RFC: elevate command

[AdrianVovk]

Component

other

Is your feature request related to a problem? Please describe

Elevating privileges in Linux currently requires setuid. These tools thus need to be careful to distrust their input (where any bug == root access on system), isolate their environments, etc etc etc

Describe the solution you'd like

systemd introduces a new tool, elevate, that's basically behaves like systemd-run w/ a more palatable CLI. This lets this elevate tool be unprivileged, and it just asks a privileged client (systemd) to take some action for it.

Describe alternatives you've considered

Discussed w/ @poettering @ ASG, and this is basically what we converged on

Name-wise: most things are named *ctl or systemd-*. This would break with the form. The name might be worth it, though 👀

The systemd version you checked that didn't have the feature you are asking for

254

[poettering]

Yeah, I think this would make sense to add as a multi-call thingy. Probably on systemd-run. (but could also be on machinectl shell).

Should probably follow syntax of sudo a bit, i.e. support -u, -s, -i, and it should some recognizable env vars about the logic being used, similar to how SUDO does it.

[Winterhuman]

Firstly, this sounds amazing! Not needing setuid is a huge advantage.

But second, how would allow-listing users work? Is it still based on a user's membership to the wheel/sudo group, or different authentication entirely?

[poettering]

We'd defer that to PK, i.e. similar to pkexec in that sense. And I#d assume the default policy we install would bind this to "wheel".

[pothos]

FYI, I played with this 2 years ago: https://gist.github.com/pothos/73dd4f7694acc3b6bbed614438f6e2b1 (Note the "known issue" which you might run into as well)

That said, Polkit still uses a setuid binary polkit-agent-helper-1 which gets spawned by systemd-run in the end. I wonder if that could be replaced with some IPC first to make Polkit non-setuid.

[poettering]

polkit-agent-helper-1

Hmm, how is that actually used? Is that something actually forked off client side? or is this something forked off by polkitd to be able to verify passwords?

I can't find a clear explanation what it actually does and how it is used.

[YHNdnzj]

I can't find a clear explanation what it actually does and how it is used.

The polkit agent prompts for password and passes it to polkit-agent-helper-1, the latter of which does pam authentication and returns the result through https://www.freedesktop.org/software/polkit/docs/latest/PolkitAuthority.html#polkit-authority-authentication-agent-response (privileged dbus method)

See also: https://gitlab.freedesktop.org/polkit/polkit/-/issues/168