Memory-safe sudo to become the default in Ubuntu
Posted by steveklabnik1@reddit | linux | View on Reddit | 69 comments
Posted by steveklabnik1@reddit | linux | View on Reddit | 69 comments
FrostyDiscipline7558@reddit
"The maintainers of sudo-rs are sticking to the "less is more" approach: some features of the original sudo will not be implemented in sudo-rs if they serve only highly niche use cases. The maintainers continue their collaboration with Todd Miller, the incumbent
sudomaintainer for over thirty years, thus indirectly improving original sudo as a by-product of this engagement."Called it. Can't just do full implementation of features, they had to mess with them.
I said before this was inevitable, as it is the Rust coder's way. Y'all thought I was wrong, that I was mischaracterizing Rust devs. Told you so.
I'm sure the utility will be mostly great... but full 1:1 compatibility with the features of the original is never possible from the Rust community. They cannot think that way. It's not 'perfect' enough the way it was.
Every dang time.
IAm_A_Complete_Idiot@reddit
https://github.com/trifectatechfoundation/sudo-rs/commit/d89c7801000f21409dd1b0c8f5b1149eac0fc69f
They've been saying that since 2023, a year after they started development. Back then, it didn't even read the
/etc/sudoersfile, and read the/etc/sudoers.testfile because of not being far along enough. There's nothing to call here,sudo-rswasn't intending on implementing all the features ofsudo(even if you think that's a bad thing).FrostyDiscipline7558@reddit
Always be 100% backwards compatible or don't fricking bother. I'm really getting sick of this replace this, and replace that, and oh, it's not fully compatible with 30+ years of fricking standards!!! Add features? Sure! But make sure you don't break ANYTHING! Why is that so hard to understand?!?!?!?
IAm_A_Complete_Idiot@reddit
What features of sudo do you use that sudo-rs doesn't implement by design? Is this an actual concern you have, where things will actually break? Even the original sudo has changed behavior on occasion to match
sudo-rsbecause the original behavior was a bug.What standard? The exact, precise behavior of sudo in all scenarios? Distributions do bigger changes all the time.
SysVInittoSystemdwas far more disruptive. X to Wayland too. Distributions change out tools all the time. Just check the release notes of Debian, and all the "Changes to be aware of". This entire argument is just an argument against all change, because something somewhere might break. Bugs shouldn't be fixed, and the system should just be forever frozen.Any system that makes heavy use of things like storing sudoers information in LDAP, or needing
sudoto be able to call out tosendmailto send email on failed sudo attempts can pretty reasonably be expected to be technically apt enough to just install the normal sudo.FrostyDiscipline7558@reddit
Yes, and the change to SystemD is still hated by many, despite how much better it is.
Yes, and the change to Wayland is still hated by many, despite it... oh right, it still can't even do simple ssh tunneling, gotta do waypipe.
5 years was plenty of time to find functional / behavioral bugs, after that, the remaining 25 years is standard. Unless you're a programmer that thinks Wayland's development history makes sense... in which case, change anything, anytime, for any reason, and compatibility be damned, and be sure to architect it in a way where one hardware manufacturer you don't like can't use it unless they hire a new team to update their driver 8 times to get around the wall you built to screw them.
IAm_A_Complete_Idiot@reddit
I don't wanna diverge too much from the initial discussion, as that was about
sudo-rs, but re:WaylandGBM is a standard implemented by every other GPU manufacturer. It's a core and central part of the graphics stack on linux. Standards exist for a reason, and arguing that hardware manufacturer's shouldn't have to follow them is odd. Nvidia has the right to try to shape the standards - they're a big player, and can discuss them in the relevant spaces if they wish to do so. Choosing not too, ignoring the standards that other hardware manufacturer's and implementers of the graphics stack settled on, and then refusing to implement that standard is a choice they made. Supporting N different APIs from different hardware vendors isn't tenable for the FOSS community.
Nvidia is collaborating with Nova now. There drivers are becoming more open, and as the relevant open source driver stack takes shape, they'll get GBM from free by virtue of being in Mesa. That is the right solution.
Yes, maybe it sucks for people with Nvidia that Wayland didn't work for them for so long. But there really wasn't any other solution short of deciding to cater to Nvidia's whims and duplicate work for largely no benefit. This isn't a Linux specific problem either. It's a known issue Nvidia has, where they don't play well with others. Even aside from the infamous torvalds clip, it's well known ABI manufacturer's find it hard to work with Nvidia. Apple did too, and outside of the switch, most console vendors dislike working with them due to how much control Nvidia wants on the end product design.
Any examples? I'm not aware of Wayland having backwards compatibility problems with itself. With X, sure... but even there, an attempt that works for most applications was made with XWayland.
FrostyDiscipline7558@reddit
That Linux forced nvidia to open their driver is just wrong. Want open source respected? Then respect closed source.
IAm_A_Complete_Idiot@reddit
And Nvidia monpolizing the market using cuda, physx, gameworks isn't? If companies want to use Linux, they have to abide by how the platform works. FOSS isn't beholden to the whims of corporations. They're allowed to fork the kernel if they so choose. If Nvidia can't abide by those terms, then they don't deserve to build on the platform.
Is it political, rather than technical? Yes. But that's the nature of choosing the policies and rules that build up the kernel. At the end of the day, someone has to support that stable ABI so proprietary vendors can use it, and understandably no one wants to support those internal kernel structures forever.
It goes to my original point, actually: This all is an argument for nothing to ever change. The kernel shouldn't be allowed to make changes that improve itself (and compatibility / performance) with newer hardware, at the cost of compatibility with closed-source drivers no one supports. We should remain on X, because Wayland broke assumptions that applications made underneath X.
That might sound appealing to some, but to me it sounds like a pretty mediocre long-term experience for the linux ecosystem as a whole.
FrostyDiscipline7558@reddit
"And Nvidia monpolizing the market using cuda, physx, gameworks isn't?"
Why not? It is their property. If you don't like that, write or use a clone of it. Others have.
Companies do not owe you cuda, physx, or gameworks for free. That's up to them. Your sense of entitlement is just, wow.
IAm_A_Complete_Idiot@reddit
And the FOSS community isn't entitled to deliver a stable ABI to them either. You can't have FOSS both be beholden to being a good guy w/ Nvidia, and have Nvidia not be beholden to play nice with FOSS. I'm just arguing that saying it's hypocritical to say the Linux community needs to play better with Nvidia, when it's well known they don't play well with others.
FrostyDiscipline7558@reddit
By breaking NVidia as distro's swapped from x11 to Wayland, and Wayland clearly breaking NVidia on systems that previously worked, I think NVidia would have a very valid claim for a few good lawsuits. I want them to do it. I want them to win. I want Wayland devs financially destroyed, personally, for doing this to all the existing NVidia users. I want their names listed, so they can be blacklisted from companies and ever making money as a developer again, because what they did to NVidia and existing hardware owners was evil as F.
IAm_A_Complete_Idiot@reddit
Not sure what you said, your comment got removed by Reddit on my end.
(Says "[ Removed by Reddit ]")
void4@reddit
If they weren't intending to implement all features of sudo then they could just use doas, which is already there for a long time.
As for what's the problem, well, some people are getting annoyed when corporate money laundering projects (always an overengineered crapware) like this sudo-rs just can't stop getting promoted by a complete idiots.
IAm_A_Complete_Idiot@reddit
And scripts or tools that call out to
sudowon't work. Scripts that use it in non-trivial ways stop working.sudo-rslets you have a middle ground where there's some edge case behavior that isn't replicated, and by and large mostly everything works. Yes, you can't rely on it with 100% certainty, but what are some practical examples of breakages?Because there have been fairly bad memory safety issues in sudo before, and a lot of them come from the fact that it's such a complicated codebase.
sudo-rsis clearly relevant.struct_iovec@reddit
None of the memory safety issues have ever been a problem for sudo
IAm_A_Complete_Idiot@reddit
https://www.sudo.ws/security/advisories I disagree. The first page for their advisories has a few memory safety issues already, with one letting a user not listed in the sudoers file elevate themselves to root.
That is a problem for sudo. You can (rightfully) point out that the last CVE was 2 years ago, but to say these issues have no impact is a stretch. I wouldn't put any money on the idea that the CVE from 2 years ago is the last remaining memory safety bug in sudo. Several other vulnerabilities are in niche features of sudo few people use.
sudois security sensitive, and should be treated as such. Sudo has done good work, and security vulnerabilities are an accepted part of software development. The project clearly takes security seriously, and that deserves praise. But that doesn't mean that it doesn't benefit from eliminating a class of security vulnerabilities that has impacted it plenty in the past.struct_iovec@reddit
I can already tell you this that none of the issues mentioned are going to be fixed by porting to rust
IAm_A_Complete_Idiot@reddit
The very first issue on that link is a double free, which is impossible in safe rust.
smirkybg@reddit
Anything worth mentioning to back this change? I never had any issues with sudo, nor do I recall CVEs that crossed my mind. Its a pretty stable and secure utility.
Haziel_g@reddit
Do a google search there have been many over the years cuz of memory related issues
Haziel_g@reddit
Do a google search before saying whatever floats ur mind
JockstrapCummies@reddit
I can't wait for the RedHat/Fedora camp to implement their own Rust/Go/Zig/$COOL_LANG rewrite and then, 5 years from now, we'll have this whole sub say how Ubuntu went NIH again on their sudo implementation and that they should've just adopted the other rewrite instead.
DistantRavioli@reddit
They literally did already as an alternative to sudo just a year ago with run0. I don't know why you seem to be implying Ubuntu is the one that is first to the punch here.
JockstrapCummies@reddit
run0: announced on 30 Apr 2024
sudo-rs: first stable release 0.2.0 on 29 Aug 2023
I don't doubt that down the line run0 will somehow win over the Linux landscape though, it being backed by systemd. I'm just annoyed at how 10 years from now it's also very likely that you'll get a bunch of people saying sudo-rs is this misbegotten project championed by Ubuntu and therefore deserve to die.
eredengrin@reddit
I'm not going to preemptively claim that sudo-rs deserves to die, but run0 has a very different design philosophy than sudo/sudo-rs. For most users who aren't using complicated sudo configurations (and perhaps even some who are), the run0 design probably makes more sense, so I do question ubuntu's decision here. run0 is already out, so even if sudo-rs was released first, I don't see why they couldn't nudge users toward run0 instead.
I suppose since run0 is in systemd, presumably that is already available in any ubuntu releases with systemd 256, so if sudo-rs is actually in a stable and secure state, it doesn't hurt to have both. Ideally the messaging would be focused on run0 though, with sudo being reserved for advanced users and configurations who absolutely need it.
DistantRavioli@reddit
run0 is not a simple sudo rewrite like sudo-rs as you have wrongly said nor is sudo-rs developed by Canonical as you seem to be implying. I fail to see how them adopting this program which is a simple rewrite of the existing sudo in another language is somehow more innovative than developing a completely different approach which is more secure. I especially don't understand preemptively coming to their defense against some perceived strawman that people 10 years in the future might criticize this move. That's extremely cringe to me.
ekaylor_@reddit
Maybe I can get a Rust Job then. I'm looking forward to it lol. 😁
Repulsive_Lobster_15@reddit
sudo-rs is not a Canonical project is it? If it was, they would slap on their CLA, because Canonical loves their legally power Imbalanced open source projects.
DistantRavioli@reddit
It is not.
okabekudo@reddit
That's an argument for snap/flatpak. And that's an entirely different argument than rust vs c. The snap store is proprietary, flathub isn't. Otherwise I actually like snap more than flatpak.
JockstrapCummies@reddit
The same argument got trotted out when it was about Upstart vs SysV init vs systemd.
Also when Unity DE was a thing and then Gnome 3 came along.
And before that we also had arguments about paths before every distro agreed on the usr-lib merge. Oh and also the old debate of whether newly installed packages should have their services enabled or not. (The Debian camp, and thus Ubuntu, does. The RedHat/Fedora camp doesn't.)
There were plenty more of these arguments and flamewars. The snap/flatpak one you remember is just one of the more recent ones. Time and again we always get history rewritten such that Ubuntu is somehow NIH-ing and impeding upstream progress.
okabekudo@reddit
Well that's just how it is. Ubuntu tries to overtake Red Hat as the leader of the Linux world, but they always fail miserably. They could have succeeded with snap, but made the store proprietary... Why this is a no go for the linux community shouldn't even need an explanation.
zinozAreNazis@reddit
I just started using g NixOS and I am impressed to find out that you could replace sudo with sudo-rs with a single Boolean flag.
nikunjuchiha@reddit
Does it remove sudo from system entirely?
zinozAreNazis@reddit
It replaces the package with the rust one. So yes? If you use the sudo command it will be using the sudo-rs package.
nikunjuchiha@reddit
I see, thanks for the info.
tiny_humble_guy@reddit
Meh
TheMovingTarget6@reddit
Everyday I find new stuff like this with NixOS
MatchingTurret@reddit
Next step the: Rusty Shell. That would really cover a large attack surface.
syklemil@reddit
For an interactive shell rather than a
/bin/shprovider there's also fish. (See also the "fish of theseus".)They did as close as a 1-to-1 port from their C++ implementation as they could though, so it has some oddities for a Rust program, like a unicode implementation mimicking the wchar/wstring they were using in C++, which I think they want to move away from so they don't have to do extra work just for the encoding.
ultrasquid9@reddit
Fish isn't POSIX compliant, and if going with a non-standard shell I would rather use Nushell.
syklemil@reddit
Yeah, I get that. Personally I prefer to avoid POSIX-isms—I haven't written a shebang targetting
/bin/shfor years, but use/bin/bashwithset -euo pipefailfor the scripts I write. For interactive use fish is fine IMO (though the lack ofset -ubothers me), and nu is … too big a distance.AyimaPetalFlower@reddit
I don't know when this happened maybe it was the rust rewrite but I tried fish recently and it was actually fine. I swear it used to be unusable before so I'm not sure what happened. The default shell was as slow as those oh my zsh bloatware zsh configs.
syklemil@reddit
I think they still have some unrealised speed gains too, as in, I think they have yet to use more of the "fearless concurrency" that Rust offers.
cAtloVeR9998@reddit
Fish is neat and all but them deliberately being non-POSIX compliant means it would be unwise to switch out ‘/bin/sh’ for all Ubuntu users with it.
syklemil@reddit
That's why I explicitly wrote "For an interactive shell rather than a
/bin/shprovider".Providing an interactive terminal environment and providing
/bin/share strictly separate goals. They can coincide (Bash is an example of that), but they can absolutely be two different programs by different organizations.gonengazit@reddit
How/when is the shell an attack surface?
MatchingTurret@reddit
It's exposed to untrusted users. They can feed it any kind of data. And don't forget old fashioned CGI scripts which expose the shell directly to the network.
gonengazit@reddit
Yeah but untrusted users run the shell as their own user, so any vulnerabilities could potentially let a user do whatever they want on the system as themselves, limited to their own privileges (which they can already do just using the shell)
The latter case is a little bit more realistic, but if the cgi script allows running commands controlled by the user, then the above applies, and if not, being able to trigger some memory corruption from it is highly unlikely I think?
MatchingTurret@reddit
The Restricted Shell
gonengazit@reddit
Fair enough - I wasn't thinking of rbash
MatchingTurret@reddit
Shell scripts run with root privileges in countless circumstances. Just think about post-install scripts of packages. If you can trick one to read data controlled by the attacker, you have an attack surface.
Beautiful_Crab6670@reddit
As long as it doesn't stop me from going back to "vanilla" sudo -- more power for the users.
FlukyS@reddit
Seems like a safe place to start, sudo is very important but in a lot of ways is the easiest to replace out of the tools Canonical is looking to replace with this effort. Coreutils is the one I'm very curious about how it goes because while Coreutils is fine for the moment can really be a massive improvement across the system.
These sorts of efforts are thankless tasks in a lot of ways because they aren't going to improve anything overnight but it tidies stuff up and gives maybe areas to improve with a nicer language to do it. Rust regardless of it being a type safe language is a language that is easier to use than C/C++.
MatchingTurret@reddit
My personal experience is, that strongly typed languages are easier to use than the "everything goes" weakly typed one (not looking at JS). I still marvel at boost.units and the way it maps dimensional analysis into C++ types without runtime overhead.
MyGoodOldFriend@reddit
Absolutely, I find python absolute hell to work with because I constantly have to look up and cross reference documentation for what types work where (especially my hated enemy, numpy arrays and panda databases and all the other weird and interconnected arrays), whereas strongly typed languages can give good compiler errors.
jaskij@reddit
Since we're in the "we love Rust" thread, have you tried Polars?
MyGoodOldFriend@reddit
Nope, I’ve only used python because I’ve had to, and at that point the libraries are already selected for me. Is polars any good?
It’s interesting, though - I learned python in 2018 as my first language during intro to IT while taking my chem degree, so I’ve known it for ages, but after my friend got me to try rust in summer 2019 I actually got really into playing with it. And even though I had to use python every semester for something or other, it got more and more difficult to work without types. It felt more like casting spells than giving commands. I don’t know if I broke my own understanding by using rust or whatever, but I’m not sure it helped lol
syklemil@reddit
FWIW Python these days is more and more typed by default, just like how Typescript is cannibalising Javascript at an incredible speed. Looks like the majority of coders actually want some type help!
Generally
pyrightis the current recommendation for typechecking in Python AFAIK, though that might change once Astral gets their typechecker out, especially if it'll be bundled withruff. Astral tools for Python likeruffanduvare also written in Rust, and seeing quick adoption.Pydantic is also implemented in Rust now, I think.
jaskij@reddit
Polars is a Pandas competitor, written in Rust, available as a crate, and has Python bindings. Supposedly more modern and performant than Pandas. Didn't need to use it myself.
FlukyS@reddit
It is just about flattening a few specific issues enough that you don't have to think of them at all. I just think if the code is written in rust I can trust it mostly as long as they aren't using the unsafe functions which you should avoid unless absolutely required.
Littux@reddit
Does
sudo-rshave insults?Megame50@reddit
This sudo?
Plenty-Light755@reddit
Aren't we supposed to switch to
run0?steveklabnik1@reddit (OP)
Switching programs is another option, for sure.
justajunior@reddit
Ok but if sudo is getting replaced then why not more stuff like coreutils? Is there even a memory safe replacement for those?
syklemil@reddit
Yes, and Ubuntu is switching to them too. Looking at the test suite chart at uutils/coreutils I get the impression they're still cooking and could be at parity in a year or two or so, and switching already in october may be jumping the gun.
(I'm not aware of how mature sudo-rs considers itself.)
steveklabnik1@reddit (OP)
They are also doing that https://jnsgr.uk/2025/03/carefully-but-purposefully-oxidising-ubuntu/
justajunior@reddit
Wow that is really cool! I hope it lands soon.