this post was submitted on 15 Apr 2024
88 points (86.7% liked)

Linux

48186 readers
1324 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
AgreeableLandscape@lemmy.ml
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz
88
Is there a way to add "Run as Sudo" to context menu like with Windows? (lemy.lol)
submitted 7 months ago* (last edited 7 months ago) by flork@lemy.lol to c/linux@lemmy.ml
112 comments fedilink hide all child comments
 

I found a (lengthy) guide to doing this but it is for gksu which is gone. I have to imagine there's an easy way. I am running Ubuntu. There is no specific use case, it is just a feature I miss from windows.

EDIT: I always expect a degree of hostility and talking-down from the desktop Linux community, but the number of people in this thread telling me I am using my own computer that I bought with my own money in a way they don't prefer while ignoring my question is just absurd and frankly should be deeply embarrassing for all of us. I have strongly defended the desktop Linux community for decades, but this experience has left a sour taste in my mouth.

Thank you to the few of you who tried to assist without judgement or assumptions.

you are viewing a single comment's thread
view the rest of the comments
[–] bizdelnick@lemmy.ml 10 points 7 months ago (4 children)

You don't need to run any GUI programs as root.

[–] olutukko@lemmy.world 16 points 7 months ago (3 children)

Now this is actually wrong. Firewall gui for example requires root. There are similar sysadmin guis that need it too

[–] bizdelnick@lemmy.ml 8 points 7 months ago

Sysadmin GUI tools are designed to be secure by isolating GUI from privileged process. That is not true for a random GUI app.

[–] Rustmilian@lemmy.world 12 points 7 months ago (1 children)

No. It's ”you probably shouldn't run them with sudo” , many GUIs need root for certain tasks. I recommend using pkexec instead of sudo, you can add it to the .desktop file and when you launch the application it'll give you a GUI authentication prompt.

[–] bizdelnick@lemmy.ml -2 points 7 months ago (1 children)

Probably? They won't run with sudo normally (in xorg at least). And only those explicitly allowed to be run with pkexec by maintainers will do. Of course it is possible to evade this restriction, but you definitely should not.

[–] Rustmilian@lemmy.world 4 points 7 months ago* (last edited 7 months ago) (1 children)

There's plenty of GUI applications that'll run just fine with sudo. For example BleachBit.
The commonality between these applications is when they were written, what (outdated) toolkit they use, etc.
Sudo is just not made for use with GUI and can possibly lead to bad behavior. pkexec leverages PAM & Polkit and is intended for GUIs.

[–] bizdelnick@lemmy.ml -1 points 7 months ago (1 children)

It's not when app was written. Wayland apps probably work with sudo, x11 don't because sudo does not pass the $DISPLAYenvironment variable. It's a correct behavior of sudo because running x11 apps with root permission you create a security hole.

[–] Rustmilian@lemmy.world 1 points 7 months ago (1 children)

sudo -E

[–] bizdelnick@lemmy.ml 1 points 7 months ago (1 children)

I know. Don't do this. Read the manual.

[–] Rustmilian@lemmy.world 1 points 7 months ago* (last edited 7 months ago) (1 children)

Polkit was created in 2009 & PAM was created in 1995. GNU dates back to 1984, so... There's still quite a handful of programs that are likely still maintained to this day that don't properly take advantage of them or other auth systems made to be able to handle GUIs in a secure fashion. BleachBit being released in 2008, predates Polkit and afaik, bleachbit doesn't leverage polkit by default, at least not on Arch.

[–] bizdelnick@lemmy.ml 1 points 7 months ago (1 children)

Idk what is bleachbit. But I know that "auth systems" can't "handle GUIs in a secure fashion". The app itself can be secure or not. By default they are not secure if they provide a GUI running in privileged process.

[–] Rustmilian@lemmy.world -1 points 7 months ago* (last edited 7 months ago) (1 children)

gksu, kdesu, sux, & polkit. All of which are privilege elevation frameworks that can securely obtain the required privileges without running GUI applications directly as root. Granted you may need to configure PAM & Polkit's policies to make them more secure.
The problem with sudo is that it runs the entire GUI application as Root; at least by default behavior. These frameworks are the proper way.

BleachBit is a cross-platform disk space cleaner that was based on Python, PyGTK, & GTK2 and then later ported to Python 3 & GTK3. BleachBit on Linux never prompts the user for authentication for operations requiring elevated privileges, it just fails with "permission denied". Inturn you can use sudo, or the by far more recommended and safer options gksudo/gksu & pkexec. In this case, a user can 100% make the mistake of using sudo, and while it's not inherently problematic for this specific case, as we've already discussed it's still risky.

[–] bizdelnick@lemmy.ml 1 points 7 months ago (1 children)

gksu and kdesu are unsupported for >10 years iirc, they were not more secure than sudo and that's one of the reasons they were abandoned. I've never heard about sux. Polkit is a bit another thing that indeed replaced them, however it does not and can not separate GUI and non-GUI processes. The process itself has to fork, drop privileges and draw a GUI after that. There's no difference between running it via sudo or pkexec, however polkit provide additional protections to prevent running unsafe apps with elevated privileges.

PAM and GVFS are not "privilege elevation frameworks" whatever you mean by this.

[–] Rustmilian@lemmy.world 1 points 7 months ago* (last edited 7 months ago)

gksu and kdesu are unsupported for >10 years iirc

I know.

they were not more secure than sudo

No, they were, barely, but they were, they were wrappers around sudo that provided "a more user-friendly and secure way to run graphical applications with elevated privileges, by handling environment variables and permissions better than using sudo directly."
They've been deprecated in favor of pkexec.
sux is wrapper around su which transfers your X credentials, it sucks, don't use it.

There's no difference between running it via sudo or pkexec, however polkit provide additional protections to prevent running unsafe apps with elevated privileges.

pkexec literally uses Polkit and PAM under the hood.

pkexec runs the program in a "minimal known and safe environment" to avoid potential security issues like code injection through environment variables. pkexec also sets the PKEXEC_UID environment variable to the user ID of the process invoking it, providing more information about the context. pkexec is more secure than using sudo -i for running graphical applications, as it can prevent certain types of privilege escalation attacks. This increased security is largely due to the use of PolicyKit (Polkit) with pkexec. Polkit is a framework that provides a way to define and enforce fine-grained access control policies for privileged operations. With Polkit, the system administrator can define rules that determine which users or processes are allowed to perform specific privileged actions, like running a GUI application as root. This provides more granular control compared to the blanket root access granted by sudo.

PAM and GVFS are not "privilege elevation frameworks" whatever you mean by this.

You're right, PAM is an authentication framework and GVFS is a whole other thing that leverages polkit and authentication agents. My bad.

[–] flork@lemy.lol 4 points 7 months ago (1 children)

There's one in every thread.

[–] bizdelnick@lemmy.ml 2 points 7 months ago (1 children)

I have no idea what you are talking about. The answer to your question is: this is impossible and this is done for purpose. Don't try to work in linux like in windows.

[–] flork@lemy.lol 1 points 7 months ago (1 children)

I have no idea what you are talking about.

Your attitude.

[–] ursakhiin@beehaw.org 4 points 7 months ago

It's not attitude they are giving you. It's strong recommendation. It's the strong recommendation of the entire Linux community.

Sudo is different than run as admin and is not intended to be used to do things the way Windows does them.