January 2017 - Arch-general - lists.archlinux.org

[arch-general] Gnome crash
by Frank Zimmermann 29 Apr '17

29 Apr '17

Good evening, since yesterday my Gnome Shell crashes at start with the following message in the log: gnome-session-f[1207]: segfault at 0 ip 00007f01adab3cc9 sp 00007ffd261ce930 error 4 in libgtk-3.so.0.2200.6[7f01ad7d1000+6fa000] Is this a problem other Gnome users see as well? KR Frank

7 7

[arch-general] Announcing pacpak
by pelzflorian (Florian Pelz) 22 Feb '17

22 Feb '17

Hello, A specter is haunting the GNU/Linux ecosystem: the specter of per-user containerization. Software like Flatpak and Snappy promise fully sandboxed GNU/Linux application bundles (instead of merely launching an application with fewer privileges but without hiding the operating system, like Bubblewrap or Firejail do). Bundles ship with the version of their dependencies which they need. Dependencies are not force-upgraded with the operating system, but easily upgradable by the bundle creator. The same files in different bundles and versions are deduplicated to save space. Applications can be containerized once for all modern GNU/Linux operating systems. Unlike Docker, Flatpak works without root privileges. Flatpak allows you to run, say, a sandboxed and containerized copy of LibreOffice where opening an infected file can only cause harm to what the sandbox has access to, but not compromise the integrity of the system as a whole. Untrustworthy games can be isolated and run without fear of a system compromise. More generally, most GUI applications should probably be installed to and run from a Flatpak sandbox. This has major implications for traditional package managers. Pacman would be demoted to providing the base system on top of which Flatpak bundles downloaded from elsewhere are run (e.g. from gnome.org or from reallytheofficialwebsiteoflibreofficeipromise.com). However, I would prefer having a unified pacman-like interface for installing containerized and non-containerized applications. I believe a PKGBUILD is a good way to specify how to build an application for Flatpak as well. I do not want to lose the many packages from Arch and derivative distributions. tl;dr: Therefore I started writing a tool called pacpak which uses pacman to populate Flatpak application bundles. Its interface is meant to be similar to pacman’s. For example, in order to install gedit into a Flatpak application using a bundle of the gnome packages as a runtime, you install pacpak from the AUR and use: $ pacpak -S Base xterm You can run the resulting application like this: $ flatpak run $(hostname).app.xterm pacpak is still in its early alpha stages. I do not currently have the time to devote more than a day per week to its development. However, I’d like some feedback on the basic idea. I am also looking for a home for the project in the longer term, since I do not currently like to administer a bug tracker on my own rented server and dislike centralizing all free software development on GitHub or Sourceforge (I’d rather administer my own then). This will only be helpful once all the basic features are implemented of course. I would be glad if pacpak or a similar tool eventually becomes an official Arch project. Let me conclude by thanking those who develop Flatpak, those who package and maintain Flatpak for Arch and all the other Arch and free software developers we rely on. Regards, Florian Pelz

15 35

[arch-general] What's with Ray Rashif?
by sekret＠posteo.se 17 Feb '17

17 Feb '17

Hey guys! I'm not writing this mail to complain, I'm just wondering! I use ardour quite a lot and of course I wanted the update to version 5 as soon as possible. The first release 5.0 didn't build here, so I thought ok, maybe the maintainer of this package is struggling with it too. The current version is 5.3 which compiles and runs just fine. So now I wonder why we don't get an update. So I looked at the other packages of the maintainer, see this link https://www.archlinux.org/packages/?packager=schiv and well, I see a lot of red there! So I must wonder: Is Ray still active? Best sekret

11 26

[arch-general] Hibernation not working
by Peter Nabbefeld 14 Feb '17

14 Feb '17

Hello, since some time, hibernation does not work, dmesg contains following messages: [ 738.404244] ACPI Warning: \_SB.PCI0.PEG0.PEGP._DSM: Argument #4 type mismatch - Found [Buffer], ACPI requires [Package] (20160422/nsarguments-95) [ 738.404353] ACPI: \_SB_.PCI0.PEG0.PEGP: failed to evaluate _DSM [ 738.404356] ACPI Warning: \_SB.PCI0.PEG0.PEGP._DSM: Argument #4 type mismatch - Found [Buffer], ACPI requires [Package] (20160422/nsarguments-95) Some time ago, when I closed my laptop, Linux automatically hibernated, now it does not. As my laptop becomes really warm and I don't want to stress my display, I'm using this rarely, so I cannot tell, since when hibernation doesn't work :-/ Kind regartds Peter

6 9

[arch-general] Bash broken: no PATH and completion
by Giovanni Santini 10 Feb '17

10 Feb '17

Good morning, I want to share one of my recent issues with bash. Everything was working nicely up to some time ago, but recently I'm having some issues. The major two things I've noticed are the following: 1. bash doesn't load */etc/profile*, thus not loading all the scripts in */etc/profile.d/* 2. bash-completion does not load properly all completion; for example, the completion for *optirun* is present but it is not loaded. Does anybody else have issues with it lately? I didn't notice info about bash config changes. -- Giovanni Santini My blog: http://giovannisantini.tk My code: https://git{hub,lab}.com/ItachiSan My GPG: 2FADEBF5

2 1

[arch-general] user namespaces
by sivmu 06 Feb '17

06 Feb '17

Summary: Arch Linux is one of the few, if not the only distribution that still disables or restricts the use of unprivileged user namespaces, a feature that is used by many applications and containers to provide secure sandboxing. There have been request to turn this feature on since Linux 3.13 (in 2013) but they are still being denied. While there may have been some reason for doing so a few year ago, leading to many distributions like Debian and Red Hat to restrict its use to privileged users via a kernel patch (they never disabled it completely), today arch seems to be the only distribution to block this feature. Even conservative distros like Debian 8 and 9 have this feature fully enabled. I would like to suggest that arch stops to disable this feature in future kernel versions. Resoning: The original reason to block user namespaces were a number of security issues that allowed unprivileged users to access features they should not have access to. Due to the nature of user namespaces to provide isolated user environments with access to privileged features like other namespaces (inside that isolated namespace only), it should be obvious that this feature had to be designed carefully in order not to harm the security outside the namespace. Even though there have been issues, this feature is now considered stable enough for distros like debian and red hat to allow its use even for unprivileged users. Moreover there are many applications that use this feature to provide or enhance security Among them are: lxc, systemd-nspawn, docker, flatpak, bubblewrap, firejail, firefox, chromium After working with sandboxing applications for several month, it seems clear to me that disabling user namespaces decreases the security of the system significantly. Some of these applications can not provide core features due to user namespaces missing. Others have significant security features disabled for this reasons. But the worst part is how some of these projects dealt with the missing feature: Many are using suid bits to execute the application as root to get access to the features they would have inside a user namespace. And for those who have worked with suid applications and their security it will not be surprising that they have failed to do this securely, leading to not just a few local root exploits. Taking firejail just as an example: (CVE-2017-5207) (CVE-2017-5206) (CVE-2017-5180) (CVE-2016-10122) (CVE-2016-10118) (CVE-2016-9016) And that is just from the last release... non of these issues would have been possible if user namespaces could be used, which is btw. what bubblewrap does if the feature is available, but since it isn’t on arch they have to use suid too (but bubblewrap is designed with security in mind for a change, so no known issues so far) Chromium is another case that has to use suid to use its sandbox and while I consider the developers very skilled in regards to security (they build a very nice broker architecture sandbox on windows too) there have been local root exploits in the linux version of chromium because of this. Even while looking at the surface of this problem it becomes clear this causes way more problems then it solves. Considering arch will be or already is the only linux distribution to disable this feature, developers of future applications will have to chose between dropping support for arch or to keep using features like suid that pose a real security threat opposite to user namespaces. Therefore I urge the people responsible to reconsider their choice an enable user namespaces in future kernel versions of arch linux. Bug reports regarding user namespaces: https://bugs.archlinux.org/task/36969 https://bugs.archlinux.org/task/49337

12 36

[arch-general] OpenJFX package out-of-date
by Kyle Laker 06 Feb '17

06 Feb '17

Hello, The extra/java-openjfx package has been flagged out-of-date since 2016-09-13 and is stuck at verison 8u76-b03. This can result in runtime warnings for some JavaFX applications whose FXML was created specifying a newer API version, potentially causing confusion for users because `java -version` would return the newest version (1.8.0_121). The following patch (created using `svn diff`) of the PKGBUILD should bring it up to match the latest version of extra/jdk8-openjdk. No changes should be necessary for the gradle.properties file. Regards, Kyle Patch: Index: PKGBUILD =================================================================== --- PKGBUILD (revision 287772) +++ PKGBUILD (working copy) @@ -12,11 +12,11 @@ pkgbase=java-${_libname} pkgname=('java-openjfx' 'java-openjfx-doc' 'java-openjfx-src') _java_ver=8 -_jdk_update=76 -_jdk_build=03 +_jdk_update=121 +_jdk_build=13 _hgtag=${_java_ver}u${_jdk_update}-b${_jdk_build} pkgver=${_java_ver}.u${_jdk_update} -pkgrel=2 +pkgrel=1 pkgdesc='Java OpenJFX 8 client application platform (open-source implementation of JavaFX)' arch=('i686' 'x86_64') url='https://wiki.openjdk.java.net/display/OpenJFX/Main'

2 3

[arch-general] Ping: 100% package loss
by Thorsten Jolitz 02 Feb '17

02 Feb '17

Hello List, sometime age my msmtp imap connections just stopped working. Investigating the cause, I checked quite a lot of things, and came across the ping "100% package loss" problem: With /etc/resolv.conf ,---- | # Generated by resolvconf | domain Speedport_W_xxxxxx | | nameserver 192.168.2.1 | nameserver fe80::1%ens34 `---- this works ,---- | $ drill @192.168.2.1. www.google.com | ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 36946 | ;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 | ;; QUESTION SECTION: | ;; www.google.com. IN A | | ;; ANSWER SECTION: | www.google.com. 39 IN A 216.58.210.196 | | ;; AUTHORITY SECTION: | | ;; ADDITIONAL SECTION: | | ;; Query time: 4 msec | ;; SERVER: 192.168.2.1 | ;; WHEN: Sun Jan 22 15:53:08 2017 | ;; MSG SIZE rcvd: 48 `---- but this not ,---- | $ ping -c 3 www.google.com | PING www.google.com(mrs04s09-in-x04.1e100.net | (2a00:1450:4006:803::2004)) 56 data bytes | | --- www.google.com ping statistics --- | 3 packets transmitted, 0 received, 100% packet loss, time 2014ms `---- Network connectivity is obviously given ,---- | [tj@arch ~]$ ping -c 3 216.58.210.196 | PING 216.58.210.196 (216.58.210.196) 56(84) bytes of data. | 64 bytes from 216.58.210.196: icmp_seq=1 ttl=54 time=51.4 ms | 64 bytes from 216.58.210.196: icmp_seq=2 ttl=54 time=49.8 ms | 64 bytes from 216.58.210.196: icmp_seq=3 ttl=54 time=50.7 ms | | --- 216.58.210.196 ping statistics --- | 3 packets transmitted, 3 received, 0% packet loss, time 2003ms | rtt min/avg/max/mdev = 49.855/50.685/51.408/0.689 ms `---- and I can ping the nameserver ip too. Even when I put Googles DNS Servers in my /etc/resolv.conf, it would not work. So what could be the problem here? TIA -- cheers, Thorsten

4 10

[arch-general] systemd latest upgrade
by Jude DaShiell 01 Feb '17

01 Feb '17

For the last several systemd upgrades an error complaining about a missing uefi directory has come out when those upgrades were being installed. Today that happened too. However any package install now finishes with the message: Arming ConditionNeedsUpdate .... This system is an old x86-64 system with bios on it not uefi so I'm curious to know if there is anything I can do or anything I really ought to do about this message. --

3 3

[arch-general] HSP/HFP profile on Bluetooth Headset causing problems
by Peter Nabbefeld 01 Feb '17

01 Feb '17

Hello, I want to use HSP/HFP profile on a Bluetooth Headset, because its microphone doesn't work with A2DP. When I activate the headset with HSP/HFP profile, it works until I stop speaking. Headset input is turned off then, and isn't turned on even when speaking again. Using jack2-dbus and pulseaudio, latest update this morning. Kind regards Peter

3 5