Additionally, this is not likely to stop, since they took an init system that was (mostly) written in a memory-safe language (bash) and rewrote it in a memory-unsafe language (C++), thus enabling a whole class of systemic security issues that will keep popping up in the future over and over again as well. This is one of the design decisions behind systemd that irks me the most.
While Bash is memory safe, it is also very error prone to write and the potential of shooting yourself in the foot with it is rather big, especially with bigger scripts and considering these are executed mostly with root privileges, bash is not an ideal choice either.
I'd prefer if systemd was a Rust project for sure, but they went with C, presumably to remain consistent with the kernel, GNOME and most lower-level Linux system software, (also, Rust was pre-1.0 at the time).
That said I agree they should have picked Go instead /s.
I don't really have an opinion on what language should have been picked instead, though OCaml may be a good candidate.
EDIT: or maybe as PID 2, per https://github.com/omisego/ewallet/issues/108 , though I'd be interested in the idea of writing an OTP application that can reap zombies and forward signals.
Isn't that basically what SysVinit and a good-sized chunk of the management tooling in Linux is?
To their credit, Bash is a _weird_ language, but it's not going to corrupt memory when it crashes, and its failure modes are pretty well understood by the distro maintainers writing those scripts.
https://en.wikipedia.org/wiki/Systemd#History
> Go was publicly announced in November 2009,[29] and version 1.0 was released in March 2012.
https://en.wikipedia.org/wiki/Go_(programming_language)#Hist...
The brand-new language that Google just announced last year was probably not considered a serious option here.
They could have even take inspiration, imagine: typed, functional, monadic init files - "systemd: avoid success at all costs" :)
Lua would have been a good candidate: memory safe, coroutine to structure the code in a concurrent-ish way if needed, and you have a configuration file parser for free (just use Lua as the configuration language, it was its very first purpose after all).
From system programming solely: libguestfs, Xen API, liquidsoap, Unison, MirageOS, google drive on fuse, 0install.
OCaml concurrency is great, and Lwt [1] would be exactly what systemd need: run daemon and poll the answer concurrently.
Ada, C++ and D would have been another great choices.
I wouldn't expect CPU-bound multithreading to be much of a concern in an init/rc system. And resource thriftiness and predictability would likely be a bigger concern.
https://en.wikipedia.org/wiki/Systemd#History
> Mozilla began sponsoring the project in 2009[16] and a nnounced it in 2010.
> The first numbered pre-alpha release of the Rust compiler occurred in January 2012.
https://en.wikipedia.org/wiki/Rust_(programming_language)#Hi...
Look, I like Rust and all, but are we really suggesting it for projects that predate public release of rustc?
Rust might be better now; my primary concern would be community size and whether I was limiting my contributor base, which Go also has as a concern. In both cases though I'd take it over C/C++ being used on such a critical project at this juncture.
In 2010, though... yeah, choices are a lot worse.
I'm not against go, other than gc and some size considerations. Given that a lot of k8s infrastructure for the likes of CoreOS and similar are written in it, it's definitely not a bad option. I think that today, and more so in late summer as async/await syntax settles, that Rust should be a first consideration for any low-level system code.
Many init systems have been created in bash, and I'd hardly call that a low level language.
And that reason is that one rarely needs to write a million lines of Bash: http://catb.org/esr/writings/unix-koans/ten-thousand.html
You underestimate my masochism and/or overestimate my sense of restraint ;)
Let's just say the language choice went from bad to equally bad.
it causes the script to terminate with an error if it encounters use of an unset variable
This seems like it needs some citation. There certainly have been bugs. I think it's legitimate to talk (with specifics!) about cultural issues with systemd's development and its impact on security. But I don't see that this statement is particularly well supported. In particular I genuinely don't know what you're referring to with respect to ignored/suppressed bugs and CVEs.
I mean, systemd is a lot of code and makes up a big chunk of the system plumbing these days. Obviously it's going to make up a big chunk of the bug budget. People don't get upset about flaws in someone's random cgroup launcher or encrypted block device manager or daemon wrapper not because those projects don't have bugs, but because basically no one uses them. Because basically everyone is using systemd!
(Just in case, this is an security issue because it enables constant dosing, as well as clears the resolver cache making spoofing easier)
(Also... gotta be honest that's sort of a vanity CVE. Note the complete lack of details in the report itself, it never saw an eyeball after it was filed. It's valid enough, but frankly I'm with Poettering on the specifics here: if we filed a CVE for every theoretically-exploitable-but-unexploited-until-fix-released crash bug the system would be beyond useless.)
Poettering is dismissive of nearly every bug. Remember when systemd would default to starting units as root when it couldn't parse the username? We're not talking about some minor piece of software like a sound multiplexing daemon, we're talking about the core userland piece of every Linux install. Bug reports on something that central should be taken seriously and with a minimum of snark.
I'm with Poettering on the specifics here: if we filed a CVE for every theoretically-exploitable-but-unexploited-until-fix-released crash bug the system would be beyond useless.
All the more reason to reduce the attack vectors and ensure that your code is well thought out, and coded defensively. That you have too many security issues to generate CVEs for each and every one is a problem in and of itself. Ten years ago how many people thought that all of these speculative execution side channel attacks were possible or practical?
I have a serious contention with the statement that systemd is the simplest possible solution for this problem. Especially since it involves not only service management, but user logins, a data bus, logging management, file system mounting, initd, and a host of other things.
Are all of those pieces necessary? Arguably yes. But not all in one system(d).
So why should I currently opt for the worse solution? Is the overall design of it promising?
> Honestly Systemd addresses the complexities of a modern system in the simplest fashion but no simpler, and that is the key.
What complexities does it address? I lost track of everything an init system is apparently responsible for.
> It works well overall and end up being more portable and consistent in the long run.
Since systemd only runs on Linux APIs, I can't figure out what this even means. There are init systems that run perfectly fine in plain POSIX environments. systemd is not one of them.
What I mean is that there are init systems that only require POSIX compliant APIs and as such are portable across systems that implement POSIX, e.g. GNU/Linux, BSD, Solaris, AIX...
systemd requires (in addition to POSIX) Linux APIs and is therefore not particularly portable by any reasonable definition of the word. You can use it if you are running a Linux kernel, and that's it.
Those are irrelevant as they can't even do basic tasks like shutting down the computer or restarting it. Feel free to find a POSIX API for Linux' reboot syscall.
Some systems also require mounting additional filesystems, again not possible in a world limited to POSIX interfaces.
Sandboxing, SELinux, ...? Not in POSIX.
And so on.
And nohup was always a hack. Now that we actually have a functioning user-level service manager keeping processes alive by throwing them at PID 1 to parent needs to go away. I really hope that systemd eventually uses subreapers to keep all user processes under the session leader.
I feel like it's weird to talk about scope creep when logind is pretty much the first system to define what a session even means on a Linux system.
We should standardize on the interfaces, avoiding hard dependencies. There is dbus for that.
As dbus user, or application, you just need some client library. As an operating system, you also need a daemon running, which is routing the messages among all the clients.
[1] - https://dbus.freedesktop.org/doc/dbus-specification.html
I am personally in the camp that doesn't mind that, Linux users should get the best possible software given their system capabilities, not the lowest common denominator one just for the sake of it. (Free)BSD developers are also not looking to make sure their stuff works with Linux, which I think it's a valid approach.
GNOME itself does exist on the BSDs, by the way knocking down the argument of systemd being a hard dependency of GNOME along the way.
If this claim were true it still is beside the point of my comment, that systemd itself has a "Linux only, and we don't care" approach, and dbus for the moment is not that.
> GNOME itself does exist on the BSDs
Yes the ports tree is a wonderful place for those things to sit for those who are interested and for a larger portion to not bother installing them. I don't know how many patches they applied to get it working or what the cost and effect of those patches may be over time.
The 'Imperialistic Culture' you speak of is one of those made-up things that systemd haters keep repeating, but has no basis in reality.
> They pushed for Gnome to have a hard dependency on it so that everyone would be _forced_ to use it instead of just letting it be accepted by merits.
Again, another fairy tail.
> They have a track record of labeling serious bugs as non-issues, ignoring them, or just not filing them as CVEs. Serious issues keep coming up.
A) This is par for the course in Linux software. See also: Linux kernel. One side you have is a bunch of security bros running around trying to fluff up their resumes and trying to turn themselves into heros. And on the other side you have devs working hard on various features and bugs and being resentful that most of their work goes unnoticed while stuff they already fixed is thrown back in their face.
B) Many of the bugs that make it onto Reddit/Hacker news are going to be ones that are largely changes in configuration defaults or behaviors that break things and are meant to be configured by the operating system designers that use it, not end users.
C) This level of scrutiny never existed before for low-level Linux features. The multitude of redundent and terrible shell scripts that made up the majority of functionality that systemd project seeks to replace was always a swampy mess of broken functionality and bad code. Having each and every major linux distribution rewriting 90% of it from scratch in a completely un-portable and estoric way didn't help matters.
Linux advocates actually went so far as to praising the fact that even though half of the scripts in their OS were completely broken and the OS still worked fine was a testament to it's robustness.
The fact that now, finally, after decades of this crap people can now track bugs related to low-level Linux userland 'plumbing' is actually a good thing.
> It is easier to configure and is convenient to have one holistic system in a lot of ways, but...
On the sysvinit side you had thousands and thousands of lines bunch of procedural code of dubious quality that is endlessly rewritten by hundreds of different teams with vastly differing levels of competency and success using a general purpose language for configuration. It was so unportable that you couldn't even use anything but the most basic and trivial (also broken) init scripts from one distribution to another without herculean levels of effort.
On the other side you have a even driven OS configuration and management engine that allows people to describe the state they want the OS to be in via a domain specific configuration language. It has managed to standardize the low level plumbing for Linux operating systems and allows distributions to share improvements with one another in a way that was previously impossible.
If people want a alternative to gain in popularity they need learn what systemd does and understand why Linux distribution makers switched to it. Then produce something of their own that takes those positive features and improves on it further.
All the hand waiving about 'Imperialism via releasing open source software to the public' is infantile.
The upside of all of this is that it's going to be a hell of a lot easier to make systemd unit files portable then it is to make Linux init shell scripts. There isn't any reason why a more capable init system wouldn't be able to parse existing unit files and know then how to start and manage the services and applications that use them... So the effort to move away from systemd should be significantly less then the effort to move to systemd.
You are repeating the there-is-only-sysvinit-and-systemd fallacy, pointed out years ago by the Uselessd Guy and decried by many others since but (alas!) still going strong today in this very discussion, and ironically you are doing it whilst erroneously ascribing things to systemd that it was intentionally designed not to be. systemd was explicitly designed not to be an event-driven system. The wholly event-driven system was Upstart, and in practice it turned out to be a problem. Lennart Poettering xyrself discussed the problem, as did some of the Debian Technical Committee members during the Debian Hoo-Hah.
* https://web.archive.org/web/20190306213420/https://uselessd....
The imperialism part is likely due to score creep into parts they just can't handle well enough. systemd-resolved for example had terrible security and functionality issues still after it was being deployed to many distros. These were simple "point a fuzzer at it and watch it crash" issues which should not be seen in a DNS resolver these days.
Maybe it's not for systemd to decide what I'm meant to do. If changes to behavior that they only meant for operating system maintainers to rely on results in angry end-users, they probably made the wrong assumption.
> On the sysvinit side you had thousands and thousands of lines bunch of procedural code of dubious quality that is endlessly rewritten by hundreds of different teams with vastly differing levels of competency and success using a general purpose language for configuration.
Meanwhile, I have ~400 LOC of init scripts (including service scripts) on my daily driver, an init system with <1% the LOC of systemd, and plain text readable system logs. I agree that hand waving about "imperialism" isn't very constructive, but on the other hand I don't think that misrepresenting the alternatives to systemd and exaggerating their faults is particularly useful either, nor is pretending that sysvinit is the only alternative. A lot of people have thought "sysvinit sucks" and done something about it.
They're probably just busy.
And calling the "imperialistic" is annoying them, so you've destroyed your political capital with them.
The most recent gripe I have is that systemd people can't even do randomness properly and even use non-cryptographic randomness for DNS transaction IDs (ok probably benign). But just boggles the mind.
It is easier to configure and is convenient to have one holistic system in a lot of ways, but...
They pushed for Gnome to have a hard dependency on it so that everyone would be _forced_ to use it instead of just letting it be accepted by merits.
They have a track record of labeling serious bugs as non-issues, ignoring them, or just not filing them as CVEs. Serious issues keep coming up.
I don't think the code is high-quality, but even more than that I have a problem with the people being controlling, dismissive, and deceptive.