Systemd lead developer Lennart Poettering has posted on Mastodon about their upcoming v256 release of Systemd, which is expected to include a sudo replacem...
  • NekkoDroid@programming.dev
    2910·
    8 months ago

    This isn’t exactly a “new” attack surface, so removing the attack surface that sudo (and alternatives) is, is probably a net positive.

    • jkrtn@lemmy.ml
      102·
      8 months ago

      That attack surface is not vanishing. It’s would be relocating the same attack surface to something that might have an xz library in memory.

      • NekkoDroid@programming.dev
        41·
        8 months ago
        1. The attack surface is there either way, this is just functionality repackaged that existed already before (systemd-run, which is calling into PID1)
        2. all compression libraries (actually most libraries at this point) are dlopened on demand (which was planned even before the attack, which is speculated that the attack was accelerated in timeline because he was on a timer before the change was released)