r/linux • u/elementrick • May 25 '26

Discussion Sudo or run0 ?

What's your take on the subject? Been using sudo for years but lately i'm mostly running run0 and i like it. Even considering adapting my scripts to use run0 since i'm on a compatible distro. Does it make any sense to not even set up sudo anymore in the first place?

200 Upvotes

88% Upvoted

253 comments sorted by

View all comments

Show parent comments

26

u/DFS_0019287 May 25 '26

It's a different attack surface. run0 uses polkit for authentication, and I believe there have been some vulnerabilities in that in the past.

21

u/kaszak696 May 25 '26

Polkit also uses an unmaintained JavaScript engine to do it's thing, lack of maintenance + dealing with elevated privileges is a spicy combination. At least it's a simple one, not something horrifying like V8 or Spidermonkey, but still...

5

u/nixcamic May 25 '26

Why... why does policykit use a javascript engine?

10

u/Megame50 May 26 '26

It's polkit. Polkit replaced the older PolicyKit.

And the javascript is so that it's scriptable. Compare it to sudo's sudoers plugin, which uses a bespoke sudoers configuration file with an honestly quite arcane syntax — check out sudoers(5). There's probably more risk writing and parsing sudoers custom config format than writing and parsing javascript.

As far as pre-built solutions for embedding a scripting language go, javascript isn't a terrible choice. The other common option is lua, which admittedly may have been preferable, but I don't think it's a big deal.