4 ms·
> The critical piece was systemd Not really, systemd was 1 way that openssh could load liblzma, but another would have been thought the selinux PAM stack. It d
by NekkoDroid 3y ago
> The critical piece was systemd
Not really, systemd was 1 way that openssh could load liblzma, but another would have been thought the selinux PAM stack. It didn't exactly rely on anything systemd specific, just that it was a (transitive) dependency to openssh.
And the entire notification stuff can also be done without linking to libsystemd, but the maintainers that added the patch I guess didn't want to reimplement it manually (now the docs have a fully functional example ready to copy-paste, but before the protocol was just explained).
- NewJazz 3y agoselinux PAM stack So... Some other huge subsystems that OpenBSD does not include.
- NekkoDroid 3y agoWhat I am trying to say is: it doesn't have to be any specific dependency, it can be any dependency that somehow loads liblzma. It can be a tiny mostly insignificant direct dependency if you want, it doesn't matter, it just needs to somehow be loaded into the address space.
- Brian_K_White 3y agoBut if such things are avoided across the board as policy, exactly to attain the result of reducing that attack surface, then there are few such possible examples, and so you can't just say "it could be anything" you have to show that there is actually much pool of "anything". What's an equivalent example that could actually happen in openbsd?