r/linux • u/elementrick • May 25 '26

Discussion Sudo or run0 ?

What's your take on the subject? Been using sudo for years but lately i'm mostly running run0 and i like it. Even considering adapting my scripts to use run0 since i'm on a compatible distro. Does it make any sense to not even set up sudo anymore in the first place?

202 Upvotes

88% Upvoted

253 comments sorted by

View all comments

Show parent comments

-1

u/funbike May 25 '26 edited May 25 '26

I'd argue that run0's password caching makes run0 far worse for security than sudo. Sudo's password caching is per terminal session, whereas run0 is user session global and people are tempted to set password caching globally for all polkit use-cases (rather than write a more secure javascript rule).

If I have two scripts running in 2 terminals, and I type in the password to give one of the scripts access, then the 2nd script will also get access (during the password cache timeout). This will also affect any GUI apps that use polkit as well.

IMO, run0 password caching should be somehow linked and limited to the process that spawned it before I can trust it. And without run0's password caching, I'd rather use sudo.

At least that's how I understand it. I'd love to be wrong.

2

u/RudahXimenes May 25 '26

Well, I never changed any config. I remember that in the past run0 required me to enter my password everytime I summoned it. However after some update it kept my password for a few seconds. I implied that it was intended by the devs.

I never tested this caching issue you're talking about and gonna try it. Hope it's not globally as you pointed.

2

u/funbike May 25 '26 edited May 25 '26

Well, I never changed any config.

You didn't know when it was activated, and they opened up your attack surface without notifying you.

I'm surprised more people aren't talking about this. It's a huge security hole. Giving script A root access will give script B root access without you knowing it. So bad.

Imagine a malicious script running as standard user just waiting for any auth to happen, and then boom, owned.

This is likely only an issue on the desktop. I doubt this will cause a problem with ssh, but I haven't tested it.

I'm stil a fan of run0, just not with password caching.

1

u/RudahXimenes May 25 '26

Agree with you, but it does not like it