Linux

5180 readers

35 users here now

A community for everything relating to the linux operating system

Also check out !linux_memes@programming.dev

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 1 year ago

MODERATORS

Ategon@programming.dev

anzo@programming.dev

dwraf_of_ignorance@programming.dev

systemd Talks Up Automatic Boot Assessment In Light Of The Crowdstrike-Microsoft Outage (www.phoronix.com)

submitted 3 months ago by lemmee_in@lemm.ee to c/linux@programming.dev

21 comments fedilink hide all child comments

In light of the CrowdStrike-Microsoft outage/disaster that has been wreaking havoc on corporate Windows systems around the world since Friday, systemd lead developer Lennart Poettering pointed out how such a situation on Linux systems could be averted by leveraging systemd's Automatic Boot Assessment functionality.

System's Automatic Boot Assessment feature can allow for reverting to a previous version of the OS or kernel automatically when a system consistently fails to boot. With the systemd-boot bootloader and related tooling within systemd and leveraging the Boot Loader Specification, systemd Automatic Boot Assessment would make for much easier recovery in case of an incident like what happened with Microsoft Windows systems running CrowdStrike software last week.

you are viewing a single comment's thread
view the rest of the comments

[–] Morphit@feddit.uk 2 points 3 months ago (1 children)

I think having an A partition and a B partition (I'm assuming that's how SteamOS works) wouldn't help in this case. If the A partition downloaded the definition file, crashed and failed to reboot; the bootloader could failover to the B partition - which would then download the definition file, crash and fail to reboot. It would have to keep rolling back to a last known good snapshot until the update got withdrawn.

You could have an ephemeral set up that wipes /var and /etc and recreates them every boot. I don't think these EDR tools would like that very much though.

[–] Telorand@reddthat.com 1 points 3 months ago (1 children)

You could potentially block your network by disabling your router or something, so it couldn't download the bad update, but you'd have to know that was a step to prevent it (which most people didn't until it was too late).

Ostree-based systems are handy for replacing the system layer, but configs live (mostly) in userspace, and they persist.

[–] Morphit@feddit.uk 2 points 3 months ago

Well at that point, just don't install any kernel mode EDR software at all.

NixOS can be set up for impermanence where all config is recreated every boot and nothing persists besides the nix store. There's helpers for ephemeral home also, so you can have something like TailsOS. I'm sure you could do that with other distros but you'd need absolute discipline to have everything the machine needs provisioned at boot.