A security issue in Omarchy’s default Docker configuration meant that
essentially every program running in the user’s desktop session could escalate
to root without a password, sudo, or a privilege prompt.
If you use Omarchy, the most important takeaway is
simple: update to 4.0.1.
I reported this issue privately through the project’s responsible-disclosure
process. The underlying configuration has since been patched, so I’m publishing
the details now to explain what the issue is and let users know to update their
systems.
This isn’t limited to Omarchy. It’s part of the way Docker works.
Do other distros default to placing your user in the docker group though? That’s the issue here.
That I’m not sure about. It’s part of the official install docs for docker, though there is a big scary warning saying that that group gives you root permissions. Either way, I place the fault on docker more than Omarchy directly since it’s a group that gets automatically when you install it on any distro.