Kevin Kofler via devel wrote:
> Dominique Martinet wrote:
>> Before making each of these safer we should make sshd not link with so
>> many things in the first place.
> 
> Indeed. E.g., Arch Linux does not transitively link sshd against liblzma. 
> Fedora does because of this innocuous-looking patch:
> https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-7.4p1-systemd.patch
> which is what ultimately allowed this to happen. This drags in libsystemd 
> for sd_notify, and libsystemd is linked to way too much stuff including 
> liblzma. Either we need a split libsdnotify that contains only sd_notify, or 
> we should just stop using sd_notify at all.

Upstream openssh-portable has a proposed patch which simply
implements the sdnotify protocol directly.  That would
provide the benefits with none of the over-linking risk.

    https://bugzilla.mindrot.org/show_bug.cgi?id=2641#c13

It could use some review from distro folks familiar with
sshd systemd integration.

(The wider point about splitting the sdnotify functionality
is still quite useful, to avoid everyone re-implementing the
same thing and possibly adding bugs in _that_ process.)

-- 
Todd

Attachment: signature.asc
Description: PGP signature

--
_______________________________________________
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue

Reply via email to