From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 31147 invoked from network); 5 Jul 2021 15:09:48 -0000 Received: from minnie.tuhs.org (45.79.103.53) by inbox.vuxu.org with ESMTPUTF8; 5 Jul 2021 15:09:48 -0000 Received: by minnie.tuhs.org (Postfix, from userid 112) id 8A2CF9CA3A; Tue, 6 Jul 2021 01:09:46 +1000 (AEST) Received: from minnie.tuhs.org (localhost [127.0.0.1]) by minnie.tuhs.org (Postfix) with ESMTP id 330949C9F1; Tue, 6 Jul 2021 01:09:03 +1000 (AEST) Received: by minnie.tuhs.org (Postfix, from userid 112) id A87959C9F1; Tue, 6 Jul 2021 01:08:59 +1000 (AEST) Received: from sdaoden.eu (sdaoden.eu [217.144.132.164]) by minnie.tuhs.org (Postfix) with ESMTPS id 447AF9C9F0 for ; Tue, 6 Jul 2021 01:08:58 +1000 (AEST) Received: from kent.sdaoden.eu (kent.sdaoden.eu [10.5.0.2]) by sdaoden.eu (Postfix) with ESMTPS id 4E23C16059; Mon, 5 Jul 2021 17:08:56 +0200 (CEST) Received: by kent.sdaoden.eu (Postfix, from userid 1000) id 894F011C17; Mon, 5 Jul 2021 17:08:54 +0200 (CEST) Date: Mon, 05 Jul 2021 17:08:54 +0200 Author: Steffen Nurpmeso From: Steffen Nurpmeso To: "Theodore Ts'o" Message-ID: <20210705150854.gtvCp%steffen@sdaoden.eu> In-Reply-To: References: <20210702213648.GW817@mcvoy.com> <396911b232bae5938068a14fe0f7181e@firemail.de> Mail-Followup-To: "Theodore Ts'o" , Tony Finch , tuhs@minnie.tuhs.org User-Agent: s-nail v14.9.22-170-g4fc3932ea4 OpenPGP: id=EE19E1C1F2F7054F8D3954D8308964B51883A0DD; url=https://ftp.sdaoden.eu/steffen.asc; preference=signencrypt BlahBlahBlah: Any stupid boy can crush a beetle. But all the professors in the world can make no bugs. Subject: Re: [TUHS] [tuhs] The Unix shell: a 50-year view X-BeenThere: tuhs@minnie.tuhs.org X-Mailman-Version: 2.1.26 Precedence: list List-Id: The Unix Heritage Society mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: tuhs@minnie.tuhs.org Errors-To: tuhs-bounces@minnie.tuhs.org Sender: "TUHS" Theodore Ts'o wrote in : |On Sun, Jul 04, 2021 at 09:10:49PM +0100, Tony Finch wrote: |> Dan Cross wrote: |>> |>> Systemd is both good and bad. |> |> I thought this article was well-informed and informative, but VERY long: |> https://blog.darknedgy.net/technology/2020/05/02/0/ |> "systemd, 10 years later: a historical and technical retrospective" | |This is also a really good talk, by Benno Rice. Benno is a FreeBSD |developer, and has served on the FreeBSD Core Team. He gave this talk |at Linux.Conf.au 2019, and it was a repeat of a talk he gave at BSDCan |2018, entitled "The Tragedy of Systemd" ("Tragedy" in the title was |used in the Greek drama context): | | https://www.youtube.com/watch?v=o_AIw9bGogo | |It's a pretty fair talk about the why systemd came up, and what we |might be able to learn from systemd. His closing line was, which I |think is quite good was: | | "What I would challenge every one here is to look at systemd, and | try find one thing you like --- and then go try to implement it." Disclaimer: i .. have not .. seen this. Everybody may use systemd until they die, my very personal concern is only that the infrastructure boils down to be unusable without it. Also as noone cares, just a few voices here and there, even more so. Many small tools exist that can do things, but as systemd grows they do not, they are not extended to follow suit Linux kernel features. I mean, i could hack instead of complaining, but as i use unshare(1) not docker/systemd i find it unpleasant that i have to use capsh(1) in addition for example instead of simply feeding unshare(1) also with the capabilities. For systemd users this is just a single line, and often programs come with readily prepared unit files, take iwd for example [Service] Type=dbus BusName=net.connman.iwd ExecStart=@libexecdir@/iwd [taken from source not installed base as not installed, no systemd here.] NotifyAccess=main LimitNPROC=1 I have cgroups yes, but unshare(1) does not do that by itself. So my shell script wrapper moves the PID by itself, which it is, essentially. Restart=on-failure I have a cron based watchdog on the server. (Which never had to trigger in >5 years of operation.) But yes... CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW Not unshare. I am about to add this via capsh(1). PrivateTmp=true So private tmp directories only via boxing into overlayfs views, but not as it is done here. NoNewPrivileges=true Capabilities not yet. Maybe one should go and write an unshare which can this too. DevicePolicy=closed DeviceAllow=/dev/rfkill rw ProtectHome=yes ProtectSystem=strict ProtectControlGroups=yes ProtectKernelModules=yes You see systemd making touchdowns, and i mean it. Because only it can. And i played football with my feet. ConfigurationDirectory=iwd StateDirectory=iwd StateDirectoryMode=0700 Granted, all these tortured administrators have a life way easier by using systemd and just adjusting the unit, if at all needed. Easier to just browse and copy+paste. I have to take back my iwd complaint about syslog. It is just they did not bother at all. This Intel program uses the Intel "ell" (Embedded Linux library), and whereas that offers ell/log.c: * l_log_set_ident: ell/log.c:LIB_EXPORT void l_log_set_ident(const char *ident) ell/log.c: * l_log_set_handler: ell/log.c:LIB_EXPORT void l_log_set_handler(l_log_func_t function) ell/log.c: * l_log_set_null: ell/log.c:LIB_EXPORT void l_log_set_null(void) ell/log.c: * l_log_set_stderr: ell/log.c:LIB_EXPORT void l_log_set_stderr(void) ell/log.c: * l_log_set_syslog: ell/log.c:LIB_EXPORT void l_log_set_syslog(void) ell/log.c: * l_log_set_journal: ell/log.c:LIB_EXPORT void l_log_set_journal(void) ell/test.c: l_log_set_stderr(); ell/log.h:void l_log_set_ident(const char *ident); ell/log.h:void l_log_set_handler(l_log_func_t function); ell/log.h:void l_log_set_null(void); ell/log.h:void l_log_set_stderr(void); ell/log.h:void l_log_set_syslog(void); ell/log.h:void l_log_set_journal(void); they use #?0|kent:iwd-1.15$ grep -r l_log_set tools/hwsim.c: l_log_set_stderr(); tools/probe-req.c: l_log_set_stderr(); client/main.c: l_log_set_stderr(); src/main.c: l_log_set_stderr(); wired/main.c: l_log_set_stderr(); One could at least be happy they did not fixate "journal", maybe. Anyhow, the actual error output is for developers only. Bitrot everywhere. So just jump on the train that delivers and pass the rest. --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt)