user-sysmaint-split - Role-Based Boot Modes - Persistent User / Live user / Persistent sysmaint (system maintenance)

Development
,
42

If he is the (super)admin then he should be able to start the service himself.

What can you do with admin mode that requires root. Only upgrade packages?

Does not really show a difference in the description between admin and superadmin mode. Both say “for software installation” but when should you choose admin or superadmin?

2 Likes
43

Any ordinary administration tasks e.g. editing config files.

Admin is still restricted under the default apparmor policy. Superadmin (or superroot) has its own, more permissive policy.

Currently, it just has access to sysctls and doesn’t include the dangerous-files abstraction.

2 Likes
44

I am copying over the conceptual notes to a wiki page and refining the concept. Please check:

What would probably cause chaos is to have sometimes 1 word and sometimes 2 words.

  • root
  • super root

also

  • admin
  • super admin

“But I used root.” “You need super root.” “I mean, I used super root.”

Therefore I think single words should be avoided. Documentation should introduce and consistently use two words. Which ones?

  • limited admin / limited root
  • super root / super root

But limited not sound good. What about “daily admin”? Also not good, because we already say user “user” is for daily activities. The word needs to be more encouraging, positive than “limited” but less exiting than “daily”. What about “normal admin”, “normal root”? Not good because “normal”, the norm, what most do is trusted root by default. Also word “untrusted” in “untrusted admin” seems confusing.

Any better suggestions thans limited admin / limited root?

45

restricted admin /restricted root ?

1 Like
46

HulaHoop via Whonix Forum:

restricted admin /restricted root ?

Technically correct but sounds so negative, sounds so not worth
bothering with. Maybe there’s no better alternative. Let’s see. Other ideas?

47

Secure admin / secure root?

1 Like
48

Using that for now until/if there are better suggestions.

Secure is also not too great since that somewhat suggests “secure, use
all the time”.

1 Like
49

how about inert or neutral root?

1 Like
50

One thing hasn’t been considered yet at all: server support. grub boot menu isn’t easily accessible for many/most servers. How would these various boot modes be available for servers?

Live mode: that probably makes little sense on servers.

Persistent user / secureadmin / superadmin however might make sense?
Even if the webapp (ruining as non-root, user) this is catastrophic but if breaking out from a VM to the host is avoided (thanks to restricted root), that’s very worthwhile. Any way to let servers securely toggle these boot options?

This is a deal breaker for installation by default.
(At least as long there’s no different meta packages for desktop use case and server use case. And that I would like to avoid for simplicity. Better solving server support.)

1 Like
51

Question, does “PERSISTENT mode USER” allow for a separate partitioned FDE storage of the persistent data, that would otherwise be independent and inaccessible from a partition loaded under “LIVE mode USER”

If so, is there any documentation outlining how to do this?
Thanks in advance I look forward to using Whonix

52

No. That would be far more complex than the current design.

Not that I am aware. Also https://www.whonix.org/wiki/Free_Support_Principle applies.

53

My 2 cents as a user, sysmaint is a strange term, the previous version “admin”, was better. It’s a well-known, established term that most users already understand and can easily be searched for using search engines.

Sysmaint sounds weird in speech, is not intuitive and can only be understood via Kicksecure / Whonix wiki pages rather than search engines or AI chat bots.

1 Like
54

The design has been updated:

User documentation is work in progress:

We’ve chosen sysmaint as the account name:

  • to avoid name collision with others who might be using the account name admin;
    • sysmaint isn’t a popular Linux account name yet to be confused;
  • to make the term specific to Kicksecure (and Whonix), because it really is (unless some other distribution decides to adopt the package or design). The way Kicksecure is implementing the separation between user account and sysmaint (system maintenance account) by default is the first time this is being done on a Freedom Software Linux desktop distribution to my knowledge.
    • To simplify finding relevant search results with search engines and AI. When searching for “Linux admin”, “Debian admin” or similar, a lot of irrelevant search results would come up, for example results related to sysadmin, system administration services.

An even more, completely unique name would have been even better, but all words already have existing search results.

Source code:

2 Likes
55

Starting from Whonix 17.3.0.5 and above…

Basic information:

Whonix-Workstation:

  • user-sysmaint-split: Yes. Will be installed by default in new images.

Whonix-Gateway:

This is because according to the threat model and usage instructions, the user should not use Whonix-Gateway for anything else besides running, configuring Tor. End-user applications such as browser should be run inside Whonix-Workstation. Therefore according to our current understanding, user-sysmaint-split would have no security benefit for Whonix-Gateway. Therefore, Whonix-Gateway will remain sudo passwordless by default for better usability. Whonix-Workstation will come with user-sysmaint-split installed by default.

During the Whonix 17 release cycle, will not be automatically installed for existing users to avoid breaking existing user workflows.

in Whonix 18 and during the Whonix 17 to 18 release upgrade, it will get installed by default.

Opt-outs, custom configurations (Unrestricted Admin Mode) will always remain supported.

1 Like
56
1 Like
57
1 Like