Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #189637

Re: Embarrassing security bug in systemd

From <tomas@tuxteam.de>
Newsgroups linux.debian.user
Subject Re: Embarrassing security bug in systemd
Date 2017-12-07 11:40 +0100
Message-ID <uU1KW-4TL-3@gated-at.bofh.it> (permalink)
References <uTQcO-62s-9@gated-at.bofh.it> <uTQFQ-6bk-7@gated-at.bofh.it> <uU0OS-4hE-11@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Dec 07, 2017 at 03:03:44AM -0600, Dave Sherohman wrote:
> On Thu, Dec 07, 2017 at 11:26:45AM +1300, Ben Caradoc-Davies wrote:
> > Special privileges have been granted to console users for as long as I can
> > remember, long before systemd, because they have physical access to the
> > machine. Console users typically are also permitted to mount, unmount, and
> > eject removable media, and have access to audio devices.
> 
> I think this is a key point that's been overlooked in the complaints
> about this behavior:  It has nothing to do with systemd.

No. It has to do with polkit & friends. On my system (which is a pretty
"classic" setup: no systemd, but also as little as possible from all
this more "modern" desktop stuff, which I don't like very much [1]),
/sbin/halt *wants* me to be root. This isn't inherently more secure
(or less) but just The Way it Is (TM) -- an heritage from times *every*
user on an Unix system was remote.

The policy kit and its descendants try to make a guess whether the
user is "physically present" to allow them to shut down the computer.
As others have pointed out, this does make sense (as long as the
above guess is sufficiently accurate, that is), because the user
can pull the cord/extract the batteries/smash the box anyway.

Now to that guess: for your vanilla PC/laptop/tablet/smartphone
class of machine, if the user is at the console or the local
terminal, implying presence is a pretty accurate guess. That's
why the default configuration comes shipped as it is. If you
are installing an ATM/voting computer/AS400, I'd hope that, as
a system integrator you *know what you are doing* and set the
defaults appropriately.

So all is well. This isn't a bug. For someone coming from
"traditional" Unix, this might be unexpected (and has thus some
potential for damage), but that expectation hasn't been broken
by systemd this time.

There are Linux distros for big IBM iron: anyone cares to have
a look how the default policy settings are there? (As that's
SuSE's realm, mainly, I'd guess they are similar enough to
RedHat that they're using something along these lines).

Cheers

[1] Don't take me wrong. Those desktop thingies have their place.
   Just not on "my" desktop, dammit :-)
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlopFhsACgkQBcgs9XrR2kaUcwCeMgdvqAWryzSSxE5W3r8+Ol2o
NE8AnAlA3wWeb2dJ4xdTN5Cyy+3Al/PT
=xit+
-----END PGP SIGNATURE-----

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Embarrassing security bug in systemd Urs Thuermann <urs@isnogud.escape.de> - 2017-12-06 23:20 +0100
  Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-06 23:50 +0100
    Re: Embarrassing security bug in systemd Ben Caradoc-Davies <ben@transient.nz> - 2017-12-07 00:40 +0100
      Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-07 03:50 +0100
        Re: Embarrassing security bug in systemd deloptes <deloptes@gmail.com> - 2017-12-07 07:30 +0100
  Re: Embarrassing security bug in systemd Ben Caradoc-Davies <ben@transient.nz> - 2017-12-06 23:50 +0100
    Re: Embarrassing security bug in systemd Dave Sherohman <dave@sherohman.org> - 2017-12-07 10:40 +0100
      Re: Embarrassing security bug in systemd Tixy <tixy@yxit.co.uk> - 2017-12-07 11:30 +0100
        Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-07 11:50 +0100
          Re: Embarrassing security bug in systemd Jimmy Johnson <field.engineer@gmail.com> - 2017-12-09 03:50 +0100
            Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-09 17:50 +0100
              Re: Embarrassing security bug in systemd Jimmy Johnson <field.engineer@gmail.com> - 2017-12-10 10:00 +0100
                Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-10 20:40 +0100
      Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-07 11:40 +0100
      Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-07 16:00 +0100
        Re: Embarrassing security bug in systemd Michael Biebl <biebl@debian.org> - 2017-12-07 20:30 +0100
          Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-08 09:20 +0100
          Re: Embarrassing security bug in systemd deloptes <deloptes@gmail.com> - 2017-12-08 12:40 +0100
            Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-08 13:40 +0100
              Re: Embarrassing security bug in systemd deloptes <deloptes@gmail.com> - 2017-12-08 21:40 +0100
            Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-08 17:10 +0100
              Re: Embarrassing security bug in systemd Curt <curty@free.fr> - 2017-12-08 19:10 +0100
              Re: Embarrassing security bug in systemd Menelaos Maglis <mmaglis@metacom.gr> - 2017-12-08 19:40 +0100
              Re: Embarrassing security bug in systemd Menelaos Maglis <mmaglis@metacom.gr> - 2017-12-08 19:50 +0100
                Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-08 20:50 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-08 21:20 +0100
                Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-09 09:10 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 11:20 +0100
                Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-09 19:40 +0100
                Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-09 20:30 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 22:00 +0100
                Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-10 00:40 +0100
                Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-10 10:40 +0100
                Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-10 11:20 +0100
                Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-10 12:40 +0100
                Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-10 16:10 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-11 15:10 +0100
                Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-09 21:10 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 21:10 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-08 21:50 +0100
                Re: Embarrassing security bug in systemd John Hasler <jhasler@newsguy.com> - 2017-12-08 22:30 +0100
                Re: Embarrassing security bug in systemd Glenn English <ghe2001@gmail.com> - 2017-12-09 02:50 +0100
                Re: Embarrassing security bug in systemd John Hasler <jhasler@newsguy.com> - 2017-12-09 06:50 +0100
                Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-09 09:20 +0100
                Re: Embarrassing security bug in systemd Jonathan Dowland <jmtd@debian.org> - 2017-12-09 09:10 +0100
                Re: Embarrassing security bug in systemd Christian Seiler <christian@iwakd.de> - 2017-12-15 13:30 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-15 14:10 +0100
                Re: Embarrassing security bug in systemd John Hasler <jhasler@newsguy.com> - 2017-12-15 16:00 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-08 21:50 +0100
                Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-08 22:40 +0100
                Re: Embarrassing security bug in systemd John Hasler <jhasler@newsguy.com> - 2017-12-09 00:30 +0100
                Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-09 10:00 +0100
        Re: Embarrassing security bug in systemd Dave Sherohman <dave@sherohman.org> - 2017-12-08 10:00 +0100
      Re: Embarrassing security bug in systemd Cindy-Sue Causey <butterflybytes@gmail.com> - 2017-12-08 23:40 +0100
        Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-09 00:30 +0100
          Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 01:20 +0100
            Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-09 11:40 +0100
              Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-09 15:30 +0100
                Re: Embarrassing security bug in systemd The Wanderer <wanderer@fastmail.fm> - 2017-12-10 01:00 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-10 22:20 +0100
              Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-09 17:50 +0100
                Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-09 18:20 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-09 21:20 +0100
                Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-10 12:00 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-10 17:10 +0100
                Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-10 20:40 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-10 21:30 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-10 23:10 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-11 00:10 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-11 00:50 +0100
                Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-11 12:30 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-11 13:40 +0100
                Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-11 14:40 +0100
                Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-10 21:50 +0100
                Re: Embarrassing security bug in systemd Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2017-12-11 13:00 +0100
                Re: Embarrassing security bug in systemd <tomas@tuxteam.de> - 2017-12-11 13:40 +0100
                Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-11 16:30 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-10 23:10 +0100
                Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-11 01:30 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-11 04:40 +0100
                Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-11 06:10 +0100
                Re: Embarrassing security bug in systemd Gene Heskett <gheskett@shentel.net> - 2017-12-11 07:40 +0100
                Rust? (and a wordsmithing question) (was: Re: Embarrassing security bug in systemd) rhkramer@gmail.com - 2017-12-11 15:40 +0100
                Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing  security bug in systemd) Darac Marjal <mailinglist@darac.org.uk> - 2017-12-11 16:00 +0100
                Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing security bug in systemd) rhkramer@gmail.com - 2017-12-11 18:30 +0100
                Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing  security bug in systemd) Joe <joe@jretrading.com> - 2017-12-11 16:30 +0100
                Re: Rust? (and a wordsmithing question) "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2017-12-11 17:40 +0100
                Re: Rust? (and a wordsmithing question) David Wright <deblis@lionunicorn.co.uk> - 2017-12-11 20:10 +0100
                Re: Rust? (and a wordsmithing question) <tomas@tuxteam.de> - 2017-12-12 09:30 +0100
                Re: Rust? (and a wordsmithing question) "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2017-12-12 17:30 +0100
                Re: Rust? (and a wordsmithing question) <tomas@tuxteam.de> - 2017-12-12 17:50 +0100
                Re: Rust? (and a wordsmithing question) Curt <curty@free.fr> - 2017-12-12 18:20 +0100
                Re: Rust? (and a wordsmithing question) Richard Hector <richard@walnut.gen.nz> - 2017-12-13 04:40 +0100
                Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing security bug in systemd) rhkramer@gmail.com - 2017-12-11 18:30 +0100
                Re: Rust? (and a wordsmithing question) (was: Re: Embarrassing  security bug in systemd) David Wright <deblis@lionunicorn.co.uk> - 2017-12-12 19:10 +0100
                UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in  systemd) Jason <electron@emypeople.net> - 2018-01-09 05:10 +0100
                Re: UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in  systemd) Christian Groessler <chris@groessler.org> - 2018-01-09 16:00 +0100
                Re: UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in  systemd) Roberto C. Sánchez <roberto@debian.org> - 2018-01-09 16:30 +0100
                Re: UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in  systemd) Christian Groessler <chris@groessler.org> - 2018-01-09 18:10 +0100
                Re: UID 1000 on Raspberry Pi (Was: Re: Embarrassing security bug in  systemd) Erik Christiansen <dvalin@internode.on.net> - 2018-01-10 04:50 +0100
          Re: Embarrassing security bug in systemd Menelaos Maglis <mmaglis@metacom.gr> - 2017-12-09 01:40 +0100
            Re: Embarrassing security bug in systemd Mark Fletcher <mark27q1@gmail.com> - 2017-12-09 03:10 +0100
              Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-09 10:50 +0100
        Re: Embarrassing security bug in systemd Ric Moore <wayward4now@gmail.com> - 2017-12-09 16:40 +0100
          Re: Embarrassing security bug in systemd Tom Furie <tom@furie.org.uk> - 2017-12-09 17:10 +0100
            Re: Embarrassing security bug in systemd Ben Caradoc-Davies <ben@transient.nz> - 2017-12-09 22:10 +0100
          Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-09 18:20 +0100
  Re: Embarrassing security bug in systemd Michael Stone <mstone@debian.org> - 2017-12-07 00:00 +0100
    Re: Embarrassing security bug in systemd Joe <joe@jretrading.com> - 2017-12-07 09:40 +0100
  Re: Embarrassing security bug in systemd Glenn English <ghe2001@gmail.com> - 2017-12-07 00:10 +0100
  Re: Embarrassing security bug in systemd Brian <ad44@cityscape.co.uk> - 2017-12-07 00:10 +0100
    Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-07 03:50 +0100
  Re: Embarrassing security bug in systemd Michael Lange <klappnase@freenet.de> - 2017-12-07 00:20 +0100
    Re: Embarrassing security bug in systemd "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2017-12-07 00:50 +0100
      Re: Embarrassing security bug in systemd Michael Stone <mstone@debian.org> - 2017-12-07 01:20 +0100
        Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-07 03:50 +0100
      Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-07 02:10 +0100
        Re: Embarrassing security bug in systemd Nicholas Geovanis <nickgeovanis@gmail.com> - 2017-12-07 03:40 +0100
          Re: Embarrassing security bug in systemd Eric S Fraga <e.fraga@ucl.ac.uk> - 2017-12-07 08:30 +0100
    Re: Embarrassing security bug in systemd Michael Biebl <biebl@debian.org> - 2017-12-07 00:50 +0100
      Re: Embarrassing security bug in systemd Dejan Jocic <jodejka@gmail.com> - 2017-12-07 02:40 +0100
      Re: Embarrassing security bug in systemd Menelaos Maglis <mmaglis@metacom.gr> - 2017-12-08 10:40 +0100
        Re: Embarrassing security bug in systemd Roberto C. Sánchez <roberto@debian.org> - 2017-12-08 13:40 +0100
          Re: Embarrassing security bug in systemd deloptes <deloptes@gmail.com> - 2017-12-08 20:10 +0100
  Re: Embarrassing security bug in systemd David Wright <deblis@lionunicorn.co.uk> - 2017-12-07 01:10 +0100
  Re: Embarrassing security bug in systemd Eric S Fraga <e.fraga@ucl.ac.uk> - 2017-12-07 08:30 +0100
  Re: Embarrassing security bug in systemd David Baron <dbaron770@gmail.com> - 2017-12-07 08:50 +0100

csiph-web