4 ms·

Did you know that polkit, the systemd replacement of sudo, uses JavaScript to validate permissions? This was the response: https://lists.freedesktop.org/archiv

Did you know that polkit, the systemd replacement of sudo, uses JavaScript to validate permissions? This was the response: https://lists.freedesktop.org/archives/systemd-devel/2016-December/038025.html https://lists.freedesktop.org/archives/systemd-devel/2016-De... systemd is a bomb waiting to go off, IMHO.

papey 10y ago
Polkit is not linked to system so...
scrollaway 10y ago
> polkit, the systemd replacement of sudo I honestly do not understand how you can feel comfortable making judgement calls about projects when you cannot even accurately state their function.
- gravypod 10y ago
  "Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems." Calling it the sudo for UIs seems reasonable. It lets you manage the permission level of the UI you're using. Does it do something else?
  - lordlimecat 10y ago
    Youre being too generous. GP's statement was, "Did you know that polkit, the systemd replacement of sudo," He calls it a replacement of sudo which is is definitely not.
    - ioquatix 10y ago
      Uh, so, systemd don't recommend to use `sudo systemctl start blah`. Their idea is to use `systemctl start blah` and have polkit handle the authentication. Not sure what's unclear here.
      - jhasse 10y ago
        The difference is that with `sudo systemctl ...` systemctl is run as root, but with PolicyKit only parts are. And if I understand it correctly PolicyKit allows more fine grained control over permissions than sudo.
- ioquatix 10y ago
  Well, since this was the recommendation from one of the polkit contributors... I'm not exactly sure what you mean. Perhaps you can enlighten me with your wisdom.
implr 10y ago
polkit doesn't typically run on server installations, so this isn't that bad.
- bandrami 10y ago
  Er... default "minimal" install of Centos runs it.
jacobmischka 10y ago
I think your being so quick to judge anything using JavaScript as inherently bad is silly, but this link just made me realize that using sudo with systemd as I had been seems to be incorrect, so thanks for the link.
- ioquatix 10y ago
  Let's say you write some authorisation code using JavaScript. If it contains a syntax error, or a logic error your authentication is broken for your entire system. Checking the correctness of a program is usually non-trivial, but I accept some things CAN be checked (e.g. syntax). However, JavaScript, naturally is a procedural language and hence the bulk of your problems would be in your logic. In contrast, /etc/sudoers{.d} config is syntactically validated using a strict grammar so that it can be validated for correctness before being loaded and used (hence visudo). It's primarily a declarative language too which means that logic bugs aren't really possible. This means that there is a robust mechanism to detect syntax issues (and some semantic issues) before breaking your system.
  - jhasse 10y ago
    What if the program reading /etc/sudoers{.d} has a bug and crashes?
    - jacobmischka 10y ago
      Exactly, like the link says, at least it runs without permissions and is sandboxed.
    - ioquatix 10y ago
      Then.. sudo has a bug and should be fixed?
      - jhasse 10y ago
        But the same can be said about your "authorisation code using JavaScript".
crest 10y ago
Sudo and polkit are so complicated because they solve the wrong problem. The common problem is how do I execute code under a different effective user id. Instead they try to solve a much harder superset: how to securely implement a policy defining who is allowed to execute what under which effective user id in a setuid executable. There are much simpler solutions without setuid: https://skarnet.org/software/s6/s6-sudo.html https://skarnet.org/software/s6/s6-sudo.html.
- geofft 10y ago
  Polkit gets remarkably close. You can use polkit to define rules so an unprivileged user can call "systemctl restart ...", which sends an unprivileged message over D-Bus to pid 1, which checks authorization and then does the task if the requestor is authorized. Polkit just also ships with pkexec and similar things in the sudo mindset.
  - gens 10y ago
    The problem is that you have many things to configure instead of just one. That is a problem as we humans have a limited capacity for remembering things. On top of that polkit is basically javascript and xml (i think), and one can not expect everybody to understand javascript or have the patience to read/write xml. Now, in addition to groups and users (and advanced fs permissions and app/se/linux/armor), you have polkit and dbus permissions. This makes it really hard to look at something and know what it can do. For example steam, when you start it up, asks NetworkManager to bring up an internet connection. To disable that one has to write javascript. In short, it's a clusterfuck. Even if everything worked properly (that is hard with Turing complete configuration files) it is still too vague, too big of a load to administrate. I expect the fd.o/fedora peoples answer to that (when people start complaining, that is) to be a GUI, not a rewrite.
    - geofft 10y ago
      I'm not going to defend polkit's choice of JS, but I have to say it's funny to see a complaint about Turing-complete configuration files when the usual anti-systemd sentiment prefers sysvinit Turing-complete shell scripts to systemd declarative configuration files :)

papey 10y ago

Polkit is not linked to system so...

scrollaway 10y ago

> polkit, the systemd replacement of sudo I honestly do not understand how you can feel comfortable making judgement calls about projects when you cannot even accurately state their function.

gravypod 10y ago
"Polkit (formerly PolicyKit) is a component for controlling system-wide privileges in Unix-like operating systems." Calling it the sudo for UIs seems reasonable. It lets you manage the permission level of the UI you're using. Does it do something else?
- lordlimecat 10y ago
  Youre being too generous. GP's statement was, "Did you know that polkit, the systemd replacement of sudo," He calls it a replacement of sudo which is is definitely not.
  - ioquatix 10y ago
    Uh, so, systemd don't recommend to use `sudo systemctl start blah`. Their idea is to use `systemctl start blah` and have polkit handle the authentication. Not sure what's unclear here.
    - jhasse 10y ago
      The difference is that with `sudo systemctl ...` systemctl is run as root, but with PolicyKit only parts are. And if I understand it correctly PolicyKit allows more fine grained control over permissions than sudo.
ioquatix 10y ago
Well, since this was the recommendation from one of the polkit contributors... I'm not exactly sure what you mean. Perhaps you can enlighten me with your wisdom.

implr 10y ago

polkit doesn't typically run on server installations, so this isn't that bad.

bandrami 10y ago
Er... default "minimal" install of Centos runs it.

jacobmischka 10y ago

I think your being so quick to judge anything using JavaScript as inherently bad is silly, but this link just made me realize that using sudo with systemd as I had been seems to be incorrect, so thanks for the link.

ioquatix 10y ago
Let's say you write some authorisation code using JavaScript. If it contains a syntax error, or a logic error your authentication is broken for your entire system. Checking the correctness of a program is usually non-trivial, but I accept some things CAN be checked (e.g. syntax). However, JavaScript, naturally is a procedural language and hence the bulk of your problems would be in your logic. In contrast, /etc/sudoers{.d} config is syntactically validated using a strict grammar so that it can be validated for correctness before being loaded and used (hence visudo). It's primarily a declarative language too which means that logic bugs aren't really possible. This means that there is a robust mechanism to detect syntax issues (and some semantic issues) before breaking your system.
- jhasse 10y ago
  What if the program reading /etc/sudoers{.d} has a bug and crashes?
  - jacobmischka 10y ago
    Exactly, like the link says, at least it runs without permissions and is sandboxed.
  - ioquatix 10y ago
    Then.. sudo has a bug and should be fixed?
    - jhasse 10y ago
      But the same can be said about your "authorisation code using JavaScript".

crest 10y ago

Sudo and polkit are so complicated because they solve the wrong problem. The common problem is how do I execute code under a different effective user id. Instead they try to solve a much harder superset: how to securely implement a policy defining who is allowed to execute what under which effective user id in a setuid executable. There are much simpler solutions without setuid: https://skarnet.org/software/s6/s6-sudo.html https://skarnet.org/software/s6/s6-sudo.html.

geofft 10y ago
Polkit gets remarkably close. You can use polkit to define rules so an unprivileged user can call "systemctl restart ...", which sends an unprivileged message over D-Bus to pid 1, which checks authorization and then does the task if the requestor is authorized. Polkit just also ships with pkexec and similar things in the sudo mindset.
- gens 10y ago
  The problem is that you have many things to configure instead of just one. That is a problem as we humans have a limited capacity for remembering things. On top of that polkit is basically javascript and xml (i think), and one can not expect everybody to understand javascript or have the patience to read/write xml. Now, in addition to groups and users (and advanced fs permissions and app/se/linux/armor), you have polkit and dbus permissions. This makes it really hard to look at something and know what it can do. For example steam, when you start it up, asks NetworkManager to bring up an internet connection. To disable that one has to write javascript. In short, it's a clusterfuck. Even if everything worked properly (that is hard with Turing complete configuration files) it is still too vague, too big of a load to administrate. I expect the fd.o/fedora peoples answer to that (when people start complaining, that is) to be a GUI, not a rewrite.
  - geofft 10y ago
    I'm not going to defend polkit's choice of JS, but I have to say it's funny to see a complaint about Turing-complete configuration files when the usual anti-systemd sentiment prefers sysvinit Turing-complete shell scripts to systemd declarative configuration files :)