Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Run0, a systemd based alternative to sudo, announced

mastodon.social

Post reply on HN
Print view View original

381–390 of 902 posts

Re: Run0, a systemd based alternative to sudo, announced

#381

Post by growse »

yjftsjthsd-h wrote: post #273
SAI_Peregrinus wrote: post #143

Earlier quoted context omitted.

Do you also think the GNU project shouldn't exist? If not, what's the difference?

I can use GNU bash on NetBSD with no other GNU software installed. I can install GNU coreutils on Alpine Linux (complete with musl libc instead of glibc). In fact, it's possible to just install a single part of GNU coreutils but not the rest - ex. Alpine packages just sha512sum as https://pkgs.alpinelinux.org/contents?branch=edge&name=coreu... (not sure why). I don't think I've seen it done, but you could build a Lin…

> and they're all portable...

I think that portability is a deliberate anti-goal of systemd.

> In contrast, if you want to use, say, run0, you must run systemd as PID 1,

No, you must run something on pid 1 that implements the spec, similar to how musl can be used instead of glibc - they both implement the same spec.

Run0 expects pid 1 to behave a certain way, much like my web browser expects web servers to behave a certain way.

Re: Run0, a systemd based alternative to sudo, announced

#382

Post by [deleted] »

airocker wrote: post #372
anonymous_union wrote: post #366

Earlier quoted context omitted.

in some other systems the concept has become overloaded. instead of multiple real people as users, different software with different permissions are different users. its not a bad abstraction.

Maybe containers are a better way of isolating processes as mentioned in other comments.

[deleted]

Re: Run0, a systemd based alternative to sudo, announced

#383

Post by oceanplexian »

adastra22 wrote: post #345
rpgwaiter wrote: post #318

Earlier quoted context omitted.

NixOS may be helping multiuser make a comeback, at least it is for me and my home servers. I no longer have to containerize my apps, i can have one baremetal server with a dozen+ services, all with their own users and permissions, and i don't have to actually think about any of the separation. Plus there’s network shares. Multiple people in my home with linux PCs, each with their own slice of the NFS pie based on use…

I’m not sure how “I don’t have to actually think about any of the separation” meshes with the fact that you explicitly setup multiple users and configured file and group permissions accordingly. You clearly put a lot of thought into it. Alternatively, containers really are a no-thinking-required solution. Everything maximally isolated by default.

Containers are isolated but a far, far cry from maximally isolated. They’re still sharing a Linux Kernel with some hand waving and cgroups. The network isolation and QoS side is half-baked even in the most mature implementations.

HVM hypervisors were doing stronger, safer, better isolation than Docker was 10 years ago. They are certainly no-thinking required though which leads to the abysmal state of containerized security and performance we have currently.

Re: Run0, a systemd based alternative to sudo, announced

#384

Post by mbreese »

airocker wrote: post #310

I have seldom come across unix multiuser environments getting used anymore for servers. Its generally just one user on one physical machine now a days. I understand run0's promise is still useful but i would really like to see the whole unix permission system simplified for just one user who has sudo access.

> across unix multiuser environments getting used anymore for servers

I guess it depends on the servers. I'm in academic/research computing and single-user systems are the anomaly. Part of it is having access to beefier systems for smaller slices of time, but most of it is being able to share data and collaboration between users.

If you're only used to cloud VMs that are setup for a single user or service, I guess your views would be different.

Re: Run0, a systemd based alternative to sudo, announced

#386

Post by robertlagrant »

Brian_K_White wrote: post #376
robertlagrant wrote: post #368

Earlier quoted context omitted.

> These absolutely SUCK as answers to that question. They entirely miss the point. They provide a specific answer to a general problem. No they don't. They are good answers. If you want answers to a more general problem, then ask. This is not an emotive topic.

They may be correct answers, in that they accomplish a task. They suck in that the proposed method for accomplishing the task is a suck-ass downgrade from the previous ways the new way proposes to displace. I beg to differ about emotive, because absolutely the other side of this fence behaves every bit as butt-hurt when challenged as I just did. You yourself just said these crappy commands were good, as a purely unfo…

> You yourself just said these crappy commands were good, as a purely unfounded assertion. They are great because you just say they are great. That is even less objective than my rant. I at least explained what exactly I find so bad. Tell me more about not emotive.

Very well: I didn't say the commands were good or great. If you attempt a little objectivity you'll see it.

Re: Run0, a systemd based alternative to sudo, announced

#387

Post by growse »

immibis wrote: post #244
growse wrote: post #124

Earlier quoted context omitted.

So aim your ire at the distributions who (I agree) cocked this one up. "Take a library dependency to implement basic functionality" is not a systemd mentality, it's pernicious throughout software development - see leftPad as another example.

"Put everything in one big ball" is systemd mentality AND something that enabled the xz exploit to work.

Lots of things enabled the xz exploit to work.

If the lesson you take from xz is "systemd bad" then you've really missed the wood for the trees.

Re: Run0, a systemd based alternative to sudo, announced

#388

Post by shrimp_emoji »

mbreese wrote: post #384
airocker wrote: post #310

I have seldom come across unix multiuser environments getting used anymore for servers. Its generally just one user on one physical machine now a days. I understand run0's promise is still useful but i would really like to see the whole unix permission system simplified for just one user who has sudo access.

> across unix multiuser environments getting used anymore for servers I guess it depends on the servers. I'm in academic/research computing and single-user systems are the anomaly. Part of it is having access to beefier systems for smaller slices of time, but most of it is being able to share data and collaboration between users. If you're only used to cloud VMs that are setup for a single user or service, I guess yo…

> If you're only used to cloud VMs that are setup for a single user or service, I guess your views would be different.

This is overwhelmingly the view for business and personal users. Settings like what you described are very rare nowadays.

No corporate IT department is timesharing users on a mainframe. It's just baremetal laptops or VMs on Windows with networked mountpoints.

Re: Run0, a systemd based alternative to sudo, announced

#389

Post by rezonant »

agilob wrote: post #230
kbar13 wrote: post #45

systemd has been a net positive for the linux ecosystem. remember when you had to write bash scripts to start, stop, restart services and handle any other signals you want to send it? nowadays it's a unit file (basically just an ini file) away with relatively straightforward API. and you can actually declare startup dependencies and other useful relationships past just "prepend a number signifying when it should run…

> remember when you had to write bash scripts to start, stop, restart services This was a really big pain, yes, but I also remember how I could `tail -f *.logs`. I remember how I didn't need to remember about `--no-pager` and `--follow`. I knew where the files were, what they were called. I remember how I didn't have to google how to find logs between 10 days ago and 4 days ago, because the logs would be in a .tar cr…

> This was a really big pain, yes, but I also remember how I could `tail -f *.logs`.

Others point out that journalctl supports `-f` and `-n` for determining how much journal to return, but for me what's great about journalctl is that I do not need to know where the program is logging to, how it rotates logs (or how it doesn't), or anything else. The program does not need special permissions to a log location in /var/log or /usr/var/log or ~/... or anything else, it just outputs using stdout and it gets captured. When I want to look at logs, I just use the same moniker that I use to control the service: its unit name. It is so incredibly nice- I do not want to go back to the bad old days of spelunking through /var/log and friends.

> --no-pager

To be clear, if you pipe journalctl somewhere, it will automatically skip the pager and just work. `--no-pager` is most useful for when you want to print some unpiped content in an automated script to avoid having a non-existent user exit the pager.

Re: Run0, a systemd based alternative to sudo, announced

#390

Post by airocker »

adastra22 wrote: post #345
rpgwaiter wrote: post #318

Earlier quoted context omitted.

NixOS may be helping multiuser make a comeback, at least it is for me and my home servers. I no longer have to containerize my apps, i can have one baremetal server with a dozen+ services, all with their own users and permissions, and i don't have to actually think about any of the separation. Plus there’s network shares. Multiple people in my home with linux PCs, each with their own slice of the NFS pie based on use…

I’m not sure how “I don’t have to actually think about any of the separation” meshes with the fact that you explicitly setup multiple users and configured file and group permissions accordingly. You clearly put a lot of thought into it. Alternatively, containers really are a no-thinking-required solution. Everything maximally isolated by default.

There have been no big cves of container escapes for a while now. I guess it can be considered secure enough.
Post reply on HN