February 2017 - Arch-general - lists.archlinux.org

[arch-general] Bash broken: no PATH and completion
by Giovanni Santini 10 Feb '17

10 Feb '17

Good morning, I want to share one of my recent issues with bash. Everything was working nicely up to some time ago, but recently I'm having some issues. The major two things I've noticed are the following: 1. bash doesn't load */etc/profile*, thus not loading all the scripts in */etc/profile.d/* 2. bash-completion does not load properly all completion; for example, the completion for *optirun* is present but it is not loaded. Does anybody else have issues with it lately? I didn't notice info about bash config changes. -- Giovanni Santini My blog: http://giovannisantini.tk My code: https://git{hub,lab}.com/ItachiSan My GPG: 2FADEBF5

2 1

[arch-general] user namespaces
by sivmu 06 Feb '17

06 Feb '17

Summary: Arch Linux is one of the few, if not the only distribution that still disables or restricts the use of unprivileged user namespaces, a feature that is used by many applications and containers to provide secure sandboxing. There have been request to turn this feature on since Linux 3.13 (in 2013) but they are still being denied. While there may have been some reason for doing so a few year ago, leading to many distributions like Debian and Red Hat to restrict its use to privileged users via a kernel patch (they never disabled it completely), today arch seems to be the only distribution to block this feature. Even conservative distros like Debian 8 and 9 have this feature fully enabled. I would like to suggest that arch stops to disable this feature in future kernel versions. Resoning: The original reason to block user namespaces were a number of security issues that allowed unprivileged users to access features they should not have access to. Due to the nature of user namespaces to provide isolated user environments with access to privileged features like other namespaces (inside that isolated namespace only), it should be obvious that this feature had to be designed carefully in order not to harm the security outside the namespace. Even though there have been issues, this feature is now considered stable enough for distros like debian and red hat to allow its use even for unprivileged users. Moreover there are many applications that use this feature to provide or enhance security Among them are: lxc, systemd-nspawn, docker, flatpak, bubblewrap, firejail, firefox, chromium After working with sandboxing applications for several month, it seems clear to me that disabling user namespaces decreases the security of the system significantly. Some of these applications can not provide core features due to user namespaces missing. Others have significant security features disabled for this reasons. But the worst part is how some of these projects dealt with the missing feature: Many are using suid bits to execute the application as root to get access to the features they would have inside a user namespace. And for those who have worked with suid applications and their security it will not be surprising that they have failed to do this securely, leading to not just a few local root exploits. Taking firejail just as an example: (CVE-2017-5207) (CVE-2017-5206) (CVE-2017-5180) (CVE-2016-10122) (CVE-2016-10118) (CVE-2016-9016) And that is just from the last release... non of these issues would have been possible if user namespaces could be used, which is btw. what bubblewrap does if the feature is available, but since it isn’t on arch they have to use suid too (but bubblewrap is designed with security in mind for a change, so no known issues so far) Chromium is another case that has to use suid to use its sandbox and while I consider the developers very skilled in regards to security (they build a very nice broker architecture sandbox on windows too) there have been local root exploits in the linux version of chromium because of this. Even while looking at the surface of this problem it becomes clear this causes way more problems then it solves. Considering arch will be or already is the only linux distribution to disable this feature, developers of future applications will have to chose between dropping support for arch or to keep using features like suid that pose a real security threat opposite to user namespaces. Therefore I urge the people responsible to reconsider their choice an enable user namespaces in future kernel versions of arch linux. Bug reports regarding user namespaces: https://bugs.archlinux.org/task/36969 https://bugs.archlinux.org/task/49337

12 36

[arch-general] OpenJFX package out-of-date
by Kyle Laker 06 Feb '17

06 Feb '17

Hello, The extra/java-openjfx package has been flagged out-of-date since 2016-09-13 and is stuck at verison 8u76-b03. This can result in runtime warnings for some JavaFX applications whose FXML was created specifying a newer API version, potentially causing confusion for users because `java -version` would return the newest version (1.8.0_121). The following patch (created using `svn diff`) of the PKGBUILD should bring it up to match the latest version of extra/jdk8-openjdk. No changes should be necessary for the gradle.properties file. Regards, Kyle Patch: Index: PKGBUILD =================================================================== --- PKGBUILD (revision 287772) +++ PKGBUILD (working copy) @@ -12,11 +12,11 @@ pkgbase=java-${_libname} pkgname=('java-openjfx' 'java-openjfx-doc' 'java-openjfx-src') _java_ver=8 -_jdk_update=76 -_jdk_build=03 +_jdk_update=121 +_jdk_build=13 _hgtag=${_java_ver}u${_jdk_update}-b${_jdk_build} pkgver=${_java_ver}.u${_jdk_update} -pkgrel=2 +pkgrel=1 pkgdesc='Java OpenJFX 8 client application platform (open-source implementation of JavaFX)' arch=('i686' 'x86_64') url='https://wiki.openjdk.java.net/display/OpenJFX/Main'

2 3

[arch-general] Generating gdb debug logs for devs
by Pekka Järvinen 03 Feb '17

03 Feb '17

Hi, I have segfaulting lxrandr and I was referred to https://wiki.archlinux.org/index.php/Debug_-_Getting_Traces after filing bug report. I've installed ABS, modified PKGBUILD and made my own /etc/makepkg-dev.conf makepkg -sf --config /etc/makepkg-dev.conf generates the executable. Still gdb gives very little info after running cd lxrandr/pkg/lxrandr/usr/bin gdb -ex "set logging file debug.log" -ex "set logging overwrite on" -ex "thread apply all bt full" -ex "set logging on" -ex "run" -ex "backtrace" -ex "frame 0" -ex "kill" -ex "quit" ./lxrandr I'm guessing because I need to add debugging to libraries which lxrandr is using too. In the wiki there's --- snip --- Note: It is insufficient to simply install the newly compiled debug package, because the debugger will check that the file containing the debug symbols is from the same build as the associated library and executable. You must install both of the recompiled packages. In Arch, the debug symbols files are installed under /usr/lib/debug. See the GDB documentation for more information about debug packages. --- snip --- But as a non c/c++ dev this doesn't say anything. What do I need to install/run and where? So could the wiki page be enhanced by adding concrete example(s)? Original bug report: https://bugs.archlinux.org/task/51480 -- Pekka Järvinen

5 11

Re: [arch-general] Ping: 100% package loss
by Guus Snijders 02 Feb '17

02 Feb '17

Op 2 feb. 2017 20:58 schreef "Thorsten Jolitz via arch-general" < arch-general(a)archlinux.org>: Robin via arch-general <arch-general(a)archlinux.org> writes: >> - IPv6 is tried , but takes forever and has 100% package loss >> (frecuent). >> - pinging IPv6 addresses works (very rare) [...] that explains it very well. ping can be forced to use a certain protocol, but my webbrowser doing google searches (e.g. textbased W3M) seems to always try v6 if its available. Which just leaves the question: do you want to use IPv6 or do you prefer IPv4? In the first case, perhaps a tunnel provider can help as your current setup appears flaky at best. In the second case, it's probably better to find out how to disable IPv6 on your machine. Mvg, Guus Snijders

2 1

[arch-general] Ping: 100% package loss
by Thorsten Jolitz 02 Feb '17

02 Feb '17

Hello List, sometime age my msmtp imap connections just stopped working. Investigating the cause, I checked quite a lot of things, and came across the ping "100% package loss" problem: With /etc/resolv.conf ,---- | # Generated by resolvconf | domain Speedport_W_xxxxxx | | nameserver 192.168.2.1 | nameserver fe80::1%ens34 `---- this works ,---- | $ drill @192.168.2.1. www.google.com | ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 36946 | ;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 | ;; QUESTION SECTION: | ;; www.google.com. IN A | | ;; ANSWER SECTION: | www.google.com. 39 IN A 216.58.210.196 | | ;; AUTHORITY SECTION: | | ;; ADDITIONAL SECTION: | | ;; Query time: 4 msec | ;; SERVER: 192.168.2.1 | ;; WHEN: Sun Jan 22 15:53:08 2017 | ;; MSG SIZE rcvd: 48 `---- but this not ,---- | $ ping -c 3 www.google.com | PING www.google.com(mrs04s09-in-x04.1e100.net | (2a00:1450:4006:803::2004)) 56 data bytes | | --- www.google.com ping statistics --- | 3 packets transmitted, 0 received, 100% packet loss, time 2014ms `---- Network connectivity is obviously given ,---- | [tj@arch ~]$ ping -c 3 216.58.210.196 | PING 216.58.210.196 (216.58.210.196) 56(84) bytes of data. | 64 bytes from 216.58.210.196: icmp_seq=1 ttl=54 time=51.4 ms | 64 bytes from 216.58.210.196: icmp_seq=2 ttl=54 time=49.8 ms | 64 bytes from 216.58.210.196: icmp_seq=3 ttl=54 time=50.7 ms | | --- 216.58.210.196 ping statistics --- | 3 packets transmitted, 3 received, 0% packet loss, time 2003ms | rtt min/avg/max/mdev = 49.855/50.685/51.408/0.689 ms `---- and I can ping the nameserver ip too. Even when I put Googles DNS Servers in my /etc/resolv.conf, it would not work. So what could be the problem here? TIA -- cheers, Thorsten

4 10

Re: [arch-general] user namespaces
by Francisco Barbee 02 Feb '17

02 Feb '17

So what's your alternatives/setup usable on Arch (not android, not ChromeOS)? We heave disabled SElinux, disabled Apparmor, disabled user namespaces, PIE not enabled by default and only partial relro. What's left then? Swimming naked?

5 8

[arch-general] ofono install
by Peter Nabbefeld 02 Feb '17

02 Feb '17

Hello, I tried to install ofono from AUR, because I want HSP/HFP support for pulseaudio (https://www.freedesktop.org/wiki/Software/PulseAudio/Documentation/User/Mod…), but I get an error about a conflict between .SRCINFO and PKGBUILD - how can I resolve this problem? Kind regards Peter

5 8

[arch-general] How to run ofono as backend for a headset?
by Peter Nabbefeld 02 Feb '17

02 Feb '17

Hello, due to https://www.freedesktop.org/wiki/Software/PulseAudio/Documentation/User/Mod… I should get HSP/HFP support using ofono as a backend and setting headset="ofono", but it doesn't work. I've already started ofono using "systemctl restart ofono" and started/stopped pulseaudio, but it displays "HSP/HFP unavailable". Is there any documentation about how to connect a bluetooth headset using ofono? Kind regards Peter

1 0

[arch-general] systemd latest upgrade
by Jude DaShiell 01 Feb '17

01 Feb '17

For the last several systemd upgrades an error complaining about a missing uefi directory has come out when those upgrades were being installed. Today that happened too. However any package install now finishes with the message: Arming ConditionNeedsUpdate .... This system is an old x86-64 system with bios on it not uefi so I'm curious to know if there is anything I can do or anything I really ought to do about this message. --

3 3