Why GNU su does not support the `wheel' group (2002)

https://ftp.gnu.org/old-gnu/Manuals/coreutils-4.5.4/html_node/coreutils_149.html

by cdrt • 3 years ago

148 143 3 years ago

ftp.gnu.org

bell-cot3• 3 years ago

Reaction: Mr. Stallman's idyllic worldview does not seem to admit that someone may actually own the computer system in question, or otherwise have legal rights to set limits on who uses the system, when, and for what purposes.

And what was allowed by the social norms of the tiny 1980's *nix computing world, or what you can get away with when you're as famous as Mr. Stallman...those may not translate well to other contexts.

voz_• 3 years ago

I can’t stand his holier than thou writing. No amount of brilliance or clever code makes someone less of an asshole.

rvnx5• 3 years ago

Some people are so dazzled by singing and dancing skills, that they consider their singer to be a hero and a nice guy.

Similarly, Stallman's coding expertise can sometimes overshadow any potential shortcomings in the non-IT subjects.

hackan• 3 years ago

legal rights? "I'm on the side of the masses, not that of the rulers." He is pretty clear...

bell-cot3• 3 years ago

Reaction: How does that ideal play out, when a few kiddies start running fork bombs on a *nix system that Mr. Stallman wants to use?

ye-olde-sysrq2• 3 years ago

If you are used to supporting the bosses and sysadmins in whatever they do, you might find this idea strange at first.

Should this be that far-fetched though? That employees might not be simple thralls of the capitalist, whose agency extends only as far as his master permits?

It reminds me of something I'd read that one of the reasons modern capitalism is so borked is because the founding fathers weren't conceiving of things like "Amazon" existing, where one entity employs a staggeringly large number of employees. Or that a small number of companies would employ such a large percentage of workers.

Their worldview was that where most people were "self-employed" - and if they weren't, employers were small and had a few or tens of employees at most. Or it was a matter of master and apprentices where both groups were investing heavily in each other in a trade and in the running of a shop.

So, while yes our current system finds it a matter of course that employees are utterly subject to the whims of their employer and the legal and economic system fully supports them in this, does it have to be that way?

(I know you can go be a contractor, but good luck with health insurance and etc etc etc all the other things that being yoked to an employer brings that I wish were just public taxpayer-funded services).

aquova• 3 years ago

It reminds me of something I'd read that one of the reasons modern capitalism is so borked is because the founding fathers weren't conceiving of things like "Amazon" existing, where one entity employs a staggeringly large number of employees. Or that a small number of companies would employ such a large percentage of workers.

I'm not quite sure I buy that argument. They lived in the time of the East India Company, which owned something like 50% of the world's trade at the time and ruled several nations.

gorjusborg• 3 years ago

It does seem a very strange position when today's sensibilities are applied.

I do understand the point of view when I think back. Today, Unix-like systems are everywhere. Learning it and working with it is a given. Back then, having access to a unix system was not a given. It was very expensive for hardware and software. The idea that one would be so close to the system and could be denied enough access by an overzealous BOFH was too much to take.

It just goes to show that circumstances change, and things can get weird if we don't change with it.

nisegami• 3 years ago

Legal rights are not moral rights.

nightpool• 3 years ago

Compare to https://news.ycombinator.com/item?id=37173339 which has a lot of discussions of similar issues for "modern" security configurations. Just because IT admins can choose to set a short session expiration on your SSO integration for your MDM managed laptop doesn't mean that we should cooperate with them or develop tools to let them do that.

seabird2• 3 years ago

Stallman's ideas are often informed by high trust environments and business arrangements where the cost of the software itself is a fraction of the TCO. There's a big disconnect between the environment where Stallman made up his mind (large education/business environments) and how most people are introduced to free software (low cost entry into technical computer usage).

I used to think Stallman was an ideologue from a different era. When I started dealing with software projects measured in years and millions his thoughts made much more sense to me. When you're selling me a system that has a 6/7 digit implementation cost for it to stand any chance of meeting my goals, withholding the source code only serves to annoy me.

Dylan168072• 3 years ago

Withholding source code is obnoxious in any era. But that's a pretty distant issue from administrative privileges.

treffer• 3 years ago

Well, I am a bit unsure if it does or does not translate well....

One of my favorites is extensive rights management. Especially on CMS. More ofte than not it is part of a buying decision, but used Stallman style soon after.

The observation that these credentials leak is correct. Or that you grow permissions over time for no other reason than doing work. A wheel group would today quickly attract users, too.

So let it be. The latest iteration is "basically let everyone, but audited and short term only". I find that very close to Stallmanns idea, for very different reasons.

indymike• 3 years ago

someone may actually own the computer system in question,

And that person may not be the systemadmin

nine_k3• 3 years ago

It shows how old is that, and how things changed.

Back in the day, it was about multiple OS users on one big machine, maintained by a university or a corporation.

Now I'm the only human user of my several machines. I have more than one interactive user account on some of them. I put these accounts to the wheel group, to avoid ever using a root password. (Void Linux has it pre-configured in /etc/sudoers.)

jml7c5• 3 years ago

Yes, Unix was designed to protect users from each other but the modern need is to protect applications/invocations from each other. It is unfortunate that Unix wasn't really designed for the modern use case.

Basically https://xkcd.com/1200/

fsflover7• 3 years ago

The solution is to use https://qubes-os.org. My daily driver, can't recommend it enough.

cookiengineer2• 3 years ago

The irony behind it is that one could argue that we are using UNIX wrong, because technically each program should run as its own user with its own groups. Which is what apparmor and firejail/sandboxes kind of want to embrace but in practice people just care too less.

TillE2• 3 years ago

This is why I'm still hopeful that capability-based microkernels are the future. They simply fit modern security needs far better than hacky sandbox solutions on top of the same old operating systems with coarse permissions.

1letterunixname2• 3 years ago

The use-case is concerned with is multi-user, most likely remote login, sometimes desktop login. He whines about everyone not having root and breaking the box. Too bad. If you don't like the isolation and privilege separation a system provides, use virtualization, containers, run your own, or change the OS to allow your specialness that doesn't affect other users.

It's not wheel's fault, and so substituting root group for wheel was nothing more than a special snowflake move by someone who thought the sysadmins were holding back and the "enemy".

m463• 3 years ago

corp users still share some machines.

actually if you think about it, lots of machines you OWN nowadays don't give you root access.

For example you can't get access at the actual filesystem on your iphone without a jailbreak.

effie6• 3 years ago

I have more than one interactive user account on some of them. I put these accounts to the wheel group, to avoid ever using a root password.

Why have multiple different unix users if all have the same power of the root user? They aren't isolated from each other, they aren't less powerful than root. So why not just use the already existing single root account?

geoelectric• 3 years ago

Seems like it’d actually decrease security as now there are several different “root” logins that could be compromised.

Though I suppose, with further thought, it’s not significantly worse than having them in sudoers, in that particular respect.

paulddraper• 3 years ago

First, some software literally refuses to run as uid 0.

Second, it can still be useful for bookkeeping.

1letterunixname2• 3 years ago

I remember having BootCommander on a test box containing Windows 95 (and a bunch of other crap) to boot to up to 16 OSes.

Back in the day, university campus networks popularized a "cluster" approach of logging in to specific machines whereby hosts followed the pattern: $(uname)[0-9]{2}. You would soon setup authorized_keys and a script that would check the load of all machines by iterating ssh. The same home directory would be shared to all machines, regardless of OS, so portability of shells scripts and POSIX/C code was necessary.

heisstupid• 3 years ago

What a great example of how slavish devotion to an ideology makes idiots out of smart people.

oasisaimlessly• 3 years ago

That's just like, your opinion, man.

dataflow• 3 years ago

I read the page and don't understand what's going on. What is special about the 'wheel' group and what is su even "checking" in the first place? Isn't it just supposed to switch user? And what are the implications of not-checking whatever it was supposed to check? And I also don't get: if someone has the root password, can't they change what groups they're a member of?

klodolph2• 3 years ago

Basically, su vs sudo. Do you want any user to be able to become root, if they know the root password? Or do you want more control over the process?

segfaultbuserr2• 3 years ago

What is special about the 'wheel' group and what is su even "checking" in the first place?

By convention, "wheel" is a special Unix user group that determines who can use "su" and "sudo". Most "su" and "sudo" implementations allow the sysadmin to make their use exclusive to the trusted users inside the "wheel" group. In most systems, it's the default setting of "su", and optional for "sudo" (given as an example in /etc/sudoers).

if someone has the root password, can't they change what groups they're a member of?

No. If "su" is configured to be "wheel"-exclusive, you can't log in as root even if you have the password, because you cannot use "su" - unless you have direct access to the system console that allows you to type "username: root", which is almost never the case on servers that disable remote root login.

cperciva• 3 years ago

What is special about the 'wheel' group and what is su even "checking" in the first place?

Users who aren't in the wheel group aren't supposed to be able to become root, even if they have the password.

Isn't it just supposed to switch user? And what are the implications of not-checking whatever it was supposed to check?

Someone who steals the root password (say, by looking over the sysadmin's shoulder) would be able to become root.

And I also don't get: if someone has the root password, can't they change what groups they're a member of?

No, because they can't log in as root and (on non-broken systems) can't become root.

ilyagr• 3 years ago

Native question: if you can `sudo`, can't you just `sudo bash`? What can you do with `su` that you couldn't do with `sudo bash`?

Or is the wheel group not really about being able to sudo?

rvnx5• 3 years ago

There are little (to no?) situations where su has a good reason to check wheel.

You either have the password, or you don't have it. But not something in-between.

Outside of any ideology, in a scenario where you use su to become root, it's a very odd choice to link the wheel group to su; because if you know the password to the "root" user, and you have physical or remote access to the computer, you can likely just login as root.

And if you can't, then it means you actually needed sudo su, not su.

Those who actually need to be root, usually use sudo instead of su.

In the other cases, if you just need to switch user, then no point at all to refer to wheel

klodolph2• 3 years ago

You can disable direct root login and force users to login as their own account first. This way, any root login is tracked—you know who logged in as root, because they had to log in as their own account in order to run su.

rvnx5• 3 years ago

In such case: sudo su, then.

and let sudo verify that the user belongs to the group of allowed sudoers.

No need for the password to the root account.

rcxdude3• 3 years ago

sudo does completely obselete su, yes. (sudo su is redundant, you can just sudo -su)

tux2bsd• 3 years ago

incorrect, they serve different purposes. If sudo isn't installed then you don't require security updates for sudo...

If you do have sudo you can be very restrictive on who can run what.

tedunangst2• 3 years ago

What a bizarre anachronistic rant.

dale_glass2• 3 years ago

To be fair, that's ancient. This links to coreutils 4.5.4. I've got 9.1 installed. The current manpage says support for wheel is implemented in PAM.

e28eta2• 3 years ago

I found this patch, which adds PAM support to coreutils 5: https://lists.gnu.org/archive/html/bug-coreutils/2003-04/msg...

It removes the section at the bottom of the man page, and has this addition to the source code comments:

    +#ifdef USE_PAM
    +
    +   Actually, with PAM, su has nothing to do with whether or not a
    +   wheel group is enforced by su.  RMS tries to restrict your access
    +   to a su which implements the wheel group, but PAM considers that
    +   to be fascist, and gives the user/sysadmin the opportunity to
    +   enforce a wheel group by proper editing of /etc/pam.conf
    +
    +#endif

dathinab3• 3 years ago

A different reason why it's good that it doesn't support wheel:

- it makes it smaller, less code which can go wrong

- su isn't limited to "set user root" but wheel tends to be

- it avoids having to handle many kind of subtle problems with group based permission handling in linux

It's just not a bad idea to have a very minimalist program like su and then delegate all more complicated "acting as user" permission handling to other programs like sudo or doas.

Through tbh. the more I do learn the more I come to believe that uid/gid based permission handling is fundamentally flawed (but also good enough inside of a single application OCI(docker) image). The facts that Linux had to add a (very limited) capability system or that enterprise permission handling often goes through stuff like pollkit adding additional handling then just "gid/uid match" is I think very telling.

vbezhenar2• 3 years ago

suid bits are flawed and ideally should not exist. You should only be able to drop privileges. su/sudo should be replaced by ssh anotheruser@localhost (or simpler implementation with unix socket and without encryption, but the idea is the same).

chasil2• 3 years ago

You would not be able to change your password without suid.

I guess there are ways that sudo/doas could be adapted to implement passwd, chfn, chsh and friends, but the approach appears to have been chosen in the '70, and codified by POSIX.

How do you think these should be implemented?

dale_glass2• 3 years ago

I don't think GNU has ever committed to any kind of minimalist philosophy.

Have you seen the number of flags every command has? ls has almost the entire alphabet taken.

rollcat3• 3 years ago

GNU had to create a convention for the --long flags to fit all of their options.

I think the convention itself is good - I prefer long flags in scripts for improved readability.

But GNU is anything but minimal - compare GNU ls[1] with BSD ls[2], and try to recall the last time you needed --dereference-command-line-symlink-to-dir.

    [1]: https://linux.die.net/man/1/ls
    [2]: http://man.openbsd.org/ls

jmclnx• 3 years ago

I don't think GNU has ever committed to any kind of minimalist philosophy

So true. I remember early on when GNU was started, people in the project where saying and developing with something like this in mind (paraphrasing):

"Make sure it works and meet users needs, even if it is too heavy for current systems, the hardware will improve as time goes on"

And that came true, for example, emacs is a lite ballerina compared to current IDEs.

mattkrause• 3 years ago

From the GNU Fortran manual:

“9.5 Case Sensitivity There are 66 useful settings that affect case sensitivity, plus 10 settings that are nearly useless, with the remaining 116 settings being either redundant or useless.”

https://gcc.gnu.org/onlinedocs/gcc-3.4.6/g77/Case-Sensitivit...

marcus0x622• 3 years ago

You’re talking about tools and systems that just did not exist when the idea to have su check wheel membership came about.

It was a different world, and having some basic speed bumps like not allowing random user accounts to su to root was useful at the time.

IshKebab• 3 years ago

This sounds like a protest against someone not giving him the root password. A stupid protest.

e28eta2• 3 years ago

I’m curious how Twenex worked, that a non-operator (root) account was able to patch the kernel. Maybe the kernel files were unprotected, because it’d be absurd for ordinary users to want to change them? Or did he have to use an exploit to elevate his privileges?

pram2• 3 years ago

Probably just didn't have filesystem permissions of any kind.

pram2• 3 years ago

Does this mean that RMS is ideologically opposed to sudo?

jrockway• 3 years ago

Maybe. You still only have to learn one password under each system. If someone named foobar sympathizes with you and leaks their password, then you login in as foobar and "sudo bash" or whatever. The way RMS envisions is that the root password is shared among many people and one of them shares it with you (there is no way to know who), and then you use your own account to "su" and use the root password.

It's easy to get someone in trouble in either case. If the user foobar starts doing crazy stuff as root, then foobar is in trouble. If you get the root password and start doing crazy stuff, then your username is associated with the troublemaking. (Assume that the logs go to some machine where you don't have access to remove them.) RMS's mechanism shifts the responsibility for your actions onto you, so that someone who knows the root password is more likely to leak it to you.

The best of both worlds is to get the root password, then find a hapless coworker who left their screen unlocked while out to lunch. su with the root password there, cause your chaos, everyone blames lunch guy. (Do look for outside systems; people and cameras can see you using someone's computer. Was always funny to me how many people have tried something like this, only to be nailed by the security cameras.)

ilyt3• 3 years ago

That doesn't make any sense ? Why it should check some random group ?

marcus0x622• 3 years ago

The idea is to only allow user accounts in the wheel group to invoke su to take on root privileges. So, if someone had access to a random user account and knew the root password it wouldn’t do them any good.

jortr0n• 3 years ago

Here's an video of RMS talking about the period referenced in that man page regarding the introduction of passwords on user accounts:

https://youtu.be/k0RYQVkQmWU?t=235

twoodfin• 3 years ago

The etymological history of the group name is interesting:

https://en.wikipedia.org/wiki/Wheel_(computing)

The term wheel was first applied to computer user privilege levels after the introduction of the TENEX operating system, later distributed under the name TOPS-20 in the 1960s and early 1970s. The term was derived from the slang phrase big wheel, referring to a person with great power or influence.

In the 1980s, the term was imported into Unix culture due to the migration of operating system developers and users from TENEX/TOPS-20 to Unix.

somat• 3 years ago

I always understood it as the thing you use to drive the ship.

Why GNU su does not support the `wheel' group (2002)

Related Stories