|
|
Subscribe / Log in / New account

Sudo and its alternatives

Sudo and its alternatives

Posted Feb 22, 2024 16:33 UTC (Thu) by MarcB (guest, #101804)
In reply to: Sudo and its alternatives by DimeCadmium
Parent article: Sudo and its alternatives

Do you really not see the major difference? With sudo, you are elevating privileges out of a potentially malicious environment.
Even if that is handled correctly, this still requires the kernel to implement the privilege elevation functionality in the first place - something it arguably should stop doing.

With uid0, your are branching off of a pre-existing, clean, privileged environment. No privilege elevation is needed, making whole classes of bugs impossible.

btw, some here argue about the complexity of Polkit and Systemd, but completely ignore the complexity that exists to implement setuid/setgid in the kernel and all the hacks in ld.so, ptrace and other places to make it not obviously insecure. There also are some constraints that would not be necessary if those mechanisms would not exist in the first place. For example, unprivileged chroot would be possible (might still break some software, but the breakage would stay within the initial user account).


to post comments


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds