←back to thread

466 points CoolCold | 1 comments | | HN request time: 1.452s | source
Show context
creshal ◴[] No.40207773[source]
But they already ship pkexec together with systemd anyway via polkit, why are they again reinventing a wheel they already reinvented?

Unit files are a neat concept I don't want to miss again, but everything else done by Lennart seems to be an inceasingly stupid mistake born from hubris.

replies(5): >>40207817 #>>40207838 #>>40207901 #>>40207944 #>>40215561 #
eternityforest ◴[] No.40207901[source]
This seems like it won't break anything except really exotic scripts, I think it will probably be a good thing for at least the main target audience of systemd, id imagine it might somehow suck for others though.
replies(1): >>40209339 #
aragilar ◴[] No.40209339[source]
Uh, depending on exactly how it's implemented, it could break a lot of things.

If all you are using sudo on is a personal (i.e. single user) laptop/desktop to install packages, this (along with other things like pkexec or doas) would seem to present no issues (and personally, from what I can see, I'd be happy to run `run0` on my personal systems!), but sudo does significantly more than that, as is called out by the systemd devs in the linked post https://mastodon.social/@pid_eins/112353324518585654

sudo supports not just LDAP (for multi-user systems), but include various levels of logging (including logging stdin and stdout of commands), apparmor and selinux profiles, the BSD and linux audit subsystem and more in a simple, easy to read and edit config format (this is just me reading from the `sudoers(5)` man page).

Whereas it seems `run0` won't have a `sudoers` file, but will instead be configurable (implicitly) via polkit, which uses JS to write policies (which I'd view as a much harder and error-prone system than the current `sudoers` format). It's not clear to me how much of sudo is tied to SUID vs. having a separate daemon (i.e. how much would have to be ditched vs. how much could be mapped over).

I do feel this is systemd moving away from traditional multi-user unix systems to being a single-user system (targeting the laptop/desktop case, or where sys-admins are the only users of the system, and it's basically a container host).

replies(1): >>40214630 #
NikkiA ◴[] No.40214630[source]
> If all you are using sudo on is a personal (i.e. single user) laptop/desktop to install packages, this (along with other things like pkexec or doas) would seem to present no issues

Of course, once distros start to say 'wait, why are we shipping 3 different privilege escalation systems again? Systemd is needed for starting units anyway, so lets just drop sudo and su'

replies(1): >>40220573 #
1. aragilar ◴[] No.40220573[source]
sudo is not installed by default on many distros (e.g. if you give a root password on Debian install, then sudo is not installed, but if you don't, it is so you can admin the system), so unless systemd introduces something to break sudo, I don't think it'll go away (it just may get bumped down the list of important packages). su seems to come from https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/, which is all the truly core stuff, and I don't see su disappearing from there.