Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Run0, a systemd based alternative to sudo, announced

mastodon.social

Post reply on HN
Print view View original

51–60 of 902 posts

Re: Run0, a systemd based alternative to sudo, announced

#51

Post by Faaak »

constantcrying wrote: post #39

Why do they have to do this? This is really, really stupid. My issue isn't even that someone tries to replace sudo. That may or may not be a completely fine thing to do, depending on the state of sudo and what improvements can be made. But what makes me really upset is this completely unexplainable need to make everything part of one particular init system. There is absolutely no reason to tie your new sudo replaceme…

I find this quite clever. Yeah yeah, "systemd is bad, it's a monopoly, yadda yadda".

Well, there's also a reason they are doing it, and many aspects of it (seatd, timesyncd, resolved, run), and more neat than cobbling together bash scripts. I like it

Re: Run0, a systemd based alternative to sudo, announced

#52

Post by mort96 »

jpollock wrote: post #21
mort96 wrote: post #19

Earlier quoted context omitted.

Is it? Does systemd's sudo replacement also have a lot of complex code running as root in a suid binary? Because that's what he's complaining about

People blame systemd for making the liblzma problem larger than it should have been. https://marc.info/?l=openbsd-misc&m=171227941117852&w=2 "Liblzma ends up dynamically linked to sshd because of a systemd-related extension added by many Linux packagers that pulls in liblzma as an unrelated dependency." https://news.ycombinator.com/item?id=39866076 "openssh does not directly use liblzma. However debian and several ot…

What relevance does this have? Poettering's complaint is that sudo is way too big for a SUID binary, sshd is not a SUID binary?

And neither Poettering nor the systemd developers patched said, the Debian people did that. Seems weird to blame systemd for that?

Re: Run0, a systemd based alternative to sudo, announced

#53

Post by deng »

constantcrying wrote: post #39

Why do they have to do this? This is really, really stupid. My issue isn't even that someone tries to replace sudo. That may or may not be a completely fine thing to do, depending on the state of sudo and what improvements can be made. But what makes me really upset is this completely unexplainable need to make everything part of one particular init system. There is absolutely no reason to tie your new sudo replaceme…

> But what makes me really upset is this completely unexplainable need to make everything part of one particular init system.

It is not unexplainable at all. In fact, the article explains it very well.

sudo allows you to execute code as another user. If you think about it, you could also replace sudo with ssh to localhost - just set a root password and allow root logins. Now, security-wise, this would obviously be a bad idea. Our current solution is to give the sudo binary itself administrative privileges, which is a slightly less bad idea, but still pretty bad.

Systemd already handles logins, so it is quite obvious that it could also handle this problem very well, and in fact, it already does: there is a tool systemd-run which you can already use. It will create a completely new process and will handle communication to it, just like ssh, but without the above downsides.

Re: Run0, a systemd based alternative to sudo, announced

#54

Post by lugu »

constantcrying wrote: post #39

Why do they have to do this? This is really, really stupid. My issue isn't even that someone tries to replace sudo. That may or may not be a completely fine thing to do, depending on the state of sudo and what improvements can be made. But what makes me really upset is this completely unexplainable need to make everything part of one particular init system. There is absolutely no reason to tie your new sudo replaceme…

The article explains how this sudo replacement ties to systemd:

> But with one key difference: it’s not in fact SUID. Instead it just asks the service manager to invoke a command or shell under the target user’s UID.

I understand your frustration, but systemd isn't the first attempt to build an integrated system. It just happens to run on Linux. It isn't insane to develop software this way, from that perspective.

Re: Run0, a systemd based alternative to sudo, announced

#55

Post by hxelk1 »

constantcrying wrote: post #39

Why do they have to do this? This is really, really stupid. My issue isn't even that someone tries to replace sudo. That may or may not be a completely fine thing to do, depending on the state of sudo and what improvements can be made. But what makes me really upset is this completely unexplainable need to make everything part of one particular init system. There is absolutely no reason to tie your new sudo replaceme…

I've spent a lot of time studying systemd alternatives. I believe the overall best design is Skarnet's s6, and that too includes a sudo-like program:

https://skarnet.org/software/s6/s6-sudo.html

I was very surprised when I learned about it, but it does make sense (for s6 at least).

> There is absolutely no reason to tie your new sudo replacement to systemd. Absolutely none.

With s6, the idea is to replace a SUID binary with an IPC mechanism. That does make sense, since (parts of) the init system need to be running as root.

> I am very glad to have jumped ship from systemd.

All that aside, so am I.

Re: Run0, a systemd based alternative to sudo, announced

#56

Post by Faaak »

kbar13 wrote: post #45

systemd has been a net positive for the linux ecosystem. remember when you had to write bash scripts to start, stop, restart services and handle any other signals you want to send it? nowadays it's a unit file (basically just an ini file) away with relatively straightforward API. and you can actually declare startup dependencies and other useful relationships past just "prepend a number signifying when it should run…

Yeah, basically I've found that the people the more vocal against systemd are either not really knowing how it works behind the scenes, and just criticizing for the sake of it (or because other people do so), or criticizing from an ideological point of view (do one thing and do it well). They see systemd as an octopus, not following the unix ideology. Which I don't really agree tbh

Re: Run0, a systemd based alternative to sudo, announced

#57

Post by jononor »

tgv wrote: post #36
deng wrote: post #28

Earlier quoted context omitted.

So that's your best shot against systemd? - Linux packagers decide to patch sshd to use libsystemd for a notification, that could have been trivially done without this library. - libsystemd depends on libzlma - libzlma depends on xz And therefore, systemd is insecure? And what does this have to do with the fact that SUID is a terrible idea that needs to go?

First, getting rid of setuid (I guess you'd have to get rid of the whole thing, not just the permission bit) is not the same as making systemd an integral part of the OS. Second, when even the package maintainers can make such "trivial" mistakes, something is wrong. You'd expect a component such as systemd to be much more trustworthy than some random library. I'm not arguing against systemd, just that it seems to gro…

Package maintainers of a distro can do absolutely anything to a package. With zero input from upstream developers. Some distros have more tradition for patching software than others. An upstream like systemd (or openssh) can hardly be blamed for what others do with their software.

Re: Run0, a systemd based alternative to sudo, announced

#59

Post by Jonnax »

constantcrying wrote: post #39

Why do they have to do this? This is really, really stupid. My issue isn't even that someone tries to replace sudo. That may or may not be a completely fine thing to do, depending on the state of sudo and what improvements can be made. But what makes me really upset is this completely unexplainable need to make everything part of one particular init system. There is absolutely no reason to tie your new sudo replaceme…

Is that really how they develop software?

Because I'm pretty sure that most of the components are optional.

You did not even discuss the reasoning given for not using sudo to instead hop on your soapbox to say it's bad software with bad practices and that they are stupid.

It's annoying how in the the more surface level Linux communities there's 0 value in discussing systemd.

"1 million lines of code for PID0!"

The new thing is blaming systemd for that recent exploit even though distros were patching in the bug themselves.

People analysing the exploit determined that a new version of systemd was going to prevent the exploit vector so the exploit seemed to have been rushed out.

Isn't this just textbook FUD?

What I've noticed is over the years is systemd would have identified a gap in functionality.

Like systemd-homed having a solution for automatically encrypting home directory when the machine is suspended.

Is that a functionality that OSX has had for years? Yes.

But anti-systemd people will dislike it automatically.

Re: Run0, a systemd based alternative to sudo, announced

#60

Post by andrewstuart »

dcow wrote: post #48
kbar13 wrote: post #45

systemd has been a net positive for the linux ecosystem. remember when you had to write bash scripts to start, stop, restart services and handle any other signals you want to send it? nowadays it's a unit file (basically just an ini file) away with relatively straightforward API. and you can actually declare startup dependencies and other useful relationships past just "prepend a number signifying when it should run…

I love systemd.

Me too. The best thing about Linux.
Post reply on HN