I just skimmed TFA (Pottering's rambling really don't make much
sense anyway). By "fully isolated", it sounds like machinectl breaks the audit trail that su has always supported (not being 'fully isolated' by design). Many *NIX systems are configured to prohibit root logins from anything other than the system console. And the reason that su doesn't do a 'full login' either as root or another user is to maintain the audit trail of who (which system user) is actually running what.
Lennart, this UNIX/Linus stuff appears to be way over your head. Sure, it seems neat for lots of gamers who can't be bothered with security and just want all the machine cycles for rendering FPS games. Perhaps you'd be better off playing with an XBox.
"When using the shell command without arguments (thus invoking the executed shell or command on the local host) it is similar in many ways to a su(1) session, but unlike su completely isolates the new session from the originating session, so that it shares no process or session properties, and is in a clean and well-defined state. It will be tracked in a new utmp, login, audit, security and keyring session, and will not inherit any environment variables or resource limits, among other properties." - from th
The road to ruin is always in good repair, and the travellers pay the
expense of it.
-- Josh Billings
Fully isolated? (Score:5, Interesting)
sense anyway). By "fully isolated", it sounds like machinectl breaks the audit trail that su has always supported (not being 'fully isolated' by design). Many *NIX systems are configured to prohibit root logins from anything other than the system console. And the reason that su doesn't do a 'full login' either as root or another user is to maintain the audit trail of who (which system user) is actually running what.
Lennart, this UNIX/Linus stuff appears to be way over your head. Sure, it seems neat for lots of gamers who can't be bothered with security and just want all the machine cycles for rendering FPS games. Perhaps you'd be better off playing with an XBox.
Re: (Score:2)
Re: (Score:2)
It doesnt. Hence "sudo rm /usr/bin/pkexec" is always a good idea on a newly installed system.
Re: (Score:2)
Re: (Score:2)
systemd now supports a su command functional and can create privileged sessions that are fully isolated from the original session.
Re: (Score:2)