4 ms·

>Only if I have root permissions (granted, I probably wouldn't be watching porn on a machine I wasn't admin on but that was just an example application). It do

by MertsA 8y ago

>Only if I have root permissions (granted, I probably wouldn't be watching porn on a machine I wasn't admin on but that was just an example application). It doesn't take root to do so, in most cases you probably still want to run the transient scope under your user so you'd use systemd-run --user in order to create it not with the main system instance of systemd but with the user level instance of it. >I'm pretty sure Windows does do it like this No it doesn't, as for your remote desktop example you can have the exact same behavior on Linux with systemd reaping user scopes by just using a VNC server. Windows is different in that when logging off it won't allow you to while an application is still running. It gives you the choice to either stop and go back to whatever application isn't closing (because you have unsaved work or something) or to kill it.

flukus 8y ago
> It doesn't take root to do so, in most cases you probably still want to run the transient scope under your user so you'd use systemd-run --user in order to create it not with the main system instance of systemd but with the user level instance of it. If a non-root user can do it and leave a program running then doesn't that invalidate all that BS about security?
- MertsA 8y ago
  None of this is about trying to prevent the user from using resources. The user is the one who is logging out in the first place. If the user wants to terminate all of their processes except for one daemon they can do that. The security benefits aren't the primary benefit, security wise all you gain is that after you log out there's no chance that anything with any sensitive information is still hanging around. I mentioned ssh-agent as an example but you could also have stuff like maybe chrome didn't close on SIGHUP and as a result maybe this makes your saved passwords accessible to someone who can dump the RAM later by getting physical access to it. It definitely helps security but it's not really that big of a deal. Ironically enough when I went to Google to search for an example the result that came up was my comments on HN on the same subject from a year and a half ago. https://news.ycombinator.com/item?id=14735145 https://news.ycombinator.com/item?id=14735145 Here's a great example of the kind of real life breakage that reaping the user scope on logout actually fixes. https://bugs.freedesktop.org/show_bug.cgi?id=94508 https://bugs.freedesktop.org/show_bug.cgi?id=94508

by MertsA 8y ago

flukus 8y ago

> It doesn't take root to do so, in most cases you probably still want to run the transient scope under your user so you'd use systemd-run --user in order to create it not with the main system instance of systemd but with the user level instance of it. If a non-root user can do it and leave a program running then doesn't that invalidate all that BS about security?

MertsA 8y ago
None of this is about trying to prevent the user from using resources. The user is the one who is logging out in the first place. If the user wants to terminate all of their processes except for one daemon they can do that. The security benefits aren't the primary benefit, security wise all you gain is that after you log out there's no chance that anything with any sensitive information is still hanging around. I mentioned ssh-agent as an example but you could also have stuff like maybe chrome didn't close on SIGHUP and as a result maybe this makes your saved passwords accessible to someone who can dump the RAM later by getting physical access to it. It definitely helps security but it's not really that big of a deal. Ironically enough when I went to Google to search for an example the result that came up was my comments on HN on the same subject from a year and a half ago. https://news.ycombinator.com/item?id=14735145 https://news.ycombinator.com/item?id=14735145 Here's a great example of the kind of real life breakage that reaping the user scope on logout actually fixes. https://bugs.freedesktop.org/show_bug.cgi?id=94508 https://bugs.freedesktop.org/show_bug.cgi?id=94508