3 ms·
It still sounds like duct tape to me. An OS should know the dependencies of each service without having to perform complex dynamic scanning to find out. Is this
by grumpyprole 2y ago
It still sounds like duct tape to me. An OS should know the dependencies of each service without having to perform complex dynamic scanning to find out. Is this information not already in dpkg?
- pabs3 2y agoYou can't know that all services are running apt installed code, or if they are whether they were restarted already, and the dependencies don't encode what each binary loads at runtime. So scanning processes is the correct thing to do.
- grumpyprole 2y ago> So scanning processes is the correct thing to do. Most solutions in engineering involve a trade-off. Clearly this solution trades simplicity for complexity and multiple CVEs. An OS could utilise a known static configuration as described by its packaging system, for a much simpler solution. It could disallow running services any other way.