Bug#1056279: Bug#1057220: Looks like the systemctl links are gone but not the pm-utils ones
On Mon, Dec 18, 2023 at 10:09:10AM +0100, Marc Haber wrote: > Thanks for the work, I was never able to fully grasp the issue and the > inner workings of the solution, and thank you for allowing me to remain > silent during the process of finding and implementing the solution. I'd like to report that it Works For Me. I downgraded molly-guard and systemd to trixie and then did an upgrade, which worked. Greetings Marc -- - Marc Haber | "I don't trust Computers. They | Mailadresse im Header Leimen, Germany| lose things."Winona Ryder | Fon: *49 6224 1600402 Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421
Bug#1056279: Bug#1057220: Looks like the systemctl links are gone but not the pm-utils ones
On Sun, Dec 17, 2023 at 09:55:13PM -0800, Francois Marier wrote: > With respect to the presence of the real commands in the path, I'm not too > worried about it personally. Agreed. Molly-Guard is not a security tool, it provides basic safety against things like "typed shutdown -r now in the wrong window". Most people just give the same commands every time, for me it happens to be shutdown -r now, and if molly-guard reliably catches that then its job is done. It was never designed to prevent fully deliberate shots in one's foot by typing things like shutdown.someweirdsuffixthatnooneeverremembers -r now. Thanks for the work, I was never able to fully grasp the issue and the inner workings of the solution, and thank you for allowing me to remain silent during the process of finding and implementing the solution. Greetings Marc -- - Marc Haber | "I don't trust Computers. They | Mailadresse im Header Leimen, Germany| lose things."Winona Ryder | Fon: *49 6224 1600402 Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421
Bug#1056279: Bug#1057220: Looks like the systemctl links are gone but not the pm-utils ones
Thank you Helmut and Chris for the helpful discussion. I have finally found some time to review your comments and the proposed molly-guard patches. While I'm still not 100% confident I understand the problem (and the fix), the solution you have settled on makes sense to me. With respect to the presence of the real commands in the path, I'm not too worried about it personally. I do agree it's unfortunate and it would be great if we could do this reliably without putting the diverted binary within easy reach, but at the end of the day, molly-guard will never catch all possible mistakes. As Helmut pointed out, it's already missing some cases (and it's always been possible to "init 6" as well), but I think it still provides a useful service if it catches the most common cases of accidental reboots. I had a similar dilemma for another package I maintain (safe-rm) and I've decided there to focus on the most common cases again to reduce complexity, and improve reliability. I will leave this for a few days in case others like Simó want to also chime in, but otherwise I am planning to upload to experimental this week and then unstable a few days later. Again many thanks for all of the work that has gone into solving this thorny problem. Francois
