Skip to Content [alt-c]
In reply to Systemd is not Magic Security Dust
Glad to see you mention qmail, and his response to your comment was fairly hilarious. Privilege separation via exec chaining (aka Berstein Chaining) is a key concept that the systemd developers don't get. If they DID get it, they'd understand that that's precisely why you don't run all of this in the same process. Small, simple utilities that do what they need to do, drop privileges, and execute something else.
Supervise > tcpserver > drop privs > app authentication > remainder of the app. This is the antithesis of the systemd model. If they truly understood it, they'd understand the importance of a tiny PID 1, which serves as the basis for everything else: small, secure tools which do precisely and only what they need to do, remove their privileges, and chain to the next step.
Reply
Your comment will be public. To contact me privately, email me. Please keep your comment polite, on-topic, and comprehensible. Your comment may be held for moderation before being published.
Your Name: (Optional; will be published)
Your Email Address: (Optional; will not be published)
Your Website: (Optional; will be published)
>
monospaced
Post a Reply
Your comment will be public. To contact me privately, email me. Please keep your comment polite, on-topic, and comprehensible. Your comment may be held for moderation before being published.