systemd 228 Had A Local Root Exploit

[Guest]

On real ground though, this is not the end of the world or something to panic about. Systemd is far more convenient than the old arch linux init scripts. Real people care more for things that make their lives easier.

Nevertheless, as I stated many tines before, they need to stop adding features (unless to support new systems) and just fix bugs for the new few years.
This is a very critical part of a Linux system. It needs to be very robust.

Edit: I also noticed they don't do freezes before release dates. Their releases feel like "known to work" snapshots tagged as releases.

[Lukas Nykryn]

All texts I find, including the CVE, say it was introduced with 228 and fixed with 229. So seem like only version 228 is affected by this vulnerability. A list of distros that ever included 228 would be good to have handy now!

Checking the version is quite often not enough. For example systemd 219 in centos7 has more then 400 patches and most of them are backports from newer versions, so the issues could be accidentally backported as well. But in this specific case, centos7 is fine.

[signals]

This is exactly when I started to laugh so loud that I could not read more of your post...

I'm sorry to hear that.

Maybe I was being overly dramatic. I probably should have said systemd was the last straw, not the only reason. I'm not, and never have been, a free software zealot. I used Linux because it was very similar to the AIX/SunOS/Digital Unix systems that I cut my teeth on in college. It wasn't a matter of open source or free software, it was a matter of being an environment that I knew like the back of my hand and was very comfortable with. As things like dbus and systemd were introduced, it started changing. I really don't want the system to do everything for me. I'm perfectly capable of typing "sudo mount /dev/sdj1 /mnt/usb" when I insert a USB disk.

Anyway, eventually, while trying to get systemd to mount an NFS server at boot time, and failing miserably, I finally asked myself why I'm bothering with this anymore... If I'm going to have to re-learn basic administrative tasks, I may as well just go with the flow and learn the Windows way. The last time I bought a new computer, I just didn't bother to install Linux and just started using Windows. Am I entirely happy with it? Absolutely not, but I hadn't been entirely happy with Linux for the last decade or so either...

(And I still use Linux on my server and some "embedded" type applications. It's just my desktop that I changed to Windows.)

Guess I'm just a stodgy old coot who doesn't adapt to the current trends very well... But, whatever... The OS I'm using on my personal computer makes no real difference. It still doesn't change the fact that the systemd developers were (apparently) attempting to hide a security vulnerability, which is a really cruddy move.

[oooverclocker]

the developers tried to hide this security breach to the community!

That's exactly what I expected. And why I don't use it. And I don't miss anything.

[pal666]

that's punishment for not using c++. macros suck

[pal666]

it was a matter of being an environment that I knew like the back of my hand and was very comfortable with. As things like dbus and systemd were introduced, it started changing.

so your main problem is that you are unable to learn

[quikee]

not only this piece of s**t contains a root exploit, but the developers tried to hide this security breach to the community!

"Never attribute to malice that which is adequately explained by stupidity"

[pal666]

Given that one of the common complaints about systemd is that it bundles too much functionality into PID 1, this makes me wonder.

given that bug in question had nothing to do with pid1 i wonder why people are so often misplacing complaints

[pal666]

but world writable suid files?!?

but ON TMPFS MOUNTED NOSUID ???!!!1111

[pal666]

so much fun and thanks to all the people that included it by default in many distrib

fedora does not include 228. f23 uses 222, f24 uses 229. thanks for fedora systemd maintainers fedora users have systemd and do not have bugs. what your distro does is your only problem, you have to suffer your choices