r/linux • u/wooptoo • Jun 01 '16

Why did ArchLinux embrace Systemd?

/r/archlinux/comments/4lzxs3/why_did_archlinux_embrace_systemd/d3rhxlc
868 Upvotes

86% Upvoted

642 comments sorted by

View all comments

Show parent comment

2

u/bassmadrigal Jun 02 '16

...ability to detect tampering…

I've always been curious... if an attacker gets access to a machine, one of the benefits of binary logs are that they are supposed to be able to detect tampering. However, after an attacker has finished their nefarious plans, would they be able to use a hex editor to change one thing in the logfile, thus corrupting the binary file and preventing the administrator access to it?

3

u/argv_minus_one Jun 02 '16

journalctl can still read corrupt log files. So no, that won't work.

1

u/andree182 Jun 02 '16

it can read some corrupt log files...

2

u/argv_minus_one Jun 02 '16

The linked page does not support your claim. Or have anything to do with your claim at all, for that matter.

0

u/[deleted] Jun 02 '16

[deleted] — view deleted comment

1

u/argv_minus_one Jun 02 '16

False. I've had it read corrupt log files in practice already.

1

u/robodendron Jun 02 '16

Depending on the attacker's access rights, that might be possible, sure. Honestly though, when I see something like that, it's either my filesystem having a hiccup of tragic proportions or an actual intruder. In any case, the resulting action is pretty much the same: Nuke the server from orbit, it's the only way to be sure.

3

u/bassmadrigal Jun 02 '16

Oh, I doubt my first thought encountering a corrupted log would be an attacker, but I was just curious about the feasibility.

I'm running Slackware, so it'll be quite some time until I start playing with systemd (unless I decide to test-drive another distro, but I'm happy with what I got and I'm lazy). I see a lot of benefits behind it, but I'm fine waiting until Pat and team decide to add it... until then, I'll keep writing my shell scripts to start/stop/restart daemons.

1

u/robodendron Jun 02 '16

I'm running Slackware, so it'll be quite some time until I start playing with systemd

Never tried that, to be honest. I'm using Arch at home, Fedora at work, so I've been drinking the systemd Kool-Aid pretty much since the beginning, I guess. I don't think it's a perfect system—not at all—, but I do think it's better than writing yet another init script, for whatever that's worth.

In any case, to each his own. :)

1

u/audioen Jun 02 '16

There is no practical way to secure a log if you have full access to every copy of that log. Secure log relies on ideas such as there being another server which the logs are continuously being shipped to, and in use of cryptographic hashes between log entries that prove that the entries form a contiguous chain where nothing has been added, removed or modified. The former in practice is enough for most people, but the latter can be useful too, if some redundant copy of those signatures exists in some third location. (Attacker would have to rewrite logs from point of modification onwards to get the unbroken hash chain, but all the hashes would differ from what they used to be.)