5 ms·

Was systemd ever properly audited? That's exactly why i use devuan as my home server.

by lousken 8y ago

tinus_hn 8y ago
Was init?
- insertcredit 8y ago
  The complexity of Sysvinit is orders of magnitude less than that of systemd.
  - dijit 8y ago
    The "sysvinit" binary package has had a total of 2 bug reports tagged "security" filed in Debian's bug tracker. That's over the entire history of the package that goes back to at least 2004. If I extend the search to all packages built from the "sysvinit" source (which includes packages like initscripts and sysvinit-utils), the count increases to 8. (source: https://www.debian.org/Bugs https://www.debian.org/Bugs. I'm not linking to exact queries since they take quite some time and HN has a tendency of taking down Debian's bug tracker)
    - nailer 8y ago
      Also crond, atd, and various log manipulation tools that systemd replaces.
      - zzzcpan 8y ago
        It doesn't replace them, it just doesn't use them.
        dijit 8y ago
        It supplants them with the same functionality. That's literally the definition of replacement.
        nailer 8y ago
        Indeed. Not complaining - I don't care for HN karma - but it is very odd that an easily searchable fact is being downvoted on a technical forum.
        yarrel 8y ago
        It provides inferior code and interfaces that are used instead of them. So you're correct, in a way.
  - tinus_hn 8y ago
    Then it should be easy to audit!
  - lima 8y ago
    Not if you count in the god-awful shell scripts full of race conditions which it replaced.
- lousken 8y ago
  No, but it's far less complex than systemd to the point where you can audit the code yourself and it's battle tested over the years. Also because it's so simple it was shown to us at the university so we've got essential understanding of how it works and I think they're still explaining it instead of systemd.
  - josteink 8y ago
    But systemd is more than just init. It replaces for instance daemontools, restartd or monit. Are you saying you can trivially audit those?
    - lousken 8y ago
      Does it fully replace monit? Could you link me more info? From what I could find I didn't see anything like free disk space warnings, web interface etc.
      - josteink 8y ago
        > Does it fully replace monit? Not fully, no but as far as I can tell, it has overlapping responsibilities. My main thought when mentioning it, was automatic restart of services in the case of failure.
    - maemilius 8y ago
      That's a fair point. However, the parent was responding to whether init - in particular - had been audited. So, bringing up other, larger projects that systemd subsumes is a bit disingenuous, imo.
TheDong 8y ago
Did you pay for an audit of sysvinit and every bash rc script it runs? I can't think of a single init system which has been audited.
- lousken 8y ago
  No I didn't but I can read bash so I can audit that myself and in fact over the years I did read most of those scripts. Also it's just a few lines of code compared to systemd so even one person can do it.
  - joelthelion 8y ago
    > I can read bash Lol. I'm sure you're the only person on earth who can think of all the corner conditions when reading a bash script. Auditing a shell script for security is near impossible to do.
    - lousken 8y ago
      I never said that, at the end of the day it's the same thing with audits, you can have 50 people auditing systemd and they won't find every single mistake either. What I'm saying is that simplicity limits room for mistakes and it gives more people chance to look at it and play with it. The concept is fairly straightforward.
  - josteink 8y ago
    > but I can read bash And all the source code for bash and all the other tools the init-scripts invokes?
  - zbentley 8y ago
    > I can read bash And I can read systemd unit files. That doesn't tell me anything about the security of the system in charge of running them. https://www.cvedetails.com/product/21050/GNU-Bash.html?vendor_id=72 https://www.cvedetails.com/product/21050/GNU-Bash.html?vendo...
josteink 8y ago
As if Devian has had more security reviews than systemd?
- insertcredit 8y ago
  Devuan is a Linux distribution that does not ship systemd by default. You are comparing apples and oranges.
  - josteink 8y ago
    Not really. systemd replaces several components you would typically find as core components (multiple packages) which everything in a distro is built and depend upon, init-scripts being no exception. Or at least it does if you present the criticism that systemd is too big. Make up your mind: either systemd is not such a big monolith or it does in fact make sense to compare it to a minimal Linux distro. You can’t have it both ways.
    - justinclift 8y ago
      Now you're comparing fruit salad with apples. :)
    - syn0byte 8y ago
      1) Devuan isn't a "minimal linux distro" Its a complete fork of Debian. Co-founded by Ian Murdock, Debian's original creator, after the systemD coup. 2) Every "core component" in any system, "minimal" or otherwise, will indeed have had more security review than the systemd code base. 3) Pid 1 - Sponsored by NSA and DoD vis a vis Redhat defense contracts.
vesinisa 8y ago
Despite being a security critical component, systemd doesn't even seem to have a proper security announcement release process. For example, there was a remote code execution vuln discovered in their DHCP client in October (CVE-2018-15688).[1] The issue was fixed with a GitHub PR that failed to mention that the changes fix a remote exec vulnerability: https://github.com/systemd/systemd/pull/10518 https://github.com/systemd/systemd/pull/10518 They also have a rather informal release process. Their "release notes" are just a very long NEWS file[2] in the git repo, with notes of trivial and critical changes mishmashed together. And for some reason, to this date there is not a mention of the DHCP remote exec vuln fixed in the latest release. I must say I don't feel too good about this project's attitude towards security. Compare this to e.g. Apache. [1] https://www.theregister.co.uk/2018/10/26/systemd_dhcpv6_rce/ https://www.theregister.co.uk/2018/10/26/systemd_dhcpv6_rce/ [2] https://github.com/systemd/systemd/blob/master/NEWS https://github.com/systemd/systemd/blob/master/NEWS
- dalai 8y ago
  That was not the first time either: https://github.com/systemd/systemd/issues/5144 https://github.com/systemd/systemd/issues/5144
  - dijit 8y ago
    Or relying on other people to report the issues so that people patch. https://www.openwall.com/lists/oss-security/2017/01/24/4 https://www.openwall.com/lists/oss-security/2017/01/24/4
  - the_duke 8y ago
    The tone of discussion there indeed suggests a very lax / "meh" attitude towards vulnerabilities.
- lima 8y ago
  systemd is a low-level building piece for distributions - the distros are doing end-user changelogs and security notices. The target audience for their NEWS file are upstream maintainers, not users.
- 8y ago

Was systemd ever properly audited? That's exactly why i use devuan as my home server.

tinus_hn 8y ago

Was init?

insertcredit 8y ago
The complexity of Sysvinit is orders of magnitude less than that of systemd.
- dijit 8y ago
  The "sysvinit" binary package has had a total of 2 bug reports tagged "security" filed in Debian's bug tracker. That's over the entire history of the package that goes back to at least 2004. If I extend the search to all packages built from the "sysvinit" source (which includes packages like initscripts and sysvinit-utils), the count increases to 8. (source: https://www.debian.org/Bugs https://www.debian.org/Bugs. I'm not linking to exact queries since they take quite some time and HN has a tendency of taking down Debian's bug tracker)
  - nailer 8y ago
    Also crond, atd, and various log manipulation tools that systemd replaces.
    - zzzcpan 8y ago
      It doesn't replace them, it just doesn't use them.
      - dijit 8y ago
        It supplants them with the same functionality. That's literally the definition of replacement.
        nailer 8y ago
        Indeed. Not complaining - I don't care for HN karma - but it is very odd that an easily searchable fact is being downvoted on a technical forum.
      - yarrel 8y ago
        It provides inferior code and interfaces that are used instead of them. So you're correct, in a way.
- tinus_hn 8y ago
  Then it should be easy to audit!
- lima 8y ago
  Not if you count in the god-awful shell scripts full of race conditions which it replaced.
lousken 8y ago
No, but it's far less complex than systemd to the point where you can audit the code yourself and it's battle tested over the years. Also because it's so simple it was shown to us at the university so we've got essential understanding of how it works and I think they're still explaining it instead of systemd.
- josteink 8y ago
  But systemd is more than just init. It replaces for instance daemontools, restartd or monit. Are you saying you can trivially audit those?
  - lousken 8y ago
    Does it fully replace monit? Could you link me more info? From what I could find I didn't see anything like free disk space warnings, web interface etc.
    - josteink 8y ago
      > Does it fully replace monit? Not fully, no but as far as I can tell, it has overlapping responsibilities. My main thought when mentioning it, was automatic restart of services in the case of failure.
  - maemilius 8y ago
    That's a fair point. However, the parent was responding to whether init - in particular - had been audited. So, bringing up other, larger projects that systemd subsumes is a bit disingenuous, imo.

TheDong 8y ago

Did you pay for an audit of sysvinit and every bash rc script it runs? I can't think of a single init system which has been audited.

lousken 8y ago
No I didn't but I can read bash so I can audit that myself and in fact over the years I did read most of those scripts. Also it's just a few lines of code compared to systemd so even one person can do it.
- joelthelion 8y ago
  > I can read bash Lol. I'm sure you're the only person on earth who can think of all the corner conditions when reading a bash script. Auditing a shell script for security is near impossible to do.
  - lousken 8y ago
    I never said that, at the end of the day it's the same thing with audits, you can have 50 people auditing systemd and they won't find every single mistake either. What I'm saying is that simplicity limits room for mistakes and it gives more people chance to look at it and play with it. The concept is fairly straightforward.
- josteink 8y ago
  > but I can read bash And all the source code for bash and all the other tools the init-scripts invokes?
- zbentley 8y ago
  > I can read bash And I can read systemd unit files. That doesn't tell me anything about the security of the system in charge of running them. https://www.cvedetails.com/product/21050/GNU-Bash.html?vendor_id=72 https://www.cvedetails.com/product/21050/GNU-Bash.html?vendo...

josteink 8y ago

As if Devian has had more security reviews than systemd?

insertcredit 8y ago
Devuan is a Linux distribution that does not ship systemd by default. You are comparing apples and oranges.
- josteink 8y ago
  Not really. systemd replaces several components you would typically find as core components (multiple packages) which everything in a distro is built and depend upon, init-scripts being no exception. Or at least it does if you present the criticism that systemd is too big. Make up your mind: either systemd is not such a big monolith or it does in fact make sense to compare it to a minimal Linux distro. You can’t have it both ways.
  - justinclift 8y ago
    Now you're comparing fruit salad with apples. :)
  - syn0byte 8y ago
    1) Devuan isn't a "minimal linux distro" Its a complete fork of Debian. Co-founded by Ian Murdock, Debian's original creator, after the systemD coup. 2) Every "core component" in any system, "minimal" or otherwise, will indeed have had more security review than the systemd code base. 3) Pid 1 - Sponsored by NSA and DoD vis a vis Redhat defense contracts.

vesinisa 8y ago

Despite being a security critical component, systemd doesn't even seem to have a proper security announcement release process. For example, there was a remote code execution vuln discovered in their DHCP client in October (CVE-2018-15688).[1] The issue was fixed with a GitHub PR that failed to mention that the changes fix a remote exec vulnerability: https://github.com/systemd/systemd/pull/10518 https://github.com/systemd/systemd/pull/10518 They also have a rather informal release process. Their "release notes" are just a very long NEWS file[2] in the git repo, with notes of trivial and critical changes mishmashed together. And for some reason, to this date there is not a mention of the DHCP remote exec vuln fixed in the latest release. I must say I don't feel too good about this project's attitude towards security. Compare this to e.g. Apache. [1] https://www.theregister.co.uk/2018/10/26/systemd_dhcpv6_rce/ https://www.theregister.co.uk/2018/10/26/systemd_dhcpv6_rce/ [2] https://github.com/systemd/systemd/blob/master/NEWS https://github.com/systemd/systemd/blob/master/NEWS

dalai 8y ago
That was not the first time either: https://github.com/systemd/systemd/issues/5144 https://github.com/systemd/systemd/issues/5144
- dijit 8y ago
  Or relying on other people to report the issues so that people patch. https://www.openwall.com/lists/oss-security/2017/01/24/4 https://www.openwall.com/lists/oss-security/2017/01/24/4
- the_duke 8y ago
  The tone of discussion there indeed suggests a very lax / "meh" attitude towards vulnerabilities.
lima 8y ago
systemd is a low-level building piece for distributions - the distros are doing end-user changelogs and security notices. The target audience for their NEWS file are upstream maintainers, not users.
8y ago