10 ms·

I'm not sure it can replace non-trivial setups - sudo/doas looks set to stay. e.g when you need to restrict a set of users to run only certain applications wit

I'm not sure it can replace non-trivial setups - sudo/doas looks set to stay. e.g when you need to restrict a set of users to run only certain applications with certain other users. sudo can do this (even if the config format can be painful).

stop50 2y ago
Thats why i moved every sudoers rule to ldap. Much nicer to configure and no need for files with the same content on multiple servers. New users are added and removed fast and i can check the rule on any server.
cozzyd 2y ago
sure but very few people (relatively) are doing stuff like that?
lupire 2y ago
What's the goal? If the host is to get most scenarios off sudo, exceptions aren't a problem. If the goal is to delete sudo, exceptions matter, and migrating what is migratable will clarify what the remaining requirements are.
agwa 2y ago
Good news! run0 will use polkit[1], which uses JavaScript for its rules[2], so there's no limit to how complex your rules can get! On the other hand, maybe adding a JavaScript interpreter to Linux's trusted computing base isn't good news... [1] https://mastodon.social/@pid_eins/112353420303876549 https://mastodon.social/@pid_eins/112353420303876549 [2] https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html https://www.freedesktop.org/software/polkit/docs/latest/polk...
- akira2501 2y ago
  If the lesson of xz was "reduce supply chain attack surface" then the freedesktop people clearly haven't received it yet.
  - bmicraft 2y ago
    Fedora has used PolKit for 12 years now, and the javascript rules have probably been a thing for about as long.
    - akira2501 2y ago
      Doctors recommended cigarettes for decades. What should give everyone similar pause is xz was found unintentionally.
- rcxdude 2y ago
  It's a heck if a lot better than a random smattering of shared libraries getting pulled into a random high-priviledge context which also inherits some other context from whoever is asking for authentication. Polkit gets a lot of flack but PAM is absolutely mad.

stop50 2y ago

Thats why i moved every sudoers rule to ldap. Much nicer to configure and no need for files with the same content on multiple servers. New users are added and removed fast and i can check the rule on any server.

cozzyd 2y ago

sure but very few people (relatively) are doing stuff like that?

lupire 2y ago

What's the goal? If the host is to get most scenarios off sudo, exceptions aren't a problem. If the goal is to delete sudo, exceptions matter, and migrating what is migratable will clarify what the remaining requirements are.

agwa 2y ago

Good news! run0 will use polkit[1], which uses JavaScript for its rules[2], so there's no limit to how complex your rules can get! On the other hand, maybe adding a JavaScript interpreter to Linux's trusted computing base isn't good news... [1] https://mastodon.social/@pid_eins/112353420303876549 https://mastodon.social/@pid_eins/112353420303876549 [2] https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html https://www.freedesktop.org/software/polkit/docs/latest/polk...

akira2501 2y ago
If the lesson of xz was "reduce supply chain attack surface" then the freedesktop people clearly haven't received it yet.
- bmicraft 2y ago
  Fedora has used PolKit for 12 years now, and the javascript rules have probably been a thing for about as long.
  - akira2501 2y ago
    Doctors recommended cigarettes for decades. What should give everyone similar pause is xz was found unintentionally.
rcxdude 2y ago
It's a heck if a lot better than a random smattering of shared libraries getting pulled into a random high-priviledge context which also inherits some other context from whoever is asking for authentication. Polkit gets a lot of flack but PAM is absolutely mad.