4 ms·
Does anyone know if distros using the systemd-notify patch are considering not linking to libsystemd and instead implementing the notify-protocol themselves? A
by iforgotpassword 3y ago
Does anyone know if distros using the systemd-notify patch are considering not linking to libsystemd and instead implementing the notify-protocol themselves?
As this would only be like 10 lines of code, instead of linking a huge library that will in turn pull in another bunch of libs, it seems like it should reduce attack surface.
- dralley 3y agoYes, either that or splitting it out into a "libsdnotify" But since it's only a few lines of code most seem to think that unnecessary. It should be noted that systemd actually fixed this a few days before the backdoor was pushed https://github.com/systemd/systemd/pull/31550#issuecomment-1972737923 https://github.com/systemd/systemd/pull/31550#issuecomment-1...
- iforgotpassword 3y agoGreat, I was trying to figure this out for Debian but I get PTSD every time I end up on any of the sites related to a package because they all look different and I can never figure out where I'd even find what I'm looking for (i.e. issue tracker, mailing list). :-) I'm not so sure what to think about the dlopen patch though. It obviously fixes this attack vector, but in general it makes it harder to discover dependencies in a simple way. I wish PE-style late binding would exist for ELF.