FM / systemd

/usr/lib/systemd

Name	Size	Mode	Actions
boot/	-	0755	rm
catalog/	-	0755	rm
network/	-	0755	rm
ntp-units.d/	-	0755	rm
system/	-	0755	rm
system-generators/	-	0755	rm
system-preset/	-	0755	rm
system-shutdown/	-	0755	rm
system-sleep/	-	0755	rm
user/	-	0755	rm
user-environment-generators/	-	0755	rm
user-generators/	-	0755	rm
user-preset/	-	0755	rm
libsystemd-shared.abignore	100	0644	edit dl rm
purge-nobody-user	2355	0755	edit dl rm
resolv.conf	710	0644	edit dl rm
systemd	98040	0755	edit dl rm
systemd-ac-power	15392	0755	edit dl rm
systemd-backlight	36216	0755	edit dl rm
systemd-binfmt	23872	0755	edit dl rm
systemd-bless-boot	32360	0755	edit dl rm
systemd-boot-check-no-failures	15672	0755	edit dl rm
systemd-cgroups-agent	15608	0755	edit dl rm
systemd-coredump	73448	0755	edit dl rm
systemd-cryptsetup	94680	0755	edit dl rm
systemd-export	44600	0755	edit dl rm
systemd-fsck	32064	0755	edit dl rm
systemd-growfs	23816	0755	edit dl rm
systemd-hibernate-resume	15416	0755	edit dl rm
systemd-hostnamed	53152	0755	edit dl rm
systemd-initctl	23896	0755	edit dl rm
systemd-integritysetup	24080	0755	edit dl rm
systemd-journald	185504	0755	edit dl rm
systemd-localed	52928	0755	edit dl rm
systemd-logind	302808	0755	edit dl rm
systemd-makefs	15616	0755	edit dl rm
systemd-measure	53176	0755	edit dl rm
systemd-modules-load	24104	0755	edit dl rm
systemd-network-generator	44720	0755	edit dl rm
systemd-pcrphase	32296	0755	edit dl rm
systemd-pstore	23976	0755	edit dl rm
systemd-quotacheck	15440	0755	edit dl rm
systemd-random-seed	27944	0755	edit dl rm
systemd-remount-fs	19744	0755	edit dl rm
systemd-reply-password	15640	0755	edit dl rm
systemd-rfkill	23912	0755	edit dl rm
systemd-shutdown	52744	0755	edit dl rm
systemd-sleep	32120	0755	edit dl rm
systemd-socket-proxyd	32248	0755	edit dl rm
systemd-sulogin-shell	19808	0755	edit dl rm
systemd-sysctl	28216	0755	edit dl rm
systemd-sysroot-fstab-check	57520	0755	edit dl rm
systemd-sysupdate	127688	0755	edit dl rm
systemd-sysv-install	44832	0755	edit dl rm
systemd-timedated	48776	0755	edit dl rm
systemd-udevd	601960	0755	edit dl rm
systemd-update-done	15640	0755	edit dl rm
systemd-update-helper	3853	0755	edit dl rm
systemd-update-utmp	23912	0755	edit dl rm
systemd-user-runtime-dir	23864	0755	edit dl rm
systemd-user-sessions	15416	0755	edit dl rm
systemd-vconsole-setup	19768	0755	edit dl rm
systemd-veritysetup	24032	0755	edit dl rm
systemd-volatile-root	23856	0755	edit dl rm
systemd-xdg-autostart-condition	15664	0755	edit dl rm

Edit: /usr/lib/systemd/purge-nobody-user (2355B)

#!/usr/bin/bash -eu

if [ $UID -ne 0 ]; then
    echo "WARNING: This script needs to run as root to be effective"
    exit 1
fi

export SYSTEMD_NSS_BYPASS_SYNTHETIC=1

if [ "${1:-}" = "--ignore-journal" ]; then
    shift
    ignore_journal=1
else
    ignore_journal=0
fi

echo "Checking processes..."
if ps h -u 99 | grep .; then
    echo "ERROR: ps reports processes with UID 99!"
    exit 2
fi
echo "... not found"

echo "Checking UTMP..."
if w -h 199 | grep . ; then
    echo "ERROR: w reports UID 99 as active!"
    exit 2
fi
if w -h nobody | grep . ; then
    echo "ERROR: w reports user nobody as active!"
    exit 2
fi
echo "... not found"

echo "Checking the journal..."
if [ "$ignore_journal" = 0 ] && journalctl -q -b -n10 _UID=99 | grep . ; then
    echo "ERROR: journalctl reports messages from UID 99 in current boot!"
    exit 2
fi
echo "... not found"

echo "Looking for files in /etc, /run, /tmp, and /var..."
if find /etc /run /tmp /var -uid 99 -print | grep -m 10 . ; then
    echo "ERROR: found files belonging to UID 99"
    exit 2
fi
echo "... not found"

echo "Checking if nobody is defined correctly..."
if getent passwd nobody |
	grep '^nobody:[x*]:65534:65534:.*:/:/sbin/nologin';
then
    echo "OK, nothing to do."
    exit 0
else
    echo "NOTICE: User nobody is not defined correctly"
fi

echo "Checking if nfsnobody or something else is using the uid..."
if getent passwd 65534 | grep . ; then
    echo "NOTICE: will have to remove this user"
else
    echo "... not found"
fi

if [ "${1:-}" = "-x" ]; then
    if getent passwd nobody >/dev/null; then
	# this will remove both the user and the group.
	( set -x
   	  userdel nobody
	)
    fi

if getent passwd 65534 >/dev/null; then
	# Make sure the uid is unused. This should free gid too.
	name="$(getent passwd 65534 | cut -d: -f1)"
	( set -x
	  userdel "$name"
	)
    fi

if grep -qE '^(passwd|group):.*\bsss\b' /etc/nsswitch.conf; then
	echo "Sleeping, so sss can catch up"
	sleep 3
    fi

if getent group 65534; then
	# Make sure the gid is unused, even if uid wasn't.
	name="$(getent group 65534 | cut -d: -f1)"
	( set -x
	  groupdel "$name"
	)
    fi

# systemd-sysusers uses the same gid and uid
    ( set -x
      systemd-sysusers --inline 'u nobody 65534 "Kernel Overflow User" / /sbin/nologin'
    )
else
    echo "Pass '-x' to perform changes"
fi

cmd: