Earlier quoted context omitted.
Because their choices are better, at least for some of us. Users who prefer the traditional desktop paradigm have a wealth of alternative DEs to choose from.
I suppose my brutally minimalist Sway config with barely there titlebars and a skinny little status bar and not an icon, button, or widget in sight doesn't give me great standing to call for a respect of conventions. I suppose I should say I found Gnomes luridly chunky decorations and widgets to be personally offensive.
Run0, a systemd based alternative to sudo, announced
581–590 of 902 posts
Re: Run0, a systemd based alternative to sudo, announced
#582> One could say, "run0" is closer to behaviour of "ssh" than to "sudo", in many ways. This is an interesting offhand comment. You could implement a very similar tool by SSHing to localhost.
I had to write an ssh client for an embedded system long ago. Looking at the design, I found it to be sort of messy. You could restrict commands ssh could invoke, but it didn't seem super secure. Also scp/sftp was not well designed. You basically had to give ssh access to your system to allow a file to be copied, and there were no real path restrictions. I personally thought ssh could be much more robust in what you…
I think you can achieve that at the file system level. At least, a long long time ago I maintained a public server with exactly that functionality. I’ve forgotten the details now but if I were tasked with this today my first attempt would be add a sticky bit like we do with /tmp: chmod +t dropbox/
If you don’t want to allow me to delete or overwrite my own files I believe (but haven’t tested) that chattr +a on the dropbox dir would achieve that.
Re: Run0, a systemd based alternative to sudo, announced
#583Re: Run0, a systemd based alternative to sudo, announced
#584Re: Run0, a systemd based alternative to sudo, announced
#585What does logging look like for this?
I don't think it would be too difficult to log commands run with polkit, but is there an equivalent of sudo I/O logs? My guess is there isn't now, but to fully replace sudo it will probably need a way to record everything on the ptty it creates.
What environment variables does it forward by default? From the man page it sounds like SHELL is. What about TERM? Any others? What environment variables are set? What is PATH set to?
How are signals handled? Will a signal sent to the run0 process be propagated to the priveleged process?
What about sudoedit? How would I achieve similar functionality with run0?
Re: Run0, a systemd based alternative to sudo, announced
#586Earlier quoted context omitted.
Don’t think of it as relearning a tool, think of it as learning one tool which works for everything. You no longer have to implement your own log rotation, compression, etc. or work out which configuration each program needs to do that in the manner you expect – for example, “is it safe to rotate a log file?” requires you to know implementation details on each program.
>think of it as learning one tool which works for everything. For how long? I've been around for decades at this point with people telling me how the newest and greatest thing will obsolete everything that came before it. The best way to look through logs is still to materialize them in as text in a files hierarchy and use find with grep to look for issues.
Debian switched to systemd about 12 years ago, so at least that long.
Re: Run0, a systemd based alternative to sudo, announced
#587In fact, if factotum were implemented on Unix along with an analogue to the Plan 9 capability device, venerable programs like su and login would no longer need to be installed ‘‘setuid root.’’ — https://plan9.io/sys/doc/auth.html
Plan9 has a completely different security model.
The Hostowner (usually Glenda) is essentially "root" and you're at the mercy of the filesystem regarding file privileges etc.
AFAIK there is no way to "become" glenda.
Re: Run0, a systemd based alternative to sudo, announced
#588In fact, if factotum were implemented on Unix along with an analogue to the Plan 9 capability device, venerable programs like su and login would no longer need to be installed ‘‘setuid root.’’ — https://plan9.io/sys/doc/auth.html
Plan9port has factotum. Plan9 has a completely different security model. The Hostowner (usually Glenda) is essentially "root" and you're at the mercy of the filesystem regarding file privileges etc. AFAIK there is no way to "become" glenda.
Re: Run0, a systemd based alternative to sudo, announced
#589Earlier quoted context omitted.
> across unix multiuser environments getting used anymore for servers I guess it depends on the servers. I'm in academic/research computing and single-user systems are the anomaly. Part of it is having access to beefier systems for smaller slices of time, but most of it is being able to share data and collaboration between users. If you're only used to cloud VMs that are setup for a single user or service, I guess yo…
> If you're only used to cloud VMs that are setup for a single user or service, I guess your views would be different. This is overwhelmingly the view for business and personal users. Settings like what you described are very rare nowadays. No corporate IT department is timesharing users on a mainframe. It's just baremetal laptops or VMs on Windows with networked mountpoints.
Not a mainframe perhaps, but this sentiment is flat wrong otherwise, because that is how Citrix and RDS (fka Terminal Server) do app virtualization. It's an approach in widespread use both for enterprise mobile/remote access, and for thin clients in point of sale or booth applications. What's more, a *nix as the underlying infrastructure is far from unusual.
I have first-hand insider knowledge of two financial institutions that prefer this delivery model to manage the attack surface in retail settings, and a supermarket chain that prefers it because employee theft is seen as a problem. It’s also a model that is easy to describe and pitch to corporate CIOs, which is undoubtedly a merit in the eyes of many project managers.
One of the above financial institutions actually does still have an entire department of users logged in to an S/390 rented from IBM. They’ve been trying to discontinue the mainframe for years. I’m told there are similar continuing circumstances in airline reservations and credit card schemes; not just transaction processing, but connected interactive user sessions.
This is what corporate IT actually looks like. It is super different to the tech environments and white-collar head offices many of us think are the universal exemplar.
Re: Run0, a systemd based alternative to sudo, announced
#590Just a side note: sudo is largely maintained by just one dude https://github.com/sudo-project/sudo/graphs/contributors
"Poettering is known for having controversial technical and architectural positions regarding the Linux ecosystem"