poettering

6 ms·

1.
by poettering 8mo ago
Yes, I have.
2.
by poettering 2y ago
Most of our tools that adjust files work really well offline. systemd-tmpfiles, systemd-sysusers, systemctl and so on all support --root= and --image=. I really don't know what the problem is suppoaed to be. Lennart
3.
by poettering 2y ago
The 64bit issue is certainly an issue, but very much overblown. First of all, in systemd, which is a heavy D-Bus user, we effectively IRL only send integers > 2^53 when we use UINT64_MAX as a special "niche" marker meaning &quo
4.
by poettering 2y ago
You are writing this as if JSON was a newly invented thing, and not a language that has become the lingua franca of the Internet when it comes to encoding structured data. Well understood, and universally handled, since 1997. A 100 digit nu
5.
by poettering 2y ago
Not really. We use two text based formats for logging: BSD syslog, and systemd's structured logging (which is basically an env block, i.e. a key-value set, with some tweaks). Programs generate text logs, journald reads text logs hence.
6.
by poettering 2y ago
Varlink is not a message bus. Hence you should be happy?
7.
by poettering 2y ago
The marshalling cost for JSON is negligible. Yes, it might be a bit slower than GVariant for example, but only by some fractional linear factor. And on small messages (which D-Bus currently always is, due to message size constraints enfor
8.
by poettering 2y ago
It would make things more secure in this specific backdooring case, since sshd only calls a single function of libsystemd (sd_notify) and that one would not trigger the dlopen of liblzma, hence the specific path chosen by the backdoor would
9.
by poettering 2y ago
Uh. systemd documents the protocol at various places and the protocol is trivial: a single text datagram sent to am AF_UNIX socket whose path you get via the NOTIFY_SOCKET. That's trivial to implement for any one with some basic unix p
10.
by poettering 3y ago
Nothing changed. You are just a victim of FUD on the Internet, my friend. That's all.
11.
by poettering 3y ago
Yes, a tpm2 enrollment takes up one slot, the recovery key another, a fido2 yet another, a pkcs11 key yet another and a password yet another in any combination/subset you like.
12.
by poettering 3y ago
With systemd you can enroll any string you want as "PIN" for tpm. There are no restrictions. Can be long, can be alphanumeric, contain weird chars, up to you.
13.
by poettering 3y ago
systemd has a similar logic, i.e. a recovery key concept, but we made sure you can type it in wherever a LUKS password would work too, even on systems where systemd is not available but LUKS ist. The recovery key is output in yubikey's
14.
by poettering 3y ago
To my knowledge Ubuntu does not use the TPM2 PCR logic systemd provides at all, but their own.
15.
by poettering 3y ago
Still would love if desktop terminal emulators would implement the zmodem receiver side, so that you can ssh into some host of your choice and just type "sz" to copy arbitrary files of your choice onto your local system.
16.
by poettering 7y ago
We actually use something like the above. But thats not sufficient since we cannot set up the PAM session fully if $HOME is not accessible because we can't acquire a password for it...
17.
by poettering 7y ago
Uh oh. This is implemented via a PAM module too. But it does substantially more than pam_mount so not sure what you want. It's like claiming that UNIX 'find' is NIH because 'ls' already can show directory listings.
18.
by poettering 7y ago
Well. How frequently do you update your user record in /etc/passwd? I mean, if you do this a million times per second then maybe your are doig something wrong, no? I update my user record maybe every year when I update my password
19.
by poettering 7y ago
Yes this is a problem. To address this systemd-homed is careful to validate the user record enclosed in the volume first (which includes checking its signature against the keyring of accepted record signers) and checks whether the provided
20.
by poettering 8y ago
Well, this boils down to: in a modern operating system, is it good design that an unprivileged user who logs in once can consume arbitrary runtime resources uncontrolled, unbounded forever, even after logout just because they decided to mas
21.
by poettering 8y ago
Well. What is a distro for then if not for picking the most highlevel of defaults suitable for them?
22.
by poettering 8y ago
We send SIGHUP btw. The kernel's own sending of SIGHUP is bound to the TTY concept btw, which is specific to TTY logins only, not graphical ones. That said the question is not so much about who sends what, but more about whether a secu
23.
by poettering 8y ago
I think my comment above explained that already.
24.
by poettering 8y ago
Aleksa, I am not trying to get you to use our APIs. You talking about the cgroups APIs again, if I am not mistaken? As I tried to explain again and again: if you want container runtimes to manage their own cgroups then just set Delegate=yes
25.
by poettering 8y ago
I kinda like how a good chunk of the community complains we are "too monolithic", and the other side of the community complains we have "too many binaries". We can't win with you guys, can we? Lennart
26.
by poettering 8y ago
You make plenty of assumptions there, in particular that there was no communication about the session killing thing. Turns however there was. We informed downstreams about our intention and the reasons in detail, and we documented this for
27.
by poettering 8y ago
First of all, as mentioned above, we made this compile-time as well as runtime-configurable, so that downstream distros can choose whether they want to make this opt-in or opt-out. Hence blame your distros if you picked it in a way you didn
28.
by poettering 8y ago
You know, because we knew this would be controversial we made sure it was both a compile-time option and a runtime option. Yes the upstream default of both defaults to on, but that's just upstream . We made it very easy and supported
29.
All Systems Go 2018 Live Streaming (Everybody's Favour Linux Userspace Conf)(streaming.media.ccc.de)
2 points by poettering 8y ago|0 comments
30.
by poettering 9y ago
> Why exactly does systemd need to mess with the networking services? It doesn't. All this stuff is opt-in. If you don't want to use it, don't. What's a bit unfair though is that you imply that the various technologie

More ›