Support for alternative privilege escalation binaries
Description:
With the release of systemd version 256, we now have a 3rd privilege escalation binary in the Linux community (sudo, doas, and run0 [of course that's already in addition to the standard pkexec from polkit]). The base-devel has a hard dependency on sudo however. Therefore, using the other options available is kind of pointless. This is especially true run0, as the main selling point for run0 is that unlike sudo and doas, it is not a SUID binary. In an ideal world, it would be possible to uncouple sudo from the base-devel package, but I suspect it's there for good reason (namely, you can't install most things without it). Perhaps an alternative would be to create a requirement that systemd >= 256, opendoas, pkexec, selinux-sudo, or sudo could satisfy (i.e. privilege-escalation-binary).
In the meantime, I would be willing to maintain an alternative AUR package that can work for run0 in the form of base-devel-run0 (much akin to the current base-devel-selinux).
Additional info:
- Manpage (
run0): https://man.archlinux.org/man/run0.1.en - Upstream (
doas): https://github.com/Duncaen/OpenDoas
Proposed PKGBUILD (base-devel-run0):
# Substitution for Arch Linux's base-devel group as a meta package for systemd-run
# https://www.archlinux.org/groups/x86_64/base-devel/
# https://wiki.archlinux.org/title/List_of_applications/Security#Privilege_elevation
# Maintainer: Seth Murphy (https://github.com/eagerestwolf)
pkgname=base-devel-run0
pkgver=1
pkgrel=1
pkgdesc='Meta package that substitutes sudo for systemd-run in base-devel'
arch=('any')
url='https://gitlab.archlinux.org/archlinux/packaging/packages/base-devel'
license=('GPL')
depends=(
archlinux-keyring
autoconf
automake
binutils
bison
debugedit
fakeroot
file
findutils
flex
gawk
gcc
gettext
grep
groff
gzip
libtool
m4
make
pacman
patch
pkgconf
sed
#sudo
texinfo
which
# polkit and systemd instead of sudo
polkit
'systemd>=256'
)
optdepends=(
'lxqt-policykit: authentication agent for LXQt'
'lxsession: authentication agent for LXDE'
'lxsession-gtk3: autentication agent for LXDE GTK3'
'mate-polkit: authentication agent for Mate'
'polkit-efl-git: authentication agent for Enlightenment'
'polkit-gnome: authentication agent for GNOME'
'polkit-kde-agent: authentication agent for KDE'
'xfce-polkit: alternative authentication agent for XFCE'
'xfce-polkit-git: alternative authentication agent for XFCE'
)
conflicts=('base-devel' 'base-devel-selinux')