<html><head></head><body><div>I can't directly and fully address all of the nuances but ...</div><div><br></div><div>All of the inits that use a scripting language that run in a shell require a fully working system to launch the shell. Debian and RHEL worked around this with dash and nash, very limited shells that could run init scripts. That was a step in the right direction. But the desire to have as many system services running with similar strict security controls as is found in the kernel is a reason to work for a different way to init the system.</div><div><br></div><div>By using a compiled init, and specifically one that uses all the same, and only the same libs used by the kernel build, it puts the init startup closer (in a sense) to the kernel and the kernel level security. For systems that need to be hardened, apparmor/selinux security is mandatory and an init that runs almost within the security tool start up process will have a tighter security process as nothing will be started in the wild.</div><div><br></div><div>It's not a perfect system as there are ways that jailbreak kernel security. Most involve bugs in glibc or the kernel itself. Those get found and fixed (usually) pretty quickly. So using systemd, and it uses glibc (and some other libs that are "core" to modern Linux systems), fixes to glibc fix systemd as well (I'm ignoring the built-in bugs that all code brings).</div><div><br></div><div>It's not a guarantee of better security but it's an opportunity for such.</div><div><br></div><div>Can other inits do the same. Of course those that follow a similar process will. Can a scripted init do it? Maybe if the all of the shell parts used were under the same level of kernel security that is being worked with using systemd. The shell can only fork a process under special circumstances and that requires special blessings, etc...</div><div><br></div><div>On Tue, 2015-12-08 at 11:39 -0500, leam hall wrote:</div><blockquote type="cite"><pre>At this point I'm echoing what I heard. Admittedly, the source was
reliable but also had probably just heard me complain about systemd. I
don't think the context was "only systemd" can do this, but that it
did it much better than init scripts.
Like I said, I've not proven it fully, but was interested to have
heard at least one positive comment.
On Tue, Dec 8, 2015 at 11:34 AM, James Sumners <<a href="mailto:james.sumners@gmail.com">james.sumners@gmail.com</a>> wrote:
<blockquote type="cite">
Such as? As far as I'm aware it just uses cgroups:
<a href="https://www.kernel.org/doc/Documentation/cgroups/">https://www.kernel.org/doc/Documentation/cgroups/</a>
<a href="https://sysadmincasts.com/episodes/14-introduction-to-linux-control-groups-cgroups">https://sysadmincasts.com/episodes/14-introduction-to-linux-control-groups-cgroups</a>
Which is completely scriptable.
On Tue, Dec 8, 2015 at 10:56 AM, leam hall <<a href="mailto:leamhall@gmail.com">leamhall@gmail.com</a>> wrote:
<blockquote type="cite">
Okay, I finally heard one positive comment on systemd. It allows some
of the more granular kernel security controls that init scripts don't.
Not that I'm totally happy, but this is something to go look more at.
Leam
--
Mind on a Mission
_______________________________________________
Ale mailing list
<a href="mailto:Ale@ale.org">Ale@ale.org</a>
<a href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a>
See JOBS, ANNOUNCE and SCHOOLS lists at
<a href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a>
</blockquote>
--
James Sumners
<a href="http://james.sumners.info/">http://james.sumners.info/</a> (technical profile)
<a href="http://jrfom.com/">http://jrfom.com/</a> (personal site)
<a href="http://haplo.bandcamp.com/">http://haplo.bandcamp.com/</a> (band page)
_______________________________________________
Ale mailing list
<a href="mailto:Ale@ale.org">Ale@ale.org</a>
<a href="http://mail.ale.org/mailman/listinfo/ale">http://mail.ale.org/mailman/listinfo/ale</a>
See JOBS, ANNOUNCE and SCHOOLS lists at
<a href="http://mail.ale.org/mailman/listinfo">http://mail.ale.org/mailman/listinfo</a>
</blockquote>
</pre></blockquote></body></html>