Root can’t hit it simply, it’s mounted rw, with a RO mount inside. Root can just check add and remove stuff while running with nix commands.
Basically, it you have a privileged access exoloit, it’s possible to target someone in ways you can’t in silverblue
Some people have made ways to make it more immutable. You can do things like add user folders and etc to the store. Harden it a little more. I’m the end, priv can just modify config*.nix and run rebuild in the background changing whatever.
Other os, you have to commit changes and actually reboot. Which gives you an opportunity to check for changes and deny. Or at least fully detect it happened.
It’s not that it’s dangerously insecure, but it’s important to recognize it’s not actually bulletproof and targeted attacks are still quite possible. It’s LEAGUES more secure than regular OS, but you can’t go full LifeLock on it.
Every immutable system allows you to run binaries
And the other 4 items?
Couldn’t reproduce modifying the store as root, but the users thing is true
Not sure which things are not in the store though
Root can’t hit it simply, it’s mounted rw, with a RO mount inside. Root can just check add and remove stuff while running with nix commands.
Basically, it you have a privileged access exoloit, it’s possible to target someone in ways you can’t in silverblue
Some people have made ways to make it more immutable. You can do things like add user folders and etc to the store. Harden it a little more. I’m the end, priv can just modify config*.nix and run rebuild in the background changing whatever.
Other os, you have to commit changes and actually reboot. Which gives you an opportunity to check for changes and deny. Or at least fully detect it happened.
It’s not that it’s dangerously insecure, but it’s important to recognize it’s not actually bulletproof and targeted attacks are still quite possible. It’s LEAGUES more secure than regular OS, but you can’t go full LifeLock on it.