On Wed, Apr 3, 2024 at 7:57 PM Andres Freund <andres@anarazel.de> wrote:
Hi,
As most will know by now, the way xz debacle was able to make sshd vulnerable was through a dependency from sshd to libsystemd and then from libsystemd to liblzma. One lesson from this is that unnecessary dependencies can still increase risk.
Yeah, I think that's something to consider for every dependency added. I think we're fairly often protected against "adding too many libraries" because many libraries simply don't exist for all the platforms we want to build on. But it's nevertheless something to think about each time.
It's worth noting that we have an optional dependency on libsystemd as well.
Openssh has now integrated [1] a patch to remove the dependency on libsystemd for triggering service manager readyness notifications, by inlining the necessary function. That's not hard, the protocol is pretty simple.
I suspect we should do the same. We're not even close to being a target as attractive as openssh, but still, it seems unnecessary.
+1.
When the code is this simple, we should definitely consider carrying it ourselves. At least if we don't expect to need *other* functionality from the same library in the future, which I doubt we will from libsystemd.
An argument could be made to instead just remove support, but I think it's quite valuable to have intra service dependencies that can rely on the server actually having started up.
If we remove support we're basically just asking most of our linux packagers to add it back in, and they will add it back in the same way we did it. I think we do everybody a disservice if we do that. It's useful functionality.