Most active commenters
  • bayindirh(6)
  • sigil(5)
  • crabbone(4)
  • 1oooqooq(4)
  • panick21_(4)
  • jimrandomh(3)
  • lyu07282(3)

←back to thread

466 points CoolCold | 73 comments | | HN request time: 2.737s | source | bottom
1. jimrandomh ◴[] No.40220398[source]
> Or in other words: the target command is invoked in an isolated exec context, freshly forked off PID 1, without inheriting any context from the client (well, admittedly, we do propagate $TERM, but that's an explicit exception, i.e. allowlist rather than denylist).

I think in practice, this is going to be an endless source of problems, so much so that it won't be adopted. The usual use case of sudo is that you have a normal shell command, making use of the environment for context in all the ways that shell commands do, but it doesn't have all the permissions it needs, so you add "sudo" as an adverb.

Sometimes it makes use of environment variables. Sometimes stdin or stdout is redirected to a file, or to something more exotic than a file. Sometimes that means it runs inside of a chroot, or a Docker container. Sometimes you care about which process group it runs in.

And sometimes the thing you're running is a complicated shell script or shell-script-like object, eg "sudo make install". In this case, you don't really know what its dependencies are. In fact this is a common enough case that, if run0 becomes widespread, I expect it'll have a flag or a set of flags that make it act exactly like sudo, and I expect people to wind up learning that they should always give run0 those flags.

And I'm kind of worried that when this breaks stuff, the systemd project is going to push forward with some plan to get rid of sudo, and not gracefully accept the feedback that this is breaking things. I'm particularly worried about this because of the whole saga of KillUsersProcesses breaking nohup and screen, which to my knowledge is still broken many years later.

replies(8): >>40220545 #>>40220776 #>>40221057 #>>40221964 #>>40222111 #>>40223577 #>>40225155 #>>40233172 #
2. yorwba ◴[] No.40220545[source]
I don't know what your sudo does, but mine requires the --preserve-env flag if you want the new process to have access to all your environment variables.

The thing you're saying is going to be an endless source of problems should already be an endless source of problems! (And I think I've been briefly confused by some missing environment variable once or twice so far.)

replies(2): >>40220671 #>>40225571 #
3. mid-kid ◴[] No.40220671[source]
It depends on whether sudo was compiled with --disable-env-reset or not, it's on by default[1].

Also some variables are inherited regardless (e.g. DISPLAY, TERM), and some useful ones (e.g. HOME) are initialized by sudo, but I can't tell where that's done.

[1]: https://github.com/sudo-project/sudo/blob/ef52db46f9b375d7ff...

4. lyu07282 ◴[] No.40220776[source]
I think what is perhaps something to consider is how much of an attack surface sudo is and how unaware people are of the fact. Many people think they can configure sudo to be safe to use for unprivileged users, by only allowing specific things to run with it. But they don't realize all the ways it can be abused for privilege escalation. Getting rid of all that configuration removes that false sense of security, which is a good thing, it has been a huge footgun in Linux for decades. Some incompatibility is price well worth paying for that imho
replies(1): >>40221072 #
5. keepamovin ◴[] No.40221057[source]
Yeah we had to explicitly set that to No and enable linger to let pulseaudio keep running for users so they can continue to stream sound from their remote browsers in BrowserBox/CloudTabs. Ie at: https://puter.com/app/cloudtabs-browserbox

Your comment was really well expressed btw. Made your thoughts and emotions very clear about this. Inspiring communication skill! :)

6. lupusreal ◴[] No.40221072[source]
I think these problems are basically negligible because the amount of people trying to "configure sudo to be safe to use for unprivileged users, by only allowing specific things to run with it" is negligible. Virtually all users of sudo are using it on their own computer which they are the sole user and ultimately the administrator of. Even in corporate contexts where the company owns the machine instead of the user, I've only ever seen cases where the use of sudo is unrestricted albeit logged. Where are these organizations where developers or syaadmins are allowed to use sudo but only with white listed commands? I don't doubt that some people are doing this, I just think it's not common.

Replacing the whole of sudo with some weird new thing to better support a niche usecase seems disconnected from reality to me.

replies(5): >>40221164 #>>40221703 #>>40222619 #>>40225606 #>>40227592 #
7. sapphire_tomb ◴[] No.40221164{3}[source]
My last job was at a UK bank. All our *nix systems were configured with a specific whitelist of commands that could be run via sudo. We found this an enormous pain in the arse when the powers that be decided to deploy ansible everywhere, and found that none of its "become" methods would work if sudo was set up like that.
replies(3): >>40221316 #>>40221476 #>>40223361 #
8. WesolyKubeczek ◴[] No.40221316{4}[source]
Not even using "su" as become_method? Granted, it would require the root's password, so it's another tradeoff, but...
9. jeremyjh ◴[] No.40221476{4}[source]
Those environments could continue to use sudo. I'm sure Red Hat will support it until long after we all dead.
10. Hendrikto ◴[] No.40221703{3}[source]
> Virtually all users of sudo are using it on their own computer which they are the sole user and ultimately the administrator of.

This is not the case at all. The vast vast majority of Linux installs are on servers.

replies(3): >>40222682 #>>40223195 #>>40225069 #
11. throw0101b ◴[] No.40221964[source]
> And I'm kind of worried that when this breaks stuff, the systemd project is going to push forward with some plan to get rid of sudo, and not gracefully accept the feedback that this is breaking things.

See for example perhaps, "systemd can't handle the process previlege that belongs to user name starts with number, such as 0day":

* https://github.com/systemd/systemd/issues/6237

Never mind that POSIX allows it:

* https://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd...

* https://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd...

> I'm particularly worried about this because of the whole saga of KillUsersProcesses breaking nohup and screen, which to my knowledge is still broken many years later.

For anyone curious, see "Systemd v230 kills background processes after user logs out, breaks screen, tmux" from 2016:

* https://news.ycombinator.com/item?id=11782364

12. bayindirh ◴[] No.40222111[source]
> And I'm kind of worried that when this breaks stuff, the systemd project is going to push forward with some plan to get rid of sudo, and not gracefully accept the feedback that this is breaking things.

Given Lennart already declared SUID concept as “bad”, I think this is the game plan all along.

Systemd: Do all the things, but not very well, and don’t listen to anyone.

replies(1): >>40222763 #
13. lyu07282 ◴[] No.40222619{3}[source]
Its a common finding during pentests, but that's just unconvincing anecdote vs. anecdote. Another argument, besides misconfiguration, is the reduced attack surface by removing the huge complexity of sudo entirely. If your argument is basically that its fine because nobody is using the complexity of sudo, then I don't quite understand what your objection is to removing that complexity. You might need to manually restore some env-vars, whats the big deal?

But I suspect this would just turn into a "doing things differently is bad because its doing things differently" argument, its not a very useful conversation to have.

14. troyvit ◴[] No.40222682{4}[source]
Then I propose letting systemd hijack sudo's usefulness only on server installs.
15. lyu07282 ◴[] No.40222763[source]
I agree with Lennart so I'm curious what the argument is against the notion that SUID was a bad idea and we should move away from it in Linux?
replies(4): >>40222900 #>>40224154 #>>40225359 #>>40227845 #
16. datadrivenangel ◴[] No.40222900{3}[source]
SUID has flaws, but it's not clear that there are any more convenient alternatives?
replies(2): >>40225703 #>>40237524 #
17. tomxor ◴[] No.40223195{4}[source]
That's not what parent means. They are arguing it's not generally used to delegate partial root access to unprivileged users, i.e by adding narrow sudoers rules to allow "some" specific things to be run as root for some users who don't have full root access otherwise.

I tend to agree that 99% or use cases are just a convenient way to gain full root for users with full root access. Configuring sudoers for the former use case has long known to be a bit dangerous, i.e it's easy to get it wrong and create privilege escalation holes.

18. fullstop ◴[] No.40223361{4}[source]
I had a job once which had a sudo whitelist, but vi was included. !sh and you had root.
replies(3): >>40224067 #>>40225238 #>>40225813 #
19. KWxIUElW8Xt0tD9 ◴[] No.40223577[source]
One binary to rule them all, one binary to find them, one binary to bring them all and in the darkness bind them; in the Land of Lennart where the shadows lie. Bwaahahaha.
replies(1): >>40230606 #
20. TheRealDunkirk ◴[] No.40224067{5}[source]
Classic case of #CorporateIT applying white paper "rules" and not understanding what they're doing. If I had a nickel...
replies(1): >>40226402 #
21. bayindirh ◴[] No.40224154{3}[source]
SUID mechanism doesn’t always “elevate to root”. It’s a mechanism to “run as another user” and with SGID allows great flexibility in user permission management. You can allow all kinds of (responsible) user switch tricks for multi-admin servers and multi-user systems.

Focusing all of this to sudo and framing SUID as “just implemented to enable sudo” is not painting the correct picture.

Moreover, removing SUID breaks tons of mechanisms and scenarios.

Security of sudo can be debated, but evolving current sudo to a better state step by step is miles better than banishing and rebuilding it and making it dependent on systemd + polkit. systemd already breaks tons of UNIX conventions and way more complicated than it should be.

When you think, it sounds like “conquering” another part of user space mixed with NIH (and we know the best), and making systemd more entrenched. systemd is already a pretty large surface area to attack to begin with.

XZ back door reached SSHd over libaystemd. Do we need another “integrated target” to attack in Linux?

replies(1): >>40225523 #
22. sigil ◴[] No.40225155[source]
run0 has already been exploited: https://twitter.com/hackerfantastic/status/17854955875146385...

There will be plenty more where that came from. Yet another terrible idea and terrible implementation from Poettering.

replies(6): >>40225409 #>>40225633 #>>40225644 #>>40227617 #>>40227978 #>>40234896 #
23. ◴[] No.40225238{5}[source]
24. lucideer ◴[] No.40225359{3}[source]
The problem with this line of thinking is it gives automatic carte blanche to anyone pointing out problems to implement "solutions" to those problems with little interrogation of whether those solutions are actually better.

SUID, like any system, is flawed. Most of those flaws are balanced trade-offs; if you're addressing one you need to be aware of the severity of any counter-problems you're inevitably introducing.

Lennart is well known for criticising existing systems while simultaneously ignoring & dismissing criticism of the proposed solutions - you need to be able to weigh up both sides in a balanced way. Lennart demonstrably isn't.

replies(1): >>40240107 #
25. sfink ◴[] No.40225409[source]
Huh. I'm not at all a fan of how Poettering operates, but it's neither the ideas nor the implementation where I'd fault him. Well, it depends on what you mean by implementation, I guess; I'm talking about the core "how does it do its thing", not the interface by which you use it.

I think Poettering has great ideas and great implementation. It's the execution and interface that are often terrible. If the square peg doesn't fit in the round hole, then he'll always say that the peg is perfect and the world just needs to chisel out the corners of the hole.

replies(2): >>40225588 #>>40238914 #
26. crabbone ◴[] No.40225523{4}[source]
All these ideas that tie permissions to a file completely fail when files need to be accessed either over network, or inside a container.

I can see how the original authors didn't consider these cases, because they simply weren't there yet... but knowing what we know today: SUID is an awful idea.

replies(1): >>40228046 #
27. crabbone ◴[] No.40225571[source]
Even without the flag, sudo preserves a bunch of stuff. And it's not even consistent. Some implementations preserve locale setting, while others don't for example.
replies(1): >>40228925 #
28. 1oooqooq ◴[] No.40225588{3}[source]
you have the wrong view point. he just have a different opinion than you.

he single handled managed to fool RH and all distros into turning Linux administration just like windows. systemctl list of services is so inspired by the atrocious windows' admin list of services (which have 3 fields supposed to describe the service, but they all just tell you the name again).

it's no wonder his reward was a job at Microsoft.

but again, he's good in all three aspects. you just disagree on building the torment Nexus that is putting Linux in the "standard certification" target for sysadmins.

replies(2): >>40227135 #>>40227986 #
29. crabbone ◴[] No.40225606{3}[source]
> Virtually all users of sudo are using it on their own computer

Nope. If I had to guess, it's in containers, like Docker. And those run in lots of places, and often in places with easy access to company's cloud account, credit card info etc.

30. mahkoh ◴[] No.40225633[source]
The linked PoC requires that the attacker already has root so that it can disable the default ptrace protection.
replies(1): >>40235084 #
31. lofenfew ◴[] No.40225644[source]
What's the difference between this and ptracing the bash session that you run sudo under?
replies(1): >>40231343 #
32. 1oooqooq ◴[] No.40225703{4}[source]
you missed the memo. it's dbus. (wish i could end with /s)
33. acdha ◴[] No.40225813{5}[source]
I also liked one where you could `sudo rpm -i`
34. fullstop ◴[] No.40226402{6}[source]
Exactly, forms were filled in and boxes were checked off.
35. superpatosainz ◴[] No.40227135{4}[source]
It's inspired by Apple's launchd.
replies(1): >>40233526 #
36. otabdeveloper4 ◴[] No.40227592{3}[source]
'systemd-run except with privilege escalation' is a thing I wished for for a long time, needed in production.

Glad they finally made it, too bad it took them so long. (To be honest, it feels like it should have just been part of systemd-run in the first place.)

replies(1): >>40234624 #
37. jimrandomh ◴[] No.40227617[source]
I wouldn't worry too much about that. It's a tricky piece of security-critical software, receiving its first round of outside auditing; of course it has vulnerabilities. Sudo does have the advantage of being much more battle-tested, but that will even out with time; what will matter is how secure it is two years from now.
38. jimrandomh ◴[] No.40227845{3}[source]
Setuid is a mechanism where you take a program, and mark it so it always runs as root (or some other user, but in this case root). The idea is that an unprivileged user can run a setuid program, and the program itself decides what privileges to allow.

The problem is that the user controls the program's view of the filesystem, environment variables, and other attributes, and this is an attack surface that can be used to trick it into loading and running code provided by the unprivileged user, which runs as root. For example, ordinary programs have a preamble inserted by the compiler where they load a programming-language runtime, usually from somewhere like /usr/lib; but a setuid program can't safely do this, because the user could use a chroot to replace /usr/lib with something different.

In practice, this means that writing a setuid program correctly is exceptionally difficult and error prone, can only be done in C, and imposes security requirements on the compiler flags/makefiles rather than the source code, which creates a large risk of distro- or compiler-specific vulnerabilities. In practice, sudo is the only program people allow to use the setuid mechanism, and sudo is a unique and dangerous snowflake.

replies(1): >>40237938 #
39. mananaysiempre ◴[] No.40227978[source]
To be fair, this is not at all Poettering’s idea. There is, for example, precedent in the form of s6-sudo[1], a utility from the s6 service supervisor, itself very much an anti-systemd project (except I believe it predates systemd?..).

And honestly I’d be okay with a suidless Unix. For example, as best as I can tell, the only reason the kernel needs to know what executable formats even are—beyond the bare minimum needed to load PID 1—is s[ug]id binaries.

[1] https://skarnet.org/software/s6/s6-sudo.html

replies(1): >>40238896 #
40. Analemma_ ◴[] No.40227986{4}[source]
I continue to be baffled at this widespread belief that Poettering somehow hoodwinked every single major Linux distro into accepting a shit product with, idk, hypnosis or something.

Is it not possible that systemd is simply better than the alternatives, and the distro owners are smart enough to notice that, instead of just wrapping themselves cultish mantras about The Unix Way and how anything which resembles a design used in Windows is bad by definition? Or could that not possibly be it and he must've used mind control magic.

replies(2): >>40233514 #>>40234863 #
41. bayindirh ◴[] No.40228046{5}[source]
Sorry for my ignorance, but what’s a scenario that you run a SUID/GUID binary from a network or a container?

If you access and run, it’s SSH or similar, so it works on the system scope. If it’s a container built correctly, it has its own users and isolation already, so it shouldn’t be able to fire any binary on your “base” system, and any effect is already in the container scope.

I have never had the need to SUID/GUID a non executable, and didn’t need to trigger something on the system inside a container in the last ~20 years.

replies(1): >>40230416 #
42. 0x457 ◴[] No.40228925{3}[source]
It depends on what options sudo us built with. Notably `--disable-env-reset` option.
43. crabbone ◴[] No.40230416{6}[source]
> but what’s a scenario that you run a SUID/GUID binary from a network or a container?

A lot of publicly available container images require elevated permissions to simply function, not for anything extraordinary. So, the user in container needs to be a superuser. It's often even not to perform the program's main function, but because various ordinary things in Linux require elevated permissions.

> container built correctly

That's a spherical horse in vacuum. If you write code s.t. there aren't any errors, you don't need to do error handling, right? You don't get to choose how containers are built. You need to deal with all possibilities of how containers can be built.

Network filesystem? -- /usr/shared, /usr/opt and /usr/local? That's by design... very typical for cluster management software to mount these from NAS. It's also very not typical to keep these as "only text files". Pretty sure a lot of Google's stuff installs automatically into /usr/shared. I think even Go compiler and other infra at some point was being installed there by default.

Finally: the same argument as with containers. You, for some reason, are trying to fantasize the world where problems don't exist because you chose the world w/o problems. But this isn't the real world. It's a fantasy. In real world, with or without reason, programmers and other computer users will do what's possible, not what you want them to do.

44. Aerbil313 ◴[] No.40230606[source]
This gave me a genuine chuckle. Clever humor, thank you.
45. nickelpro ◴[] No.40231343{3}[source]
None, it's a nonsense "hack"
46. runiq ◴[] No.40233172[source]
The way I see it, this is actually a good thing. Superuser access should impose a tiny bit of friction in this regard, to enforce discipline where discipline is warranted.

Run0 builds character. :^)

47. 1oooqooq ◴[] No.40233514{5}[source]
never said that.

just that his vision was garbage, and everyone knows. but he stood by it. and nobody was putting the same energy he was to either offer better or stop it (rejecting bad ideas also take energy. see gnome deep dive into garbage as another example)

Linux is mostly made from scraps (eg Bluetooth and wifi entire stacks) or misguided but funded things. the age of scratching own itch is mostly gone

replies(1): >>40238101 #
48. 1oooqooq ◴[] No.40233526{5}[source]
only in it's a rewrite of the concepts from inetd but using dbus and abused for local services.

which is a big part, but not the one most people complains about.

the actual UX is very much windows like.

49. intelfx ◴[] No.40234624{4}[source]
I mean, systemd-run could do privilege escalation from day one. It's even the default (otherwise overridable by systemd-run -pUser=<user>). I have used systemd-run --shell on countless occasions when I needed a clean root shell without any traces of the current environment.

What is being announced is merely a thin layer of cmdline syntactic sugar over an existing feature, to make it closer to sudo in usage.

So I'm not sure what exactly you were missing?

replies(1): >>40245294 #
50. veidr ◴[] No.40234863{5}[source]
Yes, it has always reminded me of the old "Apple just sells all those shiny devices because they're good at marketing" trope.

As if marketing alone could do that. Poettering does seem to be, to a casual observer, kind of a dick. Arrogant, dismissive of competing products... kind of like that other guy — also kind of a dick — who supposedly had that "reality distortion field" that hoodwinked all those poor saps into buying his phones.

There's no fucking way in hell you are able do that if the user base doesn't think the product is good. To those saying it, I always reply, "It may not be the product you want, but a shitload of people disagree with you, quite obviously."

I'm not personally a huge fan of the iPhone or systemd. But they are both clearly "the best" for the largest number of people. (And that is even clearer for systemd, as it doesn't cost hundreds or thousands of dollars more then the competing products.)

51. blucaz ◴[] No.40234896[source]
That's not an exploit, that's just a sequence of basic misunderstandings about how things work on Linux. Which would be fine, nobody knows everything, if they weren't coated with grand claims and not-so-veiled personal abuse.
52. blucaz ◴[] No.40235084{3}[source]
Requires root not just for the ptrace protection, but also to gain membership of the 'tty' group which gives control over all ttys. And then goes all surprised pikachu when it turns out that allows taking over ttys. Duh?
53. semi ◴[] No.40237524{4}[source]
it depends on what you're needing suid for but the first thing id evaluate is if you can just grant a specific CAPAB instead.
54. kasabali ◴[] No.40237938{4}[source]
> because the user could use a chroot to replace /usr/lib with something different

You need to be root in the first place to be able to do that

55. kasabali ◴[] No.40238101{6}[source]
> nobody was putting the same energy he was to either offer better or stop it

which was much easier thing to do, compared to an outsider, considering he was on Red Hat's payroll, along with the people (gnome/freedesktop crowd) he had need to convince

56. sigil ◴[] No.40238896{3}[source]
I like s6! One of the key differences here is that s6-sudo builds on, rather than replaces, the standard unix permissions model.

s6-sudod listens on a unix domain socket. Unix domain sockets are just files, so they have an owner, group and mode bits. The answer to "who is potentially allowed to run a differently-privileged command?" is just `ls -l /path/to.sock`.

For finer-grained access control, a unix domain socket listener can call `getpeereuid()` or `getsockopt(..., SO_PEERCRED, ...)` to learn who it's talking to. You can build powerful – but still relatively simple, and importantly, readily-inspectable – access control policy on top of these basic unix primitives. That's what s6 does. Look at how simple rule definition is. [0]

Or, you could throw all that out the window and build something much more complex and much less inspectable, which is the systemd approach. The answer to "who is potentially allowed to run a differently-privileged command?" under `run0` is to...spend the evening reading through polkit xml rules, I guess?

I realize systemd uses D-Bus, and D-Bus uses a unix domain socket. But that socket is writable by world. We're trusting polkit and complex policy xml and probably a constellation of other services to get things right after the SO_PEERCRED check.

Maybe that's fine for desktop apps, but a reminder that we're talking about sudo here.

Complexity is the enemy of security. The complexity of the systemd ecosystem broadly writ is how we get CVEs like this polkit privesc, which took 12 years to notice [1].

Addendum: it's possible to regard systemd as dangerously complex AND sudo as dangerously complex. OpenBSD as usual had the right idea with `doas`.

[0] https://skarnet.org/software/s6/s6-accessrules-cdb-from-fs.h...

[1] https://www.cvedetails.com/cve/CVE-2021-4034/

replies(2): >>40242955 #>>40256064 #
57. sigil ◴[] No.40238914{3}[source]
What do you mean by "great ideas and great implementation / bad execution and bad interface." Is this a plumbing vs porcelain distinction?
replies(1): >>40241292 #
58. panick21_ ◴[] No.40240107{4}[source]
> you need to be able to weigh up both sides in a balanced way. Lennart demonstrably isn't.

That's why nobody uses his software. I mean just nothing he does gets adopted.

The 'run0' solution uses an already existing mechanism that is already used for a lot of things.

replies(1): >>40246257 #
59. sfink ◴[] No.40241292{4}[source]
Yes? Well, partly.

For systemd and pulseaudio, the systems they were replacing legitimately had major problems. There were variants and workarounds that fixed some of these, but no holistic solution that I've ever heard of. There were just so many limitations if you maintained any degree of compatibility. People were (understandably) unwilling to start over and rearchitect something that desperately needed rearchitecting. Poettering designed and implemented replacements that were substantially better, and worked. Worked well, in fact. That's the great ideas & implementation part.

Much of this was enabled by a willingness to throw out compatibility with nearly everything. Backwards, forwards, sideways. If I were making a bold and breaking change like this, I would sacrifice compatibility but try to make up for it by bending over backwards to catch as much of the "once working, now broken" wreckage that inevitably piled up as I could, by creating shims and compatibility stubs and transition mechanisms. I'd certainly listen to people's problems and try to work out solutions.

Poettering, as far as I can tell is more of a honey badger (excuse the dated meme). He just doesn't give a shit. If your stuff doesn't work in the brave new world, then your stuff is broken and is going to have to adapt. That's the bad execution part. (Which is not to say that bending over backwards is always the right approach; it can massively increase the burden on the new system's implementer, to the point that it never happens. There's a reason why Poettering's stuff is taking over the world.)

As for bad interface, this is a lot more subjective, so it's easier to disagree. But the tools to configure and use the new system are done in the style of an isolated cathedral. The tools do a ton of stuff, but they do it all in a new way, and that's great once you learn the blessed paths and internalize the new architecture. But all of your existing knowledge is now useless, and you can't flexibly combine and extend the functionality with the usual tools you'd use (bash, grep, awk, find, sort, tee....) The main functionality of the new system is not new — none of this is really adding fundamental new capabilities, it's just improving things that were already being done. But the way you interface with that functionality is all new, even though it could have been exposed in ways at least a little more unix-like and composable. Instead, the tool author determines all the things you should be doing and gives you a way to do them. If you want more or different, then you're doing something wrong.

Normally, I'd expect something like this to die out as it rubbed up against the surrounding functionality. "Great system, but too much effort when we keep having to fix thing after thing." Surprisingly (to me), in systemd's case in particular, what has actually happened is that the cathedral just keeps expanding to swallow up enough of its surroundings to keep from being ejected.

Maybe it's sour grapes, but my guess is that this was only possible because the previous systems were so bad. esd was a nightmare. sysvinit scripts were baroque and buggy and error-prone. Sure, the first 80% was just plain simple shell scripting. But everything did the last 20% slightly differently or just punted. It was all buggy and idiosyncratic and failed intermittently. Supposedly some of the init system variants managed to corral it all together enough to do actual dependencies and get decent startup speed, but I never used such a system. And based on the quality of the init scripts I've seen from random packages, I'm guessing the successes only happened when a relatively small group of people wrote or repaired a metric shitload of init scripts by hand. And even then, systemd provides more in its base functionality set. Architecturally, it's really quite nice.

replies(1): >>40256095 #
60. shiny22 ◴[] No.40242955{4}[source]
Like many other things in Unix, SO_PEERCRED and getpeereid are half-implemented hacks that should not be used for security. They both only return the uid that was used at the time of calling connect(). Meaning you have to be incredibly careful what you do when creating the socket and you cannot really pass any sockets off to other processes if you want to try to do security that way because they will still inherit the wrong credentials. Also the usual complexities apply of how to interpret that when interacting with a process in a container.

I have a pretty low opinion of s6 because of things like this, you pretty much have to create a more complex system like polkit and systemd if you want this stuff to actually work. You don't have to use XML and javascipt like polkit does but you do have to do more than what s6 is trying to do. (Also, I personally don't find the "random collection of ad-hoc text files" style they do to be any less complex than systemd, but that's a different conversation)

replies(1): >>40250235 #
61. otabdeveloper4 ◴[] No.40245294{5}[source]
Currently you have to do `sudo systemd-run --shell` if you want a root shell from a regular user's account.
62. lucideer ◴[] No.40246257{5}[source]
> nobody uses his software

Yes, you're absolutely right. Popularity is the best indicator of quality.

replies(1): >>40246949 #
63. panick21_ ◴[] No.40246949{6}[source]
Its not the best indicator but to claim its meaningless is idiotic.

Specially since we are talking about free software, and not some software that Microsoft can preinstall on your laptop.

replies(2): >>40247939 #>>40328293 #
64. bayindirh ◴[] No.40247939{7}[source]
Just because it has been pushed by RedHat and others are semi-forced to adapt, it doesn't mean all distros got in line to get a copy of the software and get it adopted.

Pulse has been replaced with the pipewire as soon as it arrived, for example.

replies(1): >>40248201 #
65. panick21_ ◴[] No.40248201{8}[source]
Ah the old 'we were forced to use this free thing'. Sure.

> Pulse has been replaced with the pipewire as soon as it arrived

Pipewire combines alsa, pulse and jack. They all have different strength.

And Pulse was started by Lennard but he hasn't been involved for a very long time.

replies(1): >>40249578 #
66. bayindirh ◴[] No.40249578{9}[source]
> Ah the old 'we were forced to use this free thing'. Sure.

Well, I was a tech lead of a Debian derivative when Debian held the vote. I have seen and read enough. Didn't see the other "threats" thing, but since I had access to debian-devel, I was in the middle of it.

My views about systemd has not changed since then, and can be found if you search HN.

On the other hand, I have used 4-5 init systems in the last 20 years, and none of them were that aggressive and had the "we know the best" attitude, while going against all the best practices and making the same mistakes done in the past.

> Pipewire combines alsa, pulse and jack. They all have different strength.

Nope. ALSA is always there, working as the primary sink, delineating user space and hardware. I used Jack back in the day for recording, and never got to like pulse because of its backwards defaults and lassies-faire behavior about multi-channel audio (plus glitches, etc).

Pipewire is a great sound server which sits on top of ALSA, and replaces Pulse transparently, and makes everything 100x nicer along the way.

Lastly, it's Lennart Pottering. Not Lennard. :)

P.S.: It's important to understand that my views are not against the persons, but the behavior of the projects. I'd drink a nice round of beer with all of them, if I had the chance. :)

replies(1): >>40250842 #
67. sigil ◴[] No.40250235{5}[source]
You do realize D-Bus also uses SO_PEERCRED right? And transitively polkit, systemd, and everything in that ecosystem.

https://gitlab.freedesktop.org/dbus/dbus/-/blob/master/dbus/...

> Meaning you have to be incredibly careful what you do when creating the socket and you cannot really pass any sockets off to other processes if you want to try to do security that way because they will still inherit the wrong credentials.

I see nothing new here beyond "handle privileged resources with care." Don't overshare. Got an open pipe to `sh` running as root? Maybe you oughtta set O_CLOEXEC on that fd before you exec and overshare with a child. Got a socket that's been peer authed? The same.

This is pretty basic unix stuff. If you stick to the basics and avoid the siren call of complexity, the security properties remain relatively easy to reason about. Most privileged resources are fds. Mind your fds.

I'm not a huge fan of sending file descriptors over sockets – maybe we agree on that part.

68. panick21_ ◴[] No.40250842{10}[source]
The reality Debian didnt want to or couldnt develop their own. The system people used them was simply shit. And the alternatives like Upstart were just crap.

Nobody forced Debian. I followed it live too. I remember him talking to Debian and he made a technical argument for it.

I had already switched to Arch and had already been using Systemd for years at that point.

The reality is, nobody was stepping up with better solutions. Would porting SMF have been better, maybe, but nobody was porting that.

There are distros with Systemd, often very compatible ones, and almost nobody uses them.

BSD folks for years have been hoping for the linux exodus over systemd and it has never happen.

And it has to be said a 1000x times. Systemd was never just init and it mever claimed it was. By now Systemd is just a software project that makes all kind of software that you can use with or without systemd the service manager.

The should just call it the "Linux Userland Software Group" and change their naming. Then people wouldnt get triggered by the term 'systemd'.

You can have whatever technical opinion you like about systemd. Fact is most people use it, including in very large organisations. And the other fact is nobody forced systemd on Debian. Whatever consipiricy was apread in 'Devel' (and elsewhere).

replies(1): >>40251181 #
69. bayindirh ◴[] No.40251181{11}[source]
Thanks for confirming that I can have technical opinions about systemd, as an admin who touches more than a thousand physical servers. :)

I'll agree to disagree on the systemd's "we will replace anything and everything we even slightly dislike, and slowly make them dependent on systemd (the service manager) while not listening to you and your pesky experiences" attitude, and wish you more power for your future endeavors.

Have a nice day. :)

70. throwaway7356 ◴[] No.40256064{4}[source]
> Unix domain sockets are just files, so they have an owner, group and mode bits. The answer to "who is potentially allowed to run a differently-privileged command?" is just `ls -l /path/to.sock`.

Yeah, except that is not true. To quote unix(7):

       On Linux, connecting to a stream socket object requires write permission on that socket; sending
       a datagram to a datagram socket likewise requires write permission on that socket.   POSIX  does
       not make any statement about the effect of the permissions on a socket file, and on some systems
       (e.g.,  older  BSDs),  the socket permissions are ignored.  Portable programs should not rely on
       this feature for security.
So s6 just has a wide, easily exploitable security hole there. Or is not portable, contrary to its claims.
replies(1): >>40259190 #
71. throwaway7356 ◴[] No.40256095{5}[source]
> Much of this was enabled by a willingness to throw out compatibility with nearly everything. Backwards, forwards, sideways. If I were making a bold and breaking change like this, I would sacrifice compatibility but try to make up for it by bending over backwards to catch as much of the "once working, now broken" wreckage that inevitably piled up as I could, by creating shims and compatibility stubs and transition mechanisms. I'd certainly listen to people's problems and try to work out solutions.

You do realize that systemd was the only init system that offered distributions a migration path from the sysv-rc init scripts?

daemontools, s6, openrc, upstart all did not have this. systemd was the only system caring about migration and backward compatibility...

> Poettering, as far as I can tell is more of a honey badger

As far as I know, he was the only author of an alternative init system that, for example, did actually talk to distributions to understand which problems they have. Unlike the authors of most alternatives that don't give a shit (and in turn nobody gives a shit about their init). To this day you'll find the s6 author just claim "nobody needs feature X from an init" because they themselves might not need it.

72. sigil ◴[] No.40259190{5}[source]
Lol okay man. Maybe if you're running FreeBSD 4.2 or HP-UX or some BSD derivative from the 90s. All unix systems from about 2000 on will honor unix domain socket permissions.
73. ximm ◴[] No.40328293{7}[source]
Just a short reminder that Lennart is working for Microsoft. https://unpkg.com/@material-design-icons/svg@0.14.13/outline...