The Grumpy Editor's guide to surviving the systemd debate [LWN.net]

The Grumpy Editor's guide to surviving the systemd debate

Posted Nov 13, 2014 12:01 UTC (Thu) by dps (guest, #5725)
Parent article: The Grumpy Editor's guide to surviving the systemd debate

I have some *very* negative experience of systemd. A box which has systemd and local media was rendered unbootable by a networking problem unless I used init=/bin/bash and did things manually. However desirable the remainder of systemd might be this sort of behaviour is a huge step in the wrong direction.

The main beef I have with systemd is that it is very hard to fix things which are not working than it was with older and simpler solutions. I also don't like the dependencies of dbus, udev and other things which are a really bad idea on paranoid firewall systems.

My firewall has neither dbus nor udev, does not support kernel modules and a read only separate /usr partition. The fact that systemd can't cope with that suggests to systemd stuffs too much into init.

to post comments

The Grumpy Editor's guide to surviving the systemd debate

Posted Nov 13, 2014 14:10 UTC (Thu) by anselm (subscriber, #2796) [Link] (2 responses)

Paranoid? If the init process on your firewall does anything more than set up networking and iptables and then exit, then you're not paranoid enough. Who needs userspace processes on a firewall at all when a properly configured kernel on its own will do everything that's necessary?

The Grumpy Editor's guide to surviving the systemd debate

Posted Nov 13, 2014 14:49 UTC (Thu) by JGR (subscriber, #93631) [Link]

Changing the firewall rules at run time, logging/reporting, various forms of error handling and recovery (network goes down then up after init, etc.) and so on generally need some form of user-space.
It's quite possible implement these without sacrificing security.

The Grumpy Editor's guide to surviving the systemd debate

Posted Nov 13, 2014 20:15 UTC (Thu) by dlang (guest, #313) [Link]

real firewalls are more than just packet filtering, no matter what Cisco and Checkpoint try to tell you.

The Grumpy Editor's guide to surviving the systemd debate

Posted Nov 13, 2014 15:35 UTC (Thu) by jonnor (guest, #76768) [Link] (1 responses)

Are shell scripts ran as root more suitable for this paranoid system? That is what sysvinit mostly is afterall.

The Grumpy Editor's guide to surviving the systemd debate

Posted Nov 13, 2014 20:17 UTC (Thu) by dlang (guest, #313) [Link]

Yes, because you can easily delete them if you don't want them to run.

It's not as if the shell scripts are being provided by the attacker or handling any data provided by the attacker.