FM / systemd

/usr/lib/systemd

Name	Size	Mode	Actions
boot/	-	0755	rm
catalog/	-	0755	rm
network/	-	0755	rm
ntp-units.d/	-	0755	rm
portable/	-	0755	rm
system/	-	0755	rm
system-generators/	-	0755	rm
system-preset/	-	0755	rm
system-shutdown/	-	0755	rm
system-sleep/	-	0755	rm
user/	-	0755	rm
user-environment-generators/	-	0755	rm
user-generators/	-	0755	rm
user-preset/	-	0755	rm
libsystemd-shared-239.so	2765448	0755	edit dl rm
portablectl	37888	0755	edit dl rm
purge-nobody-user	2351	0755	edit dl rm
resolv.conf	678	0644	edit dl rm
systemd	1613672	0755	edit dl rm
systemd-ac-power	12160	0755	edit dl rm
systemd-backlight	25336	0755	edit dl rm
systemd-binfmt	17096	0755	edit dl rm
systemd-cgroups-agent	12304	0755	edit dl rm
systemd-coredump	62640	0755	edit dl rm
systemd-cryptsetup	29440	0755	edit dl rm
systemd-dissect	16408	0755	edit dl rm
systemd-export	42168	0755	edit dl rm
systemd-fsck	25328	0755	edit dl rm
systemd-growfs	20928	0755	edit dl rm
systemd-hibernate-resume	12296	0755	edit dl rm
systemd-hostnamed	29608	0755	edit dl rm
systemd-initctl	20928	0755	edit dl rm
systemd-journald	158112	0755	edit dl rm
systemd-localed	50360	0755	edit dl rm
systemd-logind	271672	0755	edit dl rm
systemd-makefs	12712	0755	edit dl rm
systemd-modules-load	20912	0755	edit dl rm
systemd-portabled	92072	0755	edit dl rm
systemd-pstore	21384	0755	edit dl rm
systemd-quotacheck	12592	0755	edit dl rm
systemd-random-seed	16392	0755	edit dl rm
systemd-remount-fs	25128	0755	edit dl rm
systemd-reply-password	12296	0755	edit dl rm
systemd-resolved	463632	0755	edit dl rm
systemd-rfkill	25344	0755	edit dl rm
systemd-shutdown	62664	0755	edit dl rm
systemd-sleep	21264	0755	edit dl rm
systemd-socket-proxyd	25144	0755	edit dl rm
systemd-sulogin-shell	16400	0755	edit dl rm
systemd-sysctl	21272	0755	edit dl rm
systemd-sysv-install	-	0	edit dl rm
systemd-timedated	37840	0755	edit dl rm
systemd-udevd	418352	0755	edit dl rm
systemd-update-done	12728	0755	edit dl rm
systemd-update-utmp	16400	0755	edit dl rm
systemd-user-runtime-dir	251008	0755	edit dl rm
systemd-user-sessions	12144	0755	edit dl rm
systemd-vconsole-setup	20960	0755	edit dl rm
systemd-veritysetup	12296	0755	edit dl rm
systemd-volatile-root	12296	0755	edit dl rm

Edit: /usr/lib/systemd/purge-nobody-user (2351B)

#!/bin/bash -eu

if [ $UID -ne 0 ]; then
    echo "WARNING: This script needs to run as root to be effective"
    exit 1
fi

export SYSTEMD_NSS_BYPASS_SYNTHETIC=1

if [ "${1:-}" = "--ignore-journal" ]; then
    shift
    ignore_journal=1
else
    ignore_journal=0
fi

echo "Checking processes..."
if ps h -u 99 | grep .; then
    echo "ERROR: ps reports processes with UID 99!"
    exit 2
fi
echo "... not found"

echo "Checking UTMP..."
if w -h 199 | grep . ; then
    echo "ERROR: w reports UID 99 as active!"
    exit 2
fi
if w -h nobody | grep . ; then
    echo "ERROR: w reports user nobody as active!"
    exit 2
fi
echo "... not found"

echo "Checking the journal..."
if [ "$ignore_journal" = 0 ] && journalctl -q -b -n10 _UID=99 | grep . ; then
    echo "ERROR: journalctl reports messages from UID 99 in current boot!"
    exit 2
fi
echo "... not found"

echo "Looking for files in /etc, /run, /tmp, and /var..."
if find /etc /run /tmp /var -uid 99 -print | grep -m 10 . ; then
    echo "ERROR: found files belonging to UID 99"
    exit 2
fi
echo "... not found"

echo "Checking if nobody is defined correctly..."
if getent passwd nobody |
	grep '^nobody:[x*]:65534:65534:.*:/:/sbin/nologin';
then
    echo "OK, nothing to do."
    exit 0
else
    echo "NOTICE: User nobody is not defined correctly"
fi

echo "Checking if nfsnobody or something else is using the uid..."
if getent passwd 65534 | grep . ; then
    echo "NOTICE: will have to remove this user"
else
    echo "... not found"
fi

if [ "${1:-}" = "-x" ]; then
    if getent passwd nobody >/dev/null; then
	# this will remove both the user and the group.
	( set -x
   	  userdel nobody
	)
    fi

if getent passwd 65534 >/dev/null; then
	# Make sure the uid is unused. This should free gid too.
	name="$(getent passwd 65534 | cut -d: -f1)"
	( set -x
	  userdel "$name"
	)
    fi

if grep -qE '^(passwd|group):.*\bsss\b' /etc/nsswitch.conf; then
	echo "Sleeping, so sss can catch up"
	sleep 3
    fi

if getent group 65534; then
	# Make sure the gid is unused, even if uid wasn't.
	name="$(getent group 65534 | cut -d: -f1)"
	( set -x
	  groupdel "$name"
	)
    fi

# systemd-sysusers uses the same gid and uid
    ( set -x
      systemd-sysusers --inline 'u nobody 65534 "Kernel Overflow User" / /sbin/nologin'
    )
else
    echo "Pass '-x' to perform changes"
fi

cmd: