6 ms·

Good news! run0 will use polkit[1], which uses JavaScript for its rules[2], so there's no limit to how complex your rules can get! On the other hand, maybe add

by agwa 2y ago

Good news! run0 will use polkit[1], which uses JavaScript for its rules[2], so there's no limit to how complex your rules can get! On the other hand, maybe adding a JavaScript interpreter to Linux's trusted computing base isn't good news... [1] https://mastodon.social/@pid_eins/112353420303876549 https://mastodon.social/@pid_eins/112353420303876549 [2] https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html https://www.freedesktop.org/software/polkit/docs/latest/polk...

akira2501 2y ago
If the lesson of xz was "reduce supply chain attack surface" then the freedesktop people clearly haven't received it yet.
- bmicraft 2y ago
  Fedora has used PolKit for 12 years now, and the javascript rules have probably been a thing for about as long.
  - akira2501 2y ago
    Doctors recommended cigarettes for decades. What should give everyone similar pause is xz was found unintentionally.
rcxdude 2y ago
It's a heck if a lot better than a random smattering of shared libraries getting pulled into a random high-priviledge context which also inherits some other context from whoever is asking for authentication. Polkit gets a lot of flack but PAM is absolutely mad.