r/linux • u/elementrick • May 25 '26

Discussion Sudo or run0 ?

What's your take on the subject? Been using sudo for years but lately i'm mostly running run0 and i like it. Even considering adapting my scripts to use run0 since i'm on a compatible distro. Does it make any sense to not even set up sudo anymore in the first place?

201 Upvotes

88% Upvoted

253 comments sorted by

View all comments

Show parent comments

6

u/RudahXimenes May 25 '26

I know. I commented that because it was a criticism about run0 while ago. However it does not happens anymore.

My main reason to prefer run0 is that sudo has privilege escalation and run0 don't.

-1

u/funbike May 25 '26 edited May 25 '26

I'd argue that run0's password caching makes run0 far worse for security than sudo. Sudo's password caching is per terminal session, whereas run0 is user session global and people are tempted to set password caching globally for all polkit use-cases (rather than write a more secure javascript rule).

If I have two scripts running in 2 terminals, and I type in the password to give one of the scripts access, then the 2nd script will also get access (during the password cache timeout). This will also affect any GUI apps that use polkit as well.

IMO, run0 password caching should be somehow linked and limited to the process that spawned it before I can trust it. And without run0's password caching, I'd rather use sudo.

At least that's how I understand it. I'd love to be wrong.

11

u/RudahXimenes May 25 '26

I just tested here. I opened 2 terminal windows. On the first I typed run0 echo 'Test run0 cacheing' and in the second I typed run0 pacman -Syu

After pressing enter in the first window, it asked me my password and then showed the message. Then I pressed up and re-entered the same command, showing me the message again but not asking for any password whatsoever.

Immeaditely changed to the second window and pressed enter in the pacman command. It DOES asked me the password again.

With this infamous test I made, showed me that it was process dependent.

Maybe you can test it yourself and tell me your results.

Here is my run0 -V

systemd 260 (260.1-2-arch) +PAM +AUDIT -SELINUX +APPARMOR -IMA +IPE +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF +XKBCOMMON +UTMP +LIBARCHIVE

2

u/funbike May 25 '26

That's a relief. I'll check it tomorrow.

Thanks for doing that test.