27 ms·
And what's your preferred alternative to what's described in the article? Packaging every single service in its own 500mb ubuntu chroot and using docker? Runnin
by nickysielicki 1y ago
And what's your preferred alternative to what's described in the article? Packaging every single service in its own 500mb ubuntu chroot and using docker? Running a local dhcp server and a bridge interface so that you can selectively expose ports?
Here's an alternative title for this post: these days, two lines in a systemd service file can easily constrain arbitrary applications to just the files and resources they need, and only those.
- probably_wrong 1y agoMy grumpy preferred alternative would be "you're supposed to be an init service. That's not your job".
- Un1corn 1y ago> systemd is a suite of basic building blocks for a Linux system. You can always use a simpler init system if you want
- nickysielicki 1y agoI linked it elsewhere in this thread, but you should really watch this talk, particularly 12:45 through 16:20: https://www.youtube.com/watch?v=o_AIw9bGogo https://www.youtube.com/watch?v=o_AIw9bGogo tl;dr: systemd isn't meant to be an init system, it's meant to manage services, and the alternative world where you don't have a unified system for managing services and events actually sucks.
- egorfine 1y ago> systemd isn't meant to be an init system, it's meant to embrace and extinguish unix philosophy. > the alternative world where [] actually sucks. You should bear in mind that there are plenty of people here on HN who have had the experience of running pre-systemd unixes and they know exactly how much "the alternative world" sucked. Spoiler: not much.
- nickysielicki 1y agoI was in college before Debian adopted systemd, and worked part time as a sysadmin managing hundreds of pre-systemd Debian systems. You’re wrong.
- egorfine 1y agoI was in college when you were born. And managed thousands of pre-systemd instances including a vast zoo of unixes which were long gone by the time systemd ate the world. You're wrong.
- nickysielicki 1y agoGood for you, I'm simply saying that my feelings on the superiority of systemd are informed by having used linux before systemd was around, whereas you insinuated that I had not. I don't really care to argue about it.
- silverquiet 1y agoDoesn't SELinux do that (and more)?
- amluto 1y agoThe problem is the “more”. SELinux is extremely flexible and does what the configuration tells it to do. And it does not compose well. Want to point whateverd at /var/lib/whatever? Probably works if the distro packages are correct. Want to make /var/lib/whatever be a symlink? Probably does not do what you expect. Want to run a different daemon that accesses /var/lib/whatever or mount it into a container? Good luck. Want to run a second copy of the distro’s whateverd and point it at a different directory? The result depends on how the policy works. And worst: want to understand what the actual security properties of your policy are? The answer is buried very, very deep.
- zokier 1y agoselinux doesn't really provide anything like ProtectHome or PrivateTmp mentioned in the article. SELinux only does access control, while systemd can create new resources that are scoped to specific service.
- egorfine 1y agoIt does, and that's why the systemd crowd want to replace and extinguish it.
- stefantalpalaru 1y ago[dead]