sudo isn’t simple at all. SUID binaries shouldn’t be LDAP clients, IMO. Unfortunate bugs like “user environment variables are used to select the editor” make all the complex configuration a huge risk, because permitting a single user to edit a single file suddenly gives the user full root access when they set the right env variables.
I have no specific love for run0 (doas works just as well) but sudo does way more than it should do in a binary with the SUID bit.
run0 doesn’t exist because systemd wanted to build their own sudo, they just realised their systemd-run already offers most sudo features so they may as well make them available to end users.
sudoisn’t simple at all. SUID binaries shouldn’t be LDAP clients, IMO. Unfortunate bugs like “user environment variables are used to select the editor” make all the complex configuration a huge risk, because permitting a single user to edit a single file suddenly gives the user full root access when they set the right env variables.I have no specific love for
run0(doasworks just as well) butsudodoes way more than it should do in a binary with the SUID bit.run0doesn’t exist because systemd wanted to build their ownsudo, they just realised theirsystemd-runalready offers mostsudofeatures so they may as well make them available to end users.