3 ms·

You are somewhat confused, systemd doesn't do priv sep, systemd doesn't do 'logging' and there are already tools that do what you want via chain loading

• JdeBP 8y ago
  systemd very much does do logging. systemd-journald is a compulsory part of the system. It is one big daemon that is a huge fan-in point for all log output streams. It is also the locus of the well-publicized security holes which hit the headlines recently that allowed one to gain superuser access by subverting it. It is not how I would do logging. I wouldn't have the fan-in, only to have to filter it all back out into individual streams again in most of my use cases. I wouldn't run log services as the superuser, or as the same user accounts as other services, or as user accounts that owned anything other than the log files that they create. (Subvert an instance of cyclog, which does not use alloca(), and all that you'll gain is write access to one service's log files and log directory. You won't get superuser access. You won't get access to the logged service process, which is running as another user. You won't get access to any other service's loggers, which are running as other users. You won't even get owner access to the log directory, and the rights to alter its permissions, as the logger only has has a non-owner ACL on the directory.) * http://jdebp.eu./Softwares/nosh/guide/log-service-security.html http://jdebp.eu./Softwares/nosh/guide/log-service-security.h... But systemd does do logging.