@pid_eins@mastodon.social
@pid_eins@mastodon.social avatar

pid_eins

@pid_eins@mastodon.social

⛵ I write software. ⛵

This profile is from a federated server and may be incomplete. Browse more on the original instance.

pid_eins, to random
@pid_eins@mastodon.social avatar

5️⃣ Here's the 5th installment of my series of posts highlighting key new features of the upcoming v256 release of systemd.

I am pretty sure all of you are well aware of the venerable "sudo" tool that is a key component of most Linux distributions since a long time. At the surface it's a tool that allows an unprivileged user to acquire privileges temporarily, from within their existing login sessions, for just one command, or maybe for a subshell.

"sudo" is very very useful, as it…

pid_eins,
@pid_eins@mastodon.social avatar

… the target user's UID. It allocates a new PTY for that, and then shovels data back and forth from the originating TTY and this PTY.

Or in other words: the target command is invoked in an isolated exec context, freshly forked off PID 1, without inheriting any context from the client (well, admittedly, we do propagate $TERM, but that's an explicit exception, i.e. allowlist rather than denylist).

One could say, "run0" is closer to behaviour of "ssh" than to "sudo", in many ways. Except that…

pid_eins,
@pid_eins@mastodon.social avatar

… manual clean-up is just not how security engineering should be done in 2024 anymore.

With systemd v256 we are going one step towards this. There's a new tool in systemd, called "run0". Or actually, it's not a new tool, it's actually the long existing tool "systemd-run", but when invoked under the "run0" name (via a symlink) it behaves a lot like a sudo clone. But with one key difference: it's not in fact SUID. Instead it just asks the service manager to invoke a command or shell under…

pid_eins, to random
@pid_eins@mastodon.social avatar

Credit where credit is due! I'd really like to take a minute and thank Jia Tan how they helped us to finally get sd_notify() support merged into OpenSSH upstream!

https://bugzilla.mindrot.org/show_bug.cgi?id=2641

Thank you, Jia, you rock!

pid_eins,
@pid_eins@mastodon.social avatar

@PlutoisAPlanet Urks. What a mess. I didn't know Wikipedia still allowed such anonymous edits still:

https://en.wikipedia.org/wiki/Special:Contributions/86.130.91.119

Seems that person hates a lot of stuff.

I made it a rule to never look at the wikipedia pages of systemd and my own person anymore, to not getting pissed off at the garbage that's on there. Now you made me break my own rule. 😞

pid_eins, to random
@pid_eins@mastodon.social avatar

6️⃣ Here's the 6th installment of my series of posts highlighting key new features of the upcoming v256 release of systemd.

In the 2nd installment of this series we have already discussed system and service credentials in systemd a bit. Quick recap: these are smallish blobs of data that can be passed into a service in a secure way, to parameterize, configure it, and in particular to pass secrets to it (passwords, PINs, private keys, …).

pid_eins,
@pid_eins@mastodon.social avatar

Environment variables after all suck for passing secrets, since they are by default inherited down the process tree, even across privilege changes, are placed in swappable memory, cannot be recalled, have no access control concept (i.e. not locked to the UID/GID) and so on.

There's one particularly nice facet of systemd's credentials concept: they are not just service credentials, but also system credentials.

pid_eins, to random
@pid_eins@mastodon.social avatar

1️⃣3️⃣ Here's the 13th installment of posts highlighting key new features of the upcoming v256 release of systemd.

ssh is widely established as the mechanism for controlling Linux systems remotely, both interactively and with automated tools. It not only provides means for secure authentication and communication for a tty/shell, but also does this for file transfers (sftp), and IPC communication (D-Bus or Varlink).

pid_eins,
@pid_eins@mastodon.social avatar

And ssh-via-AF_VSOCK is precisely what we are doing in systemd v256: a small new unit generator (i.e. a plugin that extends systemd's unit tree dynamically) detects if AF_VSOCK is available and sshd is installed, and if so binds AF_VSOCK/port 22 to sshd, via socket activation. Or in other words: in environments where AF_VSOCK is a thing, sshd will now just work, without any extra configuration and at minimal cost of resources (because lazy socket activation rocks).

pid_eins, to random
@pid_eins@mastodon.social avatar

Here's a fun little thing we commited to systemd the other day: the concept of .v/ directories. What do we mean by that? Many of systemd's commands that take big resource files that are often versioned (e.g. a disk image file you could pass to sysemd-nspawn's --image= switch) now learnt a magic trick if you pass a path whose last component has the suffix ".v" and is a directory. If so, the tool will iterate through the dir's contents, do a version sort and automatically pick the newest version.

pid_eins,
@pid_eins@mastodon.social avatar

If you want to learn more about this, have a look at the docs for this:

https://github.com/systemd/systemd/blob/main/man/systemd.v.xml

(sorry, currently only in the raw XML, we haven't uploaded a new version of the docbook docs in built form yet)

pid_eins, to random
@pid_eins@mastodon.social avatar

1️⃣5️⃣ Here's the 15th installment of posts highlighting key new features of the upcoming v256 release of systemd.

systemd integrates with many components of the OS. Due to this it links against various external libraries. Generic distributions – which typically enable all features a package provides – usually have to deal with relatively large dependency trees in cases like this.

pid_eins, (edited )
@pid_eins@mastodon.social avatar

All our binaries now contain an ELF "note" describing these "weak" deps that can be processed in a similar way as regular ELF dependencies.

The format of these notes is described here:

https://github.com/systemd/systemd/blob/main/docs/ELF_DLOPEN_METADATA.md

There's now work ongoing to process this data automatically at rpm and dpkg build time, so that we get the best of both worlds: "weak" dependencies and proper metadata to declare them consistently.

pid_eins, to random
@pid_eins@mastodon.social avatar

Here's another little feature we scheduled for the next systemd release. Everyone knows SSH well, and it's great to connect to hosts remotely, and even do file transfer. It's probably the single most relevant way to talk to some host for administration and various other tasks. It's a bit fragile though: it requires networking, and that even if we talk to a local VM or full OS container. But precisely networking is one of the things you might want to administer via SSH, hence you have a cyclic…

pid_eins, (edited )
@pid_eins@mastodon.social avatar

the network. AF_VSOCK is an address family that is supported on many hypervisors (including kvm/qemu), that allows talking to VMs without bothering with a real network. It's modeled after IP but can be vastly simpler since there's no routing or anything. The aforementioned generator just binds ssh to AV_VSOCK port 22, via socket activation (this is hence more or less "free"), and only if sshd is actually installed. Moreover, if a container mgr mounts /run/host/unix-export/ into the container…

pid_eins, (edited )
@pid_eins@mastodon.social avatar

…and risky dependency. But for the VM and full OS container case there's no real need to use SSH via the network: these things run on the local system, hence why bother with IP? To address that we are adding a small generator (that means: a plugin for systemd that generates units on the fly, based on system state, configuration) which binds SSH to a local AF_VSOCK socket in a VM, and to an AF_UNIX socket in a container. You can then use these to directly connect to the system without involving…

pid_eins, to random
@pid_eins@mastodon.social avatar

7️⃣ Here's the 7th installment of my series of posts highlighting key new features of the upcoming v256 release of systemd.

In systemd we put a lot of focus on operating with disk images, specifically file system images that carry an expressive GPT partition table – something that we call DDIs ("Discoverable Disk Images").

pid_eins,
@pid_eins@mastodon.social avatar

Various tools (including: systemd-nspawn, systemd-dissect, RootImage= in service files) have been updated to make use of this new IPC service, and thus can now operate without privileges. Or in other words: there's now unprivileged systems-npsawn containers. Yay!)

And that's all for today. See you soon for the 8th installment of this series.

pid_eins, to random
@pid_eins@mastodon.social avatar

Quick! Only three more days, and the All Systems Go! 2023 CfP ends! Submit now! https://cfp.all-systems-go.io/all-systems-go-2023/cfp ← ⚡️🏃🏻💨💨

siosm, to fedora
@siosm@floss.social avatar

sudo without a setuid binary or SSH over a UNIX socket: https://tim.siosm.fr/blog/2023/12/19/ssh-over-unix-socket/

I have been working on this setup as part of my investigation to reduce our reliance on setuid binaries and trying to figure out alternative for common use cases.

pid_eins,
@pid_eins@mastodon.social avatar

@siosm @lucab Inspired by this thread I decided to actually do something about this, and prepped this:

https://github.com/systemd/systemd/pull/30547

pid_eins,
@pid_eins@mastodon.social avatar

@siosm Everytime somebody says "rootless podman" something in me dies. The thing is very much root-full, given the setuid binary it calls. (ok, fcaps, but CAP_SETUID, which it asks for is is one of those caps which are effectively fully equivalent to setuid root). I wish the people involved would stop throwing around this misleading slogan, it's utter bullshit.

I mean, yes, they reduced the amount of privileged code running from user context, but it's not gone.

pid_eins,
@pid_eins@mastodon.social avatar

@siosm @lucab yeah it is suid free. High up on our todo list is turning systemd-run into a multicall binary that you can invoke via some alternative name in which case it would behave a lot like sudo, i.e. take similar args and so on. Current proposed name of the tool would be "uid0".

Its definitely one of my goals to allow distros to get rid of suid/sgid and still have a reasonably complete toolset.

pid_eins, to random
@pid_eins@mastodon.social avatar

Quiz: How many inode types are there on Linux?

You might think the answer to this is 7, i.e. regular files, directories, symlinks, block device nodes, char device nodes, fifos, and sockets. But you are actually are wrong: there's an 8th one. There's the concept of an anonymous inode on Linux which has the file type of zero. You can easily acquire fds to inodes of this type via eventfd(). If you call fstat() on such fds, then (.st_mode & S_IFMT) == 0 will hold. 🤯

pid_eins, (edited ) to random
@pid_eins@mastodon.social avatar

2️⃣ Here's the 2nd installment of my series of posts highlighting key new features of the upcoming v256 release of systemd.

This time we'll talk about encrypted credentials. Credentials are these little pieces of information that you can pass into systemd systems and into system services. They can carry secrets but also other kinds of parameters. One key feature is that they can be encrypted while at rest, locked against the system's TPM…

pid_eins,
@pid_eins@mastodon.social avatar

This functionality has been around for a while. With systemd v256 we are extending the logic with a per-user scope. The original concept after all only covered system services, decryption of the the credentials was only available to privileged service managers, and thus system services. With v256 encrypted credentials can alternatively be user-scoped, which means unprivileged users can encrypt them now in a way that ensures that only they can decrypt them again.

pid_eins, to random
@pid_eins@mastodon.social avatar

I reposted @bluca's FOSDEM talk about soft reboot earlier already. Unfortunately Mastodon doesn't allow reposting with a comment, so let's post the video a 2nd time here so that I can comment on it: I think this talk is particularly interesting as it shows a soft-reboot based online OS update on the actual Azure fleet. And that's not just technically exciting I think, but also a first: that you can actually look over Microsoft's shoulder how they make Azure work. Enjoy!

https://fosdem.org/2024/schedule/event/fosdem-2024-3282-soft-reboot-keep-your-containers-running-while-your-image-based-linux-host-gets-updated/

pid_eins, to random
@pid_eins@mastodon.social avatar

This is the good stuff:

→ https://fedoramagazine.org/create-images-directly-from-rhel-and-rhel-ubi-package-using-mkosi/

written by @zbyszek

pid_eins, to random
@pid_eins@mastodon.social avatar

9️⃣ Here's the 9th installment of my series of posts highlighting key new features of the upcoming v256 release of systemd.

I am sure you are aware of systemd-nspawn, systemd's minimal container manager focussed on full OS containers, that can boot up a Linux image from an OS in a disk image or from a directory. systemd-nspawn was originally a development tool, to make it easy for us to develop the service manager without constantly having to reboot.

Nowadays it's a lot more than that, …

pid_eins, to random
@pid_eins@mastodon.social avatar

interesting: https://fedoramagazine.org/use-systemd-cryptenroll-with-fido-u2f-or-tpm2-to-decrypt-your-disk/

pid_eins, (edited ) to random
@pid_eins@mastodon.social avatar

1️⃣4️⃣ Here's the 14th installment of posts highlighting key new features of the upcoming v256 release of systemd.

This one is going to be quick one. Previously, you had to specify a block device name when invoking systemd-cryptenroll, to specify which encrypted volume to enroll your PKCS11/TPM2/FIDO2 device to. This is now optional. If no device is specified, then the tool will now automatically look for the device behind the /var/ directory and operate on that.

pid_eins, to random
@pid_eins@mastodon.social avatar

1️⃣1️⃣ Here's the 11th installment of posts highlighting key new features of the upcoming v256 release of systemd.

There are multiple network management services in popular use on Linux. In systemd we ship systemd-networkd, and of course think it's the best choice. Weirdly, some people disagree though, and that creates problems of ownership: you either have to use one or the other network management service (i.e. either systemd-networkd OR NetworkManager), or you have to carefully make…

pid_eins, to random
@pid_eins@mastodon.social avatar

Woohoo, we just released systemd v255-rc1:

https://github.com/systemd/systemd/releases/tag/v255-rc1

What an awesome release!

pid_eins, to random
@pid_eins@mastodon.social avatar

This is such a bad bad API compat breakage:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e81cd5a983bb35dabd38ee472cf3fea1c63e0f23

It's used all over the place in userspace. In systemd we use it:

  1. to detect if a block device has partition scanning off or on
  2. In our udev test suite, to validate devices are in order
  3. udev rules use it for some feature checks (in older versions of systemd).

And it's even a frickin documented userspace API:

https://www.kernel.org/doc/html/v5.5/block/capability.html

So much about that nonsensical "we don't break userspace" kernel mantra.

pid_eins,
@pid_eins@mastodon.social avatar

Let me mention that I have sent an email to linux-block ML btw. I am not sure it went through though, can't find it on any mailing list archives.

It's the reliability and synchronous feedback I particular love about submitting bug reports, patches, and reviews via email.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • provamag3
  • mdbf
  • ngwrru68w68
  • modclub
  • magazineikmin
  • thenastyranch
  • rosin
  • khanakhh
  • InstantRegret
  • Youngstown
  • slotface
  • Durango
  • kavyap
  • DreamBathrooms
  • JUstTest
  • GTA5RPClips
  • ethstaker
  • normalnudes
  • tester
  • osvaldo12
  • everett
  • cubers
  • tacticalgear
  • anitta
  • megavids
  • Leos
  • cisconetworking
  • lostlight
  • All magazines
    •