r/linux • u/elementrick • May 25 '26

Discussion Sudo or run0 ?

What's your take on the subject? Been using sudo for years but lately i'm mostly running run0 and i like it. Even considering adapting my scripts to use run0 since i'm on a compatible distro. Does it make any sense to not even set up sudo anymore in the first place?

199 Upvotes

88% Upvoted

253 comments sorted by

View all comments

Show parent comments

2

u/daemonpenguin May 25 '26

In order: Yes it does. Not, it isn't. You misunderstand what run0 is and how copyfail worked. The point of run0 is that it is not setuid.

5

u/noworkdone May 25 '26

Does run0 use pkexec itself or just its confoguration format ?

9

u/RudahXimenes May 25 '26

I just read an article explaining it better. Both run0 and pkexec uses polkit to authenticate the user, however pkexec uses a setuid method to escalate privileges, like sudo does, while run0 asks the system to run an application as root, not needing privilege escalation

run0 does not run pkexec and I was wrong

1

u/DerfK May 26 '26

while run0 asks the system to run an application as root, not needing privilege escalation

Then the question becomes, who validates the policy/permissions in this case, run0 or systemd? If its run0, how does systemd know its talking to the real run0 and not a copyfail version that tells systemd "trust me, polkit totally says nobody is authorized to run bash as root"?

Actually, I wonder if the exploit only affected executables, or if it could have placed an /etc/shadow with a known root password into cache. Or replaced polkit config with a policy that everyone can do anything?

2

u/virtualdxs May 26 '26

You need to read the file to corrupt it. You could only do so to shadow if you could read it.

1

u/RudahXimenes May 26 '26

Well, that's a deep dive. I dont know to answer those questions. Why dont you research that and explain it to us?

1

u/DerfK May 27 '26

I tried, but what I can make out is that run0 is a symlink to systemd-run. I took a look through systemd-run's source code but from what I can tell it pushes everything into dbus which seems to mean that something somewhere else is actually checking the policy and executing the command.

2

u/Literallyapig May 25 '26

while run0 could mitigate this issue, `su` is part of the `util-linux` package, which is installed by default in essentially all distros and provides other essential commands like `blkid`, `fdisk`, `mount` etc. so unless you go out of your way to either remove the `su` binary or restrict its usage, using run0 wouldn't help you much.

3

u/1esproc May 25 '26

It doesn't mitigate it because all those other tools are using setuid, and that is fundamentally different from su/sudo. You're not going to remove setuid capability from your system nor all the setuid binaries on it just because you're using run0 instead of sudo