run0edit

run0edit is to run0 what sudoedit is to sudo (in its most basic usage).

run0edit allows a permitted user to edit a file as root. Authorization uses the same mechanism as run0, which typically takes the form of a password prompt. The file (if it already exists) is copied to a temporary location and opened in an unprivileged editor; if modified, the edited file contents are copied back to the original location when the editor is closed.

If the editor exits with an abnormal status code or copying the data back to the original location fails, then the temporary file will be left in the /tmp directory. The name of the temporary file is derived from the name of the original file, with a randomly generated suffix to avoid conflicts with existing files.

The choice of editor can be customized by writing the absolute path to a text editor (for example, /usr/bin/vim) to the file /etc/run0edit/editor.conf, or using the --editor command-line option. If this path does not point to an executable file, run0edit will default to using nano or vi.

Note: Editors that make use of JIT compilation (such as Neovim built with LuaJIT) might not work: as a security measure, run0edit makes use of systemd sandboxing settings, including MemoryDenyWriteExecute, which prevents code generated dynamically at runtime from being executed.

run0edit can also be used to edit files that have the immutable attribute set. In this case, the user will be informed of the presence of the immutable attribute and asked whether they wish to continue editing; if so, the immutable attribute will be removed before the edited file contents are copied back to the original location and then reapplied afterward. This introduces a brief window during which another user could also edit the file (if they were permitted to do so if it were not for the immutable attribute), so to protect against this, the file is compared with the edited temporary file after the immutable attribute is reapplied, and run0edit gives an error message if the file contents do not match.

Installation

For installation via system package manager, .deb and .rpm packages can be downloaded from the latest release. For automatic updates on Fedora-based distros, the package is also available in a Copr repository.

Manual installation:

git clone https://github.com/HastD/run0edit
cd run0edit
run0 mkdir -p /usr/libexec/run0edit
run0 install -m 755 run0edit_main.py /usr/bin/run0edit
run0 install -m 644 run0edit_inner.py /usr/libexec/run0edit/

Note: run0edit requires systemd version 256 or newer.

Usage

run0edit [--editor EDITOR] [--background COLOR] FILE
run0edit [--help | -h]
run0edit [--version | -v]

(There is also a --debug option meant for debugging purposes; it causes the program to exit with a stack trace in various error states instead of printing a more user-friendly error message.)