Despite being a security critical component, systemd doesn't even seem to have a proper security announcement release process. For example, there was a remote code execution vuln discovered in their DHCP client in October (CVE-2018-15688).[1] The issue was fixed with a GitHub PR that failed to mention that the changes fix a remote exec vulnerability: https://github.com/systemd/systemd/pull/10518

They also have a rather informal release process. Their "release notes" are just a very long NEWS file[2] in the git repo, with notes of trivial and critical changes mishmashed together. And for some reason, to this date there is not a mention of the DHCP remote exec vuln fixed in the latest release.

I must say I don't feel too good about this project's attitude towards security. Compare this to e.g. Apache.

[1] https://www.theregister.co.uk/2018/10/26/systemd_dhcpv6_rce/

[2] https://github.com/systemd/systemd/blob/master/NEWS

That was not the first time either:

https://github.com/systemd/systemd/issues/5144

Or relying on other people to report the issues so that people patch.

https://www.openwall.com/lists/oss-security/2017/01/24/4

The tone of discussion there indeed suggests a very lax / "meh" attitude towards vulnerabilities.

While I agree that it isn't ideal -- it should be pointed out that neither does the kernel itself.

systemd is a low-level building piece for distributions - the distros are doing end-user changelogs and security notices. The target audience for their NEWS file are upstream maintainers, not users.

As if Devian has had more security reviews than systemd?

Devuan is a Linux distribution that does not ship systemd by default.

You are comparing apples and oranges.

Not really.

systemd replaces several components you would typically find as core components (multiple packages) which everything in a distro is built and depend upon, init-scripts being no exception.

Or at least it does if you present the criticism that systemd is too big.

Make up your mind: either systemd is not such a big monolith or it does in fact make sense to compare it to a minimal Linux distro.

You can’t have it both ways.

Now you're comparing fruit salad with apples. :)

1) Devuan isn't a "minimal linux distro" Its a complete fork of Debian. Co-founded by Ian Murdock, Debian's original creator, after the systemD coup.

2) Every "core component" in any system, "minimal" or otherwise, will indeed have had more security review than the systemd code base.

3) Pid 1 - Sponsored by NSA and DoD vis a vis Redhat defense contracts.

Was init?

No, but it's far less complex than systemd to the point where you can audit the code yourself and it's battle tested over the years. Also because it's so simple it was shown to us at the university so we've got essential understanding of how it works and I think they're still explaining it instead of systemd.

But systemd is more than just init. It replaces for instance daemontools, restartd or monit.

Are you saying you can trivially audit those?

Does it fully replace monit? Could you link me more info? From what I could find I didn't see anything like free disk space warnings, web interface etc.

> Does it fully replace monit?

Not fully, no but as far as I can tell, it has overlapping responsibilities.

My main thought when mentioning it, was automatic restart of services in the case of failure.

That's a fair point. However, the parent was responding to whether init - in particular - had been audited. So, bringing up other, larger projects that systemd subsumes is a bit disingenuous, imo.

The complexity of Sysvinit is orders of magnitude less than that of systemd.

The "sysvinit" binary package has had a total of 2 bug reports tagged "security" filed in Debian's bug tracker. That's over the entire history of the package that goes back to at least 2004.

If I extend the search to all packages built from the "sysvinit" source (which includes packages like initscripts and sysvinit-utils), the count increases to 8. (source: https://www.debian.org/Bugs. I'm not linking to exact queries since they take quite some time and HN has a tendency of taking down Debian's bug tracker)

Also crond, atd, and various log manipulation tools that systemd replaces.

It doesn't replace them, it just doesn't use them.

It supplants them with the same functionality.

That's literally the definition of replacement.

Indeed. Not complaining - I don't care for HN karma - but it is very odd that an easily searchable fact is being downvoted on a technical forum.

It provides inferior code and interfaces that are used instead of them.

So you're correct, in a way.

Not if you count in the god-awful shell scripts full of race conditions which it replaced.

Then it should be easy to audit!

Did you pay for an audit of sysvinit and every bash rc script it runs?

I can't think of a single init system which has been audited.

No I didn't but I can read bash so I can audit that myself and in fact over the years I did read most of those scripts. Also it's just a few lines of code compared to systemd so even one person can do it.

> I can read bash

Lol. I'm sure you're the only person on earth who can think of all the corner conditions when reading a bash script.

Auditing a shell script for security is near impossible to do.

I never said that, at the end of the day it's the same thing with audits, you can have 50 people auditing systemd and they won't find every single mistake either. What I'm saying is that simplicity limits room for mistakes and it gives more people chance to look at it and play with it. The concept is fairly straightforward.

> I can read bash

And I can read systemd unit files. That doesn't tell me anything about the security of the system in charge of running them.

https://www.cvedetails.com/product/21050/GNU-Bash.html?vendo...

> but I can read bash

And all the source code for bash and all the other tools the init-scripts invokes?