Hi Neale, The packages in arch are built with the systemd security model in mind. You are changing that pretty fundamental assumption by ripping out systemd, logind & co. and that will have an effect on the overall security of your system. At least give the packages a chance to respond to that changed assumption by rebuilding them, telling them that there won't be any systemd. That way they can adapt their configuration and permissions during install (not that I think many will;-). Ideally you would also go through all PKGBUILDs with a fine toothed comb to find settings that need to be adapted from the arch-defaults before rebuilding. Of course you also need to be aware of the security issues that were fixed by logind. This is mostly (remote) users being able to snoop on local users by recording keystrokes or even audio/video of them at the machine. People argue that this is not much of an issue on a single-user machine. You also will need to run xorg as root, which is a huge piece of code known to be written before security was a concern to developers. Logind allows to run that as a normal user (provided other conditions are met as well). TL;DR: Replacing systemd in arch is nothing that should be attempted in an idle afternoon. Best Regards, Tobias On Tue, Jan 6, 2015 at 12:42 AM, Neale Pickett <neale@xxxxxxxxxx> wrote: > I'm not going to remove any groups, but I want to make sure I'm not > configuring mdev to set ownership to a group that may not exist in the > future. I will probably create a new group called "hardware" that will > allow users to access audio, video, serial, and USB storage devices, and > use Posix ACLs to set individual permissions for daemons like mpd. Things > that are packaged now should continue to work (or not) as normal with > Arch's default filesystem groups if they're using my mdev/runit setup. > > I do have systemd installed. Too many things depend on it for me to remove > it. If I could remove or recompile X11, tcpdump (libusb), nfs-utils > (device-mapper), and procps-ng, I think I might be able to remove the > systemd package. But I have enough work already, I don't need to go > recompiling stuff just to get rid a single dependency! :) > > On Mon Jan 05 2015 at 3:47:37 PM Leonid Isaev <lisaev@xxxxxxxxxxxx> wrote: > >> On Mon, Jan 05, 2015 at 09:59:51PM +0000, Neale Pickett wrote: >> > This is very helpful. Thank you! >> >> If you go with your own group list, check configs of your daemons to see >> which >> groups they expect. Some (e.g. dnsmasq) will call useradd and groupadd in >> their >> .install files. But syslog-ng, for example, by default creates log files >> 640 >> root:log... >> >> Also, I just wonder, do you have systemd installed at all? >> >> Cheers, >> -- >> Leonid Isaev >> GPG fingerprints: DA92 034D B4A8 EC51 7EA6 20DF 9291 EE8A 043C B8C4 >> C0DF 20D0 C075 C3F1 E1BE 775A A7AE F6CB 164B 5A6D >>
