Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Submission + - Systemd wants to expand to include a sudo replacement (fosspost.org)

An anonymous reader writes: Systemd lead developer Lennart Poettering has posted on Mastodon about their upcoming v256 release of Systemd, which is expected to include a sudo replacement called “run0”.

The developer talks about the weaknesses of sudo, and how it has a large possible attack surface. For example, sudo supports network access, LDAP configurations, other types of plugins, and much more. But most importantly, its SUID binary provides a large attack service according to Lennart:

"I personally think that the biggest problem with sudo is the fact it’s a SUID binary though – the big attack surface, the plugins, network access and so on that come after it it just make the key problem worse, but are not in themselves the main issue with sudo. SUID processes are weird concepts: they are invoked by unprivileged code and inherit the execution context intended for and controlled by unprivileged code. By execution context I mean the myriad of properties that a process has on Linux these days, from environment variables, process scheduling properties, cgroup assignments, security contexts, file descriptors passed, and so on and so on."

He’s saying that sudo is a Unix concept from many decades ago, and a better privilege escalation system should be in place for 2024 security standards:

  "So, in my ideal world, we’d have an OS entirely without SUID. Let’s throw out the concept of SUID on the dump of UNIX’ bad ideas. An execution context for privileged code that is half under the control of unprivileged code and that needs careful manual clean-up is just not how security engineering should be done in 2024 anymore."

Comment Re:So... I'm confused. (Score 5, Informative) 88

I don't know about NetFlix, but plenty of companies deliberately make the process of severing contracts exceptionally difficult so you give up and just pay.

30 seconds to sign up, but days of being on hold for the retention department to escape.

And it's not actually fraud, so you can't get the billing denied by the CC company on that basis.

Comment Easy (Score 0) 43

Ban blister packs. Ban plastic film wrap. Ban plastic jars and jugs. Accept that we need to switch back to glass containers, paper bags, and opaque cardboard packaging.

Accept that bags will split more often. Especially when wet. Accept more broken glass on the roadside.

This isn't more than an inconvenience and we still won't do it.

Comment Re:What constitutes human intervention? (Score 1) 36

I'm sure I'm miles behind the Ukrainians and ignorant of the political issues, but 'live within the designated target zone' is how I've always imagined making autonomous killer drones work. Not much different from a mine or grenade that way, except for deployment flexibility.

Comment They're already here (Score 1) 36

Seriously - with components anyone can buy and software anyone can obtain, I could build multiple types of killer robot in my garage.

Then again, I can also make all sorts of other very dangerous things. And I could drive my car down the boardwalk on a sunny day and probably kill dozens easily, hundreds with a bit of effort.

You mostly don't have to worry about that because typically we're not trying to kill each other, and the occasional unhinged person who is tends to either give a lot of warning or muck up the job.

Comment Re:But....prefab flat pack modular apartments (Score 1) 30

Thanks for that - as is often the case with these competitions I think it's more about the art than the truly practical, but they're fascinating nonetheless.

And I tend to agree that centralized production of components for on-site assembly will be more efficient. We're not quite done with humans yet, though I expect one day it's going to be a flatpack and a pair of humanoid robots that result in a home.

Comment Re: Now this one is wrong (Score 1) 130

The "Pro-Palestinian" protesters always seem to come with significant numbers of "kill Jews" protesters.

The Venn diagram isn't a perfect circle, but it's close enough that if I were running a college I'd have informed the participants that their gatherings were banned as soon as the first, sadly inevitable, antisemitic hate crime happened and had a zero-tolerance "you're out, no refund, no returning... and if you didn't belong here in the first place, say hello to the nice officer and enjoy your gift of metal bracelets" policy.

Comment Re: Now this one is wrong (Score 4, Insightful) 130

There are some legitimate complaints for both sides - China is not a free country and can compete in many areas with a manufactured advantage. The US is not known for honesty and integrity in trade, and will often use political, economic, or military muscle to dominate rather than try to compete compete on a level playing field.

If I'm going to choose one over the other, it is going to be the US, but neither one is 'the good guy' here.

Comment Now this one is wrong (Score 5, Insightful) 130

This isn't "they have a major agitprop channel to our population", it's not "they have a major electronic spy network deployed", and it's not "they can compromise our infrastructure".

This one is, "they might start building their own and stop paying us royalties, so we need to hamstring them ASAP".

I mean, it's historically accurate American foreign policy, but it's still wrong and a lot more difficult than the TikTok ban to justify while claiming the high road.

Comment Re:Cool tech, but... (Score 1) 30

At this point, I would be kind of interested in seeing a robot that could be parked between a load of lumber and a concrete slab and assemble a wood frame house. I'm sure the building techniques would have to be adjusted as wouldn't be sending in humans who could manipulate things on the interior after the next wall or a roof went on. Then again, until you've put up drywall or the exterior maybe you could just have a combination of clever design and a clever robot to reach through.

And there's nothing stopping that same robot from installing wiring and plumbing.

Comment Re:False accusation... (Score 1) 162

Which is actually more interesting, because given what we know of the current state of Russia since the invasion of Ukraine... a move by Russia for a more expansive ban is almost certainly because they can't compete any longer and want to have their opponents hobble themselves.

I'm all for fewer weapons out there, the Russian proposal is obviously not an honest one.

Slashdot Top Deals

<<<<< EVACUATION ROUTE <<<<<

Working...