Omarchy Flaw Let Any User Process Escalate to Root Without a Password

Omarchy, the Arch-based Linux distribution built for developers, shipped a default configuration that allowed essentially any program running in a user's desktop session to escalate to root — without a password, sudo, or a privilege prompt. Security researcher 0xCC reported the issue through the project's responsible-disclosure process and published the details on 28 August, after the configuration had been patched. The fix ships in Omarchy 4.0.1.

The problem: the docker group by default

The distribution added its default user to the Linux docker group, which allows that account to run Docker commands without typing sudo. On Arch, the Docker daemon runs as root and listens on /var/run/docker.sock. Members of the docker group can communicate with that socket, and Docker's own documentation warns that the group grants root-level privileges to the user.

A process with access to the socket can ask the root-owned daemon to launch a container as root, mount arbitrary parts of the host filesystem into it, operate on those files as root and run code there. The proof of concept is short: on a fresh affected installation, cat /etc/shadow returns "Permission denied", while docker run --rm -v /:/hostroot alpine cat /hostroot/etc/shadow prints the shadow file — launched by an ordinary user process, executed by a daemon running as root.

Scope: the entire user session

Linux supplementary groups are inherited by child processes, so the docker group was present on nearly every normal process beneath the user's systemd --user instance. The researcher lists AI coding agents and agent harnesses, web browsers, editors and IDEs, npm scripts, development tools and background processes among the code that could obtain root. A compromise of one ordinary application could therefore become a full machine compromise.

The configuration was also opt-out rather than opt-in: users did not have to use Docker, yet the tradeoff was applied to the default account and not explained. Omarchy's development-tools documentation mentioned "the user group changes needed for you to run Docker as the normal user and not as root" — wording a reader could reasonably read as a rootless setup, which it was not.

Timeline, fix and alternative

The docker group membership was introduced on 1 June 2025, temporarily disabled the following day, re-enabled on 17 June 2025 and finally removed from the default configuration on 24 August 2026. Versions before 4.0.1 are affected; the researcher also tested the latest 3.x ISO, 3.8.4, and confirmed the behaviour there.

For users who want containers without granting root, the write-up recommends Podman: it is daemonless, and containers run as ordinary child processes in their own user namespaces. The researcher said he was impressed by how quickly the issue was addressed, but added that this was not the first security problem he had run into in Omarchy and that he does not currently trust the project's decision-making to deliver the level of security he expects from a distribution.