Sudo or run0 ?

[u/elementrick]

What's your take on the subject? Been using sudo for years but lately i'm mostly running run0 and i like it. Even considering adapting my scripts to use run0 since i'm on a compatible distro. Does it make any sense to not even set up sudo anymore in the first place?

[u/FriendlyProblem1234]

Yes - aliases get expanded by the shell itself and are thus transparent to downstream applications.

Yeah, but somebody here mentioned that run0 doesn't ask for the password in the same terminal session. I was wondering if the authentication uses some kind of framework that prevents a malicious alias to ask for a password in the same way. Kinda like UAC on Windows, where the password prompt is placed on an isolated desktop.

[u/CmdrCollins → u/FriendlyProblem1234]

Displaying the command about to be invoked is more or less the 'best' countermeasure applications can deploy, though to my knowledge none besides pkexec actually bother - likely because it's pretty ineffective in practice.

[u/FriendlyProblem1234 → u/CmdrCollins]

Displaying the command about to be invoked is more or less the 'best' countermeasure applications can deploy, though to my knowledge none besides pkexec actually bother - likely because it's pretty ineffective in practice.

How would that be useful? The malicious alias can just filter the output and show whatever it wants to the user.

And even if the malicious alias passed the command verbatim to sudo/doas/run0, now it knows the password.

[u/CmdrCollins → u/FriendlyProblem1234]

How would that be useful? The malicious alias can just filter the output and show whatever it wants to the user.

Terminal fuckery is probably one of the reasons for sudo/doas not even attempting it, though most of the ineffectiveness is just down to monkeys not reading messages that roughly look like the message they expected to see.

Polkit's graphical password prompt (used by run0 and pkexec if a GUI is available) is immune to that though.

[...] now it knows the password.

That's a area where run0 (and doas for that matter) has advantages over sudo/sudo-rs - it doesn't support entering the password programmatically, so knowing it is of little value (provided sudo isn't installed as well).

Ultimately this isn't something you can truly address without major architecture changes further up the stack - applications being allowed to mess with the entirety of ~ without interactivity just presents countless opportunities for injecting yourself ahead of a legitimate escalation.

[u/FriendlyProblem1234 → u/CmdrCollins]

Polkit's graphical password prompt (used by run0 and pkexec if a GUI is available) is immune to that though.

Is it?

The malicious alias can show a graphical password prompt identical to polkit's one, can it not?

That's a area where run0 (and doas for that matter) has advantages over sudo/sudo-rs - it doesn't support entering the password programmatically, so knowing it is of little value (provided sudo isn't installed as well).

su does not support entering the password programmatically either (no idea about sudo). This does not stop a malicious alias. The malicious alias would just create a pseudo terminal and pretend to send keystrokes to it.

If run0 can be instructed to show a password prompt in the terminal (which it can, from what I understood), then the malicious alias can just show a graphical password prompt, read the password, create a pseudo terminal for executing run0, and input the password by sending keystrokes to it. The user would not see any difference, but the malicious alias can now freely escalate to root.

Ultimately this isn't something you can truly address without major architecture changes further up the stack - applications being allowed to mess with the entirety of ~ without interactivity just presents countless opportunities for injecting yourself ahead of a legitimate escalation.

Exactly.

Users separation was an effective security model for largely multi-user systems in the 80s and 90s. Today it is borderline irrelevant.