Torvalds Calls OpenSUSE Security 'Too Intrusive'

← Back to Stories (view on slashdot.org)

Torvalds Calls OpenSUSE Security 'Too Intrusive'

Posted by Unknown on Wednesday February 29, 2012 @05:25AM from the permission-denied dept.

jfruh writes "The balance between security and ease of use is always a tricky one to strike, and Linux distros tend to err on the side of caution. But no less a luminary than Linus Torvalds thinks openSUSE has gone too far. When his kid needed to call from school for the root password just so he could add a printer to a laptop, that's when Linus decided things had gone off the rails."

36 of 311 comments (clear)

Min score:

Reason:

Sort:

Only root? by busyqth · 2012-02-29 05:27 · Score: 5, Funny

Bah! Back in the day we recompiled the kernel to add a printer!
AND WE LIKED IT THAT WAY!!
1. Re:Only root? by Toe,+The · 2012-02-29 05:36 · Score: 5, Funny
  
  You mean sneakernet? That's nothing.
  Back in the day, we had to manually place dots onto the paper using a handheld carbon-marking device.
  On the plus side, it did have an undo function built right into the final product.
2. Re:Only root? by fuzzyfuzzyfungus · 2012-02-29 05:50 · Score: 3, Informative
  
  Only if your printer sucked. If you had a real printer you could just cat the postscript to whatever device it was connected to...
3. Re:Only root? by Anonymous Coward · 2012-02-29 05:58 · Score: 4, Insightful
  
  I love these responses. "It's not broken, incapable software, you just have to buy a different printer. Noob."
4. Re:Only root? by busyqth · 2012-02-29 06:02 · Score: 5, Informative
  
  Back in the day postscript didn't exist.
  "lp0" stands for "Line Printer 0" -- you know, 132 columns, tractor feed, green-and-white-striped paper, massive clattering mechanical wheels spinning.
  Now GET OFF MY LAWN!
5. Re:Only root? by Anonymous Coward · 2012-02-29 06:03 · Score: 4, Insightful
  
  Only if your printer sucked. If you had a real printer you could just cat the postscript to whatever device it was connected to...
  And that's why the year of Linux on the desktop will always be next year.
6. Re:Only root? by jd · 2012-02-29 06:13 · Score: 4, Funny
  
  Papyrus? Pah! Youngsters! Back in my day, we had to find a granite boulder to carve the letters into. With a herring!
  
  --
  It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
7. Re:Only root? by jameskojiro · 2012-02-29 06:26 · Score: 4, Funny
  
  Pheromone Trails, are you kidding me, back in my day we used to have to encode chemical messages in our DNA over many generations before we could pass them on to our offspring.
  
  --
  Tsukasa: All I really want, is to be left alone...
8. Re:Only root? by busyqth · 2012-02-29 06:26 · Score: 4, Funny
  
  I still do that.
9. Re:Only root? by Anonymous Coward · 2012-02-29 06:44 · Score: 3, Informative
  
  That's because there was this thing called a "line printer device driver" that was... wait for it... compiled into the kernel.
10. Re:Only root? by Grishnakh · 2012-02-29 07:39 · Score: 4, Informative
  
  There's some different issues here. Postscript (or PDF) printers are definitely superior to others, for good reason: they accept documents in a standardized format, and don't require special drivers. The only "drivers" needed are extremely simple, mainly to tell CUPS how many trays your printer has, and let you select the input and output trays, select duplexing, stuff like that.
  Drivers that don't accept Postscript (or at least some other de facto standard like HP's PCL) have to have special drivers to convert your PS/PDF file into something the printer can understand, which isn't just a document description language, but rather something more like machine code to tell the printer exactly how to move the print head around and spray ink--these cheapo printers don't have much in the way of processing power, and rely on the host to do the processing for it. This means you need a special driver (which doesn't necessarily mean kernel driver, usually these printer drivers just run in userspace), which of course has to be supplied by the manufacturer since they're the only ones who really know how the printer works inside. Everyone even semi-knowledgable about computers should know by now that relying on mfgrs to supply drivers for Linux is generally a losing proposition, so these el cheapo printers should be avoided at all costs.
  Setting up Linux to print to any decent office printer is usually a very simple affair: just find the printer, then select the manufacturer and model from the huge lists provided by CUPS, and off you go. Whether it's an HP LaserJet, a Ricoh, a Xerox, etc., it can print to any of these things. But a $30 piece of shit inkjet? Forget it. This has been the case for as long as $30 inkjets have been around, and hasn't changed, and it probably isn't going to change either, unless at some point in the future MS's near-monopoly collapses and Linux desktop systems start becoming popular (sort of like the way that many different phone makers sell their phones with different versions of Android on them, and these are doing quite well in the marketplace).
11. Re:Only root? by jedidiah · 2012-02-29 07:40 · Score: 3, Informative
  
  > The biggest problems with Linux are still device support and compatibility with what the user wants to do.
  Nonsense.
  The main problems are some notable highly proprietary walled garden holdouts and the dregs of the PC platform. For the rest, the level of support in Linux is not nearly as bad as some trolls would have you believe.
  Linux faces similar challenges to MacOS in this regard.
  
  --
  A Pirate and a Puritan look the same on a balance sheet.
12. Re:Only root? by Barefoot+Monkey · 2012-02-29 07:47 · Score: 4, Funny
  
  Are the frozen herring red by any chance? I've been looking for one forever but can never quite seem to find it.
  Wild geese are known to hunt herrings of that colour. What you should do is look for a wild goose and follow it to see where it goes. That will surely be the best fishing spot for you.
13. Re:Only root? by Barefoot+Monkey · 2012-02-29 07:51 · Score: 4, Funny
  
  Postscript is an Apple conspiracy, designed to wear out electrons by sending too many of them through the printer cable.
  I think you meant Adobe.
  Adobe is an Apple conspiracy! Just look at the first and last letters. Do you think that is merely a coincidence?
14. Re:Only root? by omnichad · 2012-02-29 08:22 · Score: 3, Informative
  
  And it really shouldn't be that hard. If you make a print driver for Mac OS X, you likely already have a CUPS ppd created.
15. Re:Only root? by Eil · 2012-02-29 08:42 · Score: 4, Insightful
  
  It's somehow the (free) operating system's fault because printer manufacturers design their hardware around yet another half-baked printing protocol instead of just using a standard that's been around for decades?
16. Re:Only root? by Anonymous Coward · 2012-02-29 08:50 · Score: 4, Interesting
  
  http://unix-tree.huihoo.org/V5/usr/sys/dmr/lp.c.html
17. Re:Only root? by Kjella · 2012-02-29 16:54 · Score: 3, Informative
  
  Setting up Linux to print to any decent office printer is usually a very simple affair: just find the printer, then select the manufacturer and model from the huge lists provided by CUPS, and off you go. Whether it's an HP LaserJet, a Ricoh, a Xerox, etc., it can print to any of these things. But a $30 piece of shit inkjet? Forget it
  Here's a $30 printer that works perfectly under Linux, not that I've tried this particular one. It's more a matter of brand than price, some companies just have shit support and others are quite good.
  
  --
  Live today, because you never know what tomorrow brings
Too much root is not a good thing by Toe,+The · 2012-02-29 05:30 · Score: 5, Insightful

I see this on Macs a lot. If you want to install anything, you have to type an administrator's password.
In theory, that's great. But in effect, you are giving that installer root access. So if I understand correctly, that installer could be putting any amount of spyware (or whatever) into your computer and nearly perfectly cover its tracks.
Otoh, many Mac apps are distributed as disk images, where you simply drag them from the image to your drive, and that's it. No password at all. If you're going to use pre-rolled software, that certainly seems more trustworthy. But of course, it is a lot more complicated of a process for the average user to be able to ever understand.
What an ass by MatthiasF · 2012-02-29 05:32 · Score: 5, Insightful

He could have just added the user to the sudo group and been done.

But no, he had to go harping on everyone on bug lists and social media rants to put people down, even suggesting whoever made the system should die.

What an ass.
1. Re:What an ass by Rhacman · 2012-02-29 05:43 · Score: 5, Informative
  
  If I understand correctly this in effect would be giving that user root priviledges. I think his complaint was that an ordinary task like adding a printer required that level of priviledge, not that it was inconvinient to do. It sounded like he wanted to administer his childs laptop without giving them free reign over it.
  
  --
  Account -> Discussions -> Disable Sigs
2. Re:What an ass by Hatta · 2012-02-29 05:44 · Score: 5, Insightful
  
  Why should he have to do that? Why isn't it sufficient to add the user to the 'lp' group? There's no reason that printing should require root access at all.
  
  --
  Give me Classic Slashdot or give me death!
3. Re:What an ass by OzPeter · 2012-02-29 05:50 · Score: 5, Insightful
  
  Why should he have to do that? Why isn't it sufficient to add the user to the 'lp' group? There's no reason that printing should require root access at all.
  Why does an administrator have to add anyone to anything in order to do a commonplace task on a machine that is really a commodity item?
  
  Not that I have read his rants but I get where he is coming from.
  
  --
  I am Slashdot. Are you Slashdot as well?
4. Re:What an ass by ArcherB · 2012-02-29 05:55 · Score: 4, Insightful
  
  If I understand correctly this in effect would be giving that user root priviledges. I think his complaint was that an ordinary task like adding a printer required that level of priviledge, not that it was inconvinient to do. It sounded like he wanted to administer his childs laptop without giving them free reign over it.
  He was also a bit pissed that you need the root password to connect to a new wifi hot spot. Could imagine the network admin's nightmare of having to give the root password to a salesman trying to give a presentation on the road?
  I had the same problem with my Fedora 16 (XFCE Spin) box needed the root password to eject a CD. It really sucked that my file manager couldn't do it unless I ran it as root. I don't even know what the file manager's name to run as root and I shouldn't have to. Of course it was no big deal for me to type in "sudo eject cdrom", but I wouldn't expect the average user to know that. Besides, I shouldn't have to add standard users to the sudoers group just so they can swap a friggin CD out!
  
  --
  There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
5. Re:What an ass by Wrath0fb0b · 2012-02-29 05:58 · Score: 3, Insightful
  
  Why should he have to do that? Why isn't it sufficient to add the user to the 'lp' group? There's no reason that printing should require root access at all.
  Because, in any sane environment, that would require proving that the entier printer-management interface is secure enough not to allow privilege escalation or agent-based attacks. At the very least, that would require a software audit of those components that can be twiddled and probably some pen-testing and/or fuzzing. You can just say "well, this is designed to just let users add a printer so surely it can't be used to do anything else" -- I suppose you *can* say that but you ought to lose your job for that kind of thinking.
  We've had large multi-user operating systems for decades now and people still don't seem to understand this basic principle -- if an interface is available to a regular user, it has to be vetted to ensure that it does not allow the user to do any more than what it advertises and that the effects of that are limited to things that the user is supposed to be able to accomplish.
6. Re:What an ass by John+Hasler · 2012-02-29 06:02 · Score: 5, Informative
  
  If I understand correctly this in effect would be giving that user root priviledges.
  
  You don't. The whole point of sudo is that it gives you fine-grained control over the privileges of each user.
  
  --
  Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
7. Re:What an ass by ArcherB · 2012-02-29 07:33 · Score: 3, Interesting
  
  Has something changed, because Network Manager allowed user control over connecting to WLAN back in ... er ... 10.0 I think, or one of the 9. series. By default, in fact. I remember it annoyed me and it was uninstalled in short order, but it worked.
  Personally, I'm not sure. I have not done wireless on Linux in quite some time and since I'm usually the only user on whatever system I'm using, meaning I set it up, I don't think twice about having to type in passwords. Being part of the sudoers group means I type my own password. It only becomes a problem when something like the file manager tells me that it does not have the permissions to eject the CD and doesn't know to ask for a my password. The sad part is that I am actually in the "root" group! What other group do I need to be part of? CDROM? Disk? Dbus? I don't know. I'll add myself to all of them and see if that takes care of the issue.
  Now, imagine if this were a notebook and I was giving this to our sales rep to give a presentation at a potential customer's site.
  Back to wireless, here is Torvald's post:
  
  I first spent weeks arguing on a bugzilla that the security policy of requiring the root password for changing the timezone and adding a new wireless network was moronic and wrong.
  I think the wireless network thing finally did get fixed, but the timezone never did - it still asks for the admin password.
  And today Daniela calls me from school, because she can't add the school printer without the admin password.
  Whoever moron thought that it's "good security" to require the root password for everyday things like this is mentally diseased.
  So here's a plea: if you have anything to do with security in a distro, and think that my kids (replace "my kids" with "sales people on the road" if you think your main customers are businesses) need to have the root password to access some wireless network, or to be able to print out a paper, or to change the date-and-time settings, please just kill yourself now. The world will be a better place.
  
  --
  There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
8. Re:What an ass by chuckinator · 2012-02-29 07:50 · Score: 5, Informative
  
  Go in to the linux box you supposedly own and type 'man 5 sudoers'. You can specify which programs a user can run as root with fine grained controls that only allow specific users or specific groups to run only specific programs. It is not an all or nothing tool even if a majority of lazy sysadmins use it that way. If it didn't have that level control, there would be no point in using it over /bin/su.
I feel you man, by Dr.+Tom · 2012-02-29 05:35 · Score: 3, Insightful

B.S. in C.S., M.S. Psy., Ph.D. in C.S. and B.S.*, and my job is to fix the printer ...
* That's Brain Science, you r'tard
In other news, Linus has a child old enough to install printers on Linux ... I feel old.
I guess it's reasonable ... they use to say, "you're not dating girls until you're 21!"
Now it's "You can't have the root password until you're 21!"
By the way, Linus is right, I usually disable selinux ... a good firewall is fine ..., and
also if your child clicks on an attachment from a stranger, that's a grounding.
My hypothesis... by brennanw · 2012-02-29 05:45 · Score: 5, Funny

Linus Torvalds is the Harlan Ellison of Linux.

--
Eviscerati.Org: All Hail the Eviscerati
Ironic by Kamiza+Ikioi · 2012-02-29 05:45 · Score: 3, Funny

But... G+ is a ghost town? Just yesterday, people were saying, oh, gee, why would I even be interested in G+? Now /. is pulling stories directly from there.
Mmm Hmmm...

--
I8-D
Re:Geeze, what a drama queen! by SomePgmr · 2012-02-29 06:10 · Score: 3

Then I'm going to have to start browsing at 0, cause that shit is dead-on.
Re:Remote ejecting by w_dragon · 2012-02-29 06:38 · Score: 3, Insightful

If that someone has a valid user name and password, and you leave ssh open on your laptop, sure. Why not?
I don't understand the problem by dnaumov · 2012-02-29 06:42 · Score: 3

Installing additional hardware on a computer is most definately a function that SHOULD require administrative priviledges on a computer. Sounds like "working as intended".
Re:if Torvalds kid is smart enough to use by inode_buddha · 2012-02-29 07:17 · Score: 4, Insightful

Yeah he can be a control freak, but in a way I can't blame him. Can you just imagine how many black hats would like to get into Torvalds home LAN? Consider also that the man is pulling over 250 thousand $$$ per year wouldn't somebody like to sniff his network?

--
C|N>K
Re:Geeze, what a drama queen! by gnapster · 2012-02-29 08:40 · Score: 3, Insightful

A business laptop that is carried five states away to deliver a million-dollar presentation should not have any security barriers that would jepordize that presentation. I would count "Contacting IT back at our headquarters so I can use the WiFi" as just such a barrier.
Clearly, then, this is not the Year of the OpenSUSE desktop.