Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Run0, a systemd based alternative to sudo, announced

mastodon.social

Post reply on HN
Print view View original

101–110 of 902 posts

Re: Run0, a systemd based alternative to sudo, announced

#101

Post by constantcrying »

growse wrote: post #98
constantcrying wrote: post #89

Earlier quoted context omitted.

The point of an integrated system is that interactions between components enhance the system as a whole. This is obviously incompatible with an easy replacement of components. This is literally just basic systems engineering. I don't even know what you are arguing here. The more tightly integrated a system is the harder it is to replace individual components.

You can have a well-integrated system without having tight coupling between components. Interfaces are a thing, and a high level of integration just means having a good collection of interfaces between well-defined conceptual components with well-defined capabilities. The actual software that implements those components is entirely separate.

I don't know what you are arguing. Replacing a component in a tightly integrated system means that the component has to be compatible to that tightly integrated system, meaning lots of assumptions and replication of functionality.

This means components have to tightly conform to the components they are replacing, which obviously decrease modularity as these components are harder to maintain for available system configurations.

This isn't about whether someone can rewrite a part of systemd, but whether you can freely mix and match, which tight integration works against. Obviously

Re: Run0, a systemd based alternative to sudo, announced

#102

Post by StimDeck »

Faaak wrote: post #56
kbar13 wrote: post #45

systemd has been a net positive for the linux ecosystem. remember when you had to write bash scripts to start, stop, restart services and handle any other signals you want to send it? nowadays it's a unit file (basically just an ini file) away with relatively straightforward API. and you can actually declare startup dependencies and other useful relationships past just "prepend a number signifying when it should run…

Yeah, basically I've found that the people the more vocal against systemd are either not really knowing how it works behind the scenes, and just criticizing for the sake of it (or because other people do so), or criticizing from an ideological point of view (do one thing and do it well). They see systemd as an octopus, not following the unix ideology. Which I don't really agree tbh

[flagged]

Re: Run0, a systemd based alternative to sudo, announced

#103

Post by growse »

constantcrying wrote: post #80
dmm wrote: post #40

Earlier quoted context omitted.

> they will force all their projects simultaneously onto all their users for absolutely no reason. That's just not true. Just because a system uses systemd the init system doesn't mean the it is forced to use the other components.

The single beat reason for doing this is to get a coherent complete system. This is what every other person here says. You can not try to create a large coherent system and then tell people they shouldn't use that particular part. That is totally disingenuous. Systemd is DESIGNED to be an all or nothing deal.

> Systemd is DESIGNED to be an all or nothing deal.

^[Citation needed]

Re: Run0, a systemd based alternative to sudo, announced

#104

Post by growse »

constantcrying wrote: post #96
Jonnax wrote: post #93

Earlier quoted context omitted.

Because your post is the repeating cliches that are under every discussion about systemd. You're essentially saying that the month you spent is enough for you to call it bad and the creators incompetent. What qualifies you to make a determination like that? There is never any actual technical reasons it's always about vague things like not adhering to UNIX philosophy, lines of code or it being badly designed (without…

>There is never any actual technical reasons it's always about vague things like not adhering to UNIX philosophy, lines of code or it being badly designed (without any real architectural criticism) I did not mention the first two, so please do not pretend I argued that. For bad design look at transactions. That is really dumb and makes the system near incomprehensible. The documentation is bad, dbus is literally so b…

> If you don't read my posts please do not respond to me. Look at the first post I made and carefully read it.

I read your OP. It does not contain a technical / security criticism of run0. It's an angry, hand-wavey, vague rant against a project that took a design decision you apparently disagree with, but lacking any actual analytical evaluation of the thing up for discussion.

This sort of top-level post shows up on every single article that mentions "systemd", so you'll maybe understand why people tend to be dismissive.

Re: Run0, a systemd based alternative to sudo, announced

#105

Post by deng »

constantcrying wrote: post #72
deng wrote: post #53

Earlier quoted context omitted.

> But what makes me really upset is this completely unexplainable need to make everything part of one particular init system. It is not unexplainable at all. In fact, the article explains it very well. sudo allows you to execute code as another user. If you think about it, you could also replace sudo with ssh to localhost - just set a root password and allow root logins. Now, security-wise, this would obviously be a…

>Systemd already handles logins Exactly that was my objection.

And I disagree with that. The 'sudo problem' is a good example why it makes sense to handle init and login by the same system (note I'm not meaning "same binary" here, in fact, they are separate binaries in systemd). The SUID approach for sudo has been a problem for decades, and it needs to go. I don't really care if it's done by systemd, or if we agree on another system like S6 that was mentioned in another thread - in the end, they work very similarly be replacing the old sudo with an IPC approach.

Re: Run0, a systemd based alternative to sudo, announced

#106

Post by growse »

StimDeck wrote: post #102
Faaak wrote: post #56

Earlier quoted context omitted.

Yeah, basically I've found that the people the more vocal against systemd are either not really knowing how it works behind the scenes, and just criticizing for the sake of it (or because other people do so), or criticizing from an ideological point of view (do one thing and do it well). They see systemd as an octopus, not following the unix ideology. Which I don't really agree tbh

[flagged]

I think dynamic linking pre-dates systemd by quite a number of years.

Re: Run0, a systemd based alternative to sudo, announced

#107

Post by dale_glass »

constantcrying wrote: post #97
dale_glass wrote: post #90

Earlier quoted context omitted.

That sounds like a job for systemd.generator. I don't think having an unit that generates units at runtime is an officially supported use case, since generators exist.

This doesn't answer the question. Also generators are started very early, before other units have been started, so if your system is already running and now you want to generate those units, depending on the state of the other units, they don't really help. >I don't think having an unit that generates units at runtime is an officially supported use case Are you sure? Can you tell me how I would find out?

> This doesn't answer the question. Also generators are started very early, before other units have been started, so if your system is already running and now you want to generate those units, depending on the state of the other units, they don't really help.

That's the point. Any situation in which you have a system modify itself at runtime is a recipe for a headache. So you do your auto-generation first, then work from a stable state.

> Are you sure? Can you tell me how I would find out?

Aside from that this kind of recursion seems like a great way to get weird problems, and that generators exist for this exact thing, the whole design of systemd discourages this kind of trickery. Units are just supposed to start a command and little else.

Maybe somebody made an official pronouncement on this somewhere, but my personal take on this kind of thing is that it's a bad idea, anywhere, not just systemd.

Re: Run0, a systemd based alternative to sudo, announced

#108

Post by xolve »

kbar13 wrote: post #45

systemd has been a net positive for the linux ecosystem. remember when you had to write bash scripts to start, stop, restart services and handle any other signals you want to send it? nowadays it's a unit file (basically just an ini file) away with relatively straightforward API. and you can actually declare startup dependencies and other useful relationships past just "prepend a number signifying when it should run…

Its refreshing to see that just hate systemd because "its not UNIX way" is not anymore. I see better discussions under this post and in other places around the web.

Re: Run0, a systemd based alternative to sudo, announced

#109

Post by dale_glass »

bandrami wrote: post #99
dale_glass wrote: post #65

Earlier quoted context omitted.

The problem is not "this program can grant root privileges", it's that the setuid bit sucks. Linux processes inherit a lot of state from the parent which means it's absolute hell to make a secure setuid binary. And at any time the Linux kernel can add a new feature which will be inherited by a child process, but that the process can't defend against because it wasn't even a thing when the code was written. Running a…

Sure, but your choices are running an on-demand binary suid root, or running a persistent daemon as root. Both have problems, but if you're going to switch users to root you have to do one of them.

The tool doesn't try to do away with root, it tries to do await with the setuid bit. Meaning, "running a persistent daemon as root" is the intentional solution, and presented as the significantly better option for good security.
Post reply on HN