Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.os.linux > #51447 > unrolled thread

Anyone know what this nginx error is about?

Back to article view | Back to alt.os.linux

Contents

  Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-01 08:48 -0500
    Re: Anyone know what this nginx error is about? Bit Twister <BitTwister@mouse-potato.com> - 2018-11-01 09:13 -0500
    Re: Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-01 20:21 -0500
      Re: Anyone know what this nginx error is about? Roger Blake <rogblake@iname.invalid> - 2018-11-02 02:14 +0000
        Re: Anyone know what this nginx error is about? Nomen Nescio <nobody@dizum.com> - 2018-11-08 09:49 +0100
      Re: Anyone know what this nginx error is about? "J.O. Aho" <user@example.net> - 2018-11-02 08:50 +0100
        Re: Anyone know what this nginx error is about? James Moe <jimoeDESPAM@sohnen-moe.com> - 2018-11-03 11:34 -0700
          Re: Anyone know what this nginx error is about? "J.O. Aho" <user@example.net> - 2018-11-04 09:36 +0100
            Re: Anyone know what this nginx error is about? Paul <nospam@needed.invalid> - 2018-11-04 06:17 -0500
              Re: Anyone know what this nginx error is about? "J.O. Aho" <user@example.net> - 2018-11-04 13:05 +0100
              [again] software complexity Ivan Shmakov <ivan@siamics.net> - 2018-11-04 12:35 +0000
              Re: Anyone know what this nginx error is about? Dan Espen <dan1espen@gmail.com> - 2018-11-04 07:46 -0500
                [again] software complexity Ivan Shmakov <ivan@siamics.net> - 2018-11-04 13:05 +0000
                Re: Anyone know what this nginx error is about? "J.O. Aho" <user@example.net> - 2018-11-04 14:27 +0100
                  Re: Anyone know what this nginx error is about? Dan Espen <dan1espen@gmail.com> - 2018-11-04 11:17 -0500
                    Re: Anyone know what this nginx error is about? "J.O. Aho" <user@example.net> - 2018-11-04 22:03 +0100
                      Re: Anyone know what this nginx error is about? Dan Espen <dan1espen@gmail.com> - 2018-11-04 19:03 -0500
                Re: Anyone know what this nginx error is about? The Natural Philosopher <tnp@invalid.invalid> - 2018-11-04 18:13 +0000
            Re: Anyone know what this nginx error is about? Dan Espen <dan1espen@gmail.com> - 2018-11-04 07:42 -0500
              Re: Anyone know what this nginx error is about? "J.O. Aho" <user@example.net> - 2018-11-04 14:51 +0100
                Re: Anyone know what this nginx error is about? Dan Espen <dan1espen@gmail.com> - 2018-11-04 11:04 -0500
                Re: Anyone know what this nginx error is about? The Natural Philosopher <tnp@invalid.invalid> - 2018-11-04 18:12 +0000
      Re: Anyone know what this nginx error is about? The Natural Philosopher <tnp@invalid.invalid> - 2018-11-02 10:44 +0000
        Re: Anyone know what this nginx error is about? Bobbie Sellers <bliss@mouse-potato.com> - 2018-11-02 06:22 -0700
        Re: Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-02 09:06 -0500
          Re: Anyone know what this nginx error is about? The Natural Philosopher <tnp@invalid.invalid> - 2018-11-02 19:41 +0000
            Re: Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-02 15:36 -0500
              Re: Anyone know what this nginx error is about? The Natural Philosopher <tnp@invalid.invalid> - 2018-11-02 21:17 +0000
                Re: Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-02 20:36 -0500
                  Re: Anyone know what this nginx error is about? Anonymous <anonymous@foto.nl1.torservers.net> - 2018-11-02 21:46 -0400
                  Re: Anyone know what this nginx error is about? The Natural Philosopher <tnp@invalid.invalid> - 2018-11-03 09:05 +0000
        Re: Anyone know what this nginx error is about? Andreas Kohlbach <ank@spamfence.net> - 2018-11-02 16:27 -0400
      Re: Anyone know what this nginx error is about? Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-11-02 13:05 +0200
        Re: Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-02 08:58 -0500
      Re: Anyone know what this nginx error is about? William Unruh <unruh@invalid.ca> - 2018-11-02 12:59 +0000
        Re: Anyone know what this nginx error is about? Dan Espen <dan1espen@gmail.com> - 2018-11-02 09:21 -0400
        Re: Anyone know what this nginx error is about? Nomen Nescio <noreply@mixnym.net> - 2018-11-02 09:01 -0500
          Re: Anyone know what this nginx error is about? Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-11-02 21:35 +0200
        Re: Anyone know what this nginx error is about? Andreas Kohlbach <ank@spamfence.net> - 2018-11-02 16:35 -0400

Page 1 of 2  [1] 2  Next page →

#51447 — Anyone know what this nginx error is about?

root@me/etc/nginx/sites-available# nginx -t && /etc/init.d/nginx 
restart

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

[....] Restarting nginx (via systemctl): nginx.serviceJob for 
nginx.service failed. See 'systemctl status nginx.service' and 
'journalctl -xn' for details.
 failed!

[toc] | [next] | [standalone]

#51448

On Thu, 01 Nov 2018 08:48:41 -0500, Nomen Nescio wrote:
> root@me/etc/nginx/sites-available# nginx -t && /etc/init.d/nginx 
> restart
>
> nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
> nginx: configuration file /etc/nginx/nginx.conf test is successful
>
> [....] Restarting nginx (via systemctl): nginx.serviceJob for 
> nginx.service failed. See 'systemctl status nginx.service' and 
> 'journalctl -xn' for details.
>  failed!

The message told you to run journalctl -xn to see the actual failure
message.

[toc] | [prev] | [next] | [standalone]

#51466

Nomen Nescio pretended :
> root@me/etc/nginx/sites-available# nginx -t && /etc/init.d/nginx 
> restart
>
> nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
> nginx: configuration file /etc/nginx/nginx.conf test is successful
>
> [....] Restarting nginx (via systemctl): nginx.serviceJob for 
> nginx.service failed. See 'systemctl status nginx.service' and 
> 'journalctl -xn' for details.
>  failed!


  Got it fixed.  And wouldn't you know it, it was a systemd problem.  
Something had connected to ports 80 and 443 outside of the systemd 
perview and systemd wouldn't allow a restart of nginx.

  Linux now lives inside a totalitarian state called systemd.  Let us 
all raise a hand of dedication and submission to systemd by saying

Sieg Heil!

[toc] | [prev] | [next] | [standalone]

#51469

On 2018-11-02, Nomen Nescio <noreply@mixnym.net> wrote:
>   Linux now lives inside a totalitarian state called systemd.  Let us 
> all raise a hand of dedication and submission to systemd by saying

Don't forget, it is not enough to simply obey Big Brother. One must love him.

-- 
-----------------------------------------------------------------------------
  Roger Blake (Posts from Google Groups killfiled due to excess spam.)

  NSA sedition and treason        -- http://www.DeathToNSAthugs.com
  Don't talk to cops!             -- http://www.DontTalkToCops.com
  Badges don't grant extra rights -- http://www.CopBlock.org
-----------------------------------------------------------------------------

[toc] | [prev] | [next] | [standalone]

#51534

In article <20181101221359@news.eternal-september.org>
Roger Blake <rogblake@iname.invalid> wrote:
>
> On 2018-11-02, Nomen Nescio <noreply@mixnym.net> wrote:
> >   Linux now lives inside a totalitarian state called systemd.  Let us
> > all raise a hand of dedication and submission to systemd by saying
>
> Don't forget, it is not enough to simply obey Big Brother. One must love him.

His bad luck to have a gay brother.

[toc] | [prev] | [next] | [standalone]

#51474

On 11/2/18 2:21 AM, Nomen Nescio wrote:
> Nomen Nescio pretended :
>> root@me/etc/nginx/sites-available# nginx -t && /etc/init.d/nginx restart
>>
>> nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
>> nginx: configuration file /etc/nginx/nginx.conf test is successful
>>
>> [....] Restarting nginx (via systemctl): nginx.serviceJob for
>> nginx.service failed. See 'systemctl status nginx.service' and
>> 'journalctl -xn' for details.
>>  failed!
> 
> 
>  Got it fixed.  And wouldn't you know it, it was a systemd problem. 
> Something had connected to ports 80 and 443 outside of the systemd
> perview and systemd wouldn't allow a restart of nginx.

Nothing to do with systemd as systemd will try to start the service,
this is how port listening works in Linux, one instance at the time can
listen to a port, when nginx (in this case) can't open port 80/443 then
it will exit.

The reason to avoid systemd is that it's a big security vulnerability
risk and it eats up GNU applications.

-- 

 //Aho

[toc] | [prev] | [next] | [standalone]

#51506

On 11/2/18 12:50 AM, J.O. Aho wrote:

> The reason to avoid systemd is that it's a big security vulnerability
> risk and it eats up GNU applications.
>
  Wild accusations without a hint of proof.

-- 
James Moe
jmm-list at sohnen-moe dot com
Think.

[toc] | [prev] | [next] | [standalone]

#51507

On 11/3/18 7:34 PM, James Moe wrote:
> On 11/2/18 12:50 AM, J.O. Aho wrote:
> 
>> The reason to avoid systemd is that it's a big security vulnerability
>> risk and it eats up GNU applications.
>>
>   Wild accusations without a hint of proof.

The larger code base, the higher risk for vulnerabilities and systemd
has been having security vulnerabilities quite often compared with the
other init systems

https://blog.trendmicro.com/trendlabs-security-intelligence/systemd-vulnerability-leads-to-denial-of-service-on-linux/
https://www.infosecurity-magazine.com/news/linux-systemd-vulnerability-dns
https://nvd.nist.gov/vuln/detail/CVE-2018-15686
https://nvd.nist.gov/vuln/detail/CVE-2018-15687
https://nvd.nist.gov/vuln/detail/CVE-2018-15688
https://www.theregister.co.uk/2017/07/05/linux_systemd_grants_root_to_invalid_user_accounts/

That just a handful during the last two years, which most people should
be able to find with a simple search engine query.

-- 

 //Aho

[toc] | [prev] | [next] | [standalone]

#51508

J.O. Aho wrote:
> On 11/3/18 7:34 PM, James Moe wrote:
>> On 11/2/18 12:50 AM, J.O. Aho wrote:
>>
>>> The reason to avoid systemd is that it's a big security vulnerability
>>> risk and it eats up GNU applications.
>>>
>>   Wild accusations without a hint of proof.
> 
> The larger code base, the higher risk for vulnerabilities and systemd
> has been having security vulnerabilities quite often compared with the
> other init systems
> 
> https://blog.trendmicro.com/trendlabs-security-intelligence/systemd-vulnerability-leads-to-denial-of-service-on-linux/
> https://www.infosecurity-magazine.com/news/linux-systemd-vulnerability-dns
> https://nvd.nist.gov/vuln/detail/CVE-2018-15686
> https://nvd.nist.gov/vuln/detail/CVE-2018-15687
> https://nvd.nist.gov/vuln/detail/CVE-2018-15688
> https://www.theregister.co.uk/2017/07/05/linux_systemd_grants_root_to_invalid_user_accounts/
> 
> That just a handful during the last two years, which most people should
> be able to find with a simple search engine query.
> 

I found a neat resource today.

"systemd"

https://scan.coverity.com/projects/350

    484,654 lines of code.

https://scan.coverity.com/projects/sysvinit

     30,497 lines of code.

https://scan.coverity.com/projects/upstart

    115,822 lines of code.

https://scan.coverity.com/projects/firefox

  8,214,791 line of code. 101 CWE instances.

I think that means I should stop using my browser :-)

    Paul

[toc] | [prev] | [next] | [standalone]

#51509

On 11/4/18 12:17 PM, Paul wrote:
> J.O. Aho wrote:
>> On 11/3/18 7:34 PM, James Moe wrote:
>>> On 11/2/18 12:50 AM, J.O. Aho wrote:
>>>
>>>> The reason to avoid systemd is that it's a big security vulnerability
>>>> risk and it eats up GNU applications.
>>>>
>>>   Wild accusations without a hint of proof.
>>
>> The larger code base, the higher risk for vulnerabilities and systemd
>> has been having security vulnerabilities quite often compared with the
>> other init systems
>>
>> https://blog.trendmicro.com/trendlabs-security-intelligence/systemd-vulnerability-leads-to-denial-of-service-on-linux/
>>
>> https://www.infosecurity-magazine.com/news/linux-systemd-vulnerability-dns
>>
>> https://nvd.nist.gov/vuln/detail/CVE-2018-15686
>> https://nvd.nist.gov/vuln/detail/CVE-2018-15687
>> https://nvd.nist.gov/vuln/detail/CVE-2018-15688
>> https://www.theregister.co.uk/2017/07/05/linux_systemd_grants_root_to_invalid_user_accounts/
>>
>>
>> That just a handful during the last two years, which most people should
>> be able to find with a simple search engine query.
>>
> 
> I found a neat resource today.
> 
> "systemd"
> 
> https://scan.coverity.com/projects/350
> 
>    484,654 lines of code.
> 
> https://scan.coverity.com/projects/sysvinit
> 
>     30,497 lines of code.
> 
> https://scan.coverity.com/projects/upstart
> 
>    115,822 lines of code.
> 
> https://scan.coverity.com/projects/firefox
> 
>  8,214,791 line of code. 101 CWE instances.
> 
> I think that means I should stop using my browser :-)

It's more likely you have a bug, but you can always use elinks, quite
good browser :P

-- 

 //Aho

[toc] | [prev] | [next] | [standalone]

#51510 — [again] software complexity

>>>>> Paul <nospam@needed.invalid> writes:
>>>>> J.O. Aho wrote:

 >> The larger code base, the higher risk for vulnerabilities and
 >> systemd has been having security vulnerabilities quite often
 >> compared with the other init systems

[...]

 > I found a neat resource today.

 > "systemd" https://scan.coverity.com/projects/350

 >    484,654 lines of code.

[...]

 > https://scan.coverity.com/projects/firefox

 >  8,214,791 line of code.  101 CWE instances.

 > I think that means I should stop using my browser :-)

	Not necessarily, but you can certainly weight the features that
	Firefox offers versus the amount of code it uses for that.
	(And Firefox /does/ by default run code that likely is useless
	to you, if not outright harmful; see, e. g., [1].)

	And similarly for Systemd, BIND, Gnome, and whatever other
	software one may consider using.

	Case in point: I was using Firefox for years before I became
	aware (rather accidently) that it asks Google's permission for
	every website I access.  And it took a non-trivial amount of
	time to learn how to disable that "feature."

	I'm afraid that at this point I have better things to spend my
	time on than learning what kind of "perfectly sensible things"
	Systemd does behind my back to ensure "proper operation" of my
	system.  (Given that it was proper way before Systemd already.)

[1] http://ghacks.net/2017/02/12/ghacks-net-firefox-user-js-config-0-11-is-out/

PS.  FWIW, for casual Web reading I've switched to Lynx for quite some
	time now, keeping Firefox around mainly for online payments.

-- 
FSF associate member #7257  Pandora's Box -- Christofori / Funky Brains

[toc] | [prev] | [next] | [standalone]

#51512

Paul <nospam@needed.invalid> writes:

> J.O. Aho wrote:
>> On 11/3/18 7:34 PM, James Moe wrote:
>>> On 11/2/18 12:50 AM, J.O. Aho wrote:
>>>
>>>> The reason to avoid systemd is that it's a big security vulnerability
>>>> risk and it eats up GNU applications.
>>>>
>>>   Wild accusations without a hint of proof.
>>
>> The larger code base, the higher risk for vulnerabilities and systemd
>> has been having security vulnerabilities quite often compared with the
>> other init systems
>>
>> https://blog.trendmicro.com/trendlabs-security-intelligence/systemd-vulnerability-leads-to-denial-of-service-on-linux/
>> https://www.infosecurity-magazine.com/news/linux-systemd-vulnerability-dns
>> https://nvd.nist.gov/vuln/detail/CVE-2018-15686
>> https://nvd.nist.gov/vuln/detail/CVE-2018-15687
>> https://nvd.nist.gov/vuln/detail/CVE-2018-15688
>> https://www.theregister.co.uk/2017/07/05/linux_systemd_grants_root_to_invalid_user_accounts/
>>
>> That just a handful during the last two years, which most people should
>> be able to find with a simple search engine query.
>>
>
> I found a neat resource today.
>
> "systemd"
>
> https://scan.coverity.com/projects/350
>
>    484,654 lines of code.

I saw this a while back, so I went to git and downloaded
systemd.  It was tiny.

These counts look bogus to me, I think they are including
all the services that have been adjusted to work better with systemd.

-- 
Dan Espen

[toc] | [prev] | [next] | [standalone]

#51513 — [again] software complexity

>>>>> Dan Espen <dan1espen@gmail.com> writes:
>>>>> Paul <nospam@needed.invalid> writes:

[...]

 >> I found a neat resource today.

 >> "systemd" https://scan.coverity.com/projects/350

 >> 484,654 lines of code.

 > I saw this a while back, so I went to git and downloaded systemd.
 > It was tiny.

	The size of the main function, or even the entire compilation
	unit it resides in, is a poor estimate of the program complexity.
	As it makes possible to "reduce complexity" of any program by
	moving its code into a library and just having "main" comprise a
	single "do_everything ()" call to said library.

	Resident set size (RSS) is a way better estimate, and, as was
	shown in previous discussions, Systemd PID 1 RSS is about an
	order of magnitude larger than that of SysVinit PID 1.

	Lastly, Systemd is more complex simply by the virtue of doing
	more than SysVinit does.  Whether the user does or does not need
	that "more" (and hence desires to deal with the "costs" it incurs)
	is up for the user to decide.

 > These counts look bogus to me, I think they are including all the
 > services that have been adjusted to work better with systemd.

	"Systemd" may refer to different things in different contexts.
	Without specific clarification, I see no reason to exclude, say,
	the "systemd-journal-remote" component from "Systemd."

-- 
FSF associate member #7257  np. Chipped'n'Buried -- Crimson King

[toc] | [prev] | [next] | [standalone]

#51514

On 11/4/18 1:46 PM, Dan Espen wrote:
> Paul <nospam@needed.invalid> writes:
> 
>> J.O. Aho wrote:
>>> On 11/3/18 7:34 PM, James Moe wrote:
>>>> On 11/2/18 12:50 AM, J.O. Aho wrote:
>>>>
>>>>> The reason to avoid systemd is that it's a big security vulnerability
>>>>> risk and it eats up GNU applications.
>>>>>
>>>>   Wild accusations without a hint of proof.
>>>
>>> The larger code base, the higher risk for vulnerabilities and systemd
>>> has been having security vulnerabilities quite often compared with the
>>> other init systems
>>>
>>> https://blog.trendmicro.com/trendlabs-security-intelligence/systemd-vulnerability-leads-to-denial-of-service-on-linux/
>>> https://www.infosecurity-magazine.com/news/linux-systemd-vulnerability-dns
>>> https://nvd.nist.gov/vuln/detail/CVE-2018-15686
>>> https://nvd.nist.gov/vuln/detail/CVE-2018-15687
>>> https://nvd.nist.gov/vuln/detail/CVE-2018-15688
>>> https://www.theregister.co.uk/2017/07/05/linux_systemd_grants_root_to_invalid_user_accounts/
>>>
>>> That just a handful during the last two years, which most people should
>>> be able to find with a simple search engine query.
>>>
>>
>> I found a neat resource today.
>>
>> "systemd"
>>
>> https://scan.coverity.com/projects/350
>>
>>    484,654 lines of code.
> 
> I saw this a while back, so I went to git and downloaded
> systemd.  It was tiny.
> 
> These counts look bogus to me, I think they are including
> all the services that have been adjusted to work better with systemd.
> 
$ git clone https://github.com/systemd/systemd.git
$ tot=0; for l in `find systemd/src/ -type f -exec wc -l {} \; | sed
's/\([0-9]*\) .*/\1/'`; do tot=$(($l + $tot)); done; echo $tot
485877

So systemd has grown and there is a bunch of other files that belongs to
the project which hasn't been counted at all.

-- 

 //Aho

[toc] | [prev] | [next] | [standalone]

#51517

"J.O. Aho" <user@example.net> writes:

> On 11/4/18 1:46 PM, Dan Espen wrote:
>> Paul <nospam@needed.invalid> writes:
>> 
>>> J.O. Aho wrote:
>>>> On 11/3/18 7:34 PM, James Moe wrote:
>>>>> On 11/2/18 12:50 AM, J.O. Aho wrote:
>>>>>
>>>>>> The reason to avoid systemd is that it's a big security vulnerability
>>>>>> risk and it eats up GNU applications.
>>>>>>
>>>>>   Wild accusations without a hint of proof.
>>>>
>>>> The larger code base, the higher risk for vulnerabilities and systemd
>>>> has been having security vulnerabilities quite often compared with the
>>>> other init systems
>>>>
>>>> https://blog.trendmicro.com/trendlabs-security-intelligence/systemd-vulnerability-leads-to-denial-of-service-on-linux/
>>>> https://www.infosecurity-magazine.com/news/linux-systemd-vulnerability-dns
>>>> https://nvd.nist.gov/vuln/detail/CVE-2018-15686
>>>> https://nvd.nist.gov/vuln/detail/CVE-2018-15687
>>>> https://nvd.nist.gov/vuln/detail/CVE-2018-15688
>>>> https://www.theregister.co.uk/2017/07/05/linux_systemd_grants_root_to_invalid_user_accounts/
>>>>
>>>> That just a handful during the last two years, which most people should
>>>> be able to find with a simple search engine query.
>>>>
>>>
>>> I found a neat resource today.
>>>
>>> "systemd"
>>>
>>> https://scan.coverity.com/projects/350
>>>
>>>    484,654 lines of code.
>> 
>> I saw this a while back, so I went to git and downloaded
>> systemd.  It was tiny.
>> 
>> These counts look bogus to me, I think they are including
>> all the services that have been adjusted to work better with systemd.
>> 
> $ git clone https://github.com/systemd/systemd.git
> $ tot=0; for l in `find systemd/src/ -type f -exec wc -l {} \; | sed
> 's/\([0-9]*\) .*/\1/'`; do tot=$(($l + $tot)); done; echo $tot
> 485877
>
> So systemd has grown and there is a bunch of other files that belongs to
> the project which hasn't been counted at all.

That's way more than just systemd.
A quick look shows fsck, hostname, journal, libudev, all kinds of stuff
that have nothing to do with starting  services.

-- 
Dan Espen

[toc] | [prev] | [next] | [standalone]

#51520

On 11/4/18 5:17 PM, Dan Espen wrote:
> "J.O. Aho" <user@example.net> writes:
> 
>> On 11/4/18 1:46 PM, Dan Espen wrote:
>>> Paul <nospam@needed.invalid> writes:
>>>
>>>> J.O. Aho wrote:
>>>>> On 11/3/18 7:34 PM, James Moe wrote:
>>>>>> On 11/2/18 12:50 AM, J.O. Aho wrote:
>>>>>>
>>>>>>> The reason to avoid systemd is that it's a big security vulnerability
>>>>>>> risk and it eats up GNU applications.
>>>>>>>
>>>>>>   Wild accusations without a hint of proof.
>>>>>
>>>>> The larger code base, the higher risk for vulnerabilities and systemd
>>>>> has been having security vulnerabilities quite often compared with the
>>>>> other init systems
>>>>>
>>>>> https://blog.trendmicro.com/trendlabs-security-intelligence/systemd-vulnerability-leads-to-denial-of-service-on-linux/
>>>>> https://www.infosecurity-magazine.com/news/linux-systemd-vulnerability-dns
>>>>> https://nvd.nist.gov/vuln/detail/CVE-2018-15686
>>>>> https://nvd.nist.gov/vuln/detail/CVE-2018-15687
>>>>> https://nvd.nist.gov/vuln/detail/CVE-2018-15688
>>>>> https://www.theregister.co.uk/2017/07/05/linux_systemd_grants_root_to_invalid_user_accounts/
>>>>>
>>>>> That just a handful during the last two years, which most people should
>>>>> be able to find with a simple search engine query.
>>>>>
>>>>
>>>> I found a neat resource today.
>>>>
>>>> "systemd"
>>>>
>>>> https://scan.coverity.com/projects/350
>>>>
>>>>    484,654 lines of code.
>>>
>>> I saw this a while back, so I went to git and downloaded
>>> systemd.  It was tiny.
>>>
>>> These counts look bogus to me, I think they are including
>>> all the services that have been adjusted to work better with systemd.
>>>
>> $ git clone https://github.com/systemd/systemd.git
>> $ tot=0; for l in `find systemd/src/ -type f -exec wc -l {} \; | sed
>> 's/\([0-9]*\) .*/\1/'`; do tot=$(($l + $tot)); done; echo $tot
>> 485877
>>
>> So systemd has grown and there is a bunch of other files that belongs to
>> the project which hasn't been counted at all.
> 
> That's way more than just systemd.
> A quick look shows fsck, hostname, journal, libudev, all kinds of stuff
> that have nothing to do with starting  services.

Those are parts which systemd has eaten up of other projects and are now
used directly by systemd.

-- 

 //Aho

[toc] | [prev] | [next] | [standalone]

#51521

"J.O. Aho" <user@example.net> writes:

> On 11/4/18 5:17 PM, Dan Espen wrote:
>> "J.O. Aho" <user@example.net> writes:
>> 
>>> On 11/4/18 1:46 PM, Dan Espen wrote:
>>>> Paul <nospam@needed.invalid> writes:
>>>>
>>>>> J.O. Aho wrote:
>>>>>> On 11/3/18 7:34 PM, James Moe wrote:
>>>>>>> On 11/2/18 12:50 AM, J.O. Aho wrote:
>>>>>>>
>>>>>>>> The reason to avoid systemd is that it's a big security vulnerability
>>>>>>>> risk and it eats up GNU applications.
>>>>>>>>
>>>>>>>   Wild accusations without a hint of proof.
>>>>>>
>>>>>> The larger code base, the higher risk for vulnerabilities and systemd
>>>>>> has been having security vulnerabilities quite often compared with the
>>>>>> other init systems
>>>>>>
>>>>>> https://blog.trendmicro.com/trendlabs-security-intelligence/systemd-vulnerability-leads-to-denial-of-service-on-linux/
>>>>>> https://www.infosecurity-magazine.com/news/linux-systemd-vulnerability-dns
>>>>>> https://nvd.nist.gov/vuln/detail/CVE-2018-15686
>>>>>> https://nvd.nist.gov/vuln/detail/CVE-2018-15687
>>>>>> https://nvd.nist.gov/vuln/detail/CVE-2018-15688
>>>>>> https://www.theregister.co.uk/2017/07/05/linux_systemd_grants_root_to_invalid_user_accounts/
>>>>>>
>>>>>> That just a handful during the last two years, which most people should
>>>>>> be able to find with a simple search engine query.
>>>>>>
>>>>>
>>>>> I found a neat resource today.
>>>>>
>>>>> "systemd"
>>>>>
>>>>> https://scan.coverity.com/projects/350
>>>>>
>>>>>    484,654 lines of code.
>>>>
>>>> I saw this a while back, so I went to git and downloaded
>>>> systemd.  It was tiny.
>>>>
>>>> These counts look bogus to me, I think they are including
>>>> all the services that have been adjusted to work better with systemd.
>>>>
>>> $ git clone https://github.com/systemd/systemd.git
>>> $ tot=0; for l in `find systemd/src/ -type f -exec wc -l {} \; | sed
>>> 's/\([0-9]*\) .*/\1/'`; do tot=$(($l + $tot)); done; echo $tot
>>> 485877
>>>
>>> So systemd has grown and there is a bunch of other files that belongs to
>>> the project which hasn't been counted at all.
>> 
>> That's way more than just systemd.
>> A quick look shows fsck, hostname, journal, libudev, all kinds of stuff
>> that have nothing to do with starting  services.
>
> Those are parts which systemd has eaten up of other projects and are now
> used directly by systemd.

Yeah, I looked closer.
Someone was very busy.
Not sure how I feel about that.

-- 
Dan Espen

[toc] | [prev] | [next] | [standalone]

#51519

On 04/11/2018 12:46, Dan Espen wrote:
> These counts look bogus to me, I think they are including
> all the services that have been adjusted to work better with systemd.

s/better//barely at all and much worse/


-- 
"If you don’t read the news paper, you are un-informed. If you read the 
news paper, you are mis-informed."

Mark Twain

[toc] | [prev] | [next] | [standalone]

#51511

"J.O. Aho" <user@example.net> writes:

> On 11/3/18 7:34 PM, James Moe wrote:
>> On 11/2/18 12:50 AM, J.O. Aho wrote:
>> 
>>> The reason to avoid systemd is that it's a big security vulnerability
>>> risk and it eats up GNU applications.
>>>
>>   Wild accusations without a hint of proof.
>
> The larger code base, the higher risk for vulnerabilities and systemd
> has been having security vulnerabilities quite often compared with the
> other init systems
>
> https://blog.trendmicro.com/trendlabs-security-intelligence/systemd-vulnerability-leads-to-denial-of-service-on-linux/

DNS resovler.

> https://www.infosecurity-magazine.com/news/linux-systemd-vulnerability-dns

DNS.

> https://nvd.nist.gov/vuln/detail/CVE-2018-15686

Awaiting analysis, "possibly leading to".

> https://nvd.nist.gov/vuln/detail/CVE-2018-15687

This vulnerability is currently awaiting analysis.  I can't tell what's
at fault.

> https://nvd.nist.gov/vuln/detail/CVE-2018-15688

dhcp client.

> https://www.theregister.co.uk/2017/07/05/linux_systemd_grants_root_to_invalid_user_accounts/

To  exploit   the  issue,  an   attacker  would  have  to   convince  an
administrator – someone who already has  root access – to install a unit
file with an invalid user name.

> That just a handful during the last two years, which most people should
> be able to find with a simple search engine query.

I fail to see how issues entirely within daemons are "systemd problems".

-- 
Dan Espen

[toc] | [prev] | [next] | [standalone]

#51515

On 11/4/18 1:42 PM, Dan Espen wrote:
> "J.O. Aho" <user@example.net> writes:
> 
>> On 11/3/18 7:34 PM, James Moe wrote:
>>> On 11/2/18 12:50 AM, J.O. Aho wrote:
>>>
>>>> The reason to avoid systemd is that it's a big security vulnerability
>>>> risk and it eats up GNU applications.
>>>>
>>>   Wild accusations without a hint of proof.
>>
>> The larger code base, the higher risk for vulnerabilities and systemd
>> has been having security vulnerabilities quite often compared with the
>> other init systems
>>
>> https://blog.trendmicro.com/trendlabs-security-intelligence/systemd-vulnerability-leads-to-denial-of-service-on-linux/
> 
> DNS resovler.

Part of nss-systemd


>> https://www.infosecurity-magazine.com/news/linux-systemd-vulnerability-dns
> 
> DNS.

Part of nss-systemd


>> https://nvd.nist.gov/vuln/detail/CVE-2018-15686
> 
> Awaiting analysis, "possibly leading to".

Pottering has a tradition to not analyse vulnerabilities and want to fix
things in quiet, but someone from the systemd team seems to have
reported this security vulnerability.

>> https://nvd.nist.gov/vuln/detail/CVE-2018-15687
> 
> This vulnerability is currently awaiting analysis.  I can't tell what's
> at fault.
> 
>> https://nvd.nist.gov/vuln/detail/CVE-2018-15688
> 
> dhcp client.

which is part of libsystemd.

>> https://www.theregister.co.uk/2017/07/05/linux_systemd_grants_root_to_invalid_user_accounts/
> 
> To  exploit   the  issue,  an   attacker  would  have  to   convince  an
> administrator – someone who already has  root access – to install a unit
> file with an invalid user name.

No, it can be a misconfiguration (written the wrong username), user that
has been removed, user never been created. Nowadays much of large
computer parks are handled by tools like salt, chef, puppet to push out
changes and it happens sometimes you may miss to run a job on a machine
say creating a user and another day someone else just pushed out the
custom systemd unit and there you got an attack vector.


>> That just a handful during the last two years, which most people should
>> be able to find with a simple search engine query.
> 
> I fail to see how issues entirely within daemons are "systemd problems".

It's not daemons, it's the systemd container to run the daemon in and
parts of these do run in the PID1 which compromises your whole system if
there is a vulnerability...

-- 

 //Aho

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | alt.os.linux

csiph-web