4 ms·
That it exists at all. Debian maintainers changed sshd to notify systemd when it is ready. This notification is only a few lines of code, but it's even _fewer_
by amiga386 3y ago
That it exists at all.
Debian maintainers changed sshd to notify systemd when it is ready. This notification is only a few lines of code, but it's even _fewer_ lines if you call the sd_notify() convenience function in libsystemd.so
So now you're linking to libsystemd.so. What's also in libsystemd.so? Logging functionality, for programs that need to read systemd logs. That could be in a separate library, but this is systemd, so of course it's not. Everything's in one library. To read compressed systemd logs, libsystemd.so requires a bunch of compression libraries, including liblzma.so.
Anyone linking to libsystemd.so, e.g. to notify at startup, ends up loading liblzma.so, the backdoored version of which abuses glibc ifunc functionality to replace functions in libssl.so in order to take over sshd.
- lyu07282 3y agoLennart actually responded to that point: https://www.mail-archive.com/devel@lists.fedoraproject.org/msg198700.html https://www.mail-archive.com/devel@lists.fedoraproject.org/m... And https://github.com/systemd/systemd/issues/32028#issuecomment-2031366922 https://github.com/systemd/systemd/issues/32028#issuecomment... There are some very compelling arguments made there if you care to read them
- amiga386 3y agoI completely agree, it's at most 50 lines of C code to send a notify message. https://sources.debian.org/patches/openssh/1:9.7p1-4/systemd-readiness.patch/ https://sources.debian.org/patches/openssh/1:9.7p1-4/systemd... If Lennart thinks through that position... sd_notify() shouldn't be in libsystemd.so at all, it's an attractive nuisance. At best it should be in a static library only.
- brokenmachine 3y agoAah ok, thanks for the explanation.
- djbusby 3y agoWould that one-huge-library that depends on so many others be solved with, for example, smaller scoped libs/processes?