[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Embarrassing security bug in systemd



Am 07.12.2017 um 15:37 schrieb Roberto C. Sánchez:
> On Thu, Dec 07, 2017 at 03:03:44AM -0600, Dave Sherohman wrote:
>>
>> I no longer have any non-systemd machines handy to verify this on, but
>> my memory is that I have *always* been able to use halt/poweroff/reboot
>> commands from the console without requiring sudo or entering a password,
>> and I've been using Debian since 2000ish, well before systemd was even a
>> gleam in some programmer's eye.  /sbin/shutdown may have also been
>> freely available at the console, but I don't remember that one clearly,
>> since I didn't use it all that often once I discovered the others.
>>
> I just did a fresh install of wheezy (7.11) with all defaults.  Here is
> what happened:
> 
> testuser@debian:~$ cat /etc/debian_version
> 7.11
> testuser@debian:~$ /sbin/reboot
> reboot: must be superuser.
> testuser@debian:~$ ls -l /sbin/reboot
> lrwxrwxrwx 1 root root 4 Jul 14  2013 /sbin/reboot -> halt
> testuser@debian:~$ ls -l /sbin/halt
> -rwxr-xr-x 1 root root 15184 Jul 14  2013 /sbin/halt
> 
> The situation is basically the same for /sbin/shutdown.

Now try CTRL+ALT+DEL on the console. This will reboot your system.
See /etc/inittab:

# What to do when CTRL-ALT-DEL is pressed.
ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now


Next, try hitting the power button. This will shut down your system.
On systems with acpi support, Debian has been installing acpid +
acpi-support-base in the past. See
/etc/acpi/powerbtn-acpi-support.sh


Next install a display manager, like gdm3 or lightdm. This will allow
you shutdown/reboot the system as well.


Basically, it was a completely inconsistent mess before systemd.
Now you at least have a central place where you can configure your
system behaviour.

Michael


-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

Attachment: signature.asc
Description: OpenPGP digital signature


Reply to: