Omarchy: Any User Process Can Escalate to Root

Omarchy: Any User Process Can Escalate to Root

A security issue in Omarchy’s default Docker configuration meant that essentially every program running in the user’s desktop session could escalate to root without a password, sudo , or a privilege prompt.

If you use Omarchy, the most important takeaway is simple: update to 4.0.1.

I reported this issue privately through the project’s responsible-disclosure process. The underlying configuration has since been patched, so I’m publishing the details now to explain what the issue is and let users know to update their systems.

The Issue

Omarchy configured its default user as a member of the Linux docker group.

That allows users to run commands such as:

docker run ...

without typing sudo .

On arch the Docker daemon runs as root and listens on:

... continue reading