My understanding is that systemd is the parent process for all other processes running on Linux.

If systemd has been updated on production devices such as servers and the service is not restarted, what are the security implications?

What are the common attack vectors for systemd to signal it must be restarted?

The article on systemctl daemon-reexec suggests that a package update already performs restart systemd.

This suggests there is no requirement to restart systemd even though the output below displays it has been updated and may be using deleted files.

PID  | PPID | UID  | User    | Command       | Service       | Files                      
1    | 0    | 0    | root    | systemd       |               | /usr/lib64/libkmod.so.2.3.3
907  | 1    | 0    | root    | systemd-udevd | systemd-udevd | /usr/lib64/libkmod.so.2.3.3
2284 | 1    | 1000 | user    | systemd       |               | /usr/lib64/libkmod.so.2.3.3
2285 | 2284 | 1000 | user    | systemd       |               | /usr/lib64/libkmod.so.2.3.3

It's still running the old binary, having all its vulnerabilities. You can restart Systemd without reboot using the Manager Lifecycle Commands: systemctl daemon-reexec should be enough after a package upgrade.

The details depends entirely on the vulnerabilities found in the specific version and is information that will become obsolete too quickly to be meaningful on a Q/A site. You should check

If you aren't able to evaluate whether these vulnerabilities have security implications in your situation, just upgrade your packages regularly and restart the services.

  • Thanks. What are the implications of its compromise and what are the types of exploits? – Motivated Feb 2 at 16:35
  • Thanks. What are the common attack vectors that would demand that systemd requires it is restarted? Does systemd restart itself when it is upgraded or does it require manual intervention? – Motivated Feb 3 at 3:41
  • That depends on the distribution. A package manager is responsible for automatically restarting the upgraded services. However, the daemon-reexec is safe to run if you are unsure. – Esa Jokinen Feb 3 at 6:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.