Live data from Hacker News

Run0, a systemd based alternative to sudo, announced

mastodon.social

861–870 of 902 posts

Re: Run0, a systemd based alternative to sudo, announced

#861

Earlier quoted context omitted.

I agree with Lennart so I'm curious what the argument is against the notion that SUID was a bad idea and we should move away from it in Linux?

The problem with this line of thinking is it gives automatic carte blanche to anyone pointing out problems to implement "solutions" to those problems with little interrogation of whether those solutions are actually better. SUID, like any system, is flawed. Most of those flaws are balanced trade-offs; if you're addressing one you need to be aware of the severity of any counter-problems you're inevitably introducing.…

> you need to be able to weigh up both sides in a balanced way. Lennart demonstrably isn't.

That's why nobody uses his software. I mean just nothing he does gets adopted.

The 'run0' solution uses an already existing mechanism that is already used for a lot of things.

Re: Run0, a systemd based alternative to sudo, announced

#862
post #859
post #747

Earlier quoted context omitted.

Huh. I'm not at all a fan of how Poettering operates, but it's neither the ideas nor the implementation where I'd fault him. Well, it depends on what you mean by implementation, I guess; I'm talking about the core "how does it do its thing", not the interface by which you use it. I think Poettering has great ideas and great implementation. It's the execution and interface that are often terrible. If the square peg do…

What do you mean by "great ideas and great implementation / bad execution and bad interface." Is this a plumbing vs porcelain distinction?

Yes? Well, partly.

For systemd and pulseaudio, the systems they were replacing legitimately had major problems. There were variants and workarounds that fixed some of these, but no holistic solution that I've ever heard of. There were just so many limitations if you maintained any degree of compatibility. People were (understandably) unwilling to start over and rearchitect something that desperately needed rearchitecting. Poettering designed and implemented replacements that were substantially better, and worked. Worked well, in fact. That's the great ideas & implementation part.

Much of this was enabled by a willingness to throw out compatibility with nearly everything. Backwards, forwards, sideways. If I were making a bold and breaking change like this, I would sacrifice compatibility but try to make up for it by bending over backwards to catch as much of the "once working, now broken" wreckage that inevitably piled up as I could, by creating shims and compatibility stubs and transition mechanisms. I'd certainly listen to people's problems and try to work out solutions.

Poettering, as far as I can tell is more of a honey badger (excuse the dated meme). He just doesn't give a shit. If your stuff doesn't work in the brave new world, then your stuff is broken and is going to have to adapt. That's the bad execution part. (Which is not to say that bending over backwards is always the right approach; it can massively increase the burden on the new system's implementer, to the point that it never happens. There's a reason why Poettering's stuff is taking over the world.)

As for bad interface, this is a lot more subjective, so it's easier to disagree. But the tools to configure and use the new system are done in the style of an isolated cathedral. The tools do a ton of stuff, but they do it all in a new way, and that's great once you learn the blessed paths and internalize the new architecture. But all of your existing knowledge is now useless, and you can't flexibly combine and extend the functionality with the usual tools you'd use (bash, grep, awk, find, sort, tee....) The main functionality of the new system is not new — none of this is really adding fundamental new capabilities, it's just improving things that were already being done. But the way you interface with that functionality is all new, even though it could have been exposed in ways at least a little more unix-like and composable. Instead, the tool author determines all the things you should be doing and gives you a way to do them. If you want more or different, then you're doing something wrong.

Normally, I'd expect something like this to die out as it rubbed up against the surrounding functionality. "Great system, but too much effort when we keep having to fix thing after thing." Surprisingly (to me), in systemd's case in particular, what has actually happened is that the cathedral just keeps expanding to swallow up enough of its surroundings to keep from being ejected.

Maybe it's sour grapes, but my guess is that this was only possible because the previous systems were so bad. esd was a nightmare. sysvinit scripts were baroque and buggy and error-prone. Sure, the first 80% was just plain simple shell scripting. But everything did the last 20% slightly differently or just punted. It was all buggy and idiosyncratic and failed intermittently. Supposedly some of the init system variants managed to corral it all together enough to do actual dependencies and get decent startup speed, but I never used such a system. And based on the quality of the init scripts I've seen from random packages, I'm guessing the successes only happened when a relatively small group of people wrote or repaired a metric shitload of init scripts by hand. And even then, systemd provides more in its base functionality set. Architecturally, it's really quite nice.

Re: Run0, a systemd based alternative to sudo, announced

#863
post #819

Earlier quoted context omitted.

Signed ssh certs make your life easy here

Maintaining your own PKI isn't exactly easy unless it's your full time job.

Its fairly easy to get setup and after done correctly pretty low maintenance. But i have done it a few times at this point.

Re: Run0, a systemd based alternative to sudo, announced

#864

Earlier quoted context omitted.

correct me if i’m wrong, but i believe the point that is trying to be made is; a system user/admin has an intuition about files. saying that ‘journalctl -f -u’ (fu, indeed :) and whatever else is inherently undiscoverable, and is a.. basically orthogonal mechanism for handling what should be a simple task. i.e., viewing some logs. it’s far easier to compose and extend from files (what if i only care about the mtime o…

I think you have me confused with someone who cares about the difference between binary and text logs. I have no pony in this race; my comment was just made to help.

fair enough :) apologies!

Re: Run0, a systemd based alternative to sudo, announced

#865
post #858

Earlier quoted context omitted.

To be fair, this is not at all Poettering’s idea. There is, for example, precedent in the form of s6-sudo[1], a utility from the s6 service supervisor, itself very much an anti-systemd project (except I believe it predates systemd?..). And honestly I’d be okay with a suidless Unix. For example, as best as I can tell, the only reason the kernel needs to know what executable formats even are—beyond the bare minimum nee…

I like s6! One of the key differences here is that s6-sudo builds on, rather than replaces, the standard unix permissions model. s6-sudod listens on a unix domain socket. Unix domain sockets are just files, so they have an owner, group and mode bits. The answer to "who is potentially allowed to run a differently-privileged command?" is just `ls -l /path/to.sock`. For finer-grained access control, a unix domain socket…

Like many other things in Unix, SO_PEERCRED and getpeereid are half-implemented hacks that should not be used for security. They both only return the uid that was used at the time of calling connect(). Meaning you have to be incredibly careful what you do when creating the socket and you cannot really pass any sockets off to other processes if you want to try to do security that way because they will still inherit the wrong credentials. Also the usual complexities apply of how to interpret that when interacting with a process in a container.

I have a pretty low opinion of s6 because of things like this, you pretty much have to create a more complex system like polkit and systemd if you want this stuff to actually work. You don't have to use XML and javascipt like polkit does but you do have to do more than what s6 is trying to do. (Also, I personally don't find the "random collection of ad-hoc text files" style they do to be any less complex than systemd, but that's a different conversation)

Re: Run0, a systemd based alternative to sudo, announced

#866

Earlier quoted context omitted.

'systemd-run except with privilege escalation' is a thing I wished for for a long time, needed in production. Glad they finally made it, too bad it took them so long. (To be honest, it feels like it should have just been part of systemd-run in the first place.)

I mean, systemd-run could do privilege escalation from day one. It's even the default (otherwise overridable by systemd-run -pUser= ). I have used systemd-run --shell on countless occasions when I needed a clean root shell without any traces of the current environment. What is being announced is merely a thin layer of cmdline syntactic sugar over an existing feature, to make it closer to sudo in usage. So I'm not sur…

Currently you have to do `sudo systemd-run --shell` if you want a root shell from a regular user's account.

Re: Run0, a systemd based alternative to sudo, announced

#867

Earlier quoted context omitted.

The problem with this line of thinking is it gives automatic carte blanche to anyone pointing out problems to implement "solutions" to those problems with little interrogation of whether those solutions are actually better. SUID, like any system, is flawed. Most of those flaws are balanced trade-offs; if you're addressing one you need to be aware of the severity of any counter-problems you're inevitably introducing.…

> you need to be able to weigh up both sides in a balanced way. Lennart demonstrably isn't. That's why nobody uses his software. I mean just nothing he does gets adopted. The 'run0' solution uses an already existing mechanism that is already used for a lot of things.

> nobody uses his software

Yes, you're absolutely right. Popularity is the best indicator of quality.

Re: Run0, a systemd based alternative to sudo, announced

#868

Earlier quoted context omitted.

> you need to be able to weigh up both sides in a balanced way. Lennart demonstrably isn't. That's why nobody uses his software. I mean just nothing he does gets adopted. The 'run0' solution uses an already existing mechanism that is already used for a lot of things.

> nobody uses his software Yes, you're absolutely right. Popularity is the best indicator of quality.

Its not the best indicator but to claim its meaningless is idiotic.

Specially since we are talking about free software, and not some software that Microsoft can preinstall on your laptop.

Re: Run0, a systemd based alternative to sudo, announced

#869
post #781

Earlier quoted context omitted.

I honestly have no clue what you mean. You can take unit files, journald, timers, and all the other neat features from my cold, dead hands. I’m not going back to writing brittle shell scripts; systemd has made my life SO much easier.

> I’m not going back to writing brittle shell scripts Then stop doing that.

Writing robust shell scripts ranges from hard to incredibly difficult. The number of footguns is insane

Re: Run0, a systemd based alternative to sudo, announced

#870

Earlier quoted context omitted.

> nobody uses his software Yes, you're absolutely right. Popularity is the best indicator of quality.

Its not the best indicator but to claim its meaningless is idiotic. Specially since we are talking about free software, and not some software that Microsoft can preinstall on your laptop.

Just because it has been pushed by RedHat and others are semi-forced to adapt, it doesn't mean all distros got in line to get a copy of the software and get it adopted.

Pulse has been replaced with the pipewire as soon as it arrived, for example.

Post reply on HN