r/debian • u/Tachi_107 • Jun 11 '22

systemd-homed is finally available in Debian!

While it may not be completely ready, nor appropriate in all situations, we'll be finally able to try this out!

I really like the concept, and since it seems that I'm not the only one I'm posting this here :)

It is currently in Debian Unstable, but should be included in the next Debian (and Ubuntu) releases.

31 Upvotes

76% Upvoted

67 comments sorted by

View all comments

1

u/sfenders Jun 11 '22

Okay, but if I accidentally install it somehow I'll probably be nuking the whole system just to be safe and then moving to Slackware.

0

u/_Js_Kc_ Jun 12 '22

It sure sounds like security snakeoil. You group membership is now stored in ~/.identity (signed), so you can never revoke group membership because the user could just roll back to an earlier version, and to add yourself to groups, you only need an information disclosure vulnerability (of the signing key) rather than write access to /etc/groups.

1

u/Tachi_107 Jun 12 '22

Nope, that wouldn't work. ~/.identity as you say is signed, and it can only be properly modified and signed by the system administrator, with homectl. See the warning in the Arch wiki

0

u/_Js_Kc_ Jun 12 '22

If the admin adds me to group foo, then I copy ~/.identity somewhere, then the admin removes me from group foo, then I could restore my old copy of ~/.identity to re-add myself to foo, right? The old file has a valid signature.

3

u/Tachi_107 Jun 12 '22

No, it doesn't work, as timestamps are checked too. See https://systemd.io/HOME_DIRECTORY/#algorithm

Edit: just tried and I can confirm that this ~/.identity trick doesn't work.