run0edit

Minimal script that brings the essential functionality of sudoedit to the run0 world.

The Problem

The new run0 command from systemd can act as a replacement for sudo. However, it lacks a direct equivalent for the sudoedit command.

Running your text editor with full root privileges is a significant security issue.

The Solution

The sudoedit command solves this by following a secure pattern:

1. Copy the target file to a temporary location.
2. Open the temporary file in your editor as a normal user.
3. Once you close the editor, copy the modified temporary file back to its original location with root privileges.

This run0edit script mimics this secure workflow, ensuring your editor never runs as root. This documentation also provides shell functions to create a sudo command that transparently uses run0edit when you pass the -e flag.

Shell Integration

To get the full sudo -e experience, add the following function to your shell's configuration file. This will create a sudo command that acts as a smart wrapper around run0 and run0edit.

Fish Shell

Add the following to ~/.config/fish/config.fish (or create it interactively and use funcsave sudo).

function sudo
    # Check if -e or --edit exists anywhere in the argument list
    if contains -- "-e" $argv; or contains -- "--edit" $argv
        # If it does, execute run0edit with the very last argument.
        run0edit $argv[-1]
    else
        # Otherwise, just execute run0 with all the original arguments
        run0 $argv
    end
end

Bash Shell

Add the following function to the end of your ~/.bashrc file.

sudo() {
  local has_edit_flag=0
  # Check if '-e' or '--edit' is in the arguments
  for arg in "$@"; do
    if [[ "$arg" == "-e" || "$arg" == "--edit" ]]; then
      has_edit_flag=1
      break
    fi
  done

  if [[ "$has_edit_flag" -eq 1 ]]; then
    # If the flag was found, call run0edit with the last argument
    run0edit "${@: -1}"
  else
    # Otherwise, call run0 with all arguments
    command run0 "$@"
  fi
}

Zsh Shell

Add the following function to the end of your ~/.zshrc file. (The same function as Bash works perfectly).

sudo() {
  local has_edit_flag=0
  # Check if '-e' or '--edit' is in the arguments
  for arg in "$@"; do
    if [[ "$arg" == "-e" || "$arg" == "--edit" ]]; then
      has_edit_flag=1
      break
    fi
  done

  if [[ "$has_edit_flag" -eq 1 ]]; then
    # If the flag was found, call run0edit with the last argument
    run0edit "${@: -1}"
  else
    # Otherwise, call run0 with all arguments
    command run0 "$@"
  fi
}

After adding the function, restart your shell or source the file (e.g., source ~/.bashrc) for the changes to take effect.

Usage

Once installed and integrated, your new sudo command will work seamlessly.

To edit a protected file securely:

# This will use run0edit behind the scenes
sudo -e /etc/hosts

To run any other command with privilege:

# This will use run0 behind the scenes
sudo whoami
sudo systemctl restart nginx