3 ms·
> so now security-critical daemons like openssh have additional dependencies like liblzma Systemd itself seems security-critical to me. Would removing other de
by bennyhill 3y ago
> so now security-critical daemons like openssh have additional dependencies like liblzma
Systemd itself seems security-critical to me. Would removing other dependencies on libsystemd really make a secure system where systemd was compromised through its library?
- agwa 3y ago1. systemd (at least the PID 1 part) does not talk to the network, so a remotely-accessible backdoor would need to be more complex (and thus more likely to be detected) than a backdoor that can be loaded into a listening daemon like openssh. 2. You can run Debian systems without systemd as PID 1, but you're still stuck with libsystemd because so many daemons now link with it.
- capitainenemo 3y ago.. well, you can use a shim package as devuan did.
- chasil 3y ago> systemd... does not talk to the network... Socket activation and the NFS automounter appear to. If I run "netstat -ap" I see pid 1 listening on enabled units. Edit: tinysshd is specifically launched this way. Edit2: there is also substantial criticism of xz on technical grounds. https://www.nongnu.org/lzip/xz_inadequate.html https://www.nongnu.org/lzip/xz_inadequate.html