This is great. Not having the attack surface of
sudo(and not even being a SUID binary) certainly are great additions.And I hope people realize that
systemdis not one large thing, but a (large) collection of tools.This is great. Not having the attack surface of sudo (and not even being a SUID binary) certainly are great additions.
And I hope people realize that systemd is not one large thing, but a (large) collection of tools.
XZ-utils rings a bell ? It was among others Debian wanting to pull in part of a systemd tool into openssh and that almost turned into a world wide disaster :(
I’ve had to scroll down eight pages to find a post that seems to actually address the good points raised in the article.
Kinda feels like writing a script that implements the
sudoCLI but callspkexecwould be an easier way to do it. Given that so many systems already come with bothsudoandpkexec, do we really need yet another option?
Not that I’m opposed to a better sudo alternatives, but I find it rather ironic that one of the reason stated is the large attack surface, considering systemd is a massive attack surface already.
This isn’t exactly a “new” attack surface, so removing the attack surface that
sudo(and alternatives) is, is probably a net positive.That attack surface is not vanishing. It’s would be relocating the same attack surface to something that might have an xz library in memory.
- The attack surface is there either way, this is just functionality repackaged that existed already before (
systemd-run, which is calling into PID1) - all compression libraries (actually most libraries at this point) are
dlopened on demand (which was planned even before the attack, which is speculated that the attack was accelerated in timeline because he was on a timer before the change was released)
- The attack surface is there either way, this is just functionality repackaged that existed already before (
As Microsoft and Poettering intended.
Artix, Devuan, Void, Alpine Linux are the way to go
Also Gentoo and Guix as mentioned in the comments
and Guix
Gentoo LET’S GO
You’re absolutely right, I absolutely forgot about Gentoo although it’s my daily driver
Glad to see PoetteringOS has still not infected the *BSD family members /s And I’ll gladly use Doas on Linux if need be, thank you.
When does systemd stop? Linux without it is increasingly looking unlikely in the future. Are we not worried about it being a single point of failure and attack vector?
This isn’t a moan about the unix philosophy btw, but a genuine curiosity about how we split responsibilities in todays linux environment.
SystemD will consume the entirety of Linux, bit by bit.
- In 2032, SystemD announces they’re going to be introducing a new way to manage software on Linux
- In 2035, SystemD will announce they’re making a display system to replace the ageing Wayland
- In 2038, the SystemD team announces they’re making their own desktop environment
- In 2039 SystemD’s codebase has grown to sixteen times its size in the 2020s. SystemD’s announces they’re going to release replacements for most other packages and ship their own vanilla distro.
- In 2045 SystemD’s distro has become the standard Linux distribution. Most other distros have quietly faded away.
- In 2047, SystemD announces they’re going to incorporate most of GNU into SystemD. Outrage ensues from the Free Software Foundation, which vehemently opposes this move.
- In 2048, Richard Stallman dies of a heart attack after attempting to clone SystemD’s git repo. SystemD engages in a hostile takeover and all resistance within the FSF crumbles
- In 2050, SystemD buys the struggling RedHat from IBM for $61 million.
- In 2053, most world governments have been pressured into using SystemD.
- In 2054, Linus Torvalds, fearing for his life, begins negotiations to merge kernel development into SystemD
- In 2056, the final message on the Linux kernel development mailing list is sent.
- In 2058, Torvalds dies under suspicious circumstances after his brand-new laptop battery explodes.
- In 2060, SystemD agents assassinate the CEO of Microsoft.
- In 2063, after immense pressure from SystemD-controlled human rights organisations, Arch developers discontinue development.
- In 2064, the remaining living Debian developers release the next stable version of their clandestine and highly illegal distro.
This is a script of Simpsons episode and Torvalds will actually die in 2058.
Thanks for that write up. Made my day! 😄
Probably the weirdest joke comment I’ve ever read.
Debian already uses systemd.
Debian in many ways isn’t as slow-moving as people think.
For example, they moved to Wayland by default (for Gnome anyway) in 2019. A number of well-known distros likely won’t have that until 2025/2026 or beyond.
Sadly they’ve been dropping archs throughout the years, meaning they’re no longer the distro you can use to run on “anything” from a pi to a mainframe…
Doesn’t trixie still support like a dozen arches? I think one of the more recent deprecations was MIPS BE which is functionally obsolete in 2024, at least insofar as practically no one is using it to run a modern distribution.
If your bar is “modern distribution” stick to Ubuntu.
If you want to maintain older hardware Debian used to be a go-to solution.
What’s the go-to solution now?
Bookworm, Trixie, and Sid all currently support a total of 10 different architectures.
And looking through the Wikipedia article for Debian’s version history, most of the dropped architectures were functionally obsolete when they were dropped, or like the Motorola 68000, when support was added. (notable exceptions being IA-64 which was dropped 4 years before intel discontinued it, SPARC which is still supported by Oracle, and PowerPC.)
I think you might want to recheck the ages of some of the people in your timeline, most of them aren’t that young anymore.
Yes, because it’s easier to take care of octogenarians than people who might actually put up a fight to having their laptop batteries replaced with a pipe bomb.
Dude if you made a movie or novel about this that would be awesome
One way to notice a person has “systemd derangement syndrome” is by looking at how they write
systemd: if they write itSystemDthey are already in late stages of SDS and it isn’t curable anymore.
When does systemd stop?
“systemd announces a repleacement module for the kernel”
By this logic the Linux kernel is also a single point of failure and attack vector.
sudo isn’t going away, so does doas. run0 is just another alternative to use or not.
There are still distribution out there without systemd and if there ever won’t be any systemd-free distributions left and systemd would become a critical part of the Linux ecosystem, then it would get the same treatment as the Linux kernel with many professional maintainers.
Gentoo, Slackware and Devuan can be used without svchost for linux.
They’ll only stop when they rebrand it to systemd OS.
Debian works fine without systemd too, there’s a page on the wiki on how to install without it, or remove it after the fact.
Easy with
sudo apt remove --purge --allow-remove-essential --auto-remove systemd:
:-D Time to go outside.
A lot of debs add services to systemd, do those just skip that part?
They seem to. Debian explicitly supports multiple init systems, sysvinit being the primary alternative, so packages have to handle systemd-init not being there.
Gentoo, Slackware and Devuan can be used without svchost for linux.
https://nosystemd.org has a list for more choice for readers.
Systemd is a bit of a hassle to be rid off, but thankfully it’s not actually that hard, the hardest part I found was converting systemd services to whatever init system I use.
I wonder how many hours you sunk into that practicality-free, weird-philosopy-dependent project
Probably not much time, a lot of packages come with init scripts anyway, and they’re pretty trivial to write if not.
You can certainly argue it’s a philosophical choice, I’d say it’s more down to recognising the many poor architectural choices in systemd, rubbing agaist its many pain points and misfeatures and being alarmed at the size of the attack surface it exposes. I understand there is an effort underway to reduce the size and complexity of the main shared library to help address the last point, but just the fact that is necessary shows the scope of the problem.
Systemd is fine. If it wasn’t, most distros wouldn’t have switched to it years ago.
Let’s agree to disagree on that point. Redhat switched because they invented it, and so took all the RHEL derivative distros with them. Debian switched to prefer it after a rather contentious vote and so took all the Debian derivative distros, including Ubuntu, with them. That just leaves a lot of the smaller distros, most of which seem to have stuck with sysvinit or similar as far as I can see.
The arguments against systemd are very unconvincing but more importantly, there is zero evidence that they actually matter.
And it works.
Further, in order to represent this as a nearly unilateral decision you failed to mention that arch, centos, and opensuse all opted in independently.
And no offense but angry Internet randos arguing software philosophy will never convince me to disagree with the creator of the Linux kernel.
Linus Torvalds said:
“I don’t actually have any particularly strong opinions on systemd itself. I’ve had issues with some of the core developers that I think are much too cavalier about bugs and compatibility, and I think some of the design details are insane (I dislike the binary logs, for example), but those are details, not big issues.”
I obviously find the arguments against systemd more persuasive than you do, and that’s fine, it’s all open source and we can all make our own choices about it. My experience with it over the years has been, and still is that it vastly over complicates things that used to be simple, often the less commonly used parts just don’t work right (the automounter is a particular bugbear of mine, and few distros seem to use the network management component). The arguments do matter in practical terms as they directly impact how it works.
Of the distros you mentioned, centos is a RHEL derivative and so wasn’t independent, arch packages multiple init systems, but yes, I’d forgotten opensuse, and they seem to be firmly in the systemd camp.
I may be an internet rando, but I’m not actually angry, more just disappointed. I’d agree with Mr Torvald’s opinion that some of the design details are insane, but I think they are more fundamental than just ‘details’ as many are to do with the fundamental concepts around what systemd is and how it works. Linus can be a real dragon around changes to the kernel, but he’s always tended to be more relaxed about the layers above it.
That the developers of systemd are ‘much too cavalier about bugs and compatibility’ is surely clear to anyone who follows the relevant mailing lists and bug trackers, and should alarm everyone.
took me about an hour to get started with artix originally, and maybe a couple more to really familiarize myself with the init. As for practicallity, it’s been a large improvement for me.
A lot (and I mean a lot) of criticism can be leveled at systemD. One of the upsides of it becoming popular is the standardization of much of things from the developers’ perspective. It’s easier to target multiple distros when you can rely on systemD’s single implementation of the feature. Over the next decade, I forsee systemD eating more and more of the userspace, until you are only left with managing the differences between DEs and which display server they are using. We’re already headed towards immutable base systems with apps shipping with their own dependencies, which we reduce the differences between distros even further.
until you are only left with managing the differences between DEs
Maybe they’ll add a DE as well?
Just kidding!
systemde
Don’t give them ideas 😂
If Canonical and RedHat weren’t backing different horses (Snap vs Flatpak), I could see the app containerization system coming under systemD as well fairly soon. The Cosmic DE project uses functionality from systemD to overlay changes onto the system that are reversible, so that alpha versions of Cosmic can be tested without permanently changing the base system. Imagine apps shipping on whatever container runtime, and dynamically overlaying system-level changes as needed for things that tap into the host system via systemd-sysext.
gross!
SystemDE
In the old days, it was Emacs trying to do everything. Now, it’s the SystemD.
That was so bad that vim users needed to make nvim to handle Emacs envy, and every modern ide tries to do the same in worse ways.
(Not trying to start a holy war, I use both)
new sudo vulnerabilities? how exciting!
E: read the article, I guess that is part of the reason for the proposal. interesting
I honestly started out not liking systemd at all, mostly due to the reports that it did waaay to much, but nowadays, I like the concept.
It is basically officially moving daemon management from a script-based approach to a table/database-based approach. That improves static analyzability, therefore increasing clarity, and probably even performance.
I agree that we should abandon scripts and move towards declarative software management, and abandoning
sudofor a more declarative system seems like a good step to me.feature creep
How does
systemd-run/run0handle what/etc/sudoerscurrently does?I’m disappointed in how little technical discussion there is in this thread.
Idk
Systemd has always been about “don’t ask questions or well call you obstructionist and old”.
There’s a rewrite of sudo happening in rust, but he wants to throw out the SUID idea altogether?
when invoked under the “run0” name (via a symlink) it behaves a lot like a sudo clone. But with one key difference: it’s not in fact SUID. Instead it just asks the service manager to invoke a command or shell under the target user’s UID. It allocates a new PTY for that, and then shovels data back and forth from the originating TTY and this PTY.
That sounds like opening up the door to what windows is doing UAC and the wonderful vulnerability that the GOG Launcher had for privilege escalation.
I’m not a security researcher, but giving arbitrary users the ability to tel PID 1 to run a binary of the user’s choosing is… probably not what Pottering is suggesting, but opens up to such vulnerabilities. And if it’s written in C/C++ my trust is further reduced.
Giving users access to PID1 running binaries, giving users access to the kernel running binaries as root, I don’t see much difference. SUID was notorious in the past for being leaky, it only ended when distros got serious about fencing use of it in, giving it only to programs actually needing it, making sure that they drop privilege properly, etc.
If anything I’m in the PID1 camp because it’s more microkernely. But in any case broader userspace shouldn’t really care about the mechanism, only have an API to do it and that API being a bit in the file permissions is soooo 1960s.
And if it’s written in C/C++ my trust is further reduced.
Do you trust Linux? Because if so, have I got news for you.
Systemdeez nuts
Gentleman and scholar
Don’t we already have polkit and pkexec for that?
invoking them is kind of a pain, my sole experience with it was meson/ninja using it but then that default was removed and I’ve never been able to put it back to satisfy my curiosity of how it’s done
It’s still missing core functionality for an init system, like a display server protocol, compositor, desktop environment and web browser smh.
Systemd isn’t just an init system. It is a project with low level building blocks for a distribution. Most of the complaints are that it isn’t just an init system, while it’s not meant to be just an init system.
systemd-chromiumd
This but unironically, would be better than Electron (low bar, I know)
If we could get an LLM that uploads all our data along with an ad server in our desktop apps, then we’d really have something going.
