Post #2207302

2026-05-07 22:49 UTC

What’s up with all these vulnerabilities? Kind of worried to be honest, two in like a week? Pretty scary. I’m very dumb about Linux technical stuff but I feel like root access is way too easy to be accessed. Is there any way to make it harder? I mean let’s say similar to Android, you need to unlock the boot loader first, flash a recovery and flash Magisk or something, that’s a good layer before root access. At least for Linux Desktop, maybe make it so we can get root access only via a bootable USB with a correct password? Just for sporadic system changes. Is there anything like that?

Replies (4)

@digdilem@lemmy.ml 2026-05-08 07:16

It’s a positive thing, don’t be worried. These vulns already existed. It’s possible the bad guys were already using them. This gets them out in the open and on their way to being resolved. Just keep patches up to date with any modern and maintained distro and you’ll be grand.

Open ##2207301
@favoredponcho@lemmy.zip 2026-05-08 01:37

There is an LLM called mythos from Anthropic that is very good at finding vulnerabilities.

Open ##2208307
@idriss@lemmy.ml 2026-05-07 23:26

if somebody has user access to your computer, they are already 95% there, so I am not worried about these priv escalation part of the last 5%

Open ##2278623
@Ooops@feddit.org 2026-05-08 19:06

Setups like Android or those new fancy ummutable distros don't actually make anything more secure. If the underlying OS is drectly exploited they don't protect you. Not having a mechanism included to get you root permissions regularly, doesn't help you against exploits achieving the same in unplanned ways. In fact -allthough that's a minor issue- you can probably specifically target the latter distros even after a patch: After all we are talking about direct changes to binary code here. On that level you could get ideas about manipulating the overlay to access the unpatched files. In the end the most effective way to be more secure is not a mass produced thing like Android that locks out everyone (and not even being that good at it because there are masses working to circumvent it to get control over their device back), but to minimise you attack surface: Don't have stuff activated you don't need. Have a kernel compiled for your device with only exactly the components you really need. Or whitelist all kernel modules you need and nothing more. Explicitly declare what a user can do and access actively (see: SELinux, AppArmor with strict policies) instead of relying on the underlying passive permission system.

Open ##2562307