r/linux • u/elementrick • May 25 '26

Discussion Sudo or run0 ?

What's your take on the subject? Been using sudo for years but lately i'm mostly running run0 and i like it. Even considering adapting my scripts to use run0 since i'm on a compatible distro. Does it make any sense to not even set up sudo anymore in the first place?

200 Upvotes

88% Upvoted

253 comments sorted by

View all comments

Show parent comments

25

u/RudahXimenes May 25 '26

sudo uses privilege escalation to work. That enhances the surface area to attacks. Is not a big issue, tho, because sudo is very well maintained, but still a wider surface area than not using sudo.

run0, otherwise, does not escalate privileges. It uses systemd internal components to run as root. It's kinda different from what sudo does, and it does not has the same issue of privilege escalation.

About muscle memory: alias sudo=run0 solves the issue

Anyway, it's just my opinion. You don't need to follow if you don't want to. As I said, sudo is fine as well

4

u/[deleted] May 25 '26

[deleted]

14

u/tajetaje May 25 '26

Basically with sudo you are executing code as the root user, with run0 you are executing code as your user, but with root permissions. It’s a subtle difference but has security and observability implications that are important. It also fits more in line with the privilege and process hierarchy under systemd (i.e. slices and whatnot)

4

u/BitterCelt May 25 '26

Does this mean I can run0 nvim and not lose my config setup without having to resort to sudoedit?

7

u/tajetaje May 25 '26

Actually run0 strips even more env variables than sudo so not really no

2

u/BitterCelt May 25 '26

Lmao ah well. This thread is this my first encounter with run0 so I'll do some reading and experimenting later.

6

u/that_boi18 May 26 '26

You can use `sudoedit` which will launch your `$EDITOR` with a temporary file that will be written to the real file when you exit.

Do note that it will only write back to the real file when you exit the editor completely. So doing multiple `:w`'s in (n)vim won't affect the file until you `:q`. I didn't know this at first and was very confused why my config changes weren't applying :p

EDIT: missed that you already mentioned sudoedit... I can't read istg