New security features in systemd
summary
systemd shifts privilege work from setuid binaries into services and API calls: a clean-environment executor spawns privileged actions, empower adds root-equivalent capabilities to a transient shell, and systemd-nsresourced allocates transient UID ranges (64K reported) for rootless containers while systemd-mountfsd permits mounting signed images tied to a kernel keyring. varlink is used for simple JSON-over-Unix-socket control (works in initrd), polkit still mediates policy so password prompts and D-Bus complexity remain for some flows.
AI-written summary · about
chapters (8)
- 0:00Unix security limitations
- 2:10Evolution of privilege models
- 7:15Systemd as a secure service
- 13:11Granting granular access
- 17:56The role of polkit
- 21:52Unprivileged containers
- 26:05Building containers demo
- 31:48Future directions and Varlink
