Solaris 11 has the security solution Linus wants for Desktop Linux | Hacker News Reader

Solaris 11 has the security solution Linus wants for Desktop Linux

blogs.oracle.com

49 pointspetsos34 comments

I'm going to go on a small tangent here and ask: Solaris ... desktop??

I've been using Linux on the desktop for quite some time now, and couldn't be happier. However I come to realize, after trying to "convert" a lot of people around me, Unix isn't made for the "desktop" (understand, unfortunately, Windows-clone).

I also use Solaris (10, not 11m but still) at work. All the time. And if Linux isn't that great on the desktop, Solaris is a catastrophe.

I'm not being very convincing, as the points I'm mentionning would take a whole blog post to prove. My question here is the following:

If this article is on the Oracle website, could it mean that the people at Redwood are trying to be more agressive on the desktop market? Or are they simply using Linus' name to attract traffic?

I'm with you on the "attract traffic" point, and if the goal was actually trying to push Solaris as a desktop experience, I'm equally confused. More likely is that someone (or several someones) put a good bit of thought and time into this nifty feature, and simply would like to maximize the visibility of their achievement.

And as a regular Linux desktop user I must admit that one of the remaining rough edges (couldn't think of a better term) in the desktop experience of some distros is precisely what Linus is referenced as railing against.

And if Linux isn't that great on the desktop, Solaris is a catastrophe.

Eh. I worked for a (small) company where Solaris was -the- desktop OS. Windows only made inroads because some clients required we do CAD work on tools that were Windows only.

It wasn't so bad. As a sysadmin ... I kind of miss it.

You know, Sun Microsystems stock ticker was SUNW... The W was for Workstation.

Yeah, but workstation and desktop are not exactly the same. Back when SUNW went public (1986), that distinction may not have been as defined. It makes sense to run Unix on a workstation (workstation defined as a high performance machine meant for a specific productivity use case). It doesn't make sense to run it on a desktop (desktop defined as a general purpose PC your family would use at home).

This article is not "on the Oracle website" it is on the Oracle *employee blog website". This is an engineer at Oracle expressing his personal opinion about technology.

Note the disclaimer at the bottom:

  The views expressed on this blog are those of the author and do not necessarily reflect the views of Oracle.

Solaris 11 currently does not run on any of the Solaris workstations (e.g blades).

Debian/Ubuntu doesn't create a root login (by default) at all, so there is no root password.

Linux already has RBAC - if you look in /etc/group, you will see a group "lpadmin", if you are in the group, you can add/configure/delete printers (after authenticating with your user password). To the best of my knowledge, this is what Oracle is bragging about, and is equivalent to Microsoft's UAC (with Win7, they finally made it as convenient as linux).

RBAC appears to be a bit richer of a concept than group based authentication. In particular, role assignments can be session dependent and role assignments can be constrained to live in a particular hierarchy. The latter is useful for situations where you want to make it possible for a user to have role A or role B but not both at once.

Edit: Just to add, the key thing that they appear to be bragging about is that they use RBAC to grant the user logged into the system console the "Console User" profile which by default has permissions to modify printers and wireless connections. Once you have this role, you don't not need to authenticate further.

I love how we have surrendered the "gains" from the "unix security model".

"yeah, there's a separation between root and user, but... there's only one user account ... and its password is the same as the root accounts password thanks to sudo ..."

> Debian/Ubuntu doesn't create a root login (by default) at all, so there is no root password.

This is true of Ubuntu, but not of Debian.

Linux doesn't already have RBAC. RBAC can do things Linux can't like two-man authentication for system administration (e.g. two people together can open a safe with their own keys, but not just one).

  https://blogs.oracle.com/gbrunett/entry/enforcing_a_two_man_rule

RBAC is nice in itself, but you can't really use Solaris on average desktop. No drivers, costs money to use in production... and still no sol11 ON sources they promised?

Along with many Linux distributions, because they ship PolicyKit policies allowing some of these things by default. That said, Solaris is used on servers and should probably default to a reduced attack surface over convenience.

It looks like PolicyKit is a little bit unknown, although all major distributions have been using it for a while.

http://www.freedesktop.org/wiki/Software/PolicyKit

The Wikipedia page works very well as TL;DR: http://en.wikipedia.org/wiki/PolicyKit

I ran OpenSolaris on the desktop for a little while. That experiment lasted only about two weeks before I gave up due to various things just not working correctly.

I wonder if things are any different with Solaris 11, or more likely I'd be running OpenIndiana which so far has worked really well for the server work I have it doing.

So serious question, how does this significantly differ from the user account controls in Windows? Even before the Vista/7 UAC was introduced, you could set permissions for a user to be able to do certain things and not other certain things. UAC increased this ability with the slider.

Obviously it sounds like Unix had more fine-grained controls earlier than Windows did, but it still seems like Microsoft could write this same article on behalf of Linus.

RBAC is garbage... developers and such need to write complicated rulesets for n solutions of RBAC systems. A less painful solution would be what FreeBSD currently has - capsicum.

If you have specific feedback about areas that need improvement, I'm certain the blog author would love to hear them. Ranting without justification isn't likely to solve anything.

I have worked on and used selinux, rsbac, smack and others, there is no area to improve on rbac itself isn't usable or even secure compared to a capability based system like capsicum.

RBAC is a capability-based system, so I think you're confused.

Unless of course you're basing your claims on a definition of "capabilities" that limits that application specifically to capsicum.

I would encourage you to read more about RBAC as it is not as limited as you seem to be implying.

I somehow find it hard to believe Linus doesn't know about "sudo"...

I find it hard to believe that you read his original 'venting'. He's complaining about the need for root permissions to connect to a printer. It was about his daughter and the school network.

No. I read Oracle's version in the Oracle article, which is the subject of this discussion after all. It's been many years since you couldn't connect to a wifi network or configure printers without anything beyond your own password, a properly configured sudo and a sensible set of permissions. In fact, I haven't entered a root password on any of my machines since 2008 or so. It's been a while since any of them even had a root password.

What Oracle is bragging about is that some parts of Solaris 11 are saner than OpenSuSe's. Having deployed to SuSe machines a couple times in the past, that's one thing I don't find particularly hard to believe. I have no direct experience with Solaris since version 8 or so. I did enjoy using OpenSolaris and OpenIndiana for a while and would consider deploying them on my home server, as soon as I build it.

I also find Linus' attitude towards fixing the problem rather than ditching the distro commendable. I wouldn't give most distros a second chance after giving me a tiny fraction of the problems he describes in his own rant. After the problems I experienced, I didn't even give OpenSuSe a first chance on my own machines. Life is too short to bitch on Bugzilla.

Of course he knows.

Read his original rant, as babarock suggested:

https://plus.google.com/u/0/102150693225130002912/posts/1vyf...

I read the rant (again) and imho it seems like sudo could very well be used as a solution to his problems ("need to have the root password to access some wireless network, or to be able to print out a paper, or to change the date-and-time settings"). From my point of view it seems like the real issue is bad default configuration for sudo (or an alternative system).

The problem isn't that Linus isn't aware of sudo (of course he is), but a stupid implementation in of the printer tool in OpenSUSE.

Agreed. Does openSUSE use PolicyKit for CUPS like Fedora does, or does it depend on lpadmin group membership?

http://fedoraproject.org/wiki/Features/CupsPolicyKitIntegrat...

sudo would give root. RBAC gives only the privileges you need for the task.

"sudo su -" would. You can restrict sudo to give a set of users a limited set of tools, such as restarting specific daemons but not others.

If you'd read the article you discover that sudo's capabilities are far more limited than RBAC's.

For example, RBAC can prevent a process from performing any network operations. Read the blog entry for more information.

I didn't say sudo can do everything RBAC can. I said "sudo" would allow Linus to do everything he wanted to do without giving (or even having) a root password.

But you implied that sudo could limit privileges to only those needed for the task based on your reply to the original poster. While sudo can limit the user to only running a utility for printer configuration, as an example, it can't limit the actions of that utility, so my point stands.

I wonder if SELinux could be used to accomplish that. IIRC, you can limit actions of programs to a given limited context, but I'm out of my depth.

Still, you don't need to give the root password (Linus' rant) with sudo and you'd have to maliciously use the programs you need to run. So, while in theory, your printer configuration utility could increase your privileges under sudo, I'm not aware of any such printer configuration utilities.

Reply on news.ycombinator.com