Fortifying Ubuntu’s Root with sudo‑rs: How Rust Reinforces Privilege Escalation

1 month 1 week ago
by George Whittaker Introduction

Privilege escalation in Linux has always walked a tightrope between convenience and risk. sudo allows users to perform tasks as root without sharing the root password—intuitive, powerful—but also a high-value target for exploits rooted in memory safety bugs. Ubuntu is now pioneering a transition: replacing the traditional C-based sudo with sudo‑rs, a Rust-powered rewrite engineered for safer root handling.

Understanding sudo‑rs

Built under the Trifecta Tech Foundation’s “Privilege Boundary” initiative, sudo‑rs is a from-scratch implementation of sudo and su created in Rust, a language celebrated for its compile-time guarantees against memory mishaps. Designed to behave like the classic “sudo,” it supports user prompts, permission checks, and environment handling, but keeps underlying behavior Turing-equivalent.

Why Ubuntu Is Betting on Rust

Rust’s strict approach to memory usage eradicates whole classes of vulnerabilities—like buffer overflows and use-after-free—that have long plagued system tools. For a utility as privileged as sudo, these protections offer exponentially greater security value. Ubuntu’s strategy, dubbed “Carefully But Purposefully Oxidising Ubuntu,” is a methodical shift toward memory-safe tooling.

Transitioning in Ubuntu 25.10 and Beyond

Canonical has announced that Ubuntu 25.10 (“Questing Quokka”), scheduled for October 9, 2025, will ship sudo‑rs as the default /usr/bin/sudo. This serves as a proving ground ahead of Ubuntu 26.04 LTS (April 2026). Regular users will find no change—commands, flags, and password prompts remain familiar—while Ubuntu monitors real-world feedback.

Ensuring Compatibility

To deliver a smooth switch, Canonical is funding “Milestone 5” development in sudo‑rs to implement:

  • NOEXEC for shell escape control,

  • AppArmor integration,

  • sudoedit,

  • Support for kernels older than 5.9 (critical for Ubuntu 20.04 containers).

A “less‑is‑more” philosophy guides, meaning legacy niche features—like LDAP-based sudoers—might remain absent. But, for most workflows, sudo‑rs should cover every essential feature.

Coexistence and Rollback

Ubuntu’s old sudo will still be available in the repositories and can be reselected via the alternatives system. Users needing features not yet ported to sudo‑rs can effortlessly revert.

Go to Full Article
George Whittaker

[Stable Update] 2025-07-20 - Kernels, Mesa, Thunderbird, LibreOffice, Perl, Vulkan

1 month 2 weeks ago

Hello community, here we have another set of package updates.

Current Promotions Recent News Valkey to replace Redis in the [extra] Repository (click for more details) Previous News Finding information easier about Manjaro (click for more details) Notable Package Updates Additional Info Python 3.13 info (click for more details) Info about AUR packages (click for more details)

Get our latest daily developer images now from Github: Plasma, GNOME, XFCE. You can get the latest stable releases of Manjaro from CDN77.

Our current supported kernels
  • linux54 5.4.296
  • linux510 5.10.240
  • linux515 5.15.189
  • linux61 6.1.146
  • linux66 6.6.99
  • linux612 6.12.39
  • linux615 6.15.7
  • linux616 6.16.0-rc6
  • linux61-rt 6.1.134_rt51
  • linux66-rt 6.6.94_rt56
  • linux612-rt 6.12.28_rt10
  • linux615-rt 6.15.0_rt2

Package Changes (Sat Jul 19 08:50:01 CEST 2025)

  • stable core x86_64: 30 new and 31 removed package(s)
  • stable extra x86_64: 1878 new and 1874 removed package(s)
  • stable multilib x86_64: 22 new and 22 removed package(s)

A list of all changes can be found here.

Click to view the poll.

Check if your mirror has already synced:

70 posts - 41 participants

Read full topic

philm

[Testing Update] 2025-07-19 - Kernels, Mesa, Thunderbird, Grub, Perl, Vulkan

1 month 2 weeks ago

Hello community, here we have another set of package updates.

Current Promotions Recent News Valkey to replace Redis in the [extra] Repository (click for more details) Previous News Finding information easier about Manjaro (click for more details) Notable Package Updates Additional Info Python 3.13 info (click for more details) Info about AUR packages (click for more details)

Get our latest daily developer images now from Github: Plasma, GNOME, XFCE. You can get the latest stable releases of Manjaro from CDN77.

Our current supported kernels
  • linux54 5.4.296
  • linux510 5.10.240
  • linux515 5.15.189
  • linux61 6.1.146
  • linux66 6.6.99
  • linux612 6.12.39
  • linux615 6.15.7
  • linux616 6.16.0-rc6
  • linux61-rt 6.1.134_rt51
  • linux66-rt 6.6.94_rt56
  • linux612-rt 6.12.28_rt10
  • linux615-rt 6.15.0_rt2

Package Changes (Sat Jul 19 08:50:01 CEST 2025)

  • testing core x86_64: 15 new and 15 removed package(s)
  • testing extra x86_64: 1752 new and 1744 removed package(s)
  • testing multilib x86_64: 22 new and 22 removed package(s)

Overlay Changes

  • testing core x86_64: 19 new and 20 removed package(s)
  • testing extra x86_64: 124 new and 126 removed package(s)

A list of all changes can be found here.

Click to view the poll.

Check if your mirror has already synced:

21 posts - 12 participants

Read full topic

philm

Charting a path forward for global collaboration in open source AI: Key takeaways from the GOSIM open source AI strategy forum

1 month 2 weeks ago

The open source AI ecosystem has reached a pivotal moment. There are now almost 2 million models on the Hugging Face Hub and open models, including a growing number of small but mighty ones, are rapidly catching up to proprietary alternatives in performance. Beyond models, researchers and developers across the world are collectively democratizing AI by sharing and collaboratively developing a range of open technologies, from open source frameworks and open standards for building AI agents and robots to open pretraining datasets and benchmarks for specialized domains and underrepresented languages.

Cailean Osborne

[Stable Update] 2025-07-18 - Kernels, UMU, KDE Frameworks, NetworkManager

1 month 2 weeks ago

Hello community, here we have another set of package updates.

Current Promotions Recent News Valkey to replace Redis in the [extra] Repository (click for more details) Previous News Finding information easier about Manjaro (click for more details) Notable Package Updates Additional Info Python 3.13 info (click for more details) Info about AUR packages (click for more details)

Get our latest daily developer images now from Github: Plasma, GNOME, XFCE. You can get the latest stable releases of Manjaro from CDN77.

Our current supported kernels
  • linux54 5.4.295
  • linux510 5.10.239
  • linux515 5.15.188
  • linux61 6.1.145
  • linux66 6.6.98
  • linux612 6.12.38
  • linux615 6.15.6
  • linux616 6.16.0-rc5
  • linux61-rt 6.1.134_rt51
  • linux66-rt 6.6.94_rt56
  • linux612-rt 6.12.28_rt10
  • linux615-rt 6.15.0_rt2

Package Changes (Tue Jul 15 09:23:53 CEST 2025)

  • stable core x86_64: 16 new and 16 removed package(s)
  • stable extra x86_64: 1107 new and 1103 removed package(s)
  • stable multilib x86_64: 4 new and 4 removed package(s)

A list of all changes can be found here.

Click to view the poll.

Check if your mirror has already synced:

30 posts - 17 participants

Read full topic

philm

Unplugged and Unstoppable: How Linux Transforms Laptop Power Management

1 month 2 weeks ago
by George Whittaker Driving Forces Behind Smarter Battery Use

In an era when remote work, video conferencing, and travel-heavy lifestyles are the norm, users expect laptops to last longer unplugged. Meanwhile, growing awareness of sustainability adds pressure to maximize energy efficiency. Recognizing this mantra, Linux developers have overhauled power-handling strategies, from the kernel core to user-space tools, to meet these expectations in 2025.

Core Kernel Enhancements: Harnessing Modern Power Tech Kernel 6.x’s Focus on Power Efficiency
  • Linux 6.8 introduced refined support for newer hardware, including better CPU/GPU idle-state transitions and energy-friendly firmware interfaces.

  • Linux 6.15, released in May 2025, continues this trend by adding improved power-capping, more regulators, voltage handlers, and enhanced support for ARM, RISC-V, and Intel/AMD CPU power modules.

These enhancements enable finer-grained control over sleep states, clock gating, and dynamic walling-off of unused chip domains, all pivotal for squeezing extra runtime.

MCU-Firmware Communication with FWCTL

A new firmware controller (fwctl) infrastructure within 6.15 gives user-space tools secure communication channels with embedded controller features, making tasks like adjusting battery charge thresholds more accessible and scriptable.

Advanced CPU & GPU Power Strategies Smarter Frequency Governors

Both intel_pstate and amd_pstate drivers continue evolving. Passive and conservative CPU governors now dynamically adapt based on workload profiles, delivering noticeable battery gains with minimal performance loss.

Low-Power On-Battery GPU Modes

Graphics subsystems are smarter about sleep:

  • Intel's Arc and DG2 families now feature improved idle ramp-down behaviors for better battery performance.

  • For AMD users, the transition from generic AMDGPU RADEON_POWER_PROFILE settings to fwctl-control offers more granular DPM tuning on laptops, especially under battery constraints.

Deep Sleep States and ACPI Evolution

The adoption of ACPI 6.6 and expanded kernel support for S0ix and modern-sleep states allow laptops to hang out in ultra-low-power standby, extending idle time battery life. Suspend-to-disk and resume logic also got less noisy, reducing spur-of-the-moment wake-ups that were draining battery life for many users.

Go to Full Article
George Whittaker