• 0 Posts
  • 168 Comments
Joined 11 months ago
cake
Cake day: July 31st, 2023

help-circle




  • pivot_root@lemmy.worldtoLinux@lemmy.mlSSH as a sudo replacement
    link
    fedilink
    arrow-up
    5
    arrow-down
    2
    ·
    8 days ago

    The problem is that they’re trying to frame it as a better replacement for sudo when it’s really not.

    In some respects, it’s safer by not using a setuid binary. In other respects, it massively increases the surface area by relying on the correctness of three separate daemons: systemd, dbus, and polkitd. If any one of those components are misconfigured, you risk an unauthorized user gaining root privileges.

    With sudo, the main concern is the sudo process being exploited through memory safety bugs since it runs at root automatically.

    Don’t get me wrong, sudo has a lot of stupid decisions and problems. There’s a ton of code in sudo for features that almost nobody uses, and there’s bound to be bugs in there somewhere. It needs to be replaced with something simpler, but run0 is not that.













  • Does sudo have a plethora of stupid features? Yeah.

    What it doesn’t have is a needlessly complicated and overengineered design that relies on interprocess communication and three different daemons from two separate packages. It generates a temporary systemd service to actually run the privileged command, for Davis’ sake. That is one hell of a surface area for something that’s the gateway between an unprivileged user and root.

    I’m not saying sudo deserves to be used permanently, but if someone is going to replace it with a new tool for security reasons, that tool should be less complicated and use fewer runtime dependencies than what it’s replacing. When you account for the entire architecture of run0, sudo is lightweight in comparison.