April 2014 - Arch-dev-public - lists.archlinux.org

[arch-dev-public] Signoff report for [testing]
by Arch Website Notification 23 Apr '14

23 Apr '14

=== Signoff report for [testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 2 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 5 fully signed off packages * 39 packages missing signoffs * 2 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == New packages in [testing] in last 24 hours (2 total) == * liblastfm-1.0.8-1 (i686) * liblastfm-1.0.8-1 (x86_64) == Incomplete signoffs for [core] (12 total) == * bash-4.3.011-1 (i686) 0/1 signoffs * btrfs-progs-3.14.1-1 (i686) 0/1 signoffs * gawk-4.1.1-1 (i686) 0/1 signoffs * grub-1:2.02.beta2-3 (i686) 0/1 signoffs * readline-6.3.005-1 (i686) 0/1 signoffs * syslinux-6.03pre11-1 (i686) 0/1 signoffs * btrfs-progs-3.14.1-1 (x86_64) 0/2 signoffs * cronie-1.4.11-2 (x86_64) 1/2 signoffs * gawk-4.1.1-1 (x86_64) 1/2 signoffs * grub-1:2.02.beta2-3 (x86_64) 1/2 signoffs * openssh-6.6p1-2 (x86_64) 1/2 signoffs * syslinux-6.03pre11-1 (x86_64) 0/2 signoffs == Incomplete signoffs for [extra] (27 total) == * flickrnet-3.10.0-1 (any) 0/2 signoffs * colord-1.2.0-1 (i686) 0/1 signoffs * colord-gtk-0.1.25-2 (i686) 0/1 signoffs * gnome-color-manager-3.12.1-2 (i686) 0/1 signoffs * gnome-control-center-3.12.1-2 (i686) 0/1 signoffs * gnome-settings-daemon-3.12.1-2 (i686) 0/1 signoffs * gtk3-3.12.1-2 (i686) 0/1 signoffs * kdebase-runtime-4.13.0-3 (i686) 0/1 signoffs * liblastfm-1.0.8-1 (i686) 0/1 signoffs * libreoffice-4.2.4-0.1 (i686) 0/1 signoffs * libssh-0.6.3-1 (i686) 0/1 signoffs * qemu-2.0.0-2 (i686) 0/1 signoffs * refind-efi-0.7.9-1 (i686) 0/1 signoffs * slim-1.3.6-4 (i686) 0/1 signoffs * colord-1.2.0-1 (x86_64) 0/2 signoffs * colord-gtk-0.1.25-2 (x86_64) 0/2 signoffs * gnome-color-manager-3.12.1-2 (x86_64) 0/2 signoffs * gnome-control-center-3.12.1-2 (x86_64) 0/2 signoffs * gnome-settings-daemon-3.12.1-2 (x86_64) 0/2 signoffs * gtk3-3.12.1-2 (x86_64) 0/2 signoffs * kdebase-runtime-4.13.0-3 (x86_64) 0/2 signoffs * liblastfm-1.0.8-1 (x86_64) 0/2 signoffs * libreoffice-4.2.4-0.1 (x86_64) 0/2 signoffs * libssh-0.6.3-1 (x86_64) 0/2 signoffs * qemu-2.0.0-2 (x86_64) 0/2 signoffs * refind-efi-0.7.9-1 (x86_64) 0/2 signoffs * slim-1.3.6-4 (x86_64) 0/2 signoffs == Completed signoffs (5 total) == * man-pages-3.65-1 (any) * cronie-1.4.11-2 (i686) * openssh-6.6p1-2 (i686) * bash-4.3.011-1 (x86_64) * readline-6.3.005-1 (x86_64) == All packages in [testing] for more than 14 days (2 total) == * grub-1:2.02.beta2-3 (i686), since 2014-04-07 * grub-1:2.02.beta2-3 (x86_64), since 2014-04-07 == Top five in signoffs in last 24 hours == 1. anatolik - 1 signoffs

1 0

Re: [arch-dev-public] providing grsecurity in [community]
by Connor Behan 22 Apr '14

22 Apr '14

[Including In-reply-to header so as not to break threading] On 22/04/14 10:43 AM, Daniel Micay wrote: >> 2) A few years back we specifically reduced the number of kernels in our >> repos to one. Then the LTS kernel appeared. Now this. The problem >> with adding a non-vanilla kernel to the repos is now for kernel bug >> reports we have to verify which kernel is running. If it is >> linux-grsec, we then need to figure out if the issue a generic linux >> one, or with the other patchset. This is a burden to all our the kernel >> maintainers and not just the packager and is part of the reason the >> variety of kernels was reduced. > Output from `uname -a` or `dmesg` is a pretty basic requirement for a > kernel issue, especially since problems like /boot not being mounted and > new upgrades installed to the wrong place often happen. I don't mind > being the one who asks for this on any [linux] issues missing it. > > I'll have to dig up the old discussion because I wasn't around for it. > It's not just a matter of asking "what kernel are you using". You'll probably have to ask the bug submitter to install linux from [core], wait a day, and start comparing two sets of output. But since you're prepared to do all the work, I don't think there's a reason to drop linux-grsec. That should happen if / when another packager has to work around it.

3 2

[arch-dev-public] providing grsecurity in [community]
by Daniel Micay 22 Apr '14

22 Apr '14

There has been a recent surge of interest in securing Arch by paying closer attention to CVEs and addressing many security issues in our packages. I also started some initial work/documenting on securing the services shipped in various packages: https://wiki.archlinux.org/index.php/DeveloperWiki:Service_isolation To go along with this, I'm interested in maintaining the grsecurity kernel and userspace tools in [community] to provide a hardened kernel and role-based access control system. This would be the first case of an alternative kernel in the repositories, so I'm open to discussion about whether it's appropriate to do this. There are also some issues relevant to other packages in the repositories. The grsecurity project has been around since 2001 and has fundamentally different goals than the mainline Linux project. Much like OpenBSD, it makes changes with a measurable performance or compatibility impact that are unlikely to ever be included in the upstream kernel. Many of these changes involve hardening the kernel against userspace exploitation, which is not something tackled by any of the Linux Security Modules. Users, groups, ACLs, chroots and namespaces already provide a solid foundation for access control, so hardening the kernel itself is the single biggest security improvement involved. It has various odds and ends exposed via sysctl switches, and these tend to trickle upstream in one form or another (symlink/hardlink protection, dmesg restriction, /proc restrictions). It also includes the PaX project to provide a much stronger implementation of ASLR along with significant memory protections for userspace. These features do break many packages, and require setting flags on binaries when exceptions are necessary. I don't want to place a burden on other packagers, so I plan on leaving the parts requiring integration with other packages disabled at first. If there turns out to be more interest than just my own in maintaining this, flipping on the PaX protections by default and setting the required flags in various packages could be considered. I don't want to approach this by filing bugs, so there would need to be a developer interested in doing some work on packages in [core] and [extra] for these kinds of features to be enabled. SELinux requires many packages to be built with support for it, along with a significant number of patches. The policies are very complex and spread out through the entire file system. In my opinion, it's pretty much the antithesis of Arch's goals of simplicity and transparent configuration. AppArmor/TOMOYO are much simpler, with centralized policy files that are much easier to review or ship in packages. The grsecurity RBAC system is similar to these and has a nice automatic learning mode. However, it's quite a bit more powerful and grsecurity is useful even without providing RBAC policies since this is only one component. All in all, I think grsecurity would be a great way of improving the level of security we offer. It's also one of the least intrusive ways of doing it, since it can provide significant benefits without everyone buying into it and adding profiles to their packages. There will be no impact on the regular/default kernel, so it's far friendlier to users who don't care about this than SELinux/AppArmor/Audit.

10 48

[arch-dev-public] Signoff report for [testing]
by Arch Website Notification 22 Apr '14

22 Apr '14

=== Signoff report for [testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 20 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 4 fully signed off packages * 40 packages missing signoffs * 2 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == New packages in [testing] in last 24 hours (20 total) == * syslinux-6.03pre11-1 (i686) * syslinux-6.03pre11-1 (x86_64) * apr-1.5.1-1 (i686) * colord-1.2.0-1 (i686) * colord-gtk-0.1.25-2 (i686) * gnome-color-manager-3.12.1-2 (i686) * gnome-control-center-3.12.1-2 (i686) * gnome-settings-daemon-3.12.1-2 (i686) * gtk3-3.12.1-2 (i686) * refind-efi-0.7.9-1 (i686) * slim-1.3.6-4 (i686) * apr-1.5.1-1 (x86_64) * colord-1.2.0-1 (x86_64) * colord-gtk-0.1.25-2 (x86_64) * gnome-color-manager-3.12.1-2 (x86_64) * gnome-control-center-3.12.1-2 (x86_64) * gnome-settings-daemon-3.12.1-2 (x86_64) * gtk3-3.12.1-2 (x86_64) * refind-efi-0.7.9-1 (x86_64) * slim-1.3.6-4 (x86_64) == Incomplete signoffs for [core] (13 total) == * man-pages-3.65-1 (any) 1/2 signoffs * bash-4.3.011-1 (i686) 0/1 signoffs * btrfs-progs-3.14.1-1 (i686) 0/1 signoffs * gawk-4.1.1-1 (i686) 0/1 signoffs * grub-1:2.02.beta2-3 (i686) 0/1 signoffs * readline-6.3.005-1 (i686) 0/1 signoffs * syslinux-6.03pre11-1 (i686) 0/1 signoffs * btrfs-progs-3.14.1-1 (x86_64) 0/2 signoffs * cronie-1.4.11-2 (x86_64) 1/2 signoffs * gawk-4.1.1-1 (x86_64) 1/2 signoffs * grub-1:2.02.beta2-3 (x86_64) 1/2 signoffs * openssh-6.6p1-2 (x86_64) 1/2 signoffs * syslinux-6.03pre11-1 (x86_64) 0/2 signoffs == Incomplete signoffs for [extra] (27 total) == * flickrnet-3.10.0-1 (any) 0/2 signoffs * apr-1.5.1-1 (i686) 0/1 signoffs * colord-1.2.0-1 (i686) 0/1 signoffs * colord-gtk-0.1.25-2 (i686) 0/1 signoffs * gnome-color-manager-3.12.1-2 (i686) 0/1 signoffs * gnome-control-center-3.12.1-2 (i686) 0/1 signoffs * gnome-settings-daemon-3.12.1-2 (i686) 0/1 signoffs * gtk3-3.12.1-2 (i686) 0/1 signoffs * kdebase-runtime-4.13.0-3 (i686) 0/1 signoffs * libreoffice-4.2.4-0.1 (i686) 0/1 signoffs * libssh-0.6.3-1 (i686) 0/1 signoffs * qemu-2.0.0-2 (i686) 0/1 signoffs * refind-efi-0.7.9-1 (i686) 0/1 signoffs * slim-1.3.6-4 (i686) 0/1 signoffs * apr-1.5.1-1 (x86_64) 0/2 signoffs * colord-1.2.0-1 (x86_64) 0/2 signoffs * colord-gtk-0.1.25-2 (x86_64) 0/2 signoffs * gnome-color-manager-3.12.1-2 (x86_64) 0/2 signoffs * gnome-control-center-3.12.1-2 (x86_64) 0/2 signoffs * gnome-settings-daemon-3.12.1-2 (x86_64) 0/2 signoffs * gtk3-3.12.1-2 (x86_64) 0/2 signoffs * kdebase-runtime-4.13.0-3 (x86_64) 0/2 signoffs * libreoffice-4.2.4-0.1 (x86_64) 0/2 signoffs * libssh-0.6.3-1 (x86_64) 0/2 signoffs * qemu-2.0.0-2 (x86_64) 0/2 signoffs * refind-efi-0.7.9-1 (x86_64) 0/2 signoffs * slim-1.3.6-4 (x86_64) 0/2 signoffs == Completed signoffs (4 total) == * cronie-1.4.11-2 (i686) * openssh-6.6p1-2 (i686) * bash-4.3.011-1 (x86_64) * readline-6.3.005-1 (x86_64) == All packages in [testing] for more than 14 days (2 total) == * grub-1:2.02.beta2-3 (i686), since 2014-04-07 * grub-1:2.02.beta2-3 (x86_64), since 2014-04-07 == Top five in signoffs in last 24 hours ==

1 0

[arch-dev-public] Unavailable
by Daniel Wallace 21 Apr '14

21 Apr '14

Hey! I am moving to my new apartment this week, and have all my computers and stuff packed up, so I will probably be unavailable outside of work hours this week, and probably part of next week as I get everything setup. Feel free to update anything! Thanks Daniel

1 0

[arch-dev-public] Signoff report for [testing]
by Arch Website Notification 21 Apr '14

21 Apr '14

=== Signoff report for [testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 5 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 6 fully signed off packages * 30 packages missing signoffs * 2 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == New packages in [testing] in last 24 hours (5 total) == * man-pages-3.65-1 (any) * openssh-6.6p1-2 (i686) * openssh-6.6p1-2 (x86_64) * libreoffice-4.2.4-0.1 (i686) * libreoffice-4.2.4-0.1 (x86_64) == Incomplete signoffs for [core] (13 total) == * man-pages-3.65-1 (any) 1/2 signoffs * bash-4.3.011-1 (i686) 0/1 signoffs * btrfs-progs-3.14.1-1 (i686) 0/1 signoffs * gawk-4.1.1-1 (i686) 0/1 signoffs * grub-1:2.02.beta2-3 (i686) 0/1 signoffs * readline-6.3.005-1 (i686) 0/1 signoffs * syslinux-6.03pre10-1 (i686) 0/1 signoffs * btrfs-progs-3.14.1-1 (x86_64) 0/2 signoffs * cronie-1.4.11-2 (x86_64) 1/2 signoffs * gawk-4.1.1-1 (x86_64) 1/2 signoffs * grub-1:2.02.beta2-3 (x86_64) 1/2 signoffs * openssh-6.6p1-2 (x86_64) 1/2 signoffs * syslinux-6.03pre10-1 (x86_64) 0/2 signoffs == Incomplete signoffs for [extra] (17 total) == * flickrnet-3.10.0-1 (any) 0/2 signoffs * hylafax-6.0.6-5 (i686) 0/1 signoffs * kdebase-runtime-4.13.0-3 (i686) 0/1 signoffs * libreoffice-4.2.4-0.1 (i686) 0/1 signoffs * libssh-0.6.3-1 (i686) 0/1 signoffs * lyx-2.1.0-1 (i686) 0/1 signoffs * network-manager-applet-0.9.8.9-1 (i686) 0/1 signoffs * networkmanager-0.9.8.9-1 (i686) 0/1 signoffs * qemu-2.0.0-2 (i686) 0/1 signoffs * hylafax-6.0.6-5 (x86_64) 0/2 signoffs * kdebase-runtime-4.13.0-3 (x86_64) 0/2 signoffs * libreoffice-4.2.4-0.1 (x86_64) 0/2 signoffs * libssh-0.6.3-1 (x86_64) 0/2 signoffs * lyx-2.1.0-1 (x86_64) 0/2 signoffs * network-manager-applet-0.9.8.9-1 (x86_64) 0/2 signoffs * networkmanager-0.9.8.9-1 (x86_64) 0/2 signoffs * qemu-2.0.0-2 (x86_64) 0/2 signoffs == Completed signoffs (6 total) == * cronie-1.4.11-2 (i686) * openssh-6.6p1-2 (i686) * psmisc-22.21-1 (i686) * bash-4.3.011-1 (x86_64) * psmisc-22.21-1 (x86_64) * readline-6.3.005-1 (x86_64) == All packages in [testing] for more than 14 days (2 total) == * hylafax-6.0.6-5 (i686), since 2014-04-01 * hylafax-6.0.6-5 (x86_64), since 2014-04-01 == Top five in signoffs in last 24 hours == 1. bisson - 7 signoffs

1 0

Re: [arch-dev-public] providing grsecurity in [community]
by Connor Behan 20 Apr '14

20 Apr '14

On 18/04/14 04:09 AM, S?bastien Luttringer wrote: > On 16/04/2014 06:09, Daniel Micay wrote: >> I don't think it makes sense to bother with the >> nvidia module because it would be a bit silly to mix it with grsecurity. >> > Why user with nvidia cards should be deprived of grsec security enhancement? Because the use of closed-source kernel modules is inherently insecure anyway.

4 3

[arch-dev-public] Signoff report for [testing]
by Arch Website Notification 20 Apr '14

20 Apr '14

=== Signoff report for [testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 4 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 2 fully signed off packages * 29 packages missing signoffs * 2 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == New packages in [testing] in last 24 hours (4 total) == * network-manager-applet-0.9.8.9-1 (i686) * networkmanager-0.9.8.9-1 (i686) * network-manager-applet-0.9.8.9-1 (x86_64) * networkmanager-0.9.8.9-1 (x86_64) == Incomplete signoffs for [core] (14 total) == * bash-4.3.011-1 (i686) 0/1 signoffs * btrfs-progs-3.14.1-1 (i686) 0/1 signoffs * gawk-4.1.1-1 (i686) 0/1 signoffs * grub-1:2.02.beta2-3 (i686) 0/1 signoffs * readline-6.3.005-1 (i686) 0/1 signoffs * syslinux-6.03pre10-1 (i686) 0/1 signoffs * bash-4.3.011-1 (x86_64) 1/2 signoffs * btrfs-progs-3.14.1-1 (x86_64) 0/2 signoffs * cronie-1.4.11-2 (x86_64) 1/2 signoffs * gawk-4.1.1-1 (x86_64) 0/2 signoffs * grub-1:2.02.beta2-3 (x86_64) 1/2 signoffs * psmisc-22.21-1 (x86_64) 1/2 signoffs * readline-6.3.005-1 (x86_64) 1/2 signoffs * syslinux-6.03pre10-1 (x86_64) 0/2 signoffs == Incomplete signoffs for [extra] (15 total) == * flickrnet-3.10.0-1 (any) 0/2 signoffs * hylafax-6.0.6-5 (i686) 0/1 signoffs * kdebase-runtime-4.13.0-3 (i686) 0/1 signoffs * libssh-0.6.3-1 (i686) 0/1 signoffs * lyx-2.1.0-1 (i686) 0/1 signoffs * network-manager-applet-0.9.8.9-1 (i686) 0/1 signoffs * networkmanager-0.9.8.9-1 (i686) 0/1 signoffs * qemu-2.0.0-2 (i686) 0/1 signoffs * hylafax-6.0.6-5 (x86_64) 0/2 signoffs * kdebase-runtime-4.13.0-3 (x86_64) 0/2 signoffs * libssh-0.6.3-1 (x86_64) 0/2 signoffs * lyx-2.1.0-1 (x86_64) 0/2 signoffs * network-manager-applet-0.9.8.9-1 (x86_64) 0/2 signoffs * networkmanager-0.9.8.9-1 (x86_64) 0/2 signoffs * qemu-2.0.0-2 (x86_64) 0/2 signoffs == Completed signoffs (2 total) == * cronie-1.4.11-2 (i686) * psmisc-22.21-1 (i686) == All packages in [testing] for more than 14 days (2 total) == * hylafax-6.0.6-5 (i686), since 2014-04-01 * hylafax-6.0.6-5 (x86_64), since 2014-04-01 == Top five in signoffs in last 24 hours == 1. eric - 2 signoffs

1 0

Re: [arch-dev-public] providing grsecurity in [community]
by Connor Behan 19 Apr '14

19 Apr '14

On 19/04/14 12:28 AM, Daniel Micay wrote: > I've already spent far more time writing these mailing list responses > than any amount of work I've put into improving security-related > issues... speaking of development resources. Hah. I would just like to add that unofficial repositories are usually a dead end. 1. Maintainer adds kernel to his own repository and tries to advertise it in the forums. 2. Only 10 people install it. 3. Maintainer decides it's not worth the work and takes down the repo. With [community] there is a much higher probability that packages will be popular and maintained for awhile.

2 1

[arch-dev-public] Signoff report for [testing]
by Arch Website Notification 19 Apr '14

19 Apr '14

=== Signoff report for [testing] === https://www.archlinux.org/packages/signoffs/ There are currently: * 14 new packages in last 24 hours * 0 known bad packages * 0 packages not accepting signoffs * 1 fully signed off package * 26 packages missing signoffs * 2 packages older than 14 days (Note: the word 'package' as used here refers to packages as grouped by pkgbase, architecture, and repository; e.g., one PKGBUILD produces one package per architecture, even if it is a split package.) == New packages in [testing] in last 24 hours (14 total) == * btrfs-progs-3.14.1-1 (i686) * gawk-4.1.1-1 (i686) * psmisc-22.21-1 (i686) * syslinux-6.03pre10-1 (i686) * btrfs-progs-3.14.1-1 (x86_64) * gawk-4.1.1-1 (x86_64) * psmisc-22.21-1 (x86_64) * syslinux-6.03pre10-1 (x86_64) * kdebase-runtime-4.13.0-3 (i686) * libssh-0.6.3-1 (i686) * qemu-2.0.0-2 (i686) * kdebase-runtime-4.13.0-3 (x86_64) * libssh-0.6.3-1 (x86_64) * qemu-2.0.0-2 (x86_64) == Incomplete signoffs for [core] (15 total) == * bash-4.3.011-1 (i686) 0/1 signoffs * btrfs-progs-3.14.1-1 (i686) 0/1 signoffs * gawk-4.1.1-1 (i686) 0/1 signoffs * grub-1:2.02.beta2-3 (i686) 0/1 signoffs * psmisc-22.21-1 (i686) 0/1 signoffs * readline-6.3.005-1 (i686) 0/1 signoffs * syslinux-6.03pre10-1 (i686) 0/1 signoffs * bash-4.3.011-1 (x86_64) 1/2 signoffs * btrfs-progs-3.14.1-1 (x86_64) 0/2 signoffs * cronie-1.4.11-2 (x86_64) 1/2 signoffs * gawk-4.1.1-1 (x86_64) 0/2 signoffs * grub-1:2.02.beta2-3 (x86_64) 1/2 signoffs * psmisc-22.21-1 (x86_64) 0/2 signoffs * readline-6.3.005-1 (x86_64) 1/2 signoffs * syslinux-6.03pre10-1 (x86_64) 0/2 signoffs == Incomplete signoffs for [extra] (11 total) == * flickrnet-3.10.0-1 (any) 0/2 signoffs * hylafax-6.0.6-5 (i686) 0/1 signoffs * kdebase-runtime-4.13.0-3 (i686) 0/1 signoffs * libssh-0.6.3-1 (i686) 0/1 signoffs * lyx-2.1.0-1 (i686) 0/1 signoffs * qemu-2.0.0-2 (i686) 0/1 signoffs * hylafax-6.0.6-5 (x86_64) 0/2 signoffs * kdebase-runtime-4.13.0-3 (x86_64) 0/2 signoffs * libssh-0.6.3-1 (x86_64) 0/2 signoffs * lyx-2.1.0-1 (x86_64) 0/2 signoffs * qemu-2.0.0-2 (x86_64) 0/2 signoffs == Completed signoffs (1 total) == * cronie-1.4.11-2 (i686) == All packages in [testing] for more than 14 days (2 total) == * hylafax-6.0.6-5 (i686), since 2014-04-01 * hylafax-6.0.6-5 (x86_64), since 2014-04-01 == Top five in signoffs in last 24 hours ==

1 0