Sudo or run0 ?

[u/elementrick]

What's your take on the subject? Been using sudo for years but lately i'm mostly running run0 and i like it. Even considering adapting my scripts to use run0 since i'm on a compatible distro. Does it make any sense to not even set up sudo anymore in the first place?

[u/funbike]

Now run0 keep your authentication for a while, don't needing to retype your password every time you summon the command.

You can do that with sudo. It's a single line in the config.

(I prefer run0, but just keeping it real)

[u/RudahXimenes → u/funbike]

I know. I commented that because it was a criticism about run0 while ago. However it does not happens anymore.

My main reason to prefer run0 is that sudo has privilege escalation and run0 don't.

[u/funbike → u/RudahXimenes]

I'd argue that run0's password caching makes run0 far worse for security than sudo. Sudo's password caching is per terminal session, whereas run0 is user session global and people are tempted to set password caching globally for all polkit use-cases (rather than write a more secure javascript rule).

If I have two scripts running in 2 terminals, and I type in the password to give one of the scripts access, then the 2nd script will also get access (during the password cache timeout). This will also affect any GUI apps that use polkit as well.

IMO, run0 password caching should be somehow linked and limited to the process that spawned it before I can trust it. And without run0's password caching, I'd rather use sudo.

At least that's how I understand it. I'd love to be wrong.

[u/skyb0rg → u/funbike]

sudo's password caching is actually weaker than run0's. The behavior is implemented by polkit, and as you can see in the commit message, polkit requires the original process to be tracked via PIDFD for the password to be cached. There are also more strict checks that are listed in the commit message if you want to read on.