[bpierre]

How does sudo-rs compare to run0? https://news.ycombinator.com/item?id=40205714

[remram]

This one is easy: run0 is not implemented in a memory-safe language, but in C. It is likely to be hit by exploitable memory-handling bugs, like the rest of systemd, as has happened multiple times before.

[Vilian]

An already existing and tested C software gonna have less bugs than a new rust rewrite

[steveklabnik]

Sudo has had bugs filed and fixed that were found by sudo-rs.

It’s not that simple.

[remram]

I don't believe that actually, neither does Ubuntu.

And if we're talking about memory bugs (which we were up to now), then definitely no.

But run0 is new C code anyway so I don't see how your claim is relevant.

[paulddraper]

A trivial Google search answers that. run0 requires systemd-type OS.

[ranger207]

Given that Ubuntu uses systemd like the vast majority of Linux systems nowadays, how does sudo-rs differ from run0?

[fweimer]

You might not have a systemd instance inside a container, but you still might want to switch user IDs there.

[Vilian]

Podman has systemd inside, you can run0 in it

[fweimer]

Surely that depends on the container? Podman doesn't artificially inject a systemd process as PID 1 by default.

[yjftsjthsd-h]

Not all containers are on podman

[Vilian]

The Lennart post about it explain it https://mastodon.social/@pid_eins/112353324518585654

He was comparing to "normal" sudo, but sudo-rs have the same problems he highlighted anyway

[paulddraper]

sudo-rs uses setuid.

run0 does not (and instead relies on systemd).

---

To answer your next question: setuid, while historic, is a bit weird, and is disabled in some environments, e.g. NoNewPrivileges.

[hedora]

sudo-rs doesn’t gratuitously require a root privilege daemon that regularly ships filesystem destruction and remote unauthenticated arbitrary code execution bugs.

If your bar is “I’ll tolerate such crap”, you may as well run your desktop session as root.

[zahlman]

If sudo does this, as you imply, why do Linux system still exist that are not part of a botnet?

[paulddraper]

Implication is that systemd does this, not sudo.

[Vilian]

Nice technical argument, did Lennart bite you while you where sleeping?

[postepowanieadm]

No one is rewriting systemd in rust?

[steveklabnik]

I'm not aware of any serious project to do so, there's been some small projects, nothing on the scale of uutils or sudo-rs.