Systemd wants to expand to include a sudo replacement

What you're refering to as Linux, is in fact, Systemd/Linux, or as I've recently taken to calling it, Systemd + Linux. Linux is not an operating system unto itself, but rather another free component of a fully functioning Systemd system made useful by the Systemd corelibs, shell utilities and vital system components comprising a full OS as defined by POSIX
- 🤣
- Oh it's no longer POSIX, he's seen to that!
- Thanks to BSDs we have sane alternatives :)
- ProgrammersAreHumanToo, great stuff.

When does systemd stop? Linux without it is increasingly looking unlikely in the future. Are we not worried about it being a single point of failure and attack vector?
This isn't a moan about the unix philosophy btw, but a genuine curiosity about how we split responsibilities in todays linux environment.
- SystemD will consume the entirety of Linux, bit by bit.
  In 2032, SystemD announces they're going to be introducing a new way to manage software on Linux
  In 2035, SystemD will announce they're making a display system to replace the ageing Wayland
  In 2038, the SystemD team announces they're making their own desktop environment
  In 2039 SystemD's codebase has grown to sixteen times its size in the 2020s. SystemD's announces they're going to release replacements for most other packages and ship their own vanilla distro.
  In 2045 SystemD's distro has become the standard Linux distribution. Most other distros have quietly faded away.
  In 2047, SystemD announces they're going to incorporate most of GNU into SystemD. Outrage ensues from the Free Software Foundation, which vehemently opposes this move.
  In 2048, Richard Stallman dies of a heart attack after attempting to clone SystemD's git repo. SystemD engages in a hostile takeover and all resistance within the FSF crumbles
  In 2050, SystemD buys the struggling RedHat from IBM for $61 million.
  In 2053, most world governments have been pressured into using SystemD.
  In 2054, Linus Torvalds, fearing for his life, begins negotiations to merge kernel development into SystemD
  In 2056, the final message on the Linux kernel development mailing list is sent.
  In 2058, Torvalds dies under suspicious circumstances after his brand-new laptop battery explodes.
  In 2060, SystemD agents assassinate the CEO of Microsoft.
  In 2063, after immense pressure from SystemD-controlled human rights organisations, Arch developers discontinue development.
  In 2064, the remaining living Debian developers release the next stable version of their clandestine and highly illegal distro.
  
  I think you might want to recheck the ages of some of the people in your timeline, most of them aren't that young anymore.
  
  Debian already uses systemd.
  
  Probably the weirdest joke comment I've ever read.
  
  Thanks for that write up. Made my day! 😄
  
  This is a script of Simpsons episode and Torvalds will actually die in 2058.
  
  Dude if you made a movie or novel about this that would be awesome
  
  One way to notice a person has "systemd derangement syndrome" is by looking at how they write systemd: if they write it SystemD they are already in late stages of SDS and it isn't curable anymore.
- When does systemd stop?
  "systemd announces a repleacement module for the kernel"
  
  HurD
- By this logic the Linux kernel is also a single point of failure and attack vector.
  sudo isn't going away, so does doas. run0 is just another alternative to use or not.
  There are still distribution out there without systemd and if there ever won't be any systemd-free distributions left and systemd would become a critical part of the Linux ecosystem, then it would get the same treatment as the Linux kernel with many professional maintainers.
  
  plus, it isn't like this isn't exactly like adding another "door" to the "systemd building". It's a modular component of systemd, so more akin to replacing the sudo building with a new, but still separate, systemd sudo building
- @Olap
  I agree. As someone who uses systemd on daily basis (I use Arch, BTW 😄) I really like it, but I am a bit worried about it being a single point of attack. Maybe just push doas as default instead? I never used doas but I watched few videos about it, so I guess it's fine and probably better than sudo (less bloated).
  Just my few cents.
  
  I don't see how something would be inherently easier to attack if it is called systemd-foo instead of just foo. Attack surface and vectors do not depend on which project develops a particular tool.
- Gentoo, Slackware and Devuan can be used without svchost for linux.
  They'll only stop when they rebrand it to systemd OS.
  
  Gentoo, Slackware and Devuan can be used without svchost for linux.
  https://nosystemd.org has a list for more choice for readers.
  
  Debian works fine without systemd too, there's a page on the wiki on how to install without it, or remove it after the fact.
- Systemd is a bit of a hassle to be rid off, but thankfully it's not actually that hard, the hardest part I found was converting systemd services to whatever init system I use.
  
  I wonder how many hours you sunk into that practicality-free, weird-philosopy-dependent project

Soon we will have to call it GNU/systemd/Linux
- Nah. Replacing the kernel is probably planned for the next point release - it'll just be GNU/systemd
  
  Can we rename it GNUtriSystemD?
- I mean it should kind of already be something like GNU/SystemD/X11/PipeWire/Linux, I guess.
  It's not like the GNU utils are the only massive integral part of the OS. I think GNU/Linux caught on squarely because many people follow Stallman, and that's how he wants people to refer to it.
  
  It definitely made way more sense at early on. I mean GNU made most of UX of using Linux at some point. Systemd, and the browser now make a much bigger portion than before, and the world is more than GNOME now too.
- Systemd makes life easy. It also makes Linux more teachable. I like accessibility and don’t even mind this
  
  hard disagree. life with plain text logs and daemon init scripts was so easy and nice. But we can't have nice things...
  
  But it's so unbearably slow.
  Me when my computer that has a typical uptime of 37 days boots up in 7 seconds with systemd instead of 5.5 seconds with runit: 😡😡😡😡
  
  I'm not on the systemd hate train by any means, but I don't understand how this is any improvement over pkexec
- Or as I've taken to calling it, GNU+systemd+Linux.
- https://news.ycombinator.com/item?id=40217813

It's still missing core functionality for an init system, like a display server protocol, compositor, desktop environment and web browser smh.
- systemd-chromiumd
  
  This but unironically, would be better than Electron (low bar, I know)
- Systemd isn't just an init system. It is a project with low level building blocks for a distribution. Most of the complaints are that it isn't just an init system, while it's not meant to be just an init system.
- If we could get an LLM that uploads all our data along with an ad server in our desktop apps, then we'd really have something going.

- Agreed, this is a nice inclusion. I also hate sudoers with a passion - I already use doas but it's not standard (in the Linux world anyway), but with systemd providing an alternative means that it'll become a standard which most distros would adopt, and I hope this means we can finally ditch the convoluted sudoers file once and for all.
  
  How does doas differ from sudo?
  Never heard of the former until now.
- I read the original mastodon post by the developer of run0 and I am still don’t understand what the problem with SUID is.
  Whats an example of an attack that would work with sudo and doas (which also uses SUID) and not on run0?

Not that I'm opposed to a better sudo alternatives, but I find it rather ironic that one of the reason stated is the large attack surface, considering systemd is a massive attack surface already.
- This isn't exactly a "new" attack surface, so removing the attack surface that sudo (and alternatives) is, is probably a net positive.
  
  That attack surface is not vanishing. It's would be relocating the same attack surface to something that might have an xz library in memory.

feature creep

I'm no Linux expert, but I've never had any problems with sudo, it just works. Shouldn't systemd have higher priorities on their mind? This feels like change for the sake of change. And if this does happen, I sincerely hope that it just works, like sudo.
- I think the article (or more Lennart Poertting post) explains it quite nicely. The problem with sudo is that the sudo binary itself has the ability to gane elevated privileges which is a potential attack surface

Oh, it's gonna use polkit. Sudo bloat is a grain of sand compared to polkit.
Why people want to replace sudo with polkit? Visudo is no near as obscure as configuring polkit.
I hope distro maintainers don't follow this.
- ...is pkexec not good enough already as a polkit based sudo replacement? Why would one need to systemd-ify that?
- I just treat polkit as "set it and forget" kind of thing and leave it on defaults, I'd rather spend my time on something more important
- They can't help themselves. They gorge themselves on his phallic offerings.
- First thing I do with any new desktop installation is disable polkit prompts.
  Fuck having to enter my password every time I want to do something.
  
  Hey uh can I get your IP address real quick? I have a strong suspicion your philosophy extends to your network ports.

sudo is already an optional component (yes, really—I don't have it installed). Don't want its attack surface? You can stick with su and its attack surface instead. Either is going to be smaller than systemd's.
systemd's feature creep is only surpassed by that of emacs.
- systemd's feature creep is only surpassed by that of emacs.
  Tomorrow's headline: emacs wants to expand to include a Sudo replacement
  
  And after that: emacs wants to include a systemd replacement
  :wq
- Or you can use a doas implementation like OpenDoas, or maybe sudo-rs...
  
  Though a Rust clone of sudo that operates in the same way will still have the same problems.
- But systemd is modular. They make an offer and distro maintainers and admins get to choose which parts to use
  
  The problem is that those modules are packaged by the developers as opt-out rather than opt-in. It's a variation on Microsoft's old embrace-extend-extinguish playbook, only the "extinguish" part hasn't worked so well because there are some stubborn distros whose needs don't align with what systemd provides and have maintainers that go out of their way to provide alternatives.
  (By contrast, although we may joke about emacs, it's the myriad of third-party extensions that cause it to just about be its own operating system—it doesn't all ship with the core.)
- And there's also doas which is a nice substitute.
- I'm not a fan of having root be able to actually login.
  Even more so in a true multiuser env where I would rather have privilege escalation be more granular (certain user/groups can esculate certain actions but not others, maybe even limit options of a cmd).
  
  Granted, in a true multiuser environment with an admin who's carefully tailoring /etc/sudoers to make sure everyone has the least possible privileges that will allow them to still do what they need, sudo is more secure. There's no doubt of that.
  On a machine that has only one human user who's also the admin, and retains the default sudo-with-user-passwords configuration, su vs sudo is pretty much a wash, security-wise. su requires a second password to get root access, but sudo times out and requires the password to be re-entered while a shell created by su can stay open indefinitely. Which is more easily broken will depend on other details of your situation.
  (If you're running an incorrectly configured ssh server that allows direct root login with only password authentification, having a root password could contribute to problems, but the correct fix there is to reconfigure the ssh server not to do something so stupid. I hope there's no distro that still ships that way out of the box.)
- You also won't be required to use run0.

There's a rewrite of sudo happening in rust, but he wants to throw out the SUID idea altogether?
when invoked under the “run0” name (via a symlink) it behaves a lot like a sudo clone. But with one key difference: it’s not in fact SUID. Instead it just asks the service manager to invoke a command or shell under the target user’s UID. It allocates a new PTY for that, and then shovels data back and forth from the originating TTY and this PTY.
That sounds like opening up the door to what windows is doing UAC and the wonderful vulnerability that the GOG Launcher had for privilege escalation.
I'm not a security researcher, but giving arbitrary users the ability to tel PID 1 to run a binary of the user's choosing is... probably not what Pottering is suggesting, but opens up to such vulnerabilities. And if it's written in C/C++ my trust is further reduced.
Anti Commercial-AI license
- Giving users access to PID1 running binaries, giving users access to the kernel running binaries as root, I don't see much difference. SUID was notorious in the past for being leaky, it only ended when distros got serious about fencing use of it in, giving it only to programs actually needing it, making sure that they drop privilege properly, etc.
  If anything I'm in the PID1 camp because it's more microkernely. But in any case broader userspace shouldn't really care about the mechanism, only have an API to do it and that API being a bit in the file permissions is soooo 1960s.
- And if it’s written in C/C++ my trust is further reduced.
  Do you trust Linux? Because if so, have I got news for you.
  
  Wait until they hear the language used to implement OpenBSD. Imagine being one of the authors of seL4 encountering a member of the rust cult.

A lot (and I mean a lot) of criticism can be leveled at systemD. One of the upsides of it becoming popular is the standardization of much of things from the developers' perspective. It's easier to target multiple distros when you can rely on systemD's single implementation of the feature. Over the next decade, I forsee systemD eating more and more of the userspace, until you are only left with managing the differences between DEs and which display server they are using. We're already headed towards immutable base systems with apps shipping with their own dependencies, which we reduce the differences between distros even further.
- until you are only left with managing the differences between DEs
  Maybe they'll add a DE as well?
  Just kidding!
  
  SystemDE
  
  systemde
  
  Don't give them ideas 😂
  If Canonical and RedHat weren't backing different horses (Snap vs Flatpak), I could see the app containerization system coming under systemD as well fairly soon. The Cosmic DE project uses functionality from systemD to overlay changes onto the system that are reversible, so that alpha versions of Cosmic can be tested without permanently changing the base system. Imagine apps shipping on whatever container runtime, and dynamically overlaying system-level changes as needed for things that tap into the host system via systemd-sysext.

This is great. Not having the attack surface of sudo (and not even being a SUID binary) certainly are great additions.
And I hope people realize that systemd is not one large thing, but a (large) collection of tools.
- The attack surface will be a systemd daemon running with UID=0 instead, because how else are you going to hand out root privileges?
  So it doesn't really change anything to the attack surface, it just moves it to a different location.
  
  That already exists. systemd-run is already available today. So the attack surface would be smaller
- that systemd is not one large thing, but a (large) collection of tools.
  Who don't work without Systemd. And Systemd can't coexist with tools in the same repo doing the same job in a portable way.
  I think Chimera was it (?) which tried to have Systemd and Runit and others in the same repo. With lots of wrappers and shims. Not because of Runit & co.
  
  Just like gnu utils.
  
  Right. That reminds of the time I was visiting a friend who had broken his Linux computer (No, not "apt-get remove --purge systemd" but they did something slightly similar). When I booted from a live Linux, used chroot and wanted to use configure networking : FAIL because systemd was ... not running. As he had no Internet because of his broken machine this caused some delays in fixing this but we got the job done eventually.
- This is great. Not having the attack surface of sudo (and not even being a SUID binary) certainly are great additions.
  And I hope people realize that systemd is not one large thing, but a (large) collection of tools.
  XZ-utils rings a bell ? It was among others Debian wanting to pull in part of a systemd tool into openssh and that almost turned into a world wide disaster :(
  
  I didnt understand that sentence. Is that what you meant?
  Among other things, Debian wanted to integrate a part of the systemd tools into openssh, which almost led to a worldwide catastrophe
  xz is not part of systemd or openssh afaik.
- I've had to scroll down eight pages to find a post that seems to actually address the good points raised in the article.
- Kinda feels like writing a script that implements the sudo CLI but calls pkexec would be an easier way to do it. Given that so many systems already come with both sudo and pkexec, do we really need yet another option?
  
  The point of this is to implement some form of privilege escalation without the SUID mechanism. sudo, pkexec and doas are all SUID.

Surprised people aren't moaning about systemd being too big already and still wanting to do more.
- It's too big!
  
  😂
  
  That's what somethin' somethin' said lastnight, Trebek! ;)
- SPoF !!!! Ahhhhh we all dead
- The comments are here now, you can come check again 😅
  
  😂

So I don't even use systemd myself I run OpenRC. Yet honestly I find the idea quite intriguing, having the service manager (PID 1) invoke the command seems like a cool idea to me.
It's not really a sudo alternative as much as it is another way of doing something similar.

How does systemd-run/run0 handle what /etc/sudoers currently does?
I'm disappointed in how little technical discussion there is in this thread.
- Looking at the implementation, it doesn't really implement sudoers or tools like sudoedit in any way. systemd-run has already been an existing tool for quite some time and this is really just a different CLI for it. That tool asks systemd to make a temporary new service and immediately run it. That, in turn, requires blanket yes/no approval for org.freedesktop.systemd1.manage-units via polkit.
  So with run0, you can either do everything or you can do nothing. In-betweens are just not a thing at the moment. There's very little new backend code running as root.
  run0 bash should behave very similar to something like systemd-run --uid=0 --gid=0 --wait --same-dir --send-sighup --pty --pipe --collect bash and the majority of those options have been available for quite a while.
- Idk
- Systemd has always been about "don't ask questions or well call you obstructionist and old".
- sudo is overkill for most users tbh
  
  so is systemd
  
  Yeah I think I'm the exception but I just use su at home

I honestly started out not liking systemd at all, mostly due to the reports that it did waaay to much, but nowadays, I like the concept.
It is basically officially moving daemon management from a script-based approach to a table/database-based approach. That improves static analyzability, therefore increasing clarity, and probably even performance.
I agree that we should abandon scripts and move towards declarative software management, and abandoning sudo for a more declarative system seems like a good step to me.

Systemdeez nuts
- Gentleman and scholar

The meme is becoming a reality. Systemd really is going to try to be everything lmao
- AlwaysHasBeen.jpg

But for why (I'm commenting this before reading) wouldn't it make more sense to home I'm the scope of systemd so it can be easier to maintain? Why have it do everything?
- systemd is more of a set of products and software components branded under a single name rather than a single thing.
  systemd itself is rather simple, as most other pieces systemd-* software, like systemd-boot, systemd-networkd and systemd-resolvd. these are usually more stable and less bloated than more popular alternatives
  
  As long as they can work independently, yes. If they are modular and a distro admin (or just a computer admin) can choose to install and use systemd-x but not install or use systemd-y, we are in good business
  Now if you have to take a few you don't like or need to use so that the one component you do want works, then no
  I honestly don't know enough of systemd to say either way
  
  Oh okay I didn't know that thanks
- You can't think of it a single massive project. It's actually lots of small components.
  We could argue the linux kernel is bloated too. The reality is though, provided the project is designed to be modular (as SystemD is), it actually makes sense to keep it together, to ensure there is a standard base and all the components are synchronised fully with their API's.
  It also saves distro's a lot of effort.
  
  distro's
  You can pluralize without the apostrophe. In fact, you never need an apostrophe to pluralize.
  It also saves distro's a lot of effort.
  Only if they want to break free.
  And they don't need nfsroot or a separate consolidated /usr mount or, really, a whole host of things that lennart didnt understand and unilaterally broke like an arrogant noob.
  But that's blasphemy.
  
  In practice, all those tight coupling between components mean that it behaves more or less monolithic, despite the claims to the contrary. Replacing them with alternatives is a pain because something else breaks or some software has a hard dependency on it.
  
  Oooh okay that makes more sense. Thanks I didn't know that
- Why have it do everything?
  Isn't the guy behind systemd a (former?) Microsoft employee? I feel as though that might offer a clue as to why the trajectory towards bloat.
  
  He's working for Microsoft now but it's very recent, he developed systemd while working at RedHat.
  I don't even know of he's still working on it. There are a lot of things to be said about systemd and Lennart but the link to Microsoft is irrelevant.
  
  It is. He is poisoning Linux, slowly, from the inside. Like the XZ attack, just smarter and much slower.
- I can understand that it makes it easier to add changes that would benefit systemd and distros in general. I read that they introduced run0 to solve long shortcomings of sudo (I'm not aware of which). That sounds logical.

Well... Poettering will eventually work his way up to browser engines and then we'll get something efficient... Here's the announcement:
"There's a new component in systemd, called "engined". Or actually, it's not a new component, it's actually the long existing "WebKit" engine now done properly. The engine is also a lot more fun to use than "WebKit" or "Blink" because you can finally have hundreds of tabs open in your browser without running out of RAM.
Coming soon in Coming for systemd 981.

I'm not surprised. Not surprised at all. (scope creep)

new sudo vulnerabilities? how exciting!
E: read the article, I guess that is part of the reason for the proposal. interesting

Even when that releases, it doesn't mean distros will switch to it. Just because it's systemd, doesn't always mean it's better. Just look at network manager vs systemd-networkd. Correct me if I'm wrong but afaik they are made to serve the same purpose and most distros prefer Network Manager over systemd-networkd.
- Honestly, though, NM is useless on a server or VM. I don't know why they still have that kludge installed on 90% of machines.
  Having said that. Lennart's Cancer is junk from junk process. It WILL be adopted by every distro but PCLinuxOS because no other distro is putting effort towards stability and reliability.
  I'd hoped that moving to Microsoft would allow IBM to re-evaluate the shit shoveled into its declining enterprise product, but that's not looking likely given staffing and IBM's ancillary priorities. RHEL only needs to be Good Enough so it can sell certs and classes and AAP and other make-work.
  
  If RHEL is as shit as you say, what do you recommend companies switch to?

As long as it's not a mandatory switch, I can't see any issue with this.
- In theory it isn't mandatory, in practice you will see a lot of distros replacing it.
  
  You think? Hardly anyone uses the built-in network stack or the homed thing.
- It's the same drama as with the home directory replacement they announced and that no-one ever used.
  
  homed isn't exactly a home directory replacement, more of an extension. You can mix and match homed and normal home directories like you want (on a per-user basis at least, not within a single user). It does have some nice things, such as user-password based encryption of the home directory, so the password is required to unlock it (no admin access) or automatically using subvolumes on btrfs.

Don't we already have polkit and pkexec for that?
- invoking them is kind of a pain, my sole experience with it was meson/ninja using it but then that default was removed and I've never been able to put it back to satisfy my curiosity of how it's done

Whp is this "Lennart Poettering" character, anyway? I suspect he might be secretly working for Microsoft.
- It stopped being secret a couple of years ago.

However, distributions like Fedora will definitely be in the lead, judging by previous experiences and stories of adapting new Linux technologies and Systemd components.
I wonder if this is still true, now that he no longer works for RedHat, but Microsoft.
- I wonder if this is still true, now that he no longer works for RedHat, but Microsoft.
  Why wouldn't Fedora do that? Decisions are decided by multiple people, they are not forced through or just decided unilaterally by one person.
  Enough people in Fedora try to improve the low level stuff. I'm looking forward to that homedir systemd stuff. Don't care about this sudo alternative.
  
  Decisions are decided by multiple people, they are not forced through or just decided unilaterally by one person.
  Unless you're talking about GrapheneOS, but that's an horror story for another night 🤣

Glad to see PoetteringOS has still not infected the *BSD family members /s And I'll gladly use Doas on Linux if need be, thank you.
- What version of doas though? Opendoas is hardly maintained.

In the old days, it was Emacs trying to do everything. Now, it's the SystemD.
- That was so bad that vim users needed to make nvim to handle Emacs envy, and every modern ide tries to do the same in worse ways.
  (Not trying to start a holy war, I use both)

Dudes trolling, right?

Artix, Devuan, Void, Alpine Linux are the way to go
Also Gentoo and Guix as mentioned in the comments
- Gentoo LET'S GO
  
  You're absolutely right, I absolutely forgot about Gentoo although it's my daily driver
- and Guix

No.

Well I'm not a fan of systemd to begin with...

https://xkcd.com/1200/

Can't see how this could go wrong

@starman
Systemd is nice. I miss GUI apps for #SystemD.
Permanent mounting a Network drive or creating new Services and inspect and modify is such a point.

No fuckin thanks

This is why people don't like systemd...
- Systemd monolith - worst thing to have ever happened to Linux
  Wayland monolith - best thing to have ever happened to Linux
  
  Wayland monolith
  There seems to be misunderstanding about what Wayland is.
  Wayland is set of protocols. They are implemented by wayland servers (compositors) and wayland clients (applications) themselves. There is no single "wayland binary" like in the X11 days. Servers or clients may choose to implement or not implement a specific protocol.
  
  Oh you had me going in the first half. Sly devil you. Wayland still doesn't work on the fleet of equipment we have.
  
  hey, many of us dislike both equally! (specially the push to become the only alternative)
  
  If they had named it systemd-x11 people would hate it.
  
  I think wayland has potential but in it's current state it's just half baked. Once more protocols get merged, ~~maybe in a decades time~~ Wayland should be quite flexible and robust.

Maybe that could be a good thing, but only if the distros do not include sudo by default, the fact to have one thing to update to update more things is good in the security side! If it's well implemented I'm okay with it

Fuck off Poettering!