From 4c59ca0dd37f36dcd2f56ab203636df9e5331b3d Mon Sep 17 00:00:00 2001 From: Eduard Tolosa Date: Tue, 6 Jan 2026 13:41:01 -0500 Subject: [PATCH] (post-update): New Year, New sudo: using systemd's run0 as a sudo replacement Add note about setuid --- ...-year-new-sudo-using-systemd-s-run0-as-a-sudo-replacement.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_posts/2026-01-01-new-year-new-sudo-using-systemd-s-run0-as-a-sudo-replacement.md b/_posts/2026-01-01-new-year-new-sudo-using-systemd-s-run0-as-a-sudo-replacement.md index a951b20..3c0b981 100644 --- a/_posts/2026-01-01-new-year-new-sudo-using-systemd-s-run0-as-a-sudo-replacement.md +++ b/_posts/2026-01-01-new-year-new-sudo-using-systemd-s-run0-as-a-sudo-replacement.md @@ -15,7 +15,7 @@ excerpt: systemd 256 introduced run0, a new tool that can be used as a sudo repl systemd 256 [introduced](https://github.com/systemd/systemd/commit/7aed43437175623e0f3ae8b071bbc500c13ce893) `run0`. It isn't a new tool per se, but rather a symbolic link to `systemd-run` that changes its behavior to run commands as root, similar to `sudo`. Some of the motivations to replace `sudo` with `run0` are: -- `run0` doesn't rely on the [setuid](https://en.wikipedia.org/wiki/Setuid) bit. +- `run0` doesn't rely on the [setuid](https://en.wikipedia.org/wiki/Setuid) bit. **Note:** It still depends on [Polkit](https://github.com/polkit-org/polkit) which has the setuid bit set, with the exception that Polkit doesn't process arbitrary data, making it a big step forward in terms of security. A more detailed reply to this topic can be found [in this reply](https://github.com/systemd/systemd/issues/32757#issuecomment-2167613521) from one of the devs. - `run0` uses [Polkit](https://github.com/polkit-org/polkit) for authorization and privilege management. - `run0` can be used to run commands in a more controlled environment, with better isolation and resource management. - `run0` automatically integrates with D-Bus when running as a different user, making it easier to run commands that require D-Bus access (No more "Failed to connect to bus: No such file or directory" messages!).