4 ms·
OpenRC does most of the stuff that systemd does but better, and has existed for longer. SystemD is architected in a way that makes significant security issues
by traverseda 3y ago
OpenRC does most of the stuff that systemd does but better, and has existed for longer.
SystemD is architected in a way that makes significant security issues all but inevitable. There's just too much code running in PID 1 to be able to audit, too big of an attack surface.
Binary logs are frankly pretty annoying, but probably really helpful if you're in a large enterprise environment.
Locality of behavior is another annoyance, some services require a bunch of unit files to work well. One `.service`, another `.socket`, maybe a timer. There are also something like 6 different locations a unit file can live, depending on how it was installed, who owns it, etc. This is once again great for enterprise customers but means that if you want to find a unit file you can't just look in a directory, maybe a users home dir if it's a user service. You have to memorize or look up the systemd command that tells you where the unit files actually is. Same problem with unit file overrides. Overrides aren't just `myunit.service.override` or something next to your service, they live in their own folder and you need to use systemd commands to find/edit them.
Basically it discourages general unix knowledge in favor of memorizing a huge number of systemd specific commands, it does this by hiding files all over the place, using binary logs, and otherwise going out of their way to make themselves incompatible with unix-as-a-programming-environment.
They also make controversial decisions that you're probably shielded from by your distro, things like killing long-lived tmux sessions. Changing the behavior of your lid switch with no warning. They break a lot of stuff and when they do they're very unsympathetic about it. I recognize that they get a lot of hate, but when I look at issue trackers I often see people on the SystemD side being unprofessional first and escalating minor disagreements.
Can't launch systemd services in a chroot either, you need to be running systemd as pid 1 on your host system if you want to work with any kind of embedded linux that uses systemd.