Live data from Hacker News

Run0, a systemd based alternative to sudo, announced

mastodon.social

311–320 of 902 posts

Re: Run0, a systemd based alternative to sudo, announced

#311

Earlier quoted context omitted.

The follow argument is identical to tail `-f`. `sudo journalctl -f -u `

And what would be the equivalent to, "Oh, I don´t know the name of the log for this process I can see in 'ps aux', let me cd into /var/log and see what filenames I can find ... or grep everything until I can find a couple of words that make some sense so I can keep digging further"? The lack of explorability in journalctl, the "need" to keep everything locked behind their own flavor of tools and magic file types, is…

    # journalctl -f _PID=${your_pid}  # option 1
    # systemctl status ${your_pid}    # option 2
[1]: https://www.freedesktop.org/software/systemd/man/latest/jour...

[2]: https://www.freedesktop.org/software/systemd/man/latest/syst...

Re: Run0, a systemd based alternative to sudo, announced

#312

Earlier quoted context omitted.

And what would be the equivalent to, "Oh, I don´t know the name of the log for this process I can see in 'ps aux', let me cd into /var/log and see what filenames I can find ... or grep everything until I can find a couple of words that make some sense so I can keep digging further"? The lack of explorability in journalctl, the "need" to keep everything locked behind their own flavor of tools and magic file types, is…

Huh, isn't grepping journalctl output pretty much the same? It even prefixes messages by the binary name.

Pedantically, they're the unit name which only sometimes matches the binary name

Re: Run0, a systemd based alternative to sudo, announced

#313

Earlier quoted context omitted.

> I could `tail -f *.logs`. I remember how I didn't need to remember about `--no-pager` and `--follow`. journalctl supports -f, which by your own account you were already using for tail, so I'm not clear what's worse there. > I remember how I didn't have to google how to find logs between 10 days ago and 4 days ago, because the logs would be in a .tar created by logrotate with a date in the filename. My memory of thi…

I think my biggest gripe with journalctl is (and this may just be because I'm novice at using it) that discovering what sort of logs are on the system feels a lot more complex. With regular logs, I can go to /var/log, ls the dir, and get a nice list of what's being logged. There will be, for example, an `apache.log` file that has all the logs relevant to apache.

It's just journalctl -u apache -f, assuming your distribution calls the unit file "apache", and the last few messages of the logfile appear with systemctl status apache

And you don't need to worry about "is this service rotating logs appropriately?"

Re: Run0, a systemd based alternative to sudo, announced

#314

Perhaps the nomenclature should be updated from GNU/Linux to GNU/systemd/Linux.

Until systemd consumes the kernel and then it will be GNU/systemd

https://www.tumblr.com/wizardofbits/96856361060/rethinking-t...

Waiting for this to no longer be fake.

Re: Run0, a systemd based alternative to sudo, announced

#315
post #278

Earlier quoted context omitted.

> journalctl supports -f, which by your own account you were already using for tail, so I'm not clear what's worse there Yeah, this is a bit of an odd complaint. If I were this bothered by having to type those, I'd just make an alias to "journalctl --follow --nopager"` and would have forgotten about it years ago.

Never tried it, but if the complainer wrote: tail -f *.logs Which involves glob’ing. I assume it allows to monitor several services at the same time. Can systemd do that?

Yes, journalctl -u postgres -u redis -f etc

Re: Run0, a systemd based alternative to sudo, announced

#316
post #304
post #45

systemd has been a net positive for the linux ecosystem. remember when you had to write bash scripts to start, stop, restart services and handle any other signals you want to send it? nowadays it's a unit file (basically just an ini file) away with relatively straightforward API. and you can actually declare startup dependencies and other useful relationships past just "prepend a number signifying when it should run…

Ah yes I remember back when you just put the system hostname in /etc/hostname. Now we have hostnamed!

Which is now borderline impossible to tame. Google "change hostname ubuntu" and take a look at the results and comments.

Re: Run0, a systemd based alternative to sudo, announced

#317
post #230

Earlier quoted context omitted.

> remember when you had to write bash scripts to start, stop, restart services This was a really big pain, yes, but I also remember how I could `tail -f *.logs`. I remember how I didn't need to remember about `--no-pager` and `--follow`. I knew where the files were, what they were called. I remember how I didn't have to google how to find logs between 10 days ago and 4 days ago, because the logs would be in a .tar cr…

The follow argument is identical to tail `-f`. `sudo journalctl -f -u `

[deleted]

Re: Run0, a systemd based alternative to sudo, announced

#318

I have seldom come across unix multiuser environments getting used anymore for servers. Its generally just one user on one physical machine now a days. I understand run0's promise is still useful but i would really like to see the whole unix permission system simplified for just one user who has sudo access.

NixOS may be helping multiuser make a comeback, at least it is for me and my home servers. I no longer have to containerize my apps, i can have one baremetal server with a dozen+ services, all with their own users and permissions, and i don't have to actually think about any of the separation.

Plus there’s network shares. Multiple people in my home with linux PCs, each with their own slice of the NFS pie based on user perms. Sure, it’s not secure, but these are people I live with, not state-sponsored hackers.

All that said, I’d also love a simpler single-user perm setup. For VMs, containers, etc it would be amazing

Re: Run0, a systemd based alternative to sudo, announced

#319
post #313

Earlier quoted context omitted.

I think my biggest gripe with journalctl is (and this may just be because I'm novice at using it) that discovering what sort of logs are on the system feels a lot more complex. With regular logs, I can go to /var/log, ls the dir, and get a nice list of what's being logged. There will be, for example, an `apache.log` file that has all the logs relevant to apache.

It's just journalctl -u apache -f, assuming your distribution calls the unit file "apache", and the last few messages of the logfile appear with systemctl status apache And you don't need to worry about "is this service rotating logs appropriately?"

The important thing for me at least isn't he `-u apache` but rather knowing that `apache` exists as one of the installed services on this box.

In the old ways, that was apparent because of the presence of the log file.

Granted, this isn't the problem it used to be for us, however, it would come up because we'd have our services named things like `foo-ws` and knowing that `foo-ws` existed on a given box might be tricky were it not for the log files.

Re: Run0, a systemd based alternative to sudo, announced

#320
post #2

Uses polkit. run0, which behaves like sudo, but works entirely differently and is not SUID. Run0 asks the services manager to create a shell or command under the target user’s ID, creating a new PTY, sending data back and forth from the originating TTY and the new PTY.

How hard would it be to create a program to send a signal to polkit "impersonating" run0 and obtains a root shell? :)

Is that even a problem? Any program can shell out to sudo, hence why you shouldn't set NOPASSWD in sudoers. Polkit takes in a request on an unprivileged interface, that request is evaluated in privileged code against the set of privilege rules, and then passed the proper capabilities if the rules allow. This includes a mechanism where it can, if desired, prompt a user to enter a password etc to prevent a rogue program silently acquiring root. But even in the worst case, the rogue program is not going to acquire any capabilities that you would not otherwise have as with sudo, and the breakpoint between privileged and unprivileged code is (in theory) more tightly defined and controlled.
Post reply on HN