Slashdot Mirror

← Back to Stories (view on slashdot.org)

Systemd Absorbs "su" Command Functionality

Posted by timothy on from the big-and-professional-like-gnu dept.

jones_supa writes: With a pull request systemd now supports a su command functional and can create privileged sessions that are fully isolated from the original session. The su command is seen as bad because what it is supposed to do is ambiguous. On one hand it's supposed to open a new session and change a number of execution context parameters, and on the other it's supposed to inherit a lot concepts from the originating session. Lennart Poettering's long story short: "`su` is really a broken concept. It will given you kind of a shell, and it's fine to use it for that, but it's not a full login, and shouldn't be mistaken for one." The replacement command provided by systemd is machinectl shell.

23 of 747 comments (clear)

  1. Bullshit by mysidia · · Score: 5, Insightful

    Lennart Poettering's long story short: "`su` is really a broken concept

    Declaring established concepts as broken so you can "fix" them.

    Su is not a broken concept; it's a long well-established fundamental of BSD Unix/Linux. You need a shell with some commands to be run with additional privileges in the original user's context.

    If you need a full login you invoke 'su -' or 'sudo bash -'

    Deciding what a full login comprises is the shell's responsibility, not your init system's job.

    1. Re:Bullshit by LoRdTAW · · Score: 5, Insightful

      su is not only for root. it has a dual purpose: switch user or super user. Sometimes you might have to run a command as another user. So if you need to login as Gary you $su gary and type in Gary's password.

    2. Re:Bullshit by Microlith · · Score: 4, Insightful

      Su is not a broken concept; it's a long well-established fundamental of BSD Unix/Linux.

      You're pretty much making an argument to tradition here. The correct thing to do would be to counter his claims:

      what "su" is supposed to do is very unclear. On one hand it's supposed to open a new session and change a number of execution context parameters (`uid`, `gid`, `env`, ...), and on the other it's supposed to inherit a lot concepts from the originating session (`tty`, `cgroup`, `audit`, ...). Since this is so weakly defined it's a really weird mix&match of old and new paramters.

      I would like more detail from him on why and how it's broken, and how his replacement is truly different from "su -" but since it doesn't appear to be mutually exclusive with the use of "su" or "su -", other than typical reactionary hate I don't see what the problem is.

    3. Re:Bullshit by gweihir · · Score: 4, Insightful

      Deciding what a full login comprises is the shell's responsibility, not your init system's job.

      And certainly not the job of one Poettering, who still has not produced one piece of good software in his life.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    4. Re:Bullshit by Anonymous Coward · · Score: 5, Insightful

      He bring new code, but brings nothing new. That's called re-inventing the wheel, and in Poettering's case, the old wheels worked better and didn't go flat as often, and were easier for average people to fix.

    5. Re:Bullshit by pla · · Score: 4, Insightful

      other than typical reactionary hate I don't see what the problem is.

      You now have your init daemon providing an alternate attack pathway for gaining privileged access to the system, in a way that completely circumvents the well-established (and monitored by most IDSs) auditing capabilities of the platform.

      I'd call that a problem, but YMMV.

    6. Re:Bullshit by bytesex · · Score: 4, Insightful

      The problem is at step 5): su isn't confusing. It's a lame excuse to get your way.

      --
      Religion is what happens when nature strikes and groupthink goes wrong.
  2. What's with all the awkward systemd command names? by RabidReindeer · · Score: 5, Insightful

    I know systemd sneers at the old Unix convention of keeping it simple, keeping it separate, but that's not the only convention they spit on. God intended Unix (Linux) commands to be cryptic things 2-4 letters long (like "su", for example). Not "systemctl", "machinectl", "journalctl", etc. Might as well just give everything a 47-character long multi-word command like the old Apple commando shell did.

    Seriously, though, when you're banging through system commands all day long, it gets old and their choices aren't especially friendly to tab completion. On top of which why is "machinectl" a shell and not some sort of hardware function? They should have just named the bloody thing command.com.

  3. Hang on a minute... by Anonymous Coward · · Score: 5, Insightful

    Well, let me explain some of the problems that I've had with su.

    Oh wait. I've never had problems with su. Ever. What is up with this???

    1. Re:Hang on a minute... by magamiako1 · · Score: 4, Insightful

      Welcome to IT. Where the youngin's come in and rip up everything that was built for decades because "oh that's too complicated".

    2. Re:Hang on a minute... by TheGratefulNet · · Score: 4, Insightful

      its the other way around. we used to have small, simple programs that did not take whole systems to build and gigs of mem to run in. things were easier to understand and concepts were not overdone a hundred times, just because 'reasons'.

      now, we have software that can't be debugged well, people who are current software eng's have no attention span to fix bugs or do proper design, older guys who DO remember 'why' are no longer being hired and we can't seem to stand on our giants' shoulders anymore. again, because 'reasons'.

      --

      --
      "It is now safe to switch off your computer."
    3. Re:Hang on a minute... by Blymie · · Score: 4, Insightful

      I honestly, seriously sometimes wonder if systemd is Skynet... or, a way for Skynet to 'waken'.

      And if Pottering isn't just a T3 from the future or some such, working to prepared the existing internet for it to awaken.

      I mean, really -- honestly, he has essentially re-written the entire userland, as one package, maintained by one. More kernel patches are next.

  4. Security by slashways · · Score: 5, Insightful

    Doing everything as systemd do, and adding 'su', is likely a new security threat.

    1. Re:Security by phantomfive · · Score: 5, Insightful

      Can you explain how it is "likely a new security threat" or is it simply FUD?

      Bruce Schneier (in Cryptography Engineering) pointed out that to keep something secure, you need to keep it simple (because exploits hide in complexity). When you have a large, complex, system that does a lot of different things, there's a high chance that there are security flaws. If you go to DefCon, speakers will actually say that one of the things they look for when doing 'security research' is a large, complex interface.

      So that's the reason. When you see a large complex system running as root, it means hackers will be root.

      --
      "First they came for the slanderers and i said nothing."
  5. systemd is a broken concept by QuietLagoon · · Score: 4, Insightful

    ... Lennart Poettering's long story short: "`su` is really a broken concept. ...

    So every command that Poettering thinks may be broken is added to the already bloated systemd?

    .
    How long before there is nothing left to GNU/Linux besides the Linux kernel and systemd?

  6. Re:quality engineering by QuietLagoon · · Score: 5, Insightful
    Poettering is following the philosophy that has created nearly every piece of bloated software that is in existence today: the design is not complete unless there is nothing more than can be added. Bloated software feeds upon the constant influx of new features, regardless of whether those new features are appropriate or not. They are new therefore they are justified.

    .
    You know you have achieved perfection in design, not when you have nothing more to add, but when you have nothing more to take away.
    -- Antoine de Saint-Exupery

  7. Re:What's with all the awkward systemd command nam by silas_moeckel · · Score: 4, Insightful

    So what you're saying is you like powershell?

    Aliases are not realy a fix you can not reliably write shell script with them and stay portable.

    --
    No sir I dont like it.
  8. I, for one, welcome this addition... by tlambert · · Score: 5, Insightful

    I, for one, welcome this addition... every privilege escalation path you add is good for literally years of paid contract work.

  9. Re:BSD is looking better all the time by 0123456 · · Score: 5, Insightful

    That's a bit rude... I think Poettering's main motivation has been to simply modernize Linux.

    Where 'modernize' is a codeword for 'shit all over'.

  10. Re:BSD is looking better all the time by phantomfive · · Score: 5, Insightful

    That's a bit rude... I think Poettering's main motivation has been to simply modernize Linux.

    Yeah, that's true. He sees features people want, and he builds them. For example, Debian distro builders were frustrated writing init scripts, so Poettering made something that filled the need of those distro builders. That's why it got adopted, because it contained features they wanted.

    The problem of course is that he doesn't understand the Unix way, especially when it comes to good interfaces between code (IMNSHO).

    The people who like systemd tend to like the features.......the people who dislike it, the architecture.

    --
    "First they came for the slanderers and i said nothing."
  11. Re:BSD is looking better all the time by menkhaura · · Score: 4, Insightful

    Please remember devuan (http://www.devuan.org), a Debian fork which aims to do away with systemd and all that bullcrap. It's picking up steam, and I believe things like these make it more and more worth it to help the new fork.

    --
    Stupidity is an equal opportunity striker.
    Fellow slashdotter Bill Dog
  12. Thinking about leaving any systemd linux behind by wnfJv8eC · · Score: 5, Insightful

    I am really tired of systemd. So really tired of the developers shoving that shit down the linux throat. It's not pretty, it seems to grow out of control, taking on more and more responsibility .... I don't even have an idea how to look at my logs anymore. Nor how to clear the damn things out! Adding toolkits should make the system as clear to understand as it was, not more complex. If it gets any worse it might as well be Windows 10! init was easy to understand, easy to use. syslog was easy read easy to understand and easy to clear. All this bull about "it's a faster startup" is just ... well bull. I'm using a computer 20 times faster than I was a decade ago. You think 20 seconds off a minute startup is an achievement? It's seconds on a couple of days uptime; big f*cking deal. Redhat, Fedora, turn away from the light and return to your roots!

  13. Ever stop and ask why? by walterbyrd · · Score: 5, Insightful

    This has been going on for years, and has years more to go. This is a long term strategy.

    But why?

    Why has Red Hat been replacing standard Linux components with Red Hat components, when the Red Hat stuff is worse?

    Why isn't systemd optional? It is just an init replacement, right? Why does Red Hat care which init you use?

    Why is systemd being tied to so many other components?

    Why binary logging? Who asked for that?

    Why throw away POSIX, and the entire UNIX philosophy? Clearly you do not have to do that just to replace init.

    Why does Red Hat instantly berate anybody who does not like systemd? Why the barrage of ad hominem attacks systemd critics?

    I think there is only one logical answer to all of those questions, and it's glaringly obvious.