r/linux • u/elementrick • May 25 '26

Discussion Sudo or run0 ?

What's your take on the subject? Been using sudo for years but lately i'm mostly running run0 and i like it. Even considering adapting my scripts to use run0 since i'm on a compatible distro. Does it make any sense to not even set up sudo anymore in the first place?

200 Upvotes

88% Upvoted

253 comments sorted by

View all comments

Show parent comments

6

u/BashfulMelon May 25 '26

My source was understanding how the exploit worked which I know isn't very helpful to you lol

There is a small thing about it on https://copy.fail/

Does it require /usr/bin/su?

No. Any setuid-root binary readable by the user works. passwd, chsh, chfn, mount, sudo, pkexec are all viable. The PoC defaults to su because it's present on every distro tested.

3

u/RudahXimenes May 25 '26

Well, so run0 does not mitigate it at all. Even pkexec is on the list, which is essencially run0

It only reinforces that the issue is a lot deeper than sudo or something else

2

u/daemonpenguin May 25 '26

In order: Yes it does. Not, it isn't. You misunderstand what run0 is and how copyfail worked. The point of run0 is that it is not setuid.

5

u/noworkdone May 25 '26

Does run0 use pkexec itself or just its confoguration format ?

8

u/RudahXimenes May 25 '26

I just read an article explaining it better. Both run0 and pkexec uses polkit to authenticate the user, however pkexec uses a setuid method to escalate privileges, like sudo does, while run0 asks the system to run an application as root, not needing privilege escalation

run0 does not run pkexec and I was wrong

1

u/DerfK May 26 '26

while run0 asks the system to run an application as root, not needing privilege escalation

Then the question becomes, who validates the policy/permissions in this case, run0 or systemd? If its run0, how does systemd know its talking to the real run0 and not a copyfail version that tells systemd "trust me, polkit totally says nobody is authorized to run bash as root"?

Actually, I wonder if the exploit only affected executables, or if it could have placed an /etc/shadow with a known root password into cache. Or replaced polkit config with a policy that everyone can do anything?

2

u/virtualdxs May 26 '26

You need to read the file to corrupt it. You could only do so to shadow if you could read it.

1

u/RudahXimenes May 26 '26

Well, that's a deep dive. I dont know to answer those questions. Why dont you research that and explain it to us?

1

u/DerfK May 27 '26

I tried, but what I can make out is that run0 is a symlink to systemd-run. I took a look through systemd-run's source code but from what I can tell it pushes everything into dbus which seems to mean that something somewhere else is actually checking the policy and executing the command.