systemd/run0
run0(1) is a privilege elevation tool. It is implemented as an alternative invocation mode of systemd-run(1). run0 provides a safer and more robust alternative to the sudo mechanism, without relying on suid binaries. It uses polkit for authentication.
Installation
run0 is installed with systemd.
Install polkit, as it is required to handle authorization.
Configuration
run0 does not have a configuration file. Configuration is done with Polkit#Actions and Polkit#Authorization rules.
Default Polkit#Administrator identities grants group wheel the addAdminRule, therefore consider to add your user to the
wheel group to authenticate as your own user.
Authentication caching
sudo-like authentication can be cached for a short period by the ExpirationSeconds setting in polkitd.conf(5) (by default 5 minutes). Unlike sudo, invoking run0 again does not reset the expiration countdown. Allowing run0 to be cached requires installing the following polkit rule:
/etc/polkit-1/rules.d/90-run0-password-caching.rules
/* Allow authentication caching for run0 */
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.systemd1.manage-units") {
return polkit.Result.AUTH_ADMIN_KEEP;
}
});
Usage
To use run0, simply prefix a command and its arguments with run0 and a space:
$ run0 cmd
For example, to use pacman:
$ run0 pacman -Syu
To launch an interactive shell (similar to sudo -i or su -l), just type run0.
With the --empower option, privileged commands are run as the current user, avoiding a full root context. This is useful to run a command with privileges but still have all created files and directories be owned by your current user.
Options for systemd-run also apply. See systemd-run(1) and run0(1).