sudois already an optional component (yes, really—I don’t have it installed). Don’t want its attack surface? You can stick withsuand its attack surface instead. Either is going to be smaller than systemd’s.systemd’s feature creep is only surpassed by that of emacs.
systemd’s feature creep is only surpassed by that of emacs.
Tomorrow’s headline: emacs wants to expand to include a Sudo replacement
And after that: emacs wants to include a systemd replacement
:wq
I’d take that over systemd.
And there’s also doas which is a nice substitute.
But systemd is modular. They make an offer and distro maintainers and admins get to choose which parts to use
The problem is that those modules are packaged by the developers as opt-out rather than opt-in. It’s a variation on Microsoft’s old embrace-extend-extinguish playbook, only the “extinguish” part hasn’t worked so well because there are some stubborn distros whose needs don’t align with what systemd provides and have maintainers that go out of their way to provide alternatives.
(By contrast, although we may joke about emacs, it’s the myriad of third-party extensions that cause it to just about be its own operating system—it doesn’t all ship with the core.)
Or you can use a
doasimplementation like OpenDoas, or maybesudo-rs…Though a Rust clone of sudo that operates in the same way will still have the same problems.
I’m not a fan of having root be able to actually login.
Even more so in a true multiuser env where I would rather have privilege escalation be more granular (certain user/groups can esculate certain actions but not others, maybe even limit options of a cmd).
Granted, in a true multiuser environment with an admin who’s carefully tailoring /etc/sudoers to make sure everyone has the least possible privileges that will allow them to still do what they need,
sudois more secure. There’s no doubt of that.On a machine that has only one human user who’s also the admin, and retains the default sudo-with-user-passwords configuration,
suvssudois pretty much a wash, security-wise.surequires a second password to get root access, butsudotimes out and requires the password to be re-entered while a shell created bysucan stay open indefinitely. Which is more easily broken will depend on other details of your situation.(If you’re running an incorrectly configured ssh server that allows direct root login with only password authentification, having a root password could contribute to problems, but the correct fix there is to reconfigure the ssh server not to do something so stupid. I hope there’s no distro that still ships that way out of the box.)
Systemdeez nuts
Gentleman and scholar
The meme is becoming a reality. Systemd really is going to try to be everything lmao
AlwaysHasBeen.jpg
This is why people don’t like systemd…
Systemd monolith - worst thing to have ever happened to Linux
Wayland monolith - best thing to have ever happened to Linux
Oh you had me going in the first half. Sly devil you. Wayland still doesn’t work on the fleet of equipment we have.
If they had named it systemd-x11 people would hate it.
I think wayland has potential but in it’s current state it’s just half baked. Once more protocols get merged,
maybe in a decades timeWayland should be quite flexible and robust.More like over baked but still only half done.
It does have potential. I think anyone denying that is simply wrong. the issue with wayland is purely how slowly it moves and the fragmentation. Now the fragmentation is actually in large part due to how slowly it moves. There are numerous WIP protocols that will greatly decrease fragmentation when all are merged.
I can’t wait because it seems like it will happen in the short future of one or two decades xD
That’s how I feel as well. IMO it’s ridiculous that Fedora wants to remove xorg completely from the repos in the next version.
It is ridiculous. Nothing like says f you to a large percentage of your user base like pushing out a solution that doesn’t work for them.
The wildest thing is that current xorg package is maintained by the community and they’re still removing it completely because “xorg is taking up too much dev time”.
Wayland monolith
There seems to be misunderstanding about what Wayland is.
Wayland is set of protocols. They are implemented by wayland servers (compositors) and wayland clients (applications) themselves. There is no single “wayland binary” like in the X11 days. Servers or clients may choose to implement or not implement a specific protocol.
I think what they meant is that there are people that think: “Wayland is too fragmented, there should be 1 ‘Wayland Compositor’ and the rest should be window managers”
Nope, I meant that the wayland compositors are inflexible monoliths that are so tightly integrated into a DE that they can’t be replaced. Xorg might be bloated, but it follows the UNIX philosophy closely enough that each part of the stack above xorg can be trivially replaced.
I guess my interpretation was too charitable.
Nothing in the protocol prevents you from splitting the server from the window manager, just everyone implementing the wayland server protocol didn’t see any benefit in splitting it out.
Sure, but that doesn’t change the fact that Wayland compositors are forced to be inflexible monoliths that need to be so tightly integrated into a DE that they can’t be replaced.
In xorg the server, wm, and compositor all do their own thing and can be replaced trivially. It took me like 5 minutes to replace xfwm4 with i3, and that included the research.
They’re also all shit and dysfunctional as hell. Xorg forever. Systemd good too.
MacOS 7 forever, in the same way
X11 is a protocol too. Xorg is the binary you are talking about
Wayland is set of protocols.
Oh my god! It’s like hearing the same on hold greeting again and again. WE KNOW!
hey, many of us dislike both equally! (specially the push to become the only alternative)
But for why (I’m commenting this before reading) wouldn’t it make more sense to home I’m the scope of systemd so it can be easier to maintain? Why have it do everything?
You can’t think of it a single massive project. It’s actually lots of small components.
We could argue the linux kernel is bloated too. The reality is though, provided the project is designed to be modular (as SystemD is), it actually makes sense to keep it together, to ensure there is a standard base and all the components are synchronised fully with their API’s.
It also saves distro’s a lot of effort.
distro’s
You can pluralize without the apostrophe. In fact, you never need an apostrophe to pluralize.
It also saves distro’s a lot of effort.
Only if they want to break free.
And they don’t need nfsroot or a separate consolidated /usr mount or, really, a whole host of things that lennart didnt understand and unilaterally broke like an arrogant noob.
But that’s blasphemy.
In practice, all those tight coupling between components mean that it behaves more or less monolithic, despite the claims to the contrary. Replacing them with alternatives is a pain because something else breaks or some software has a hard dependency on it.
I can understand that it makes it easier to add changes that would benefit systemd and distros in general. I read that they introduced run0 to solve long shortcomings of sudo (I’m not aware of which). That sounds logical.
Why have it do everything?
Isn’t the guy behind systemd a (former?) Microsoft employee? I feel as though that might offer a clue as to why the trajectory towards bloat.
It is. He is poisoning Linux, slowly, from the inside. Like the XZ attack, just smarter and much slower.
Why do you consider it as poisoning? I’ve heard the argument about not doing things the traditional Linux way (binary logs for example). But if the alternative provides so many benefits, why is it an issue? Systemd is a piece of cake for all parties compared to sysvinit and alternatives, so why is it bad when it solves so many issued, and makes it super easy to use by just adding e.g. a new option to a Unit?
Another example: timers are more complex than cronjobs, but timers offer additional needed features like dependencies, persistence, easy and understandable syntax, and more. So although more complex, once you get the hang of them, they’re a very welcomed feature imo
By itself, solely doing init, it would have been fine, however, binary logging (even if you eventually end up with a text log, that’s wasting disk space on a binary format no one wants or needs), and it didn’t stop there. He keeps replacing Linux subsystem after subsystem, and many of those replacements are not progress, just duplication of effort and creates more ways for configuration drift.
Here is the rationale for the Journal. In short it is really not that simple and it has a lot of advantages over simple text files and it saves disk space.
You can still forward to text syslog or to a central logging server like Loki if working with multiple hosts. I still don’t get the issue with binary logs.
Yes, and many distros have that out of the box… But they don’t have it sent to keep the binary journal as close to empty as possible. So you end up with twice the space in use for logs. As for the issue with binary logs, text logs can be read by far more tools and utilities, rather than just journalctl and pipes.
You can set the space limit for journals logs really low then, to avoid double space usage. As for the last argument, that also was an issue for me years ago because not all tools were compatible with the journald format, but that’s since long fixed now and I’ve not experienced any issue for a long time. Journal logs provide a standard format for all applications, so third party tools don’t need to be compatible with every log format of your applications. And it also comes with great additional features like -b or --since etc. So I still don’t get the issue here
The guy who discovered the xz attack was also a Microsoft employee, for what it’s worth.
Maybe they discovered xz attack because they are familiar with these things.
He’s working for Microsoft now but it’s very recent, he developed systemd while working at RedHat.
I don’t even know of he’s still working on it. There are a lot of things to be said about systemd and Lennart but the link to Microsoft is irrelevant.
systemd is more of a set of products and software components branded under a single name rather than a single thing.
systemd itself is rather simple, as most other pieces systemd-* software, like systemd-boot, systemd-networkd and systemd-resolvd. these are usually more stable and less bloated than more popular alternativesOh okay I didn’t know that thanks
As long as they can work independently, yes. If they are modular and a distro admin (or just a computer admin) can choose to install and use systemd-x but not install or use systemd-x, we are in good business
Now of you have to take a few you don’t like or need or use so that the one component you do want works, then no
I honestly don’t know enough of systemd to say either way
Most of systemd stuff is decoupled well. You don’t need to use networkd to make use of resolved for example.
Good to know, thanks for the answer
Don’t we already have polkit and pkexec for that?
invoking them is kind of a pain, my sole experience with it was meson/ninja using it but then that default was removed and I’ve never been able to put it back to satisfy my curiosity of how it’s done
Well I’m not a fan of systemd to begin with…
So I don’t even use systemd myself I run OpenRC. Yet honestly I find the idea quite intriguing, having the service manager (PID 1) invoke the command seems like a cool idea to me.
It’s not really a sudo alternative as much as it is another way of doing something similar.
In the old days, it was Emacs trying to do everything. Now, it’s the SystemD.
That was so bad that vim users needed to make nvim to handle Emacs envy, and every modern ide tries to do the same in worse ways.
(Not trying to start a holy war, I use both)
Not that I’m opposed to a better sudo alternatives, but I find it rather ironic that one of the reason stated is the large attack surface, considering systemd is a massive attack surface already.
This isn’t exactly a “new” attack surface, so removing the attack surface that
sudo(and alternatives) is, is probably a net positive.That attack surface is not vanishing. It’s would be relocating the same attack surface to something that might have an xz library in memory.
- The attack surface is there either way, this is just functionality repackaged that existed already before (
systemd-run, which is calling into PID1) - all compression libraries (actually most libraries at this point) are
dlopened on demand (which was planned even before the attack, which is speculated that the attack was accelerated in timeline because he was on a timer before the change was released)
- The attack surface is there either way, this is just functionality repackaged that existed already before (
As Microsoft and Poettering intended.
Can’t see how this could go wrong
Surprised people aren’t moaning about systemd being too big already and still wanting to do more.
It’s too big!
😂
That’s what somethin’ somethin’ said lastnight, Trebek! ;)
SPoF !!! Ahhhhh we all dead
Those comments are here now, you can come check again 😅
😂
How does
systemd-run/run0handle what/etc/sudoerscurrently does?I’m disappointed in how little technical discussion there is in this thread.
Idk
Looking at the implementation, it doesn’t really implement sudoers or tools like sudoedit in any way.
systemd-runhas already been an existing tool for quite some time and this is really just a different CLI for it. That tool asks systemd to make a temporary new service and immediately run it. That, in turn, requires blanket yes/no approval fororg.freedesktop.systemd1.manage-unitsvia polkit.So with run0, you can either do everything or you can do nothing. In-betweens are just not a thing at the moment. There’s very little new backend code running as root.
run0 bashshould behave very similar to something likesystemd-run --uid=0 --gid=0 --wait --same-dir --send-sighup --pty --pipe --collect bashand the majority of those options have been available for quite a while.sudo is overkill for most users tbh
so is systemd
Actually no. The thing is just that systemd handles so many things that makes the lives both developers/distro maintainers and users easier, but most of it happens in the background. You can forget about having to learning complexer tools, just do it all via systemd
Systemd has always been about “don’t ask questions or well call you obstructionist and old”.
Well… Poettering will eventually work his way up to browser engines and then we’ll get something efficient… Here’s the announcement:
"There’s a new component in systemd, called “engined”. Or actually, it’s not a new component, it’s actually the long existing “WebKit” engine now done properly. The engine is also a lot more fun to use than “WebKit” or “Blink” because you can finally have hundreds of tabs open in your browser without running out of RAM.
Coming soon in Coming for systemd 981.
