Re: Security lessons from liblzma - libsystemd - Mailing list pgsql-hackers

From Tom Lane
Subject Re: Security lessons from liblzma - libsystemd
Date
Msg-id 385938.1712181535@sss.pgh.pa.us
Whole thread Raw
In response to Re: Security lessons from liblzma - libsystemd  (Magnus Hagander <magnus@hagander.net>)
Responses Re: Security lessons from liblzma - libsystemd
List pgsql-hackers
Magnus Hagander <magnus@hagander.net> writes:
> On Wed, Apr 3, 2024 at 7:57 PM Andres Freund <andres@anarazel.de> wrote:
>> Openssh has now integrated [1] a patch to remove the dependency on
>> libsystemd
>> for triggering service manager readyness notifications, by inlining the
>> necessary function. That's not hard, the protocol is pretty simple.
>> I suspect we should do the same. We're not even close to being a target as
>> attractive as openssh, but still, it seems unnecessary.

> +1.

I didn't read the patch, but if it's short and stable enough then this
seems like a good idea.  (If openssh and we are using such a patch,
that will probably be a big enough stake in the ground to prevent
somebody deciding to change the protocol ...)

>> An argument could be made to instead just remove support, but I think it's
>> quite valuable to have intra service dependencies that can rely on the
>> server actually having started up.

> If we remove support we're basically just asking most of our linux
> packagers to add it back in, and they will add it back in the same way we
> did it. I think we do everybody a disservice if we do that. It's useful
> functionality.

Yeah, that idea seems particularly silly in view of the desire
expressed earlier in this thread to reduce the number of patches
carried by packagers.  People packaging for systemd-using distros
will not consider that this functionality is optional.

            regards, tom lane



pgsql-hackers by date:

Previous
From: Tom Lane
Date:
Subject: Re: Detoasting optionally to make Explain-Analyze less misleading
Next
From: Tom Lane
Date:
Subject: Re: Cutting support for OpenSSL 1.0.1 and 1.0.2 in 17~?