Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Run0, a systemd based alternative to sudo, announced

mastodon.social

Post reply on HN
Print view View original

11–20 of 902 posts

Re: Run0, a systemd based alternative to sudo, announced

#13

Post by creshal »

But they already ship pkexec together with systemd anyway via polkit, why are they again reinventing a wheel they already reinvented?

Unit files are a neat concept I don't want to miss again, but everything else done by Lennart seems to be an inceasingly stupid mistake born from hubris.

Re: Run0, a systemd based alternative to sudo, announced

#14

Post by andrewstuart »

“Systemd” and “expand” used in the same sentence….. all the systemd haters will be triggered like it’s the national rifle association shooting carnival.

In many ways systemd has actually become the operating system. It’s so pervasive that it certainly is more deserving of naming rights than gnu. “Systemd/Linux” makes more sense than “gnu/Linux”

Re: Run0, a systemd based alternative to sudo, announced

#15

Post by roenxi »

creshal wrote: post #13

But they already ship pkexec together with systemd anyway via polkit, why are they again reinventing a wheel they already reinvented? Unit files are a neat concept I don't want to miss again, but everything else done by Lennart seems to be an inceasingly stupid mistake born from hubris.

AFAIK privileges are an area that has an easy problem statement ("execute this command with that capability") and is fiendishly difficult to execute in practice. `sudo` alone has weird bits to set in the filesystem, magic users and all sorts of unhelpful implications - and it doesn't even lead to any particular security for single-user systems. Same-user code is a scary enough place to be running untrusted code.

Those sort of problems sound like the sort that get a lot of attempts which run into the complexity wall and halt. I think Amazon has one of the best implementations of a privilege system I've used and it is horrible.

Re: Run0, a systemd based alternative to sudo, announced

#16

Post by kristjank »

I am looking forward to the day systemd will implement everything a typical Linux system needs. No more systems greater than the sum of their parts, just a Half-Life 2-style Combine of Microsoft sponsored Poetteringware, running a monolythic system on top of a monolythic kernel, until systemd rewrites the Linux kernel as well. The future is bright! \s

Seriously though, this seems to be a decent replacement for sudo if it works as seamlessly as it's described in the article. I still prefer the doas line of approach that simplifies the tool as much as possible, but I see the value of having such an important tool integrated into the existing system tooling, especially if it already includes everything but the kitchen sink.

Re: Run0, a systemd based alternative to sudo, announced

#17

Post by deng »

creshal wrote: post #13

But they already ship pkexec together with systemd anyway via polkit, why are they again reinventing a wheel they already reinvented? Unit files are a neat concept I don't want to miss again, but everything else done by Lennart seems to be an inceasingly stupid mistake born from hubris.

Because pkexec has the same problems as sudo: it's a SUID binary. As Lennart says, the goal is to eventually get rid of SUID binaries altogether, as they are an inherent security risk. Replacing sudo with pkexec would not change much. In fact, pkexec has had its fair share of local root exploits over the past few years.

Re: Run0, a systemd based alternative to sudo, announced

#19

Post by mort96 »

pmlnr wrote: post #10

> The developer talks about the weaknesses of sudo, and how it has a large possible attack surface Poettering's hypocrisy is painful.

Is it? Does systemd's sudo replacement also have a lot of complex code running as root in a suid binary?

Because that's what he's complaining about

Post reply on HN