Adopting sudo-rs By Default in Ubuntu 25.10
discourse.ubuntu.com
Introduction Following on from Carefully But Purposefully Oxidising Ubuntu, Ubuntu will be the first major Linux distribution to adopt sudo-rs as the default implementation of sudo, in partnership with the Trifecta Tech Foundation The change will be effective from the release of Ubuntu 25.10. You can see the Trifecta Tech Foundation’s announcement here. What is sudo-rs? sudo-rs is a reimplementation of the traditional sudo tool, written in Rust. It’s being developed by the Trifecta Tech Founda...
  • kixik@lemmy.ml
    0·
    2 months ago

    A way smaller alternative therefore less prompt to vulnerabilities is OpenDoas found on Arch/Artix/… and other distros. From the GH project:

    doas is a minimal replacement for the venerable sudo. It was initially written by Ted Unangst of the OpenBSD project to provide 95% of the features of sudo with a fraction of the codebase.

    • MTK@lemmy.world
      0·
      2 months ago

      Tried it but it is not a 100% compatible as sudo replacment as it lacks some of the args. This means that some programs fail as they attempt to use incorrect args.

      • kixik@lemmy.ml
        1·
        2 months ago

        I’m curious about which programs if you can share. I write few bash scripts which used to call sudo, and I replace sudo with doas in those. And in case of muscular memory I also added a bash alias so that if by mistake calling sudo in reality I’d be calling doas. So far no issues. O course I don’t use fancy args, and what I really needed from sudo I used to include it in /etc/sudoers and now on /etc/doas.conf, and I believe I couldn’t include a couple of options but they were not critical since I’ve lived without them so far. And it’s weird to find actual software that requires sudo, perhaps proprietary software. One can actually live without sudo and without doas, as long as there’s still su.

        Not judging, rather curious, actually I’ve met several guys who write scripts which would benefit from using sudo/doas, but they claim better call the scripts through sudo/doas rather than adding them as dependencies.

        • MTK@lemmy.world
          1·
          2 months ago

          I don’t remember what it was exactly, I encountered two times where doas failed as a sudo replacement. After that I went back to sudo

    • FooBarrington@lemmy.world
      0·
      2 months ago

      sudo-rs doesn’t have anything to do with run0. Please take your pills grandpa, we’re worried about you.

      Edit: in case you’re actually an older person, the latter part wasn’t meant as a swipe (just saw your pfp). In that case, sorry!

        • FooBarrington@lemmy.world
          0·
          2 months ago

          What? No I’m not. Using a memory-safe implementation of sudo doesn’t take any power away from the user, how does that make sense?

          • nanook@friendica.eskimo.combanned_from_community_badge
            0·
            2 months ago

            @FooBarrington You didn’t just specify memory safe, you advocated stripping away a number of features. Yes memory safe anything is a good idea and I’ve got no objection to the use of rust, I think it’s a good language, one of the few worthwhile efforts to emerge in recent years, but if it is going go be re-implemented, do so fully. Yes, anything that runs with privileges should be memory safe else it’s open to attack and Rust certainly makes that more possible, I am just concerned about the limiting feature set aspect. I’m not in favor of protecting users from themselves, I don’t want a car that is capable of reading speed limit signs and prevents me from exceeding them even if doing so might be unsafe or illegal, that not the car manufacturers job to be come an arm of the government, likewise I don’t want Linux protecting me from myself, I already address potentials with regular backups, etc.

    • Ephera@lemmy.mlEnglish
      0·
      2 months ago

      Seems like it’s Apache-2.0, but original sudo is under ISC license, which is more permissive as far as I’m aware. Although Apache-2.0 is very much still considered “permissive”, too.