More respian developer insanity

tOn Sat, 25 Jun 2022 13:13:03 +0100, Ahem A Rivet's Shot snipped-for-privacy@eircom.net declaimed the following:

And supposedly doesn't exist on the latest release of the OS.

A process running as root can issue syscalls that root is allowed to issue. That's roughly all of them.

A process not running as root can't. If you can't issue the fork() syscall, either through policy (eg SECCOMP, SELinux) or because you can't craft the right arguments (you built an exploit using ROP/JOP gadgets and can only control certain registers), you can't issue the appropriate sudo command. For example, the string 'sudo ...' is unlikely to be lying around in memory such that your exploit can make a pointer to it to pass to system() or exec().

Plus *you have to know that passwordless sudo is available*. Which is fine for a targeted attacker, but most attacks are bulk script-kiddies trying things on.

Basically attackers only get a limited toehold in the system and any extra steps make it harder work.

Also, any time you or something else makes a mistake (of the 'rm -rf ./*' kind, where you forgot the dot), there's a much higher risk of damage.

Theo

The main danger I see in operating such an unprotected system is that, if it is accessable from J Random Blackhat anywhere on the internet, it is an inviting target for being taken over, enrolled in said blackhat's network and used to launch various nasties such as service denial, ransomware or data theft campaigns. If that should happen, I suspect its owner could have an 'interesting' time convincing victims that they aren't part of the gang.

In view of this, I would hope that everybody running RPis with default security levels would have placed a properly configured, secured and tested firewall between the LAN that their Pi or Pis are connected to and the rest of the Internet.

Same applies to any wifi-equipped Pis, such as the Zero W. These should be configured to ONLY make connections to or accept connections from a suitably secure wifi gateway on their own LAN.

Den 2022-06-24 kl. 16:28, skrev Jan Panteltje:

If this was a newsgroup free to talk about everything I'd ask you to back that statement with some links.

Ah at last something real - but not much of a worry.

That is not the case on a Pi.

Your exploit is going to lead to arbitrary code execution as pi or it isn't much use, once you have that you're in.

In the same vein you have to know that root syscalls are available.

sudo is an easy one to try and passwordless is all too common, especially given the number of pis around with no competent administrator.

Not particularly in this case.

True enough, but if all that's at risk is PiOS and a some experimental binaries that are easily replaced then that's a minor concern.

This is the real crux - if there's nothing of consequence at risk and there is an advantage to running as root then there is no good reason not to do so.

A step in the right direction, or more accurately undoing a step in a silly direction.

Newest version does away with default user "pi". You can still use that name but, just like in other distros, now you choose your user name. Blog post from 7 Apr 2022:

Oh, you already saw that, oops.

internet,

passwordless sudo is also not good

because that approch may then be carried over to a system that DOES have sensitive data.

sudo came into existence on Unix in the early 1980's. I'm not going to rehash the history (which I'm not an expert on), anyone who is interested can read up on it, beginning with the sudo and su man pages on the Raspberry Pi OS (Raspbian) and continuing with the link there to a web page documenting the history. There are a variety of reasons for its appearance and continued evolution on Unix, Linux, and Raspbian.

sudo appeared well before most Unix administrators had any serious concerns about being breached from external networks, which most were not connected to. I came to this by using Unix as a user and developer and then being part of product teams at two different companies in that era that were producing Unix-based systems. Everyone with my background knew, by osmosis, that sudo (and its less-talented predecessor su) was created to deal with the underlying Unix user structure, which empowered the root user to do just about anything on the system but defined strict limits on what non-root users could do via a permissions structure embedded in the operating system.

The idea of using the root user all the time has been around for a long time. It has a major problem that can show up in multiple ways. As Theo said in response to your question, the user running all the time as root is empowered to do things they may not intend. So they may type "rm -rf *" from the command line, or a program they are testing may start writing all over, e.g., system configuration files, or programs started up by cron may do... almost anything. Making the change of user explicit in a sudo command (and, normally, changing the command line prompt) is a safeguard. And it's one that has survived the test of time.

If Jan or Steve or someone else here wants to run as root all the time I don't think anyone else cares. If they feel that reinstalling after a mistake by the user or one of their programs is preferable to exercising the discipline sudo is designed to support, fine, that may indeed be the best choice for them.

I think the flak directed at Jan has not been about his use, or not, of the sudo command, it's been about the repeated attacks on the Raspberry Pi developers and the software tools he is using for not implementing the world in which he imagines he wants to live. As far as I can tell from reading the exchange,

1. He has no idea why sudo exists and is supported and widely used 40 years after its introduction on Unix.
2. He supposes that his uses of the software and his judgement about, e.g., the inclusion of the pi user and use of sudo, somehow transcend the uses and the judgement that millions of other Pi users may be employing.

I don't think this forum benefits from either the ranting or the response to it and I trust I'm not alone. And I don't expect the Raspberry Pi developers to be influenced by it because they don't suffer from 1 above and because it is their responsibility to take a radically different position on 2 above.

So you, Steve, have managed to focus on the question you seem interested in. And you may be satisfied with your conclusion, quoted above. I will point out, for your benefit, that it used to be the custom for some well-engineered Unix programs to check whether they were being run as root - and to print a short message and exit if they were. This is because the developers were concerned about inadvertent consequences (e.g., overwriting lock files) and presumably viewed coding an exit as a preferable to taking responsibility for their software running correctly in a root environment. My first thought when I read Jan's report about software that didn't run as expected when he ran as root, but did when he ran as a non-root user, was that this was the problem he was experiencing. You cannot, however, expect every developer to exercise that same diligence. They may reasonably take the position that if you use their software in a fashion that wasn't intended then the responsibility is yours.

Also, in my past experience and on my current Raspberry systems, attached devices may contained data that is not replaceable, easily or otherwise, and they are just as exposed as the contents of an easily-replaceable root device on Raspbian might be.

So, perhaps you have already taken these issues into account.

On a related note, my reading of the Pi Foundation's announcement is that it has nothing to do with sudo or objections to using it -- Raspbian's use of the existing Unix user structure will continue without change. They are simply requiring a user to supply a username for the default account during configuration rather than assigning 'pi' automatically.

Tom

That's the crux and that attitude is also why he is a climate change denying nutjob. Sorry to hijack your thoughtful response.

Yes, Tom's response was well-thought-out, interesting and reasonable (My knowledge of su predates sudo by decades, I hadn't realised sudo had been around so long).

However, in the spirit of usenet, I will respond to your comment about climate change. Whilst, I'm a 100% believer in stronger efforts to limit CO2 emissions, due to the risk of catastrophic climate change, I can also see that the MSM distort the science as a certainty rather than as a risk. I can see that this might irritate people who fixate on the absolute truth of the message rather than the bigger picture.

While it is true that some massive undiscovered negative feedback mechanism (natural or invented) could kick in at some relatively tolerable planetary temperature to save our bacon, the very long oceanic circulation periods and the lack of evidence for this during past excursions make this a bad bet. (Especially considering the life-altering stakes.)

And the sky might fall on our heads, too. He isnt flying 50 passengers round the sky. If he wants to crash, its his business. If he is employed as a sysdamin, its his employers business. Its cetainly not mine.

Contrariwise, if the convention is *NOT* to run as root, then you cant moan about things not working the way you expect, if you do.

Life is short and the documentation is ten times the size of the source code....

Excellent summary.

I would precis it down to this.

Conventions are as much about things being as you expect, than for deep moral or technical reasons. There is no reason to drive on the right, or the left, beyond it gets messy if people don't decide on one or the other and stick to it.

There is slightly more reason for people to not do root when doing normal usery things. But you wont go to hell if you do.

But the third point is, as you have expressed, if you *do* decide to drive on the side of the road that no one else does, you are a total plonker if you start *blaming someone one else* for the mess you find yourself in.

Its not a mortal sin, it's just mortal.

does he actually deny the facts that modern climate change is comfortably within natural limits? I rather thought he was of the opposite persuasion, and he had actually realised that the probability that the bulk of modern climate change is man made is approximately zero.

-- “It is not the truth of Marxism that explains the willingness of intellectuals to believe it, but the power that it confers on intellectuals, in their attempts to control the world. And since...it is futile to reason someone out of a thing that he was not reasoned into, we can conclude that Marxism owes its remarkable power to survive every criticism to the fact that it is not a truth-directed but a power-directed system of thought.” Sir Roger Scruton

Me. I have only been studying climate change for the last ten or 15 years, and so my conclusions that what is really scaring the powers that be and the reason they are lyiing to us, is that the current global energy crisis is the real issue that they dare not address, because they cant do anything about it.

Climate change is an excuse to blame it all on something else.

There's only a minuscule man made impact on climate, but it is a good a bandwagon as state religion ever was. It will be used to justify state control of all energy, a new poverty and a return to essentially feudal social conditions.

As my Phd BIL said 'if the so called positive climate feedback that allegedly makes CO2 induced warming scary, actually existed, life as we know it would never have developed on earth at all. Its a very long way from 'CO2 absorbs infra red' to 'CO2 will cause an overall catastrophic impact on climate at 450pppm' when its exceeded that in the past, several times, and been warmer than today in the past with less CO2... In short the correlation between modern CO2 rise and modern temperature change has pretty much been debunked. More than ever post 2000 when the warming pretty much stopped. But CO2 rise did not.

The observation that perhaps something else is causing it, possibly even the chaotic nature of a highly complex climate system with multiple negative feedback paths, is of cause thrown out by those in denial of the reality of climate change.

The bandwagon is simply too profitable for industry, for the media, for the academics and for the politicians, to be derailed.

If man made climate change didn't exist, someone would have had to invent it, and they did...