42
Microsoft: Introducing Sudo for Windows! (devblogs.microsoft.com)
submitted 2 years ago* (last edited 2 years ago) by to c/technology@beehaw.org
27 comments fedilink hide all child comments
 

Shipped in Windows 11 Insider Preview Build 26052. https://www.tiraniddo.dev/2024/02/sudo-on-windows-quick-rundown.html claims it has a big security problem that makes the program accept calls to elevate from anywhere once first run

Edit:

  1. The security problem has been internally fixed and will be available in the next release
  2. It's not just an alias for 'runas'. It seems to be able to configurably block user input for sudo'd commands, retain the existing environment, ditch it and open a new window, and remember that you've sudo'd in the last minute or so.
  3. It brings up UAC instead of having you input the password

all 28 comments

sorted by: hot top controversial new old
[–] 22 points 2 years ago (5 children)

I was Googling like mad just this week on how to execute a cmdlet as Admin from within a script that isn't running with elevated privileges. The results all basically came back with some variation of "just run the script as Admin".

This is the right way to do it. I'm glad it's coming.

  • permalink
  • fedilink
  • source
  • hideshow 10 child comments
    •
  • [–] 12 points 2 years ago* (last edited 2 years ago) (2 children)

    The OpenBSD devs published a mail about it. The irony here is how Microsoft would behave if anybody else copied their concepts, including the name. The treatment is never symmetric or reciprocal.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 12 points 2 years ago (1 child)

    I mean licensing comes in here. The FOSS licenses allow this. Microsoft EULA and copyright almost certainly does not. But yes, I get the sentiment.

    It's almost as if all of the FAANG/Magnificent 7 market outperformance the past 15 years was built on the backs of the free labor provided by the FOSS movement. But then they will turn around and claim that non-western companies steal IP, etc and have US intervene to ban competition, or sue in courts. Kind of funny.

    Back to the tech discussion, I've been using doas for a few years now instead of sudo. Even on my GNU/Linux machines. It's a lot simpler to setup for desktop workflow machines.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 2 years ago

    free labor provided by the FOSS movement

    Check out the contributors to Linux, how many of them work for free vs. how many work on behalf of companies.

    There is this pervasive myth that FOSS gets developed by lone wolves working in their spare time, when in reality most of the projects that get any traction, have a financing model behind them.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 6 points 2 years ago (1 child)

    start-process -verb runas

    https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-process

    Not the same as sudo, but mostly equivalent for single cmdlets or scripts.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 years ago

    That's where I started, of course - but you can't combine -verb with -credential. It's a silly limitation that seems to make sense to Microsoft. What you can do is configure a savecred which you can call with RunAs, but you then need to update that saved credential every time the password changes.

    I do have a $Credential object that has been pulled out of the password safe that has elevation permissions, but can't seem to apply it non-interactively or without being in an elevated session. This appears to be by design. Not that I intended my comment to turn into a support question. 😀

  • permalink
  • fedilink
  • source
  • parent
  • [–] [S] 3 points 2 years ago (1 child)

    google gsudo

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago (1 child)

    I like it! I think I'll tinker with this on my workstation, potentially even my dev environment. It isn't suitable for my present issue though, as gsudo is not in the SOE. Also, from that little demo thingy, it appears to pop up a UAC prompt the first time it executes. I need to be non-interactive.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 16 points 2 years ago (1 child)

    I would say "hey that's just copying" but Microsoft is legally incapable of being wrong, or noticing irony so I'll leave it be

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 17 points 2 years ago (2 children)

    If I'm understanding this correctly, it's not even copying. It's apparently just a wrapper for the built-in runas command that's been there since Windows 2000.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 9 points 2 years ago (2 children)

    @OmnipotentEntity @Pilgrim it's actually not just a wrapper for runas. There's a lot of other plumbing here to get the console handle you're actually using plumbed to the target application. That's the magic that lets you actually interact with the elevated process in the same terminal.

    With runas, the target application is just stuck in a separate console window (gross)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 4 points 2 years ago (1 child)

    So please forgive me if this is a rather naive question. I haven't seriously used Windows in nearly 15 years.

    I seem to recall runas being a lot like su, in that you enter the target user's credentials, rather than your own as in sudo. This works because sudo is a setuid executable, and reads from configuration to find out what you're allowed to do as the switched user.

    Is the behavior of windows sudo like unix su or unix sudo with regard to the credentials you enter? Can you limit the user to only certain commands?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 2 years ago (2 children)

    Exactly. Windows already has this functionality with runas and this implantation doesn't improve on it at all.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
    • [–] 10 points 2 years ago

    Sudo on windows...

  • permalink
  • fedilink
  • source
    •
    [–] 2 points 2 years ago

    I've been using Sudo for years.

    • install scoop
    • scoop install sudo
  • permalink
  • fedilink
  • source
    •
    [–] 1 point 2 years ago*

    This would be real nice if this let you easly run commands as SYSTEM or TrustedInstaller from a script, not just as Admin. Not only can Admin be reached from the "Run as Admininstrator" menu option, is actualy quite limited for messing around with system files. For the most part, Admin lets you mess with system settings/registry, and user files, but not with a lot if system/application files without TAKEOWNing everything.

  • permalink
  • fedilink
  • source
    •
    [–] 1 point 2 years ago

    sudo format /q c: && apt install debian

    Nice!

  • permalink
  • fedilink
  • source
    •