Root can’t hit it simply, it’s mounted rw, with a RO mount inside. Root can just check add and remove stuff while running with nix commands.
Basically, it you have a privileged access exoloit, it’s possible to target someone in ways you can’t in silverblue
Some people have made ways to make it more immutable. You can do things like add user folders and etc to the store. Harden it a little more. I’m the end, priv can just modify config*.nix and run rebuild in the background changing whatever.
Other os, you have to commit changes and actually reboot. Which gives you an opportunity to check for changes and deny. Or at least fully detect it happened.
It’s not that it’s dangerously insecure, but it’s important to recognize it’s not actually bulletproof and targeted attacks are still quite possible. It’s LEAGUES more secure than regular OS, but you can’t go full LifeLock on it.
Root can’t hit it simply, it’s mounted rw, with a RO mount inside. Root can just check add and remove stuff while running with nix commands.
Basically, it you have a privileged access exoloit, it’s possible to target someone in ways you can’t in silverblue
Some people have made ways to make it more immutable. You can do things like add user folders and etc to the store. Harden it a little more. I’m the end, priv can just modify config*.nix and run rebuild in the background changing whatever.
Other os, you have to commit changes and actually reboot. Which gives you an opportunity to check for changes and deny. Or at least fully detect it happened.
It’s not that it’s dangerously insecure, but it’s important to recognize it’s not actually bulletproof and targeted attacks are still quite possible. It’s LEAGUES more secure than regular OS, but you can’t go full LifeLock on it.
If you have a root exploit I doubt Silverblue will save you
I’m not really running it for security reasons either
I would argue it’s harder to get a root exploit on Silverblue because more of the filesystem is less mutable and applications are more sandboxed.
I’m running NixOS because declarative is saving me time on system changes nad keeping multiple workstations synced up.
SB is more well protected against unauthorized system changes, Nix is more flexible while still providing good rollbacks.