Root can’t hit it simply, it’s mounted rw, with a RO mount inside. Root can just check add and remove stuff while running with nix commands.
Basically, it you have a privileged access exoloit, it’s possible to target someone in ways you can’t in silverblue
Some people have made ways to make it more immutable. You can do things like add user folders and etc to the store. Harden it a little more. I’m the end, priv can just modify config*.nix and run rebuild in the background changing whatever.
Other os, you have to commit changes and actually reboot. Which gives you an opportunity to check for changes and deny. Or at least fully detect it happened.
It’s not that it’s dangerously insecure, but it’s important to recognize it’s not actually bulletproof and targeted attacks are still quite possible. It’s LEAGUES more secure than regular OS, but you can’t go full LifeLock on it.
I spent their better part of two days wourth of spare time trying to get OBS and flat packs to take plugins.
To be honest, I only install stuff that I use everyday and randomly. For anything that’s part of a certain project or subsystem either use nix develop or nix shell.
I have one that activates kdenlive, makes YTDLP available, FFmpeg, MPV, and then when I exit that shell all that stuff is no longer linked.
Likewise I have oodles of rust and python projects that only bring into being what they need to get the work done.
Not everything in the config paths are in the store.
None of the users are in the store
Any users can run arbitrary binaries as long as they’re not dynamically linked.
Root can permanently add and remove arbitrary stuff to/from the store at run time.
It’s pretty good in a lot of ways you can’t modify hosts and you can’t throw stuff into cron, but a great deal of Nixos is mutable.
Every immutable system allows you to run binaries
And the other 4 items?
Couldn’t reproduce modifying the store as root, but the users thing is true
Not sure which things are not in the store though
Root can’t hit it simply, it’s mounted rw, with a RO mount inside. Root can just check add and remove stuff while running with nix commands.
Basically, it you have a privileged access exoloit, it’s possible to target someone in ways you can’t in silverblue
Some people have made ways to make it more immutable. You can do things like add user folders and etc to the store. Harden it a little more. I’m the end, priv can just modify config*.nix and run rebuild in the background changing whatever.
Other os, you have to commit changes and actually reboot. Which gives you an opportunity to check for changes and deny. Or at least fully detect it happened.
It’s not that it’s dangerously insecure, but it’s important to recognize it’s not actually bulletproof and targeted attacks are still quite possible. It’s LEAGUES more secure than regular OS, but you can’t go full LifeLock on it.
If you have a root exploit I doubt Silverblue will save you
I’m not really running it for security reasons either
I would argue it’s harder to get a root exploit on Silverblue because more of the filesystem is less mutable and applications are more sandboxed.
I’m running NixOS because declarative is saving me time on system changes nad keeping multiple workstations synced up.
SB is more well protected against unauthorized system changes, Nix is more flexible while still providing good rollbacks.
Nobody is forcing you to install system applications on NixOS. I use flatpaks on it all the time
I hate flatpacks worse than I hate snap
I spent their better part of two days wourth of spare time trying to get OBS and flat packs to take plugins.
To be honest, I only install stuff that I use everyday and randomly. For anything that’s part of a certain project or subsystem either use nix develop or nix shell.
I have one that activates kdenlive, makes YTDLP available, FFmpeg, MPV, and then when I exit that shell all that stuff is no longer linked.
Likewise I have oodles of rust and python projects that only bring into being what they need to get the work done.