Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Thursday June 17 2021, @12:56PM   Printer-friendly

Nasty Linux systemd root level security bug revealed and patched:

This obnoxious Linux systemd bug has been fixed, which means if you're running most recent Linux distributions, you'll need to patch it now.

The good news is the seven-year-old security bug in Linux systemd's polkit, used in many Linux distros, has been patched. The bad news is that it was ever there in the first place. Polkit, which systemd uses in place of sudo, enables unauthorized users to run privileged processes they'd otherwise couldn't run. It turned out that you could also abuse polkit to get root access to a system. 

The power to grab root privileges is the ultimate evil in Unix and Linux systems. Kevin Backhouse, a member of the GitHub Security Lab, found the polkit security hole in the course of his duties. He revealed it to the polkit maintainers and Red Hat's security team. Then, when a fix was released on June 3, 2021, it was publicly disclosed as CVE-2021-3560.

Backhouse found an unauthorized local user could easily get a root shell on a system using a few standard shell tools such as bash, kill, and dbus-send. Oddly enough, while the bug is quite old, it only recently started shipping in the most popular Linux distributions. For example, if you're running Red Hat Enterprise Linux (RHEL) 7; Debian 10; or Ubuntu 18.04; you're invulnerable to this security hole. But, if you're running the newer RHEL 8, Debian testing; or Ubuntu 20.04, you can be attacked with it.

Why? Because this buggy code hadn't been used in most Linux distros. Recently, however, the vulnerable code was backported into shipping versions of polkit. An old security hole was given a new lease on life. 

That's not the only reason this bug hid in plain sight for so long. Backhouse explained the security hole isn't triggered every time you run programs that can call it. Why? It turns out that polkit asks dbus-daemon for the UID [User ID] of the requesting process multiple times, on different codepaths. Most of those codepaths handle the error correctly, but one of them doesn't. If you kill the dbus-send command early, it's handled by one of the correct codepaths and the request is rejected. To trigger the vulnerable codepath, you have to disconnect at just the right moment. And because there are multiple processes involved, the timing of that "right moment" varies from one run to the next. That's why it usually takes a few tries for the exploit to succeed. I'd guess it's also the reason why the bug wasn't previously discovered.


Original Submission

This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
  • (Score: 5, Touché) by Anonymous Coward on Thursday June 17 2021, @01:17PM

    by Anonymous Coward on Thursday June 17 2021, @01:17PM (#1146457)

    >> The power to grab root privileges is the ultimate evil in Unix and Linux systems

    No, I think this article proves that Poettering is the ultimate evil.

  • (Score: 5, Insightful) by Anonymous Coward on Thursday June 17 2021, @01:18PM (6 children)

    by Anonymous Coward on Thursday June 17 2021, @01:18PM (#1146458)

    Put this on the same pile as "just rewrite it in Rust"(*).
    Things that have been around for a long time work; rewriting them in the new-language-hotness-of-the-day or new fancy javascript framework that won't last longer than a carton of milk kept outside of your fridge, opens you up to reintroducing bugs (blatant, hidden, subtle, and hidden) that your original project took years to weed out and eliminate.

    I predict that the whole "just rewrite it in Rust" is going to produce a bunch of similar things like this in the years to come.

    (*) I realize I'm picking on Rust here, and that this is not localized to just that movement.

    • (Score: 5, Interesting) by isostatic on Thursday June 17 2021, @01:31PM

      by isostatic (365) on Thursday June 17 2021, @01:31PM (#1146463) Journal

      systemd is a special type of awfulness though.

      After faced with a nodejs smoking hole of crap that a developer had dumped on me and was constantly breaking and requiring pm2 restarts etc, then unceremoniously broke one day, I spend 3 hours rewriting the whole thing in 200 lines of perl and a bit of jquery, because I've got better things to do.

      Developer of course had got bored and moved on to the latest and greatest thing. nodejs/react is very 2020, he's now on something else (I forget what).

    • (Score: 0) by Anonymous Coward on Thursday June 17 2021, @01:36PM (2 children)

      by Anonymous Coward on Thursday June 17 2021, @01:36PM (#1146467)

      The rust rewrite is to be memory safe, something that is hard to control (or if you prefer, easy to use wrongly) in C and C++. that alone is the source of a huge amount of security problems
      This bug was bad application design (wrong error handling and bad fallback), something that would fail in all languages.

      So the rust argument here doesn't apply

      • (Score: 1, Insightful) by Anonymous Coward on Thursday June 17 2021, @01:44PM (1 child)

        by Anonymous Coward on Thursday June 17 2021, @01:44PM (#1146471)

        Agreed about the desired intention of why a Rust-rewrite could potentially be a good idea.
        Disagreed on whether that is typically needed for things like sudo, ls, etc... The (memory) issues have been ironed out there already, so what exactly are you gaining? When was the last time you read about a security vulnerability or memory leak in ls/sudo/rm/cat?
        Disagreed on whether that typically is the actual intention, given that community's (current) track record on display.

        Re-emphasizing the prediction of "the whole "just rewrite it in Rust" is going to produce a bunch of similar things like this in the years to come".

        • (Score: 0) by Anonymous Coward on Thursday June 17 2021, @02:11PM

          by Anonymous Coward on Thursday June 17 2021, @02:11PM (#1146484)

          No matter the intention, more tools and more freely available code is a good thing. The GNU userland wouldn't exist if they shied away from reinventing the wheel, and neither would extremely useful projects ike busybox and u-root.

    • (Score: -1, Troll) by Anonymous Coward on Thursday June 17 2021, @09:01PM (1 child)

      by Anonymous Coward on Thursday June 17 2021, @09:01PM (#1146702)

      Linux is fucked. This is what happens when you let ノewish trannies take over your project, especially with a flash-in-the-pan language wholly owned by Globohomo. In another few years, Linux fiends are gonna be no different than Mac fanboys now, defending their buggy unstable kludge with the fists of China and Soros up their collective asses.

      When it comes to software vulnerabilities, there are bug hunters and there are bug chasers. Bug chasers are the ones who are now in charge of your precious Linux. Bug chasers love bugs. They themselves are riddled with bugs.

      • (Score: 0) by Anonymous Coward on Friday June 18 2021, @05:10PM

        by Anonymous Coward on Friday June 18 2021, @05:10PM (#1147033)

        Always a great look when you start using Cyrillic or Arabic characters to defeat troll filters. Wonderful progress.

  • (Score: 2) by JoeMerchant on Thursday June 17 2021, @01:19PM (4 children)

    by JoeMerchant (3937) on Thursday June 17 2021, @01:19PM (#1146459)

    an unauthorized local user could easily get a root shell on a system using a few standard shell tools such as bash, kill, and dbus-send

    This is why our kiosk systems absolutely forbid shell access (including ssh) to unknown users.

    --
    🌻🌻 [google.com]
    • (Score: 2) by PartTimeZombie on Thursday June 17 2021, @10:36PM (3 children)

      by PartTimeZombie (4827) on Thursday June 17 2021, @10:36PM (#1146742)

      This is why our kiosk systems absolutely forbid shell access (including ssh) to unknown users.

      Which is entirely sensible, and all the idiots blathering on about how systemd is "evil" have completely missed the point that if an unknown user has shell access on your box, you've got bigger problems than some obscure bug in systemd.

      • (Score: 2) by JoeMerchant on Friday June 18 2021, @01:38AM (2 children)

        by JoeMerchant (3937) on Friday June 18 2021, @01:38AM (#1146801)

        We basically assume: if you have shell access, you are root.

        --
        🌻🌻 [google.com]
        • (Score: 0) by Anonymous Coward on Friday June 18 2021, @06:27AM (1 child)

          by Anonymous Coward on Friday June 18 2021, @06:27AM (#1146871)

          All users have root privileges, some chose not to use them.

          • (Score: 0) by Anonymous Coward on Friday June 18 2021, @05:11PM

            by Anonymous Coward on Friday June 18 2021, @05:11PM (#1147035)

            Check your privilege.

  • (Score: 5, Insightful) by Runaway1956 on Thursday June 17 2021, @01:40PM (10 children)

    by Runaway1956 (2926) Subscriber Badge on Thursday June 17 2021, @01:40PM (#1146469) Journal

    Linux systemd

    This is not a Linux bug, it is a systemd bug. So, why does it get named as "Linux systemd" bug? There are many of us who run Linux, who didn't have to worry about this bug, because systemd does not exist (or in some cases, is not activated) on our systems.

    • (Score: 2) by tangomargarine on Thursday June 17 2021, @04:16PM (6 children)

      by tangomargarine (667) on Thursday June 17 2021, @04:16PM (#1146554)

      And "Linux systemd bug" is redundant because it's not like systemd runs on any platforms *other than* Linux, right?

      --
      "Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
      • (Score: 4, Informative) by Runaway1956 on Thursday June 17 2021, @04:37PM (4 children)

        by Runaway1956 (2926) Subscriber Badge on Thursday June 17 2021, @04:37PM (#1146573) Journal

        My point is that "a bug in Linux" reflects directly on Linux. A but in systemd shouldn't reflect on Linux, but on the developers of systemd and the of the distro(s) that adopt systemd. Linux works fine without systemd.

        Linux has it's own bugs to worry about, they don't need to be blamed for Gnu bugs, or Qt bugs, or systemd bugs.

        • (Score: 2) by tangomargarine on Friday June 18 2021, @12:51AM (3 children)

          by tangomargarine (667) on Friday June 18 2021, @12:51AM (#1146790)

          I think the ship has long since sailed on calling it "GNU/Linux" or "GNU/Linux/X" or "GNU/Linux/X/GNOME" or whatever. "Linux" just means "any distro that runs on the Linux kernel" now.

          --
          "Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
          • (Score: 2, Insightful) by ThatIrritatingGuy on Friday June 18 2021, @04:55AM (2 children)

            by ThatIrritatingGuy (5857) on Friday June 18 2021, @04:55AM (#1146854)

            This bug does not happen on "any distro that runs on the Linux kernel", but only on systems that use systemd. Linux should not be mentioned at all in this article.

            • (Score: 2) by tangomargarine on Friday June 18 2021, @07:21AM (1 child)

              by tangomargarine (667) on Friday June 18 2021, @07:21AM (#1146876)

              only on systems that use systemd

              Which is last I heard about 97% of all Linux systems?

              --
              "Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
              • (Score: 2) by Pav on Friday June 18 2021, @10:49PM

                by Pav (114) on Friday June 18 2021, @10:49PM (#1147161)

                If you count headless corporate boxes. The ones people actually use themselves largely don't run systemd. The Mint distro took Ubuntus mantle, and doesn't run Systemd by default... and the new #1 distro the kids are running these days is MXLinux, and I don't know if it's even easily possible to run systemd on MX.

      • (Score: 2) by edIII on Thursday June 17 2021, @05:57PM

        by edIII (791) on Thursday June 17 2021, @05:57PM (#1146609)

        It's certainly not running on my OpenBSD servers ;)

        --
        Technically, lunchtime is at any moment. It's just a wave function.
    • (Score: 1, Insightful) by Anonymous Coward on Thursday June 17 2021, @06:50PM (1 child)

      by Anonymous Coward on Thursday June 17 2021, @06:50PM (#1146624)

      I'd just like to interject for a moment. What you're referring to as systemd, is in fact, Linux systemd, or as I've recently taken to calling it, Linux fhtagn systemd. systemd is not an operating system unto itself, but rather another free parasite infesting a fully functioning Linux system riddled with the Linux cgroups, pulseaudio, dbus, journald, udevd, networkd, and vital system components comprising a full OS as defined by POETTERIX.

      Many computer users run a modified version of the Linux system every day, without realizing it. Through a peculiar turn of events, the version of Linux which is widely used today is often called "systemd", and many of its users are not aware that it is basically the Linux system, distorted by Red Hat and crammed down everyone's throat.

      There really is a systemd, and these people are using it, but it is just a part of the system they use. systemd is the init: the program in the system that allocates the machine's resources to any process that disconnects from dbus at just the right time. The init is an essential part of an operating system, but useless by itself; it can only function in the context of a complete operating system. Systemd is normally used in combination with the Linux operating system: the whole system is basically Linux with systemd corrupting it, or Linux🦑systemd. All the so-called "systemd" distributions are really distributions of Linux🦑systemd.

      • (Score: 0) by Anonymous Coward on Friday June 18 2021, @05:13PM

        by Anonymous Coward on Friday June 18 2021, @05:13PM (#1147036)

        Just shut up and fix the bug, goddamn whining...

    • (Score: 2) by Thexalon on Thursday June 17 2021, @07:51PM

      by Thexalon (636) on Thursday June 17 2021, @07:51PM (#1146658)

      If I had to guess, that framing is part of Red Hat, who is the money behind systemd, trying to equate Poettering's malware with the Linux kernel, because they'd like to control how all Linuxes that exist operate and their method of doing so is to try to create an ecosystem in which you can't usefully run desktop or server Linux without systemd.

      I sure can't think of a good technical explanation for why a big pile of Unix things that had at least 15-20 years worth of testing behind them had to be scrapped in favor of an ever-growing blob that was allegedly just a replacement for Sysvinit. Dennis Ritchie must be spinning in his grave.

      --
      The only thing that stops a bad guy with a compiler is a good guy with a compiler.
  • (Score: 3, Insightful) by c0lo on Thursday June 17 2021, @01:43PM (2 children)

    by c0lo (156) Subscriber Badge on Thursday June 17 2021, @01:43PM (#1146470) Journal

    Nasty Linux systemd [Full Stop] Root Level Security Bug Revealed and Patched

    FTFY

    Until systemd is not exorcised or excised or extirpated or exploded, nothing patched anyway

    --
    https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
    • (Score: 4, Informative) by Anonymous Coward on Thursday June 17 2021, @05:24PM (1 child)

      by Anonymous Coward on Thursday June 17 2021, @05:24PM (#1146597)

      blame redhat for pushing the "modern" obscure linux layout, so people pay then support instead of learning and fixing problems on their own!
      and them blame most of the other distros for following redhat

      • (Score: 0) by Anonymous Coward on Friday June 18 2021, @05:16PM

        by Anonymous Coward on Friday June 18 2021, @05:16PM (#1147037)

        "The internal structure of Red Flag Linux is very similar to Red Hat Linux, using a similar installer. "

  • (Score: 1, Redundant) by zion-fueled on Thursday June 17 2021, @02:05PM

    by zion-fueled (8646) on Thursday June 17 2021, @02:05PM (#1146480)

    I don't remember our earlier init systems having this kind of bug. At least it's local.

  • (Score: 4, Informative) by Anonymous Coward on Thursday June 17 2021, @02:29PM (1 child)

    by Anonymous Coward on Thursday June 17 2021, @02:29PM (#1146492)

    Actually this is not related to systemd at all.

    Polkit is independent of systemd and as far as I can tell also used in non-systemd distributions like devuan. Yes, you can use polkut to make some systemd things more user friendly, but it is not a part of the systemd project nir necessary to use systemd.

    • (Score: 2, Insightful) by darkfeline on Thursday June 17 2021, @07:04PM

      by darkfeline (1030) on Thursday June 17 2021, @07:04PM (#1146630) Homepage

      One cannot let an opportunity to make a political statement slip by, even if it requires one to twist the facts.

      At least, that's the moral code of parties with certain interests. Apparently that includes systemd haters.

      --
      Join the SDF Public Access UNIX System today!
  • (Score: 2, Funny) by srobert on Thursday June 17 2021, @02:57PM (3 children)

    by srobert (4803) on Thursday June 17 2021, @02:57PM (#1146499)

    The phrase "obnoxious Linux systemd bug" is redundant or unnecessarily repetitive.

    • (Score: 0) by Anonymous Coward on Thursday June 17 2021, @03:05PM (2 children)

      by Anonymous Coward on Thursday June 17 2021, @03:05PM (#1146507)

      Which one is redundant, systemd bug? or obnoxious Linux?

      • (Score: 2) by tangomargarine on Thursday June 17 2021, @04:14PM

        by tangomargarine (667) on Thursday June 17 2021, @04:14PM (#1146553)

        Anything related to systemD being obnoxious, presumably.

        --
        "Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
      • (Score: 0) by Anonymous Coward on Thursday June 17 2021, @06:12PM

        by Anonymous Coward on Thursday June 17 2021, @06:12PM (#1146615)

        systemd already implies obnoxious, Linux, and bug.

  • (Score: 0) by Anonymous Coward on Thursday June 17 2021, @04:21PM (1 child)

    by Anonymous Coward on Thursday June 17 2021, @04:21PM (#1146558)

    How many left to go?

    • (Score: 3, Funny) by Runaway1956 on Thursday June 17 2021, @04:39PM

      by Runaway1956 (2926) Subscriber Badge on Thursday June 17 2021, @04:39PM (#1146574) Journal

      That wasn't a back door! That was the basement door at the side of the house. ;^)

  • (Score: 2) by srobert on Thursday June 17 2021, @04:43PM (16 children)

    by srobert (4803) on Thursday June 17 2021, @04:43PM (#1146578)

    1. One of the BSD's
    2. Void Linux
    3. Devuan
    4. Gentoo
    5. MS Windows
    6. Apple Stuff
    7. Attempting to avoid systemd marks you as an antiquated neckbeard.
    8. Other

    I'm just asking. I don't know the answer. My laptop has been running Void for a long time. I'm happy with it. For servers I would think Devuan might be preferable. I used FreeBSD for years when I had equipment that was compatible.

    • (Score: 2, Informative) by Anonymous Coward on Thursday June 17 2021, @05:01PM (9 children)

      by Anonymous Coward on Thursday June 17 2021, @05:01PM (#1146587)

      Slackware.

      • (Score: 2) by srobert on Thursday June 17 2021, @05:15PM (8 children)

        by srobert (4803) on Thursday June 17 2021, @05:15PM (#1146592)

        Oh yeah Slackware. Strange that I forgot the first Linux distribution that I ever used.

        • (Score: 0) by Anonymous Coward on Thursday June 17 2021, @09:53PM (6 children)

          by Anonymous Coward on Thursday June 17 2021, @09:53PM (#1146721)

          Slackware does indeed avoid systemd, but not polkit nor pulseaudio. Though it's possible to run without pulseaudio, with something like apulse. It's a hack, but it works. And I think Slackware 15 is going to have the option to completely remove pulseaudio if you want.

          • (Score: 0, Disagree) by Anonymous Coward on Thursday June 17 2021, @11:55PM (5 children)

            by Anonymous Coward on Thursday June 17 2021, @11:55PM (#1146771)

            Gentoo doesn't make you use pulseaudio either.

            Unfortunately there are enough applications that assume pulseaudio, that if you don't have it they will break. But if you do have pulseaudio, you will have the problems caused by pulseaudio. It is harder to get a system with reliably working sound now than in 1996.

            • (Score: 1, Informative) by Anonymous Coward on Friday June 18 2021, @02:42AM (4 children)

              by Anonymous Coward on Friday June 18 2021, @02:42AM (#1146815)

              Slackware.

              This extra package: http://slackbuilds.org/repository/14.2/audio/apulse/ [slackbuilds.org]

              Just enough 'pulseaudio' to make the apps that expect pulseaudio (firefox being the worst offender) happy and working.

              No actual pulseaudio - no pulseaudio problems.

              • (Score: 0) by Anonymous Coward on Friday June 18 2021, @03:43AM (3 children)

                by Anonymous Coward on Friday June 18 2021, @03:43AM (#1146836)

                I've found that apulse doesn't work with Zoom and makes Chromium crash if your webcam's microphone doesn't have a hardware volume control.

                • (Score: 0) by Anonymous Coward on Friday June 18 2021, @12:01PM (2 children)

                  by Anonymous Coward on Friday June 18 2021, @12:01PM (#1146916)

                  Yep! Gentoo gives you the option of pulse, apulse, or neither, and none of the options work correctly with all applications.

                  • (Score: 0) by Anonymous Coward on Friday June 18 2021, @05:22PM (1 child)

                    by Anonymous Coward on Friday June 18 2021, @05:22PM (#1147040)

                    That sounds like Linux and every application. It often works but often not enough that you can switch over to it.

                    • (Score: 2) by Pav on Friday June 18 2021, @10:57PM

                      by Pav (114) on Friday June 18 2021, @10:57PM (#1147166)

                      So go with the system that frustrates you and your workflow the least. It may surprise you, but some people choose a Linux distro for that exact reason (despite no ads or tech press trying to put brainworms in their head to steer them different).

        • (Score: 2) by Reziac on Friday June 18 2021, @04:03AM

          by Reziac (2489) on Friday June 18 2021, @04:03AM (#1146843) Homepage

          That's because it ate a Slackware-shaped hole in your brain. ;)

          --
          And there is no Alkibiades to come back and save us from ourselves.
    • (Score: 2) by SDRefugee on Thursday June 17 2021, @05:25PM (2 children)

      by SDRefugee (4477) on Thursday June 17 2021, @05:25PM (#1146598)

      7. Attempting to avoid systemd marks you as an antiquated neckbeard.

      I'm damn PROUD to be an "antiquated neckbeard". FUCK systemd. For the moment I'm stuck on Ubuntu 20.04 but
      am working hard to get off of anything with systemd..

      --
      America should be proud of Edward Snowden, the hero, whether they know it or not..
      • (Score: 2, Touché) by Anonymous Coward on Thursday June 17 2021, @11:39PM (1 child)

        by Anonymous Coward on Thursday June 17 2021, @11:39PM (#1146763)

        Hate to break it to you Senior Poseur, but real neckbeards don't run Ubuntu. j/k

        • (Score: 2) by DECbot on Saturday June 19 2021, @03:34AM

          by DECbot (832) on Saturday June 19 2021, @03:34AM (#1147227) Journal

          The neckbeards you envision are lame. A true neckbeard would be running XFCE 4.16 on a 5.14 kernel compiled from source on an AMD Epyc system that was originally installed from a Dapper Drake CD found in a magazine because floppy disk 3 of the Slackware installer was chewed up by the cat. Since he's pulling source code strait from github, the apt repositories and lsb_release still point to Ubuntu 6.06 LTS. It doesn't matter to him since he's using pacman and the Arch AUR for any packages he might install and yast to configure them.

          --
          cats~$ sudo chown -R us /home/base
    • (Score: 0) by Anonymous Coward on Thursday June 17 2021, @05:47PM

      by Anonymous Coward on Thursday June 17 2021, @05:47PM (#1146606)

      This is the polkit package for void linux: https://github.com/void-linux/void-packages/tree/master/srcpkgs/polkit [github.com]
      and the various polkit packages in devuan: https://pkginfo.devuan.org/cgi-bin/policy-query.html?c=package&q=libpolkit* [devuan.org]
      Gnetoo of course has polkit.

      This problem is in no way limited to systemd distributions!

    • (Score: 4, Informative) by RS3 on Thursday June 17 2021, @06:00PM

      by RS3 (6367) on Thursday June 17 2021, @06:00PM (#1146612)

      So many to choose from.

      https://nosystemd.org/ [nosystemd.org]

      https://en.wikipedia.org/wiki/Category:Linux_distributions_without_systemd [wikipedia.org]

      I've used Slackware for desktop for 25 years. A few years ago found and love Alpine for servers. It can do desktop, but a lot of things weren't to my liking, some didn't work well, fiddly, etc.

      As someone else recently pointed out here on SN, Alpine is based on musl libraries, which could cause problems for glibc-compiled binaries and packages. I've used pretty much only Alpine packages, or compiled on the platform, so I'm not sure how problematic musl might be.

    • (Score: 3, Informative) by UncleSlacky on Thursday June 17 2021, @06:12PM

      by UncleSlacky (2859) on Thursday June 17 2021, @06:12PM (#1146614)

      There's also Artix, antiX and MX Linux (systemd can be enabled, but it's sysvinit by default).

  • (Score: 0) by Anonymous Coward on Thursday June 17 2021, @05:18PM

    by Anonymous Coward on Thursday June 17 2021, @05:18PM (#1146593)

    Polkit, which systemd uses in place of sudo, enables unauthorized users to run privileged processes they'd otherwise couldn't run

    Probably not what they meant to say. Not wrong, though.

  • (Score: 5, Informative) by pvanhoof on Thursday June 17 2021, @05:19PM

    by pvanhoof (4638) on Thursday June 17 2021, @05:19PM (#1146594) Homepage

    This commit introduced it. [freedesktop.org]

    PolkitSystemBusName: Retrieve both pid and uid
    For polkit_system_bus_name_get_process_sync(), as pointed out by
    Miloslav Trmac, we can securely retrieve the owner uid as well from
    the system bus, rather than (racily) looking it up internally.

    This avoids use of a deprecated API.

    However, this is not a security fix because nothing in the polkit
    codebase itself actually retrieves the uid from the result of this API
    call. But, it might be useful in the future.

  • (Score: 0, Troll) by Rosco P. Coltrane on Thursday June 17 2021, @07:32PM (15 children)

    by Rosco P. Coltrane (4757) on Thursday June 17 2021, @07:32PM (#1146642)

    and here we go again. This entire thread turns into a systemd hatefest.

    I used to hate systemd. I still do sometimes for various reasons - mostly linked to Poettering's obnoxious personality, which is hardly a technical reason. Those who keep saying "systemd sucks" would be well advised to have a listen to the following talk to understand why it was needed and why it's so useful:

    The Tragedy of systemd [youtube.com] by Benno Rice, of BSD fame.

    Do yourself a favor and the spend 45 minutes it takes to go through this talk. Seriously...

    • (Score: 5, Informative) by jbernardo on Thursday June 17 2021, @07:42PM (4 children)

      by jbernardo (300) on Thursday June 17 2021, @07:42PM (#1146648)

      That "talk" is just a repeat, almost word by word, of the lies and fallacies in poetering's infamous "biggest myths" (https://www.linux.com/news/poettering-biggest-myths/) and all "arguments" there were completely debunked and ridicularized in "Systemd: the biggest fallacies" (https://judecnelson.blogspot.com/2014/09/systemd-biggest-fallacies.html#!) back in 2014. Bringing that up as well as the typical cultist label of "haters" on anyone who dares to criticize that steaming pile of code is the mark of a typical poeterring follower. You guys haven't changed in these 7 years. Lacking anything positive to say, you defend that horror with the same lies and attacks on critics as always.
      BTW, linux.au first deleted than blocked comments as everyone was making fun of that dumb talk and asking who had paid for that propaganda.

      • (Score: 2) by jbernardo on Thursday June 17 2021, @07:45PM

        by jbernardo (300) on Thursday June 17 2021, @07:45PM (#1146651)

        ...deleted THEN blocked... Autocorrect hits again.
        Why can't I edit a comment I just posted?
        ,...,......................

      • (Score: 2) by Rosco P. Coltrane on Thursday June 17 2021, @07:46PM (2 children)

        by Rosco P. Coltrane (4757) on Thursday June 17 2021, @07:46PM (#1146653)

        Systemd is a steaming pile, and Poettering even more so. But I'm sorry, the reason why systemd came to be are valid.

        • (Score: 3, Insightful) by jbernardo on Thursday June 17 2021, @07:50PM (1 child)

          by jbernardo (300) on Thursday June 17 2021, @07:50PM (#1146657)

          Changing goal posts, now? Any of the "reasons" in that video and Lennart's blog were long exposed as fallacies. The only reason left is the disgusting political manouvering around Debian's technical committee and the vote.
          Ah, and a couple of corner cases that could have been better solved with any of several other init systems.

          • (Score: 1, Insightful) by Anonymous Coward on Thursday June 17 2021, @11:46PM

            by Anonymous Coward on Thursday June 17 2021, @11:46PM (#1146766)

            "could have been better solved with any of several other init systems."

            "could have been" but weren't. If someone or a group of someone's wanted a better way they should have built it. This is just like flatpak, snaps and appimage. I don't really like these all that much either, but their proliferation is the fault of distros' "everything is fine" attitude. Everything is not fine.

    • (Score: 1, Troll) by Rosco P. Coltrane on Thursday June 17 2021, @07:44PM (3 children)

      by Rosco P. Coltrane (4757) on Thursday June 17 2021, @07:44PM (#1146650)

      Someone tell me how my post is a troll...

      Hey modder, did you even read what I posted? Or did you automatically assume someone who isn't a systemd hater is a troll?

      • (Score: 5, Insightful) by jbernardo on Thursday June 17 2021, @07:47PM (2 children)

        by jbernardo (300) on Thursday June 17 2021, @07:47PM (#1146654)

        Calling systemD critics "haters" and spewing the same old recicled Lennart's fallacies is trolling in my book...
        Come on, do you think you're posting in some redhat owned forum?

        • (Score: 2, Troll) by Rosco P. Coltrane on Thursday June 17 2021, @07:56PM (1 child)

          by Rosco P. Coltrane (4757) on Thursday June 17 2021, @07:56PM (#1146662)

          Then your book isn't written properly. People who hate systemd are factually haters, and I didn't post trolling material. I posted a link to a talk you're free to agree or disagree with and criticize, I didn't post off-topic ascii art or racist slur.

          This is not a troll. I don't even know why I bother to explain this to you. Maybe you're the troll - in which case, well done: you got me wasting my time.

          • (Score: 3, Informative) by digitalaudiorock on Friday June 18 2021, @11:55AM

            by digitalaudiorock (688) on Friday June 18 2021, @11:55AM (#1146915) Journal

            jbernardo is 100% right. Repeating the same debunked LP myths from years ago IS trolling and nothing else. Here's something you should read...it's a very thorough analysis of systemd's "design", or more notably, the lack thereof:

            https://blog.darknedgy.net/technology/2015/10/11/0/ [darknedgy.net]

            LP is a clueless fucking asshole that knows nothing about what's made Linux/unix great, and clearly nothing about real software engineering.

    • (Score: 5, Informative) by Thexalon on Thursday June 17 2021, @08:12PM (1 child)

      by Thexalon (636) on Thursday June 17 2021, @08:12PM (#1146672)

      I hate systemd for 2 fundamental technical reasons:
      1. It aggressively breaks one of the central ideas of Unix: "Do one thing well". It very intentionally tries to do as much as possible. As a very simple example, there's absolutely no reason why the init system should be coupled to application logging.

      2. It throws out decades of development in order to satisfy that desire to couple everything together into the One True System. One of my basic technical philosophies is "Thou Shalt Not Discard Working Code Without a Damn Good Reason", because (a) newer developers often want to do that for stylistic rather than technical reasons, and (b) you lose years of bug discoveries and fixes when you go along with it. And that is a big part of why systemd is as buggy as it is.

      Poettering's arrogance also is a problem, and it pervades a lot of the rest of the project team. I still remember when a systemd dev broke the Linux kernel, and rather than say "whoops, sorry, I'll fix it" or "revert that, obviously not the right move" it was "my new code is perfect, you're the ones who have been doing it wrong for the last 20 years". To people like Alan Cox and Linus Torvalds, who aren't perfect at everything but have been around the block enough to know that you don't do that without a lot of discussion.

      --
      The only thing that stops a bad guy with a compiler is a good guy with a compiler.
      • (Score: 0) by Anonymous Coward on Thursday June 17 2021, @09:12PM

        by Anonymous Coward on Thursday June 17 2021, @09:12PM (#1146707)

        Gnu is not UNIX...

    • (Score: 4, Informative) by digitalaudiorock on Thursday June 17 2021, @08:21PM

      by digitalaudiorock (688) on Thursday June 17 2021, @08:21PM (#1146677) Journal

      and here we go again. This entire thread turns into a systemd hatefest.

      Yes, because systemd still blows dead fucking monkeys, and is still a thing...primarily because people like yourself keep telling us all to "get over it". You can keep it. None of my Linux systems (Gentoo) have it, nor do any of my companies systems (Devuan).

    • (Score: 4, Interesting) by Anonymous Coward on Thursday June 17 2021, @10:37PM (2 children)

      by Anonymous Coward on Thursday June 17 2021, @10:37PM (#1146743)

      mostly linked to Poettering's obnoxious personality, which is hardly a technical reason

      Obnoxious personality in a project's maintainer is TOTALLY a technical reason. Shooing off users reporting bugs, deliberately leaving bugs be (WONTFIX is the watchword), the my-way-or-the-highway no matter how demonstrably wrong, the raging NIH syndrome; all those things are producing decidedly technical damage.

      • (Score: 2) by Runaway1956 on Friday June 18 2021, @01:12PM (1 child)

        by Runaway1956 (2926) Subscriber Badge on Friday June 18 2021, @01:12PM (#1146929) Journal

        Obnoxious personality in a project's maintainer is TOTALLY a technical reason.

        Not true, really. A lot of whiny pusses have claimed that Torvalds is obnoxious. That is not a technical issue, unless you can quantify and qualify how that obnoxious quality affects the code.

        You do, however, go on to explain how and why Puttering's attitudes impact development, so you mostly get a pass on your inaccurate statement. ;^)

        • (Score: 3, Insightful) by sjames on Saturday June 19 2021, @07:52PM

          by sjames (2882) on Saturday June 19 2021, @07:52PM (#1147340) Journal

          It's a different form. Linus tended to swear and never sugarcoated anything. The difference is that he did not shoo away bug reports, refuse to fix, or reject ideas because they weren't his. The few times he didn't fix a flaw, he was quite clear that it was because he did not yet know of a cure that wasn't worse than the disease. The difference is why Linus's "obnoxious" wasn't a technical issue. Some even argue that it prevented technical issues. There is some merit to those arguments.

  • (Score: 0) by Anonymous Coward on Thursday June 17 2021, @09:18PM

    by Anonymous Coward on Thursday June 17 2021, @09:18PM (#1146711)

    aaannnddd that's how windows stuff running thru wine gets you rooted ... weeh.

(1)