Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Run0, a systemd based alternative to sudo, announced

mastodon.social

Post reply on HN
Print view View original

621–630 of 902 posts

Re: Run0, a systemd based alternative to sudo, announced

#621

Post by _flux »

StimDeck wrote: post #102
Faaak wrote: post #56

Earlier quoted context omitted.

Yeah, basically I've found that the people the more vocal against systemd are either not really knowing how it works behind the scenes, and just criticizing for the sake of it (or because other people do so), or criticizing from an ideological point of view (do one thing and do it well). They see systemd as an octopus, not following the unix ideology. Which I don't really agree tbh

[flagged]

They didn't need to use the library to make use of the systemd notify mechanism, which is simple to interface and quite a nice feature in the first place.

The free-standing implementation: https://github.com/openssh/openssh-portable/commit/08f579231...

Re: Run0, a systemd based alternative to sudo, announced

#623

Post by wongarsu »

airocker wrote: post #426
mbreese wrote: post #413

Earlier quoted context omitted.

Multi-user clusters are still quite common in HPC. And I think you're not going to see a switch away from multi-user systems anytime soon. Single user systems like laptops might be a good use-case, but even the laptop I'm using now has different accounts for me and my wife (and it's a Mac). When you have one OS that is used on devices from phones, to laptops, to servers, to HPC clusters, you're going to have this fri…

you could potentially create multiple containers in that machine which are single user and give to every user who needs access. CPU/Memory/GPU can be assigned in any way you want(shared/not shared). Now no user can mess up another user.

Isn't that just reinventing multiuser operating systems? Normal Linux already has the property that no user can mess up any other user (unless they are root or have sudo rights)

Re: Run0, a systemd based alternative to sudo, announced

#624

Post by cyberpunk »

Khaine wrote: post #577
cyberpunk wrote: post #561

Earlier quoted context omitted.

I assumed it wasn’t doing tls interception as simply using it to allow/disallow internet traffic from various internal hosts — pf works for that also. Relayd also does a bunch of similar things and is closely integrated with pf too..

That's fair. I assumed he was using squid to filter/block ads and dodgy websites. You can also kind of do this with pf, but not as well.

I use openbsd for that purpose also, but with unbound :}

Re: Run0, a systemd based alternative to sudo, announced

#625

Post by jwilk »

tommiegannert wrote: post #232
StimDeck wrote: post #110

Earlier quoted context omitted.

SSH being linked to XZ doesn’t.

My Ubuntu /usr/sbin/sshd already links to libz, liblzma, liblz4 and libzstd. I don't see why linking to libxz would be so outrageous. All-in-all, ldd reports 26 libraries. They attacked the weakest link, and systemd was just a small pawn in that game. Sure, a smaller attack surface is better, but it's not like OpenSSHd has a small attack surface even without libsystemd. Not even in projects with a similar possibility…

> My Ubuntu /usr/sbin/sshd already links to libz, liblzma, liblz4 and libzstd.

Except for libz, they are only linked indirectly through libsystemd.

> I don't see why linking to libxz would be so outrageous

The XZ Utils library is called liblzma, not libxz.

Re: Run0, a systemd based alternative to sudo, announced

#626

Post by yorwba »

jimrandomh wrote: post #620

> Or in other words: the target command is invoked in an isolated exec context, freshly forked off PID 1, without inheriting any context from the client (well, admittedly, we do propagate $TERM, but that's an explicit exception, i.e. allowlist rather than denylist). I think in practice, this is going to be an endless source of problems, so much so that it won't be adopted. The usual use case of sudo is that you have…

I don't know what your sudo does, but mine requires the --preserve-env flag if you want the new process to have access to all your environment variables.

The thing you're saying is going to be an endless source of problems should already be an endless source of problems! (And I think I've been briefly confused by some missing environment variable once or twice so far.)

Re: Run0, a systemd based alternative to sudo, announced

#627

Post by aragilar »

NikkiA wrote: post #212
aragilar wrote: post #116

Earlier quoted context omitted.

Uh, depending on exactly how it's implemented, it could break a lot of things. If all you are using sudo on is a personal (i.e. single user) laptop/desktop to install packages, this (along with other things like pkexec or doas) would seem to present no issues (and personally, from what I can see, I'd be happy to run `run0` on my personal systems!), but sudo does significantly more than that, as is called out by the s…

> If all you are using sudo on is a personal (i.e. single user) laptop/desktop to install packages, this (along with other things like pkexec or doas) would seem to present no issues Of course, once distros start to say 'wait, why are we shipping 3 different privilege escalation systems again? Systemd is needed for starting units anyway, so lets just drop sudo and su'

sudo is not installed by default on many distros (e.g. if you give a root password on Debian install, then sudo is not installed, but if you don't, it is so you can admin the system), so unless systemd introduces something to break sudo, I don't think it'll go away (it just may get bumped down the list of important packages). su seems to come from https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/, which is all the truly core stuff, and I don't see su disappearing from there.

Re: Run0, a systemd based alternative to sudo, announced

#628

Post by cduzz »

olddustytrail wrote: post #586
llm_trw wrote: post #538

Earlier quoted context omitted.

>think of it as learning one tool which works for everything. For how long? I've been around for decades at this point with people telling me how the newest and greatest thing will obsolete everything that came before it. The best way to look through logs is still to materialize them in as text in a files hierarchy and use find with grep to look for issues.

> For how long? Debian switched to systemd about 12 years ago, so at least that long.

A quick google indicates that it was made default in debian 8 in 2015, which is 9 years ago, not 12.

Perhaps it was available prior to then, but so were daemontools, upstart, and probably a variety of other alternatives.

Re: Run0, a systemd based alternative to sudo, announced

#629

Post by YtvwlD »

segasaturn wrote: post #147
CoolCold wrote: post #2

Uses polkit. run0, which behaves like sudo, but works entirely differently and is not SUID. Run0 asks the services manager to create a shell or command under the target user’s ID, creating a new PTY, sending data back and forth from the originating TTY and the new PTY.

How hard would it be to create a program to send a signal to polkit "impersonating" run0 and obtains a root shell? :)

You'd need to be root already, so hard.
Post reply on HN