Fedora 37 Looks To Make pkexec Optional For Improved Security

[phoronix]

Phoronix: Fedora 37 Looks To Make pkexec Optional For Improved Security

Following the nasty local privilege escalation vulnerability that was disclosed last month for Polkit's pkexec, Fedora developers are hoping to make pkexec optional later this year with Fedora 37...

https://www.phoronix.com/scan.php?page=news_item&px=Fedora-37-Optional-pkexec

[kylew77]

This is where OpenBSD shines by splitting programs into different parts and using pledge and unveil system calls to restrict the subprocesses. I've written numerous papers on the subject as part of my masters degree. Only thing that keeps me from using OpenBSD as a daily driver is a few little things like gaming, but the day grows closer every 6 months with a new release that I will eventually be daily driving OpenBSD.

[kpedersen]

Only thing that keeps me from using OpenBSD as a daily driver is a few little things like gaming, but the day grows closer every 6 months with a new release that I will eventually be daily driving OpenBSD.

Agreed. I made the switch a long while back and although Linux has many great things, I have never been fully tempted back.

As for games, Steam's DRM service, which I won't engage with has pretty much killed them for me anyway. Some larger ones for OpenBSD that are quite fun are:

https://github.com/osen/openhl

https://github.com/jonathangray/rtcw-sp-openbsd

https://github.com/jonathangray/doom3-openbsd

[mdedetrich]

This is where OpenBSD shines by splitting programs into different parts and using pledge and unveil system calls to restrict the subprocesses. I've written numerous papers on the subject as part of my masters degree. Only thing that keeps me from using OpenBSD as a daily driver is a few little things like gaming, but the day grows closer every 6 months with a new release that I will eventually be daily driving OpenBSD.

Can you expand more on this topic? What is pledge/unveil?

[RahulSundaram]

Can you expand more on this topic? What is pledge/unveil?

https://lwn.net/Articles/767137/ and closest Linux equivalent now is landlock, refer to https://lwn.net/Articles/859908/ and seccomp etc has been achieved to do similar privilege separation.

[pal666]

This is where OpenBSD shines by splitting programs into different parts and using pledge and unveil system calls to restrict the subprocesses. I've written numerous papers on the subject as part of my masters degree.

the fact that you are unaware of linux counterparts doesn't mean that they don't exist, it only means lack of education on your part

[mdedetrich]

the fact that you are unaware of linux counterparts doesn't mean that they don't exist, it only means lack of education on your part

I think the point is that Linux counterparts exist, but they are terrible in comparison either because they are so convoluted that most developers don't bother using them (which from a security standpoint is failure) or the security is being applied by the wrong party.

Lately Linux seems to be just copying security mechanisms from BSD's basically because the implementation is both simple and also solves the problem.

[skeevy420]

I think the point is that Linux counterparts exist, but they are terrible in comparison either because they are so convoluted that most developers don't bother using them (which from a security standpoint is failure) or the security is being applied by the wrong party.

Lately Linux seems to be just copying security mechanisms from BSD's basically because the implementation is both simple and also solves the problem.

Not to mention one set of distros will use AppArmor, others SELinux, there are umpteen different sandbox methods with different levels of support...

They say there is more than one way to skin a cat. Somewhere around learning way 27 is when I decided to pick one way and stick with it.

[skeevy420]

Agreed. I made the switch a long while back and although Linux has many great things, I have never been fully tempted back.

As for games, Steam's DRM service, which I won't engage with has pretty much killed them for me anyway. Some larger ones for OpenBSD that are quite fun are:

https://github.com/osen/openhl

https://github.com/jonathangray/rtcw-sp-openbsd

https://github.com/jonathangray/doom3-openbsd

I don't mind the DRM as much as I mind the 30% Steam Tax.

[kpedersen]

I don't mind the DRM as much as I mind the 30% Steam Tax.

• 30% Steam tax makes it needlessly expensive
• Steam DRM makes it so you are effectively only renting games

Together... nah, no thanks.