where you defended against one user taking over a big machine they didn't own.

But today on personal computers all the good stuff is inside regular users accounts, and there is nothing valuable to be gained by becoming root.

So the whole security model is broken, it protects the OS system files that nobody cares about, while allowing any piece of software complete access to valuable user files.

reply
upvoteby lrvick3 hours ago|
parent|
[-]
Well you of course want to sub-divide every application in user space either with gvisor or a hypervisor, like QubesOS.

If someone pwns your personal browser they should pop out into an environment where nothing exists but that browser, with no idea the work browser is in a sibling vm.

reply