- Arch-general - lists.archlinux.org

Re: [arch-general] End of official PaX and grsecurity support in Arch Linux
by Alexander Harrigan 01 May '17

01 May '17

It looks Gentoo's Hardened Kernel Project oficially started. https://wiki.gentoo.org/wiki/Hardened/Hardened_Kernel_Project \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

2 1

Re: [arch-general] [Questions] Questions from past project and ideas fomr -dev-public that get silence.
by Alexander Harrigan 30 Apr '17

30 Apr '17

I think the problem is lack of information about statuses of various projects. Users can't disticnt between something that is being worked on slowly because of lack of time of dev or technical difficulties and something totally forgotten. I think it would be helpful if features/isues discussed here have official tickets in Arch bugsystem where everyone could see current status with dev commentary and could ask questions. It doesn't need to be updated daily or weekly but we could point to it everyone who's interested instead of creating new topics here or on forum over and over. On On Sun, Apr 30, 2017 at 08:33 AM, Bartłomiej Piotrowski <bpiotrowski(a)archlinux.org> wrote: > On 2017-04-30 09:43, Pablo Roberto Lezaeta Reyes via arch-general wrote: > > During this and the end of previous year some ideas and projects were > > started to adress some problems, but most of them get now silence and > > nothing more. > > I'm talking about > > > > * ABS deprecation draft, Will be one or just ABS will be removed and ASP > > (which sound like Active Server Pages) will be pushed or both will coexist > > until it get broken? > > asp is already in extra. Yesterday I prepared changes to Ansible > playbooks and another one for disabling ABS. I just need to write a news > draft. > (Again, because I believe not everyone gets it: we're doing everything > in our personal, free time; our lives do not end on making Arch.) > > > * What happend with the project of sign-off from non TU that was mentioned > > a few months? Is still runing? is there a way/path to get involved? > > We're getting signoffs from selected group of testers. You can contact > Florian Pritz if you want to become one; we should probably think about > more formal way of getting new people in. > > > * What about the new build flags [1], Now that Allan is not more the > > maintainer and that either Debian and Fedora enabled PIE on binutils > > sucessfully aparently, What will happend? Will it be enabled? What about > > the other flags? > > The issue has been fixed upstream; as noted previously I will handle > this when time allows. This will definitely happen sooner than later, > probably in May. > > Bartłomiej > > \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

3 2

[arch-general] Best practices for creating an Arch Docker image
by Giovanni Santini 30 Apr '17

30 Apr '17

Good evening to everybody, I got interested in Docker lately and I've decided to create an ArchLinux image for it. There's one suggested from the ArchWiki (*base/archlinux*) but I wanted to learn from scratch. So, I've then some questions: 1. As the root filesystem, I've made a repacked version of the bootstrap tarball. Even though it is not so clean, it works and it is easy peasy to do. Should I go still for a `pacstrap`? 2. Theorically, one step of the Dockerfile should be installing the whole 'base' group, which includes also the kernel, which is not really needed in a container. So this questions splits up in 2 parts: - which packages I can ignore of the 'base' group? - which packages present in the bootstrap OS can be removed? This is because I think the Docker image should contain only the least number of packages of an Arch system; ideally, *pacman* and the needed core utils. 3. I'm having a GPGME error with the i686 tarball... Upgrading GPGME breaks pacman, upgrading pacman does the same. If someone is interested in helping me, I would be glad to share the Dockerfile. A first working code is here: https://github.com/ItachiSan/dockerfiles -- Giovanni Santini My blog: http://giovannisantini.tk My code: https://git{hub,lab}.com/ItachiSan My GPG: 2FADEBF5

5 5

[arch-general] [Q] What is sign-off?
by Dragon ryu 30 Apr '17

30 Apr '17

I wonder what is meaning. Also exsample will be appreciated

2 3

[arch-general] [Questions] Questions from past project and ideas fomr -dev-public that get silence.
by Pablo Roberto Lezaeta Reyes 30 Apr '17

30 Apr '17

During this and the end of previous year some ideas and projects were started to adress some problems, but most of them get now silence and nothing more. I'm talking about * ABS deprecation draft, Will be one or just ABS will be removed and ASP (which sound like Active Server Pages) will be pushed or both will coexist until it get broken? * What happend with the project of sign-off from non TU that was mentioned a few months? Is still runing? is there a way/path to get involved? * What about the new build flags [1], Now that Allan is not more the maintainer and that either Debian and Fedora enabled PIE on binutils sucessfully aparently, What will happend? Will it be enabled? What about the other flags? [1] https://www.archlinux.org/news/test-sec-flags-call-for-assistance/ -- *Pablo Lezaeta*

2 1

[arch-general] Tobias Powalowski and his nonsensical maintenance decisions
by fnodeuser 29 Apr '17

29 Apr '17

Tobias Powalowski, you continue to place pkgs in the testing repo that do not require any further testing. for what reasons, exactly, do the linux 4.10.13 and hwids 20170328 pkgs need to be in testing for 4+ days? also, you did not replace git:// with git+https:// in the hwids PKGBUILD file. github has HTTPS enabled for everything.

9 14

Re: [arch-general] Tobias Powalowski and his nonsensical maintenance decisions
by Dragon ryu 29 Apr '17

29 Apr '17

2017/04/30 午前5:58 "fnodeuser" <fnodeuser(a)binkmail.com>: i do not thank you for your conclusion jumping and for the censorship ("I have put you on moderation."). you have disappointed me Florian. time to set the record straight. > Florian Pritz, > > 1. i am not annoying, i am rational. > > 2. testing the stable minor releases makes no sense. we should be testing the release candidates of 4.11 > since its stable release is nearing. that would actually be beneficial to the users. the placing of stable > minor releases in testing is only delaying the distribution of the fixes to the users. > > also, AL users are expected to RTFM. AL is for advanced users and for people who are willing to learn how to > administrate their system(s). > > 3. he has known about it for many months. https://www.archlinux.org/ todo/use-gpg-signatures-and-https-sources/ the above reply was rejected yesterday by little Florian for this reason: > The moderator gave the following reason for rejecting your request: > > "Your message was deemed inappropriate by the moderator." i know. it is so 'inappropriate' that Pope Francis would have died if he ever read it. now, on to the rest. about the '4+ days' thing. reread my message, carefully, because you have difficulties comprehending what i typed. hint: it is about delaying things for no good reason. two more maintenance examples, a recent Antonio Rojas one (once again, he edited today another imperfect PKGBUILD file and left it imperfect), and a Sébastien Luttringer one (an example of stupidity): https://git.archlinux.org/svntogit/packages.git/commit/ trunk/PKGBUILD?h=packages/help2man&id=47e0c555b37f059be552a930a5da80 130942d5a6 an md5 hash is still used and ftp.gnu.org is HTTPS-enabled. nevertheless, i must say that he has improved. https://git.archlinux.org/svntogit/packages.git/commit/ trunk/PKGBUILD?h=packages/btrfs-progs&id=c2dab0f16df636bb0ea94e54d7f116 d5d1504e60 https://www.kernel.org/pub/linux/kernel/people/kdave/ btrfs-progs/sha256sums.asc he has learning difficulties. Carsten Mattner, yes, it is true. sometimes things break, but things can be fixed and there are ways to avoid breakage. RTFM and/or RTFW is a requirement.[1] also, because of evolution, each one of us possess a brain that can do 'miracles' when it is actually used. use it, people. i know that there are people for whom the activity of thinking is extremely painful, but we cannot stop 'rolling' because of them. in almost all cases it is the AL user's fault. if one is careless and clueless, bad things can and do happen. that is true almost everywhere, not only in system administration. - "They see me rollin', They hatin'!" (AL is a rolling release distro, and we want to (rock and) 'roll' forever) _ [1] https://wiki.archlinux.org/index.php/Pacman#Skip_package_ from_being_upgraded https://wiki.archlinux.org/index.php/Pacman#Skip_package_ group_from_being_upgraded https://wiki.archlinux.org/index.php/Pacman#Skip_files_ from_being_installed_to_system PS: Florian's censorship necessitated the use of a different address. any complaints about the message being out of the existing threads are invalid and remarks about my disposable email address are irrelevant. Florian, remove me immediately from 'moderation' to prove: 1. that you actually want to have an honest discussion about anything and everything, 2. that you are a decent person. PPS: whoever you are, you are so cute! port scanning my IP address yesterday, and today registering around with my name. Whoa. Why PKGBUILD need to be perfect? don't need to... And I think PKGBUILD is only thing in AUR, not in this Mailing list. Also, you need to calm down a little bit, think about what you did. - Chroma/Proj. Chisaki

1 0

Re: [arch-general] End of official PaX and grsecurity support in Arch Linux
by Alexander Harrigan 29 Apr '17

29 Apr '17

Name doesn't matter. When it breaks with systemd then it will be stopped but that won't be in months. Paxd is avalaible and it always be assumed to maintain it by yourself. Also I see contradiction when you say many critical grsecurity features won't be avalaible in mainline kernels anytime soon and same time you say there is no sense to use last grsec kernel as long as we can. I'm not asking you to maintain it. There is a chance that gentoo|opensuse|debian guys step in to do it. In that case it will be beneficial to Arch having it avalaible in AUR. Anyway I'll be using grsec kernel myself until something like linux-hardened be avalaible. On On Sat, Apr 29, 2017 at 07:20 PM, Daniel Micay via arch-general <arch- general(a)archlinux.org> wrote: > On Sat, 2017-04-29 at 17:03 +0000, Alexander Harrigan wrote: > > I found someone from opensuse started to maintain grsec patches for > > 4.9 kernel > > series [1]. Maybe it will be possible to add linux-lts-grsec package > > to AUR > > based on Daniel's PKGBUILD and config with RANDSTRUCT enabled linked > > to new > > upstream source. > > > > [1] https://github.com/kdave/grsecurity-patches/tree/master/wip > > As I mentioned, it can't be called PaX or grsecurity. I also don't think > it makes sense to expend time on this. It won't support new hardware and > systemd will probably increase the minimum kernel version before the 4.9 > LTS is end-of-life. Effort spent on 4.9 is effort not spent on anything > that will actually last. If someone decides to do this, they'll also be > taking responsibility for maintaining PaX exceptions, etc. and handling > any bugs caught by the features or false positives. There will be new > issues introduced as the LTS gets changes backported to it. \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

2 1

[arch-general] Tobias Powalowski and his nonsensical maintenance decisions
by fnodeuser 29 Apr '17

29 Apr '17

i do not thank you for your conclusion jumping and for the censorship ("I have put you on moderation."). you have disappointed me Florian. time to set the record straight. > Florian Pritz, > > 1. i am not annoying, i am rational. > > 2. testing the stable minor releases makes no sense. we should be testing the release candidates of 4.11 > since its stable release is nearing. that would actually be beneficial to the users. the placing of stable > minor releases in testing is only delaying the distribution of the fixes to the users. > > also, AL users are expected to RTFM. AL is for advanced users and for people who are willing to learn how to > administrate their system(s). > > 3. he has known about it for many months. https://www.archlinux.org/todo/use-gpg-signatures-and-https-sources/ the above reply was rejected yesterday by little Florian for this reason: > The moderator gave the following reason for rejecting your request: > > "Your message was deemed inappropriate by the moderator." i know. it is so 'inappropriate' that Pope Francis would have died if he ever read it. now, on to the rest. about the '4+ days' thing. reread my message, carefully, because you have difficulties comprehending what i typed. hint: it is about delaying things for no good reason. two more maintenance examples, a recent Antonio Rojas one (once again, he edited today another imperfect PKGBUILD file and left it imperfect), and a Sébastien Luttringer one (an example of stupidity): https://git.archlinux.org/svntogit/packages.git/commit/trunk/PKGBUILD?h=pac… an md5 hash is still used and ftp.gnu.org is HTTPS-enabled. nevertheless, i must say that he has improved. https://git.archlinux.org/svntogit/packages.git/commit/trunk/PKGBUILD?h=pac… https://www.kernel.org/pub/linux/kernel/people/kdave/btrfs-progs/sha256sums… he has learning difficulties. Carsten Mattner, yes, it is true. sometimes things break, but things can be fixed and there are ways to avoid breakage. RTFM and/or RTFW is a requirement.[1] also, because of evolution, each one of us possess a brain that can do 'miracles' when it is actually used. use it, people. i know that there are people for whom the activity of thinking is extremely painful, but we cannot stop 'rolling' because of them. in almost all cases it is the AL user's fault. if one is careless and clueless, bad things can and do happen. that is true almost everywhere, not only in system administration. - "They see me rollin', They hatin'!" (AL is a rolling release distro, and we want to (rock and) 'roll' forever) _ [1] https://wiki.archlinux.org/index.php/Pacman#Skip_package_from_being_upgraded https://wiki.archlinux.org/index.php/Pacman#Skip_package_group_from_being_u… https://wiki.archlinux.org/index.php/Pacman#Skip_files_from_being_installed… PS: Florian's censorship necessitated the use of a different address. any complaints about the message being out of the existing threads are invalid and remarks about my disposable email address are irrelevant. Florian, remove me immediately from 'moderation' to prove: 1. that you actually want to have an honest discussion about anything and everything, 2. that you are a decent person. PPS: whoever you are, you are so cute! port scanning my IP address yesterday, and today registering around with my name.

1 0

Re: [arch-general] End of official PaX and grsecurity support in Arch Linux
by Alexander Harrigan 29 Apr '17

29 Apr '17

I found someone from opensuse started to maintain grsec patches for 4.9 kernel series [1]. Maybe it will be possible to add linux-lts-grsec package to AUR based on Daniel's PKGBUILD and config with RANDSTRUCT enabled linked to new upstream source. [1] https://github.com/kdave/grsecurity-patches/tree/master/wip \-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io

2 1