Root can’t hit it simply, it’s mounted rw, with a RO mount inside. Root can just check add and remove stuff while running with nix commands.
Basically, it you have a privileged access exoloit, it’s possible to target someone in ways you can’t in silverblue
Some people have made ways to make it more immutable. You can do things like add user folders and etc to the store. Harden it a little more. I’m the end, priv can just modify config*.nix and run rebuild in the background changing whatever.
Other os, you have to commit changes and actually reboot. Which gives you an opportunity to check for changes and deny. Or at least fully detect it happened.
It’s not that it’s dangerously insecure, but it’s important to recognize it’s not actually bulletproof and targeted attacks are still quite possible. It’s LEAGUES more secure than regular OS, but you can’t go full LifeLock on it.
What’s not fully immutable? You can’t modify the store
Not everything in the config paths are in the store.
None of the users are in the store
Any users can run arbitrary binaries as long as they’re not dynamically linked.
Root can permanently add and remove arbitrary stuff to/from the store at run time.
It’s pretty good in a lot of ways you can’t modify hosts and you can’t throw stuff into cron, but a great deal of Nixos is mutable.
Every immutable system allows you to run binaries
And the other 4 items?
Couldn’t reproduce modifying the store as root, but the users thing is true
Not sure which things are not in the store though
Root can’t hit it simply, it’s mounted rw, with a RO mount inside. Root can just check add and remove stuff while running with nix commands.
Basically, it you have a privileged access exoloit, it’s possible to target someone in ways you can’t in silverblue
Some people have made ways to make it more immutable. You can do things like add user folders and etc to the store. Harden it a little more. I’m the end, priv can just modify config*.nix and run rebuild in the background changing whatever.
Other os, you have to commit changes and actually reboot. Which gives you an opportunity to check for changes and deny. Or at least fully detect it happened.
It’s not that it’s dangerously insecure, but it’s important to recognize it’s not actually bulletproof and targeted attacks are still quite possible. It’s LEAGUES more secure than regular OS, but you can’t go full LifeLock on it.