3 ms·
I’ve since moved away from systemd for all my Linux boxes, work and home. We still cannot block systemd from making a network socket connection so security mod
by egberts1 5y ago
I’ve since moved away from systemd for all my Linux boxes, work and home.
We still cannot block systemd from making a network socket connection so security model is shot right there by the virtue of systemd running as a root process.
In the old days of systemd, no network sockets were made.
Systemd has become a veritable octopus.
Now, I use openrc and am evaluating S6.
- viraptor 5y agoSelinux can block systemd from making network sockets. What do you mean by "security model" in this case? What model is that?
- lloydatkinson 5y agoBut the solution is for it to not try make the socket rather than needing another system to correct bad behaviour of the first system?
- egberts1 5y agoThere ye go. Make system process small as efficient, not to mention easily auditable.
- josephcsible 5y agoBy "cannot block systemd from making a network socket connection", I think GP meant that your system will break if you block systemd from making network socket connections, not that it's physically impossible to do so.
- egberts1 5y agoYes. If you borked your systemd config file, system-wide failure. Non-bootable, non-useable. Also if intransigent network connection occurs (fuZzing or not), untested errors occur … notably in PID 1 which isn’t easy to debug.
- egberts1 5y agoSystemd is already in root mode. Just need to do malicious buffer overruns … somewhere, somehow … at root level … someday. And it’s codebase is too ginormously huge.