3 ms·
This is another furphy, because OpenSSH proper neither requires nor uses xz/lzma. It's made clear in Andres Freund's original report¹ that the libsystemd depend
by inopinatus 3y ago
This is another furphy, because OpenSSH proper neither requires nor uses xz/lzma. It's made clear in Andres Freund's original report¹ that the libsystemd dependency dragging it along arises from distros patching openssh to support systemd notifications. The sad part is that systemd notifications are just a datagram on a socket, so using libsystemd for this is reminiscent of Joe Armstrong's banana.
[1] https://seclists.org/oss-sec/2024/q1/268 https://seclists.org/oss-sec/2024/q1/268
- LtWorf 3y agoAs many have already pointed out, the library can also be linked to sshd via selinux.
- inopinatus 3y agoI've seen that ambit claim too, but I'm not even sure what distro(s) it is referring to since I'm unable to confirm it on any host where I have ldd casually to hand. Ref however https://seclists.org/oss-sec/2024/q1/356 https://seclists.org/oss-sec/2024/q1/356
- deleted 3y ago[deleted]
- usr1106 3y agoThat packaging error makes liblzma being pulled in at installation (well, it's probably already there if pid 1 requires it). But it will not make the sshd binary use it. So I think the original claim stands: Without patching sshd for the notification it will not use liblzma. Disclaimer: I did not search for all possible occurrences of dlopen().
- himinlomax 3y agohttps://github.com/proposal-signals/proposal-signals https://github.com/proposal-signals/proposal-signals > libselinux does not link to liblzma. It turns out the confusion was because of an old downstream-only patch in Fedora and a stale dependency in the RPM spec which persisted long-beyond its removal.