// HACKER NEWS — CYBERSECURITY
Omarchy: Any User Process Can Escalate to Root
A security issue in Omarchy’s default Docker configuration meant that
essentially every program running in the user’s desktop session could escalate
to root without a password, sudo, or a privilege prompt.
If you use Omarchy, the most important takeaway is
simple: update to 4.0.1.
I reported this issue privately through the project’s responsible-disclosure
process. The underlying configuration has since been patched, so I’m publishing
the details now to explain what the issue is and let users know to update their
systems.
Omarchy configured its default user as a member of the Linux docker group.
On arch the Docker daemon runs as root and listens on:
Members of the docker group can communicate with that socket. Docker itself
explicitly warns that the docker group grants root-level privileges to the
user.
A process with access to the Docker socket can ask the root-owned Docker daemon
to launch a container as root, mount arbitrary portions of the host filesystem
into it, operate on those files as root, and run code as root.
On affected Omarchy systems, this means that the default user and all processes
launched in that user session have access to root.
On a fresh affected Omarchy installation try reading /etc/shadow:
Now read the protected file with docker acting as root: