Solaris 11 has the security solution Linus wants for Desktop Linux

https://blogs.oracle.com/darren/entry/solaris_11_has_the_security

by petsos • 14 years ago

49 34 14 years ago

blogs.oracle.com

babarock2• 14 years ago

I'm going to go on a small tangent here and ask: Solaris ... desktop??

I've been using Linux on the desktop for quite some time now, and couldn't be happier. However I come to realize, after trying to "convert" a lot of people around me, Unix isn't made for the "desktop" (understand, unfortunately, Windows-clone).

I also use Solaris (10, not 11m but still) at work. All the time. And if Linux isn't that great on the desktop, Solaris is a catastrophe.

I'm not being very convincing, as the points I'm mentionning would take a whole blog post to prove. My question here is the following:

If this article is on the Oracle website, could it mean that the people at Redwood are trying to be more agressive on the desktop market? Or are they simply using Linus' name to attract traffic?

chao-• 14 years ago

I'm with you on the "attract traffic" point, and if the goal was actually trying to push Solaris as a desktop experience, I'm equally confused. More likely is that someone (or several someones) put a good bit of thought and time into this nifty feature, and simply would like to maximize the visibility of their achievement.

And as a regular Linux desktop user I must admit that one of the remaining rough edges (couldn't think of a better term) in the desktop experience of some distros is precisely what Linus is referenced as railing against.

bdunbar• 14 years ago

And if Linux isn't that great on the desktop, Solaris is a catastrophe.

Eh. I worked for a (small) company where Solaris was -the- desktop OS. Windows only made inroads because some clients required we do CAD work on tools that were Windows only.

It wasn't so bad. As a sysadmin ... I kind of miss it.

gaius• 14 years ago

You know, Sun Microsystems stock ticker was SUNW... The W was for Workstation.

freehunter2• 14 years ago

Yeah, but workstation and desktop are not exactly the same. Back when SUNW went public (1986), that distinction may not have been as defined. It makes sense to run Unix on a workstation (workstation defined as a high performance machine meant for a specific productivity use case). It doesn't make sense to run it on a desktop (desktop defined as a general purpose PC your family would use at home).

binarycrusader6• 14 years ago

This article is not "on the Oracle website" it is on the Oracle *employee blog website". This is an engineer at Oracle expressing his personal opinion about technology.

Note the disclaimer at the bottom:

  The views expressed on this blog are those of the author and do not necessarily reflect the views of Oracle.

jopython2• 14 years ago

Solaris 11 currently does not run on any of the Solaris workstations (e.g blades).

Elhana• 14 years ago

RBAC is nice in itself, but you can't really use Solaris on average desktop. No drivers, costs money to use in production... and still no sol11 ON sources they promised?

obtu• 14 years ago

Along with many Linux distributions, because they ship PolicyKit policies allowing some of these things by default. That said, Solaris is used on servers and should probably default to a reduced attack surface over convenience.

reidrac• 14 years ago

It looks like PolicyKit is a little bit unknown, although all major distributions have been using it for a while.

http://www.freedesktop.org/wiki/Software/PolicyKit

The Wikipedia page works very well as TL;DR: http://en.wikipedia.org/wiki/PolicyKit

freehunter2• 14 years ago

So serious question, how does this significantly differ from the user account controls in Windows? Even before the Vista/7 UAC was introduced, you could set permissions for a user to be able to do certain things and not other certain things. UAC increased this ability with the slider.

Obviously it sounds like Unix had more fine-grained controls earlier than Windows did, but it still seems like Microsoft could write this same article on behalf of Linus.

rbanffy5• 14 years ago

I somehow find it hard to believe Linus doesn't know about "sudo"...

babarock2• 14 years ago

I find it hard to believe that you read his original 'venting'. He's complaining about the need for root permissions to connect to a printer. It was about his daughter and the school network.

rbanffy5• 14 years ago

No. I read Oracle's version in the Oracle article, which is the subject of this discussion after all. It's been many years since you couldn't connect to a wifi network or configure printers without anything beyond your own password, a properly configured sudo and a sensible set of permissions. In fact, I haven't entered a root password on any of my machines since 2008 or so. It's been a while since any of them even had a root password.

What Oracle is bragging about is that some parts of Solaris 11 are saner than OpenSuSe's. Having deployed to SuSe machines a couple times in the past, that's one thing I don't find particularly hard to believe. I have no direct experience with Solaris since version 8 or so. I did enjoy using OpenSolaris and OpenIndiana for a while and would consider deploying them on my home server, as soon as I build it.

I also find Linus' attitude towards fixing the problem rather than ditching the distro commendable. I wouldn't give most distros a second chance after giving me a tiny fraction of the problems he describes in his own rant. After the problems I experienced, I didn't even give OpenSuSe a first chance on my own machines. Life is too short to bitch on Bugzilla.

klausa• 14 years ago

Of course he knows.

Read his original rant, as babarock suggested:

https://plus.google.com/u/0/102150693225130002912/posts/1vyf...

zokier• 14 years ago

I read the rant (again) and imho it seems like sudo could very well be used as a solution to his problems ("need to have the root password to access some wireless network, or to be able to print out a paper, or to change the date-and-time settings"). From my point of view it seems like the real issue is bad default configuration for sudo (or an alternative system).

bensummers• 14 years ago

sudo would give root. RBAC gives only the privileges you need for the task.

rbanffy5• 14 years ago

"sudo su -" would. You can restrict sudo to give a set of users a limited set of tools, such as restarting specific daemons but not others.

calloc• 14 years ago

I ran OpenSolaris on the desktop for a little while. That experiment lasted only about two weeks before I gave up due to various things just not working correctly.

I wonder if things are any different with Solaris 11, or more likely I'd be running OpenIndiana which so far has worked really well for the server work I have it doing.

gvb• 14 years ago

Debian/Ubuntu doesn't create a root login (by default) at all, so there is no root password.

Linux already has RBAC - if you look in /etc/group, you will see a group "lpadmin", if you are in the group, you can add/configure/delete printers (after authenticating with your user password). To the best of my knowledge, this is what Oracle is bragging about, and is equivalent to Microsoft's UAC (with Win7, they finally made it as convenient as linux).

pejoculant• 14 years ago

RBAC appears to be a bit richer of a concept than group based authentication. In particular, role assignments can be session dependent and role assignments can be constrained to live in a particular hierarchy. The latter is useful for situations where you want to make it possible for a user to have role A or role B but not both at once.

Edit: Just to add, the key thing that they appear to be bragging about is that they use RBAC to grant the user logged into the system console the "Console User" profile which by default has permissions to modify printers and wireless connections. Once you have this role, you don't not need to authenticate further.

munin• 14 years ago

I love how we have surrendered the "gains" from the "unix security model".

"yeah, there's a separation between root and user, but... there's only one user account ... and its password is the same as the root accounts password thanks to sudo ..."

rwl• 14 years ago

> Debian/Ubuntu doesn't create a root login (by default) at all, so there is no root password.

This is true of Ubuntu, but not of Debian.

binarycrusader6• 14 years ago

Linux doesn't already have RBAC. RBAC can do things Linux can't like two-man authentication for system administration (e.g. two people together can open a safe with their own keys, but not just one).

  https://blogs.oracle.com/gbrunett/entry/enforcing_a_two_man_rule

nwmcsween2• 14 years ago

RBAC is garbage... developers and such need to write complicated rulesets for n solutions of RBAC systems. A less painful solution would be what FreeBSD currently has - capsicum.

binarycrusader6• 14 years ago

If you have specific feedback about areas that need improvement, I'm certain the blog author would love to hear them. Ranting without justification isn't likely to solve anything.

nwmcsween2• 14 years ago

I have worked on and used selinux, rsbac, smack and others, there is no area to improve on rbac itself isn't usable or even secure compared to a capability based system like capsicum.

Solaris 11 has the security solution Linus wants for Desktop Linux

Related Stories