Run0, a systemd based alternative to sudo, announced

Post by jeremyjh » Wed, May 01, 2024, 10:25 AM UTC

sapphire_tomb wrote: post #656

lupusreal wrote: post #653

Earlier quoted context omitted.

I think these problems are basically negligible because the amount of people trying to "configure sudo to be safe to use for unprivileged users, by only allowing specific things to run with it" is negligible. Virtually all users of sudo are using it on their own computer which they are the sole user and ultimately the administrator of. Even in corporate contexts where the company owns the machine instead of the user,…

My last job was at a UK bank. All our *nix systems were configured with a specific whitelist of commands that could be run via sudo. We found this an enormous pain in the arse when the powers that be decided to deploy ansible everywhere, and found that none of its "become" methods would work if sudo was set up like that.

Post by [deleted] » Wed, May 01, 2024, 10:37 AM UTC

NekkoDroid wrote: post #660

lupusreal wrote: post #654

Earlier quoted context omitted.

He's controversial because numerous times his ego has so severely clouded his judgemental that he refuses to see egregious bugs in his programs for what they are. Just one example: https://github.com/systemd/systemd/issues/6237#issuecomment-... The "people hate him because he makes new stuff" narrative is just more ego-protecting cope. Many developers of other new systems are widely respected and appreciated because…

> Just one example: https://github.com/systemd/systemd/issues/6237#issuecomment- ... 1. He gave a clear reason why it is how it is 2. He realizes it is/might be frustrating 3. even `adduser` will not allow it by default 4. The issue that it still runs the unit even with config errors has been addressed: https://github.com/systemd/systemd/commit/bb28e68477a3a39796... (~2 weeks after the issue was opened)

Post by vbezhenar » Wed, May 01, 2024, 10:59 AM UTC

tadfisher wrote: post #347

cogman10 wrote: post #319

Earlier quoted context omitted.

The important thing for me at least isn't he `-u apache` but rather knowing that `apache` exists as one of the installed services on this box. In the old ways, that was apparent because of the presence of the log file. Granted, this isn't the problem it used to be for us, however, it would come up because we'd have our services named things like `foo-ws` and knowing that `foo-ws` existed on a given box might be trick…

journalctl -f -u Shows you all installed units if you have working shell completion, or 'a ' gets you all units starting with 'a', etc.

Post by lenerdenator » Wed, May 01, 2024, 11:15 AM UTC

skywal_l wrote: post #556

rascul wrote: post #517

Earlier quoted context omitted.

For three decades. I suspect he hasn't seen much money for the work, but hopefully I'm wrong.

From his personal page: For the past 30+ years I’ve been the maintainer of sudo. I’m currently in search of a sponsor to fund continued sudo maintenance and development. If you or your organization is interested in sponsoring sudo, please let me know. [0] [0]: https://www.millert.dev/

Post by Khaine » Wed, May 01, 2024, 11:27 AM UTC

cyberpunk wrote: post #624

Khaine wrote: post #577

Earlier quoted context omitted.

That's fair. I assumed he was using squid to filter/block ads and dodgy websites. You can also kind of do this with pf, but not as well.

I use openbsd for that purpose also, but with unbound :}