Systemd Adds New "ProtectSystem Strict" Option, Other New Tunables

[RahulSundaram]

Not only, but its a problem. It's a classic problem too, the UID 0 problem.

"innovated" rrriight... I forgot that systemd is innovative.. heh.. not the word I'd use for systemd-mount or systemd-journald.. maybe omnipotent, monolithic, maniacal, oppressive would be better words.

Oh, how dramatic. Btw, read again. I said, Linux has innovated beyond Unix. Not specifically systemd.

[jrch2k8]

This looks like its for docker? - Ugh systemd.. Can we just say that Linux is no longer a "Unix like" operating system?

The moment you realize Linux is not even close "Unix Like" since like 15+ years ago, The digital Horror.

Btw anybody that claims today Linux is "Unix Like" should leave the 90's behind and return to the present

[jrch2k8]

Not only, but its a problem. It's a classic problem too, the UID 0 problem.

"innovated" rrriight... I forgot that systemd is innovative.. heh.. not the word I'd use for systemd-mount or systemd-journald.. maybe omnipotent, monolithic, maniacal, oppressive would be better words.

systemd-mount: the word you are looking for is Awesome, specially for embeded users/developers, i've been drooling for this since systemd 30. i don't expect you to get why but whatever

systemd-journal: again really, somehow is 2012 again and i dodn't notice? whatever.

Omnipotent: fuck yeah and standard functionality is there too, so double fuck yeah. You are welcome to the 21th Century where security matters and bash is not that relevant anymore

Monolithic: Well is ovbious you don't develop software and as user you only here of a package named systemd, so you assume is one giant blob because you don't know better, so i can let this one slide but for future reference is way more modular than think it is.

Maniacal: take your xanax, boom

Oppresive(i guess you mean PID0 + CGroups, sooo): FUCK YEAH, process isolation and security without let any random moron mess with the critical parts and compromise it. is worth noting only 3 guys on this planet are jelly about this and 2 are confirmed as very crappy developers without any regard on security and were basically exploiting a kernel flaw and exposing to a massive seciurity risk any of their users. The third seems it focused his attention back to find aliens passing as humans on the CIA, so he won't be a problem for a while.

[k1e0x]

Let me tell you guys a systemd story. At the end of this we get to the point where I gave up all hope and decided to avoid systemd whenever and wherever I could. Before that time though I was all in, I thought "Ok, this is the future and we are going to use it so lets learn it and all will be well.. and all was.. relatively well for a time.

One day a few years ago I decided I wanted to have a PXE boot NFS system that I could just spin up whenever I needed an OS to work on various systems. Think of it like a rescue cd, or a temporary os, with persistent storage and my own programs. I got the system built compiled the kernel did all my due diligence and.. systemd would die during boot. ?? K lets check the logs. Turns out journald corrupted the log file making it unreadable.

Now I don't know what *bonehead* decided to make the system log a binary proprietary thing but when that gets corrupted what are you options? Worse yet, that was what was actually causing the problem. I can't even image why someone would WANT to do this, it's like some kind of ego-maniac decided "Logging is part of the system and since systemd is the system we must do logging so if we are going to do logging we need to do it in a way that we are the only thing that can do it." Seriously? Why is all this complexity good?

That was the last straw. There were other issues, many in fact, but at that moment I decided NO.. I'm not going to figure out how to schedule the unmount of the NFS root to make this dumb thing happy. It is stupid and it's a monolithic monster that has no scope or defined role other than to take over the entire system and that is so far away from the Unix philosophy that it might as well be it's entire own alien OS. You like it? Great, I'm happy for you. Keep it. Linux doesn't have a direction it evolves and if powerful entities like Mark Shuttleworth, or Google or FreeDesktop.org want to evolve it so far away from it's Unix roots then be my guest because FreeBSD still exists and it's development actually is controlled by a governing body.

I think its the wrong direction for you guys to take but there are some in the Linux community that have a a total lack of respect for Unix. It's extreme hubris to believe that there is so much innovation past Unix in Linux when it's lacking so much. Every once in a while its good to peek outside your echo chamber and get some air.

[cynic]

...Now I don't know what *bonehead* decided to make the system log a binary proprietary thing...

who is that *bonehead* that told you that systemd logs are proprietary?

[cj.wijtmans]

Let me tell you guys a systemd story. At the end of this we get to the point where I gave up all hope and decided to avoid systemd whenever and wherever I could. Before that time though I was all in, I thought "Ok, this is the future and we are going to use it so lets learn it and all will be well.. and all was.. relatively well for a time.

One day a few years ago I decided I wanted to have a PXE boot NFS system that I could just spin up whenever I needed an OS to work on various systems. Think of it like a rescue cd, or a temporary os, with persistent storage and my own programs. I got the system built compiled the kernel did all my due diligence and.. systemd would die during boot. ?? K lets check the logs. Turns out journald corrupted the log file making it unreadable.

Now I don't know what *bonehead* decided to make the system log a binary proprietary thing but when that gets corrupted what are you options? Worse yet, that was what was actually causing the problem. I can't even image why someone would WANT to do this, it's like some kind of ego-maniac decided "Logging is part of the system and since systemd is the system we must do logging so if we are going to do logging we need to do it in a way that we are the only thing that can do it." Seriously? Why is all this complexity good?

That was the last straw. There were other issues, many in fact, but at that moment I decided NO.. I'm not going to figure out how to schedule the unmount of the NFS root to make this dumb thing happy. It is stupid and it's a monolithic monster that has no scope or defined role other than to take over the entire system and that is so far away from the Unix philosophy that it might as well be it's entire own alien OS. You like it? Great, I'm happy for you. Keep it. Linux doesn't have a direction it evolves and if powerful entities like Mark Shuttleworth, or Google or FreeDesktop.org want to evolve it so far away from it's Unix roots then be my guest because FreeBSD still exists and it's development actually is controlled by a governing body.

I think its the wrong direction for you guys to take but there are some in the Linux community that have a a total lack of respect for Unix. It's extreme hubris to believe that there is so much innovation past Unix in Linux when it's lacking so much. Every once in a while its good to peek outside your echo chamber and get some air.

logs are probably encrypted for security and decrease disk size.

[chrisq]

Let me tell you guys a systemd story. At the end of this we get to the point where I gave up all hope and decided to avoid systemd whenever and wherever I could. Before that time though I was all in, I thought "Ok, this is the future and we are going to use it so lets learn it and all will be well.. and all was.. relatively well for a time.

One day a few years ago I decided I wanted to have a PXE boot NFS system that I could just spin up whenever I needed an OS to work on various systems. Think of it like a rescue cd, or a temporary os, with persistent storage and my own programs. I got the system built compiled the kernel did all my due diligence and.. systemd would die during boot. ?? K lets check the logs. Turns out journald corrupted the log file making it unreadable.

Now I don't know what *bonehead* decided to make the system log a binary proprietary thing but when that gets corrupted what are you options? Worse yet, that was what was actually causing the problem. I can't even image why someone would WANT to do this, it's like some kind of ego-maniac decided "Logging is part of the system and since systemd is the system we must do logging so if we are going to do logging we need to do it in a way that we are the only thing that can do it." Seriously? Why is all this complexity good?

That was the last straw. There were other issues, many in fact, but at that moment I decided NO.. I'm not going to figure out how to schedule the unmount of the NFS root to make this dumb thing happy. It is stupid and it's a monolithic monster that has no scope or defined role other than to take over the entire system and that is so far away from the Unix philosophy that it might as well be it's entire own alien OS. You like it? Great, I'm happy for you. Keep it. Linux doesn't have a direction it evolves and if powerful entities like Mark Shuttleworth, or Google or FreeDesktop.org want to evolve it so far away from it's Unix roots then be my guest because FreeBSD still exists and it's development actually is controlled by a governing body.

I think its the wrong direction for you guys to take but there are some in the Linux community that have a a total lack of respect for Unix. It's extreme hubris to believe that there is so much innovation past Unix in Linux when it's lacking so much. Every once in a while its good to peek outside your echo chamber and get some air.

I have had corrupted logfiles several times, every time journald stored it and started a new one, it never hated my systemd.

You can pass the log on to the legacy logging daemons if you want.

If you can't even IMAGINE why someone would want a binary, not proprietary, log, your imagination is embarrassingly weak.
Let me give you some keywords: indexing, query by start/stop date, query by syslog level, I could go on.
All without parsing the entire log file.

As for you coming here to rant about a system you're not even using, I don't see the point.

[k1e0x]

I have had corrupted logfiles several times, every time journald stored it and started a new one, it never hated my systemd.

You can pass the log on to the legacy logging daemons if you want.

If you can't even IMAGINE why someone would want a binary, not proprietary, log, your imagination is embarrassingly weak.
Let me give you some keywords: indexing, query by start/stop date, query by syslog level, I could go on.
All without parsing the entire log file.

As for you coming here to rant about a system you're not even using, I don't see the point.

Yes, there are ways to fix it. Ways that I don't care about because tail works just fine. thanks for your help but no thanks.

I still use Linux as a desktop.. least for the time being.. and I like Linux and I have a lot of respect for it.. but I don't use systemd anymore.

[Mystro256]

Let me tell you guys a systemd story. At the end of this we get to the point where I gave up all hope and decided to avoid systemd whenever and wherever I could. Before that time though I was all in, I thought "Ok, this is the future and we are going to use it so lets learn it and all will be well.. and all was.. relatively well for a time.

One day a few years ago I decided I wanted to have a PXE boot NFS system that I could just spin up whenever I needed an OS to work on various systems. Think of it like a rescue cd, or a temporary os, with persistent storage and my own programs. I got the system built compiled the kernel did all my due diligence and.. systemd would die during boot. ?? K lets check the logs. Turns out journald corrupted the log file making it unreadable.

Now I don't know what *bonehead* decided to make the system log a binary proprietary thing but when that gets corrupted what are you options? Worse yet, that was what was actually causing the problem. I can't even image why someone would WANT to do this, it's like some kind of ego-maniac decided "Logging is part of the system and since systemd is the system we must do logging so if we are going to do logging we need to do it in a way that we are the only thing that can do it." Seriously? Why is all this complexity good?

That was the last straw. There were other issues, many in fact, but at that moment I decided NO.. I'm not going to figure out how to schedule the unmount of the NFS root to make this dumb thing happy. It is stupid and it's a monolithic monster that has no scope or defined role other than to take over the entire system and that is so far away from the Unix philosophy that it might as well be it's entire own alien OS. You like it? Great, I'm happy for you. Keep it. Linux doesn't have a direction it evolves and if powerful entities like Mark Shuttleworth, or Google or FreeDesktop.org want to evolve it so far away from it's Unix roots then be my guest because FreeBSD still exists and it's development actually is controlled by a governing body.

I think its the wrong direction for you guys to take but there are some in the Linux community that have a a total lack of respect for Unix. It's extreme hubris to believe that there is so much innovation past Unix in Linux when it's lacking so much. Every once in a while its good to peek outside your echo chamber and get some air.

Proprietary thing? I think you mean encoded. Regardless, this is my only issue with systemd, but I still think your hate is somewhat irrational. This isn't exactly innovation for the sake of innovation here; Unix did some things well, it did some things poorly and Linux is changing to suit the needs of it's stake holders, not to respect any standards that Unix set.

Linux stopped being a Unix-like clone a long time ago. If you like the Unix ways, I would encourage you to use one of the BSD's instead, or FreeBSD as you mentioned, as they tend to have goals that more align with Unix.

Honestly though, I have no interest in arguing with you. I would suggest you move on to something you like more, as it seems like Linux really isn't your thing, and perhaps donate some of your time to improve that project, so other people who agree with your philosophy can benefit as well. For example, I think Libreboot and Linux-libre are a useless waste of time, but you don't see me complaining about it, instead I just don't use them, end of story. People who care about those projects can improve them, while I'll focus my attention more on improving mainline Linux, coreboot, and whatever else floats my boat.

[Luke_Wolf]

I am feeling like this should be the default. With this approach, packages for an given software are responsible for providing the scripts that lock them down. If it was the other way around (I.E, like android manifest), they would request access to some parts of the system, making it way easier to identify rogue services.
Or am I wrong?

That said, it would probably break backward compatibility if it was enforced. Maybe a progressive switch?

Absolutely a service requesting a specified set of capabilities and then dropping them when it no longer needs them is the ideal model, and something of the premise behind Capsicum (http://www.cl.cam.ac.uk/research/security/capsicum/), however as great as it would be to enable a strict mode of such things by default, the realities of software don't allow it as you have to change the world in order for it to work. Android got away with it because it didn't have to deal with legacy baggage, but normal desktop or server Linux has a ton of baggage, so yeah it's going to need to be a progressive rollout requiring changes to many programs.