Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Run0, a systemd based alternative to sudo, announced

mastodon.social

Post reply on HN
Print view View original

711–720 of 902 posts

Re: Run0, a systemd based alternative to sudo, announced

#711

Post by datadrivenangel »

lyu07282 wrote: post #710
bayindirh wrote: post #690

Earlier quoted context omitted.

> And I'm kind of worried that when this breaks stuff, the systemd project is going to push forward with some plan to get rid of sudo, and not gracefully accept the feedback that this is breaking things. Given Lennart already declared SUID concept as “bad”, I think this is the game plan all along. Systemd: Do all the things, but not very well, and don’t listen to anyone.

I agree with Lennart so I'm curious what the argument is against the notion that SUID was a bad idea and we should move away from it in Linux?

SUID has flaws, but it's not clear that there are any more convenient alternatives?

Re: Run0, a systemd based alternative to sudo, announced

#712

Post by lupusreal »

NekkoDroid wrote: post #660
lupusreal wrote: post #654

Earlier quoted context omitted.

He's controversial because numerous times his ego has so severely clouded his judgemental that he refuses to see egregious bugs in his programs for what they are. Just one example: https://github.com/systemd/systemd/issues/6237#issuecomment-... The "people hate him because he makes new stuff" narrative is just more ego-protecting cope. Many developers of other new systems are widely respected and appreciated because…

> Just one example: https://github.com/systemd/systemd/issues/6237#issuecomment- ... 1. He gave a clear reason why it is how it is 2. He realizes it is/might be frustrating 3. even `adduser` will not allow it by default 4. The issue that it still runs the unit even with config errors has been addressed: https://github.com/systemd/systemd/commit/bb28e68477a3a39796... (~2 weeks after the issue was opened)

His reason, although clear, is also plainly wrong. Such usernames although bizarre may be encountered by SystemD so it shouldn't break when it sees them. Computer programs, particularly important ones, should be conservative in what they emit and liberal with what they accept and that means not breaking when they encounter weird but technically permissible usernames. His response should have been "Golly, that's a weird username, I didn't think that was possible" and then fix the bug.

Re: Run0, a systemd based alternative to sudo, announced

#713

Post by blablabla123 »

airocker wrote: post #310

I have seldom come across unix multiuser environments getting used anymore for servers. Its generally just one user on one physical machine now a days. I understand run0's promise is still useful but i would really like to see the whole unix permission system simplified for just one user who has sudo access.

Yeah but elevated permissions may be needed from time to time anyway. Either on the client, the baremetal server or the container. Running everything as root is even for containers not recommended. Considering how popular these have become, it's a bit of an irony that systemd isn't available on the container without considerable detours.

Re: Run0, a systemd based alternative to sudo, announced

#714

Post by aragilar »

Spivak wrote: post #696
aragilar wrote: post #631

Earlier quoted context omitted.

You can't think of ways this could break things? I would find this a useful feature, but I'm also aware of how this works, and the issues it could cause.

No? Of all the esoteric escape sequences that terminals handle the ones that change colors are well trodden.

There are at least 3 different ways of expressing colour as covered by https://en.wikipedia.org/wiki/ANSI_escape_code#Colors, and given the wide propensity of newer terminals to misidentify what they are (I know I have some additional checking in my shell startup to unbreak things if needed), and/or bad termcap/terminfo settings on older systems, sending terminal sequences that are apparently supported but are not happens surprisingly often (enough such that I've made sure to always install two different terminals which use different rendering backends, e.g. xterm and VTE).

Re: Run0, a systemd based alternative to sudo, announced

#715

Post by lupusreal »

bmicraft wrote: post #462
lupusreal wrote: post #408

Earlier quoted context omitted.

One password is easier than two and it feels weird to use the same password for both accounts. About half of my sudo invocations are 'sudo su' lmao.

You could probably save a process with `sudo -i`

Slightly less convienent to type.

Re: Run0, a systemd based alternative to sudo, announced

#716

Post by tomxor »

Hendrikto wrote: post #676
lupusreal wrote: post #653

Earlier quoted context omitted.

I think these problems are basically negligible because the amount of people trying to "configure sudo to be safe to use for unprivileged users, by only allowing specific things to run with it" is negligible. Virtually all users of sudo are using it on their own computer which they are the sole user and ultimately the administrator of. Even in corporate contexts where the company owns the machine instead of the user,…

> Virtually all users of sudo are using it on their own computer which they are the sole user and ultimately the administrator of. This is not the case at all. The vast vast majority of Linux installs are on servers.

That's not what parent means. They are arguing it's not generally used to delegate partial root access to unprivileged users, i.e by adding narrow sudoers rules to allow "some" specific things to be run as root for some users who don't have full root access otherwise.

I tend to agree that 99% or use cases are just a convenient way to gain full root for users with full root access. Configuring sudoers for the former use case has long known to be a bit dangerous, i.e it's easy to get it wrong and create privilege escalation holes.

Re: Run0, a systemd based alternative to sudo, announced

#717

Post by ece »

korhojoa wrote: post #531
ece wrote: post #506

Over the years I've switched from various cron daemons (anacron, cronie), sysloggers (r-syslog, syslog-ng), network managers (netifrc, NetworkManager) even ssh servers/clients (dropbear, openssh), and init systems (sysvinit, openrc) and never have I felt the need to switch to systemd despite reading some of Lennart's posts. I've used Gentoo over the years, maybe that's why. Doas is available on Linux as a sudo altern…

Now if then the commands run via some kind of privilege elevation mechanism would require pledges to be used, that would be awesome: https://news.ycombinator.com/item?id=38037075 "This needs root", okay. But you only get exactly what you need.

It's not pledge, but firejail and other SUID binaries like it (bubblewrap, nsjail, etc..) are the only such ones on my system. It's better than grsec/chroot sandbox I used back in the day on Gentoo. I've also used shorewall, ufw, opensnitch for firewalls over the years. I could go on.

Re: Run0, a systemd based alternative to sudo, announced

#718

Post by fullstop »

sapphire_tomb wrote: post #656
lupusreal wrote: post #653

Earlier quoted context omitted.

I think these problems are basically negligible because the amount of people trying to "configure sudo to be safe to use for unprivileged users, by only allowing specific things to run with it" is negligible. Virtually all users of sudo are using it on their own computer which they are the sole user and ultimately the administrator of. Even in corporate contexts where the company owns the machine instead of the user,…

My last job was at a UK bank. All our *nix systems were configured with a specific whitelist of commands that could be run via sudo. We found this an enormous pain in the arse when the powers that be decided to deploy ansible everywhere, and found that none of its "become" methods would work if sudo was set up like that.

I had a job once which had a sudo whitelist, but vi was included. !sh and you had root.

Re: Run0, a systemd based alternative to sudo, announced

#719

Post by cesarb »

michaelt wrote: post #691
ccorcos wrote: post #594

Can someone explain what this is / how it works to someone who has done a considerable amount of programming but lacks this kind of operating system level knowledge? I was under the impression that ‘sudo’ was baked into the entire system. Like ‘cd’ or ‘ps’. How exactly can you just swap out sudo? Does that involve swapping out chmod as well?

> I was under the impression that ‘sudo’ was baked into the entire system. There's a capability baked into the entire system named 'setuid' which allows certain binaries run by a user to access things as if they were root. For example, when a user changes their password using 'passwd' that executable gets special write access to the file containing hashes of all users' passwords. The system's security relies on passw…

> There's a capability baked into the entire system named 'setuid' which allows certain binaries run by a user to access things as if they were root.

It's actually "to access things as if they were the owner of the binary" (which usually is root, but that's not required).

The problem with that, is that other than the uid, the program inherits everything like a normal program. Environment variables, current directory, open file descriptors, and so on. If the program (and the dynamic linker it uses, and any library it uses including the C standard library) is not very careful, it can be tricked through these inherited things to do unexpected actions while being able to access things as if they were root (or whoever the owner of the binary is). For instance, some environment variables tell the dynamic linker to load extra libraries, or to change from where it loads libraries; these have to be ignored when running as a setuid process.

Re: Run0, a systemd based alternative to sudo, announced

#720

Post by fullstop »

yjftsjthsd-h wrote: post #237
SR2Z wrote: post #218

Earlier quoted context omitted.

Why wouldn't SSH be linked to XZ? Isn't it supported as a compression method for connections?

IIRC, xz was used by a systemd library, and that systemd library got added to sshd so it could tell systemd when it had started or something like that. SSH itself doesn't use xz.

ssh out of the box also does not use libsystemd, except on systems which were patched to do so.
Post reply on HN