4 ms·

Accepting something as cryptographicly significant as a rng seed as a command line argument makes my security whiskers bristle. Especially since the ultimate d

Accepting something as cryptographicly significant as a rng seed as a command line argument makes my security whiskers bristle. Especially since the ultimate destination for that value is a root owned 600 perm file.

ktRolster 10y ago
It doesn't do that, the gp post misread the source code. It reads the data from a file defined at compile time.
- majewsky 10y ago
  As can be checked easily with `systemctl cat`: $ systemctl cat systemd-random-seed # /usr/lib/systemd/system/systemd-random-seed.service [...] ExecStart=/usr/lib/systemd/systemd-random-seed load ExecStop=/usr/lib/systemd/systemd-random-seed save [...] Note how the executable is not even installed to /usr/bin, because it's explicitly not supposed to be called by a user.
- kbenson 10y ago
  Yes, I skimmed the file far too quickly. I was working off some assumptions from the portion I saw that errored if argc != 2, with an error along the lines of "There must be only one argument".
  - ktRolster 10y ago
    That's fine. Now try to do a retrospective to figure out how the mistake was made, so it doesn't happen again
    - kbenson 10y ago
      > Now try to do a retrospective to figure out how the mistake was made, so it doesn't happen again What? It doesn't affect my point in any way. I looked at multiple other man pages for services before posting, and noted that of the ones I checked, they all listed options for the service and/or command. I stand by other other portion of my comment (whether you interpreted them as I meant, or in some more negative light that might induce the negativity I feel from this reply). I noted my reasoning on why I didn't find your example entirely compelling, but also noted that there could well be other examples that fit the criteria of what I considered more problematic. I still believe the man pages are lacking quite a bit with respect to OpenBSD equivalents.

ktRolster 10y ago

It doesn't do that, the gp post misread the source code. It reads the data from a file defined at compile time.

majewsky 10y ago
As can be checked easily with `systemctl cat`: $ systemctl cat systemd-random-seed # /usr/lib/systemd/system/systemd-random-seed.service [...] ExecStart=/usr/lib/systemd/systemd-random-seed load ExecStop=/usr/lib/systemd/systemd-random-seed save [...] Note how the executable is not even installed to /usr/bin, because it's explicitly not supposed to be called by a user.
kbenson 10y ago
Yes, I skimmed the file far too quickly. I was working off some assumptions from the portion I saw that errored if argc != 2, with an error along the lines of "There must be only one argument".
- ktRolster 10y ago
  That's fine. Now try to do a retrospective to figure out how the mistake was made, so it doesn't happen again
  - kbenson 10y ago
    > Now try to do a retrospective to figure out how the mistake was made, so it doesn't happen again What? It doesn't affect my point in any way. I looked at multiple other man pages for services before posting, and noted that of the ones I checked, they all listed options for the service and/or command. I stand by other other portion of my comment (whether you interpreted them as I meant, or in some more negative light that might induce the negativity I feel from this reply). I noted my reasoning on why I didn't find your example entirely compelling, but also noted that there could well be other examples that fit the criteria of what I considered more problematic. I still believe the man pages are lacking quite a bit with respect to OpenBSD equivalents.