#run0 — Public Fediverse posts

Today I had a first: a completely unpracticed, but still successful #lightning #talk at #oSC26 :-)

Someone talked about replacing #sudo with #systemd's #run0, so I talked about a feature not implemented there, but used at many places after my various sudo talks: central session recording

Read more about it at https://opensource.com/article/22/3/sudo-session-recordings-raspberry-pi

Today I had a first: a completely unpracticed, but still successful #lightning #talk at #oSC26 :-)

Someone talked about replacing #sudo with #systemd's #run0, so I talked about a feature not implemented there, but used at many places after my various sudo talks: central session recording

Read more about it at https://opensource.com/article/22/3/sudo-session-recordings-raspberry-pi

While #NixOS should not be affected by #CopyFail as it uses recent kernels, here are additional fixes you can apply:

Disabling setuid does not mitigate it, but reduces the attack surfaces overall significantly.

Instead of #sudo, #su, #pkexec and other #setuid binaries you can use #run0 or a dedicated root account.

I have disabled setuid for a bunch of binaries I don't need, they still work when ran as root, with run0 or #sudo-rs.

```nix
boot.blacklistedKernelModules = [
"algif_aead"
];

security.sudo.enable = false;

security.wrappers = {
su.enable = false;
pkexec.enable = false;

# example setuid binary
chsh = {
source = "${pkgs.shadow}/bin/chsh";
setuid = lib.mkForce false;
owner = "root";
group = "root";
};
};
```

While #NixOS should not be affected by #CopyFail as it uses recent kernels, here are additional fixes you can apply:

Disabling setuid does not mitigate it, but reduces the attack surfaces overall significantly.

Instead of #sudo, #su, #pkexec and other #setuid binaries you can use #run0 or a dedicated root account.

I have disabled setuid for a bunch of binaries I don't need, they still work when ran as root, with run0 or #sudo-rs.

```nix
boot.blacklistedKernelModules = [
"algif_aead"
];

security.sudo.enable = false;

security.wrappers = {
su.enable = false;
pkexec.enable = false;

# example setuid binary
chsh = {
source = "${pkgs.shadow}/bin/chsh";
setuid = lib.mkForce false;
owner = "root";
group = "root";
};
};
```

This week's Cockpit release adds a systemd/polkit-based superuser authentication (think `run0`) as a fallback when sudo is not available/broken. It also finally removes the long-deprecated pam_cockpit_cert module.

https://cockpit-project.org/blog/cockpit-355.html

#cockpit #release #run0

This week's Cockpit release adds a systemd/polkit-based superuser authentication (think `run0`) as a fallback when sudo is not available/broken. It also finally removes the long-deprecated pam_cockpit_cert module.

https://cockpit-project.org/blog/cockpit-355.html

#cockpit #release #run0

engang for hundre år siden, da jeg først begynte med #Linux, så var liksom ikke #sudo en greie. Og så ble det det, og en del av oss himlet litt med øynene av "sudo su" og sånt, men så ble det etter hvert ganske vanlig.

Men mellom det @pid_eins har skravlet om rundt #run0, og @trifectatech sin #sudors, så er det kanskje på tide å gå tilbake til å ikke ha vanilla sudo på maskina igjen?

https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot

engang for hundre år siden, da jeg først begynte med #Linux, så var liksom ikke #sudo en greie. Og så ble det det, og en del av oss himlet litt med øynene av "sudo su" og sånt, men så ble det etter hvert ganske vanlig.

Men mellom det @pid_eins har skravlet om rundt #run0, og @trifectatech sin #sudors, så er det kanskje på tide å gå tilbake til å ikke ha vanilla sudo på maskina igjen?

https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot

The one thing that makes systemd run0 annoying to use is that it'll ask you every time for the password. With sudo you have this 10 minutes where it won't ask again.

I know the technical reasons, but still this drives me back to sudo.

#systemd #run0 #sudo #Linux

The one thing that makes systemd run0 annoying to use is that it'll ask you every time for the password. With sudo you have this 10 minutes where it won't ask again.

I know the technical reasons, but still this drives me back to sudo.

#systemd #run0 #sudo #Linux

How to Use #Run0 in #Linux

https://www.maketecheasier.com/how-to-use-run0-in-linux/

How to Use #Run0 in #Linux

https://www.maketecheasier.com/how-to-use-run0-in-linux/

Ist es möglich, run0 als eine Alternative zu sudo zu nutzen?

Die Antwort findet ihr unseren Blogbeitrag:
https://www.credativ.de/blog/credativ-inside/run0-als-sudo-alternative/

#credativ #NetApp #run0 #sudo #Debian

Discover run0 for Linux, a passwordless command execution tool. Learn its similarities and differences with sudo, security analysis, installation, and usage for daily tasks and automation.

https://linuxexpert.org/understanding-run0/

#Linux #LinuxTools #run0 #sudo #SystemAdministration #LinuxCommands #LinuxTips #RootAccess #PasswordlessCommands #Automation #Security #LinuxTutorial #TechTips #AdminTools #ITSecurity #OpenSource #LinuxLearning #DevOps #SysAdmin #LinuxCommunity

Discover run0 for Linux, a passwordless command execution tool. Learn its similarities and differences with sudo, security analysis, installation, and usage for daily tasks and automation.

https://linuxexpert.org/understanding-run0/

#Linux #LinuxTools #run0 #sudo #SystemAdministration #LinuxCommands #LinuxTips #RootAccess #PasswordlessCommands #Automation #Security #LinuxTutorial #TechTips #AdminTools #ITSecurity #OpenSource #LinuxLearning #DevOps #SysAdmin #LinuxCommunity

Just updated #paru to use #run0 instead of sudo on #ArchLinux. Easy peasy. 👍
https://chaos.social/@frederic/112847141891035302

Just updated #paru to use #run0 instead of sudo on #ArchLinux. Easy peasy. 👍
https://chaos.social/@frederic/112847141891035302

@shuLhan @cazabon Well, based on my experiences with #journald as a #syslog_ng guy, my expectation is that around 5-10 years of security nightmares are about to come with #run0:

https://www.syslog-ng.com/community/b/blog/posts/systemd-journald-vs-syslog-ng

Yes, a decade later after journald arrived, I have no problem recommending it. But the first 7-8 years were catastrophic both for users and developers.

@shuLhan @cazabon Well, based on my experiences with #journald as a #syslog_ng guy, my expectation is that around 5-10 years of security nightmares are about to come with #run0:

https://www.syslog-ng.com/community/b/blog/posts/systemd-journald-vs-syslog-ng

Yes, a decade later after journald arrived, I have no problem recommending it. But the first 7-8 years were catastrophic both for users and developers.

Despite what the #systemd #devs might think, "42% less #Unix philosophy" is an anti-selling-point.

"Replace #sudo with #run0, let systemd do it" - sure. Throw away a well-audited, widely-used codebase which has worked well for decades, and instead turn it into a request to a #PID 1 process that is a huge modular-but-#monolithic codebase full of constant churn which has barely been #compiled, much less #understood.

Dollars to doughnuts there are more root holes lurking in systemd than in sudo.

Despite what the #systemd #devs might think, "42% less #Unix philosophy" is an anti-selling-point.

"Replace #sudo with #run0, let systemd do it" - sure. Throw away a well-audited, widely-used codebase which has worked well for decades, and instead turn it into a request to a #PID 1 process that is a huge modular-but-#monolithic codebase full of constant churn which has barely been #compiled, much less #understood.

Dollars to doughnuts there are more root holes lurking in systemd than in sudo.

@fabiscafe
So now my question is, how does #run0 compare to #doas? Is it true that doas comes from the *BSD sector, however run0 is newer and from #Linux world? Also, what are the differences, other than that run0 apparently doesn't need SETUID?

@fabiscafe
So now my question is, how does #run0 compare to #doas? Is it true that doas comes from the *BSD sector, however run0 is newer and from #Linux world? Also, what are the differences, other than that run0 apparently doesn't need SETUID?

Сьогодні оновився SystemD до версії 256 у якій зʼявилась заміна sudo - run0.

 $ run0 pacman -Sy

Але це повна фігня. Воно працює, але запит пароля відбувається у спливаючому графічному вікні та запит пароля відбувається щоразу. Можливо з часом щось зміниться, але поки це повна дурня.

SystemD/GNU/Linux блін.

#linux #systemd #run0 #sudo #альтернатива #systemd256

Хто використовує альтернативні системи ініціалізації (OpenRC/DInit/RunIt...), що використовуєте і чи не виникають проблеми з ПЗ?

Сьогодні оновився SystemD до версії 256 у якій зʼявилась заміна sudo - run0.

 $ run0 pacman -Sy

Але це повна фігня. Воно працює, але запит пароля відбувається у спливаючому графічному вікні та запит пароля відбувається щоразу. Можливо з часом щось зміниться, але поки це повна дурня.

SystemD/GNU/Linux блін.

#linux #systemd #run0 #sudo #альтернатива #systemd256

Хто використовує альтернативні системи ініціалізації (OpenRC/DInit/RunIt...), що використовуєте і чи не виникають проблеми з ПЗ?

Ok, I clearly was living under a rock. #systemd version 256 is packed with updates.

For me #run0 and capsule are the ones I'm most excited about. 😄

@pid_eins has been an incredible job cataloging it all.

https://0pointer.net/blog/announcing-systemd-v256.html

Ok, I clearly was living under a rock. #systemd version 256 is packed with updates.

For me #run0 and capsule are the ones I'm most excited about. 😄

@pid_eins has been an incredible job cataloging it all.

https://0pointer.net/blog/announcing-systemd-v256.html

So, what is everyone's opinion on this whole #run0 replacement for #sudo on #Linux systems? I'm not even near well enough versed in it all to know which is better or worse. I'll just use whatever my #Fedora system defaults to I'm sure. I've seen some people talk up run0 and others kind of just roll their eyes seeing that it was created by the #systemd dev - but I'm assuming those same eye rollers aren't big fans of systemd either.

So, what is everyone's opinion on this whole #run0 replacement for #sudo on #Linux systems? I'm not even near well enough versed in it all to know which is better or worse. I'll just use whatever my #Fedora system defaults to I'm sure. I've seen some people talk up run0 and others kind of just roll their eyes seeing that it was created by the #systemd dev - but I'm assuming those same eye rollers aren't big fans of systemd either.

@SS7 for #systemd users, it will be #run0 soon

@SS7 for #systemd users, it will be #run0 soon

#systemd doing a #sudo replacement is definitely not in my bingo card ​:koishtare:​

#run0

RE: https://mastodon.social/users/pid_eins/statuses/112353388561456436

#systemd doing a #sudo replacement is definitely not in my bingo card ​:koishtare:​

#run0

RE: https://mastodon.social/users/pid_eins/statuses/112353388561456436

Introducing #run0: Run Processes as Other Users with #systemd

https://debugpointnews.com/systemd-run0/

Introducing #run0: Run Processes as Other Users with #systemd

https://debugpointnews.com/systemd-run0/

#run0 ?
No, I don't think I will.

#run0 ?
No, I don't think I will.

So, with #run0 being a part of #systemd, that’s fair enough. I mean, I get it. Turn Linux into #systemd owning all the things and it’s done. Excellent.

Thankfully, if that’s not relevant to you, BSD and other Linux distros such as #voidlinux, #alpinelinux, and the BSDs exist.

Something for everyone without the flamewars.

So, with #run0 being a part of #systemd, that’s fair enough. I mean, I get it. Turn Linux into #systemd owning all the things and it’s done. Excellent.

Thankfully, if that’s not relevant to you, BSD and other Linux distros such as #voidlinux, #alpinelinux, and the BSDs exist.

Something for everyone without the flamewars.

@nixCraft
Is it just me, or is #run0 a solution in search of a problem? And also #systemd rolling out a tool in the name of "security" after its part in the recent #xz / #ssh debacle is both eyebrow- and hackle-raising to me.

@nixCraft
Is it just me, or is #run0 a solution in search of a problem? And also #systemd rolling out a tool in the name of "security" after its part in the recent #xz / #ssh debacle is both eyebrow- and hackle-raising to me.

#run0 también formará parte de #systemd.

¿Qué necesidad hay de que eso sea así?

#Systemd v256 Introduces #run0: A Safer Alternative to #sudo

https://linuxiac.com/systemd-v256-introduces-run0/

#Systemd v256 Introduces #run0: A Safer Alternative to #sudo

https://linuxiac.com/systemd-v256-introduces-run0/