Re: Three steps we could take to make supply chain attacks a bit harder
On Sat, Mar 30, 2024 at 06:58:05PM +0100, Kevin Kofler via devel wrote:
Neal Gompa wrote:
> Note that dlopen() doesn't fix the problem of the giant libsystemd in
> the first place. It just obfuscates the true dependency graph of
> libsystemd.
At least it (hopefully) means liblzma will not be opened if you do not use
an API that needs liblzma. But it makes it even harder to tell whether
liblzma will end up being loaded or not.
> Long ago (I think like ~10 years ago), libsystemd was actually several
> separate smaller libraries. Perhaps we could consider asking upstream
> to switch back to that model?
+1
This comes up occasionally, and the main reason to not do this is that
systemd code has a lot of helpers that are used across a lot of the
codebase and we end up with recursive calls between many of the different
"components". So if tried to split things, we'd either need to remove
a lot of polish, or copy code, or have the shared code duplicated.
Some of those split-out libraries would probably end up embedding
almost all of some of the other ones. libsystemd now consists of 12
parts (sd-bus, sd-daemon, sd-device, sd-event, sd-hwdb, sd-id128,
sd-journal, sd-login, sd-netlink, sd-network, sd-path, sd-resolve)
and it'd be a lot of work to untangle, and the overall footprint would
likely grow.
Zbyszek