6 ms·

It didn't matter where the init system came from, but where xz came from.

lsaljdljsljljsa 3y ago
it does. If the init system links xz... and systemd does.
toast0 3y ago
My understanding is that nothing in base has a dependency on anything outside. There may be some third party software in contrib (if OpenBSD has contrib, like FreeBSD), but I don't think the 3rd party software's build system would be used. Some BSDs use an external compiler on some platforms, and in that case, you have a build dependency on that, and trusting trust may apply.
- sillywalk 3y ago
  > that nothing in base has a dependency on anything outside. From [0] "The system includes the following major components from outside suppliers: Xenocara (based on X.Org 7.7 with xserver 21.1.11 + patches, freetype 2.13.0, fontconfig 2.14.2, Mesa 23.1.9, xterm 378, xkeyboard-config 2.20, fonttosfnt 1.2.3 and more) LLVM/Clang 16.0.6 (+ patches) GCC 4.2.1 (+ patches) and 3.3.6 (+ patches) Perl 5.36.3 (+ patches) NSD 4.8.0 Unbound 1.18.0 Ncurses 6.4 Binutils 2.17 (+ patches) Gdb 6.3 (+ patches) Awk January 22, 2024 Expat 2.6.0 zlib 1.3.1 (+ patches) [0] https://www.openbsd.org/75.html https://www.openbsd.org/75.html
- johnny22 3y ago
  What openbsd includes in the base system is the real star vs the way linux distros get made.
akira2501 3y ago
The critical piece was systemd, was it not? ssh is no dependent on xz, it only gets there through the "systemd notification" hook provided by vendor specific patches.
- NekkoDroid 3y ago
  > The critical piece was systemd Not really, systemd was 1 way that openssh could load liblzma, but another would have been thought the selinux PAM stack. It didn't exactly rely on anything systemd specific, just that it was a (transitive) dependency to openssh. And the entire notification stuff can also be done without linking to libsystemd, but the maintainers that added the patch I guess didn't want to reimplement it manually (now the docs have a fully functional example ready to copy-paste, but before the protocol was just explained).
  - NewJazz 3y ago
    selinux PAM stack So... Some other huge subsystems that OpenBSD does not include.
    - NekkoDroid 3y ago
      What I am trying to say is: it doesn't have to be any specific dependency, it can be any dependency that somehow loads liblzma. It can be a tiny mostly insignificant direct dependency if you want, it doesn't matter, it just needs to somehow be loaded into the address space.
      - Brian_K_White 3y ago
        But if such things are avoided across the board as policy, exactly to attain the result of reducing that attack surface, then there are few such possible examples, and so you can't just say "it could be anything" you have to show that there is actually much pool of "anything". What's an equivalent example that could actually happen in openbsd?
- johnny22 3y ago
  no, it wasn't. But even if it was, the flaw was in xz.

it does. If the init system links xz... and systemd does.

My understanding is that nothing in base has a dependency on anything outside. There may be some third party software in contrib (if OpenBSD has contrib, like FreeBSD), but I don't think the 3rd party software's build system would be used. Some BSDs use an external compiler on some platforms, and in that case, you have a build dependency on that, and trusting trust may apply.

sillywalk 3y ago
> that nothing in base has a dependency on anything outside. From [0] "The system includes the following major components from outside suppliers: Xenocara (based on X.Org 7.7 with xserver 21.1.11 + patches, freetype 2.13.0, fontconfig 2.14.2, Mesa 23.1.9, xterm 378, xkeyboard-config 2.20, fonttosfnt 1.2.3 and more) LLVM/Clang 16.0.6 (+ patches) GCC 4.2.1 (+ patches) and 3.3.6 (+ patches) Perl 5.36.3 (+ patches) NSD 4.8.0 Unbound 1.18.0 Ncurses 6.4 Binutils 2.17 (+ patches) Gdb 6.3 (+ patches) Awk January 22, 2024 Expat 2.6.0 zlib 1.3.1 (+ patches) [0] https://www.openbsd.org/75.html https://www.openbsd.org/75.html
johnny22 3y ago
What openbsd includes in the base system is the real star vs the way linux distros get made.

akira2501 3y ago

The critical piece was systemd, was it not? ssh is no dependent on xz, it only gets there through the "systemd notification" hook provided by vendor specific patches.

NekkoDroid 3y ago
> The critical piece was systemd Not really, systemd was 1 way that openssh could load liblzma, but another would have been thought the selinux PAM stack. It didn't exactly rely on anything systemd specific, just that it was a (transitive) dependency to openssh. And the entire notification stuff can also be done without linking to libsystemd, but the maintainers that added the patch I guess didn't want to reimplement it manually (now the docs have a fully functional example ready to copy-paste, but before the protocol was just explained).
- NewJazz 3y ago
  selinux PAM stack So... Some other huge subsystems that OpenBSD does not include.
  - NekkoDroid 3y ago
    What I am trying to say is: it doesn't have to be any specific dependency, it can be any dependency that somehow loads liblzma. It can be a tiny mostly insignificant direct dependency if you want, it doesn't matter, it just needs to somehow be loaded into the address space.
    - Brian_K_White 3y ago
      But if such things are avoided across the board as policy, exactly to attain the result of reducing that attack surface, then there are few such possible examples, and so you can't just say "it could be anything" you have to show that there is actually much pool of "anything". What's an equivalent example that could actually happen in openbsd?
johnny22 3y ago
no, it wasn't. But even if it was, the flaw was in xz.