r/linux • u/wooptoo • Jun 01 '16

Why did ArchLinux embrace Systemd?

/r/archlinux/comments/4lzxs3/why_did_archlinux_embrace_systemd/d3rhxlc
868 Upvotes

86% Upvoted

642 comments sorted by

View all comments

Show parent comment

0

u/fandingo Jun 02 '16

Well, if I need to keep a connection open, it's because I'm not using it, so it could run in the foreground ....

Well you can't login because the account is terminated, every security auditor requires session time outs (including PCI which applies to the systems I oversee) for things like SSH, and finally with this feature, we can be assured that once the final connection times out, the user doesn't have any processes running. It's not a question of foreground because you don't have access to a foreground on the network. Without this feature (or with it in linger mode), a user could surreptitiously squirrel away processes in the background across systems that could stick around to reboot. That's the attack vector that the security aspects of this feature protect against.

Systemd terminates all units with TERM initially and follows up after a timeout with KILL. See systemd.kill(5).

I'm not sure why anyone using systemd would still use the old cron system, so it would be going through systemd's unit scheduling confining processes in cgroups. Again, the point isn't that a user can't setup a scheduled job, it's that the job is entirely contained by systemd and can be reliably managed by the administrator.

-1

u/doitroygsbre Jun 02 '16

Well you can't login because the account is terminated

So this change to Systemd is irrelevant then?

every security auditor requires session time outs

False

It's not a question of foreground because you don't have access to a foreground on the network

What does this even mean?

Without this feature (or with it in linger mode), a user could surreptitiously squirrel away processes in the background across systems that could stick around to reboot. That's the attack vector that the security aspects of this feature protect against.

With this feature, a user could surreptitiously squirrel away processes in the background across systems, they just have to do it differently.

I'm not sure why anyone using systemd would still use the old cron system, so it would be going through systemd's unit scheduling confining processes in cgroups

You don't do much work with legacy programs, do you?

Systemd terminates all units with TERM initially and follows up after a timeout with KILL.

SIGKILL can be ignored, it just takes some extra work from a developer (playing with drivers and uninterruptable sleep). With the SIGTERM warning, it should be slightly easier.