- Arch-general - lists.archlinux.org

[arch-general] On containers. WAS: Re: snapcraft.io ...
by Martin Kühne 30 Nov '16

30 Nov '16

This whole sandboxing and containerisation idiocy is such a pain. Oh look, the apps are not secure, the apps sometimes crash. But you know what, let's take a high level approach, because we're such great managers. Let's NOT make better apps and a better stack by actually writing better multimedia libraries. No, let's instead just lock the stuff in which we use anyway, so they can't do more harm than absolutely unavoidable. Let's face it: those wheels are BROKEN, and what we actually need is an effort to reinvent them a few more times so some of them might hold further scrutiny. Slightly off topic, I know, I'll be back at planning my own world domination myself. cheers! mar77i

11 13

Re: [arch-general] [arch-dev-public] Preparing OpenVPN 2.4.x - possible incompatible changes
by Mauro Santos 29 Nov '16

29 Nov '16

On 29-11-2016 17:00, Giancarlo Razzolini wrote: > Em novembro 29, 2016 14:38 Christian Hesse escreveu: >> >> We need root privileges at initialization phase, no? Privileges are >> dropped >> to nobody/nobody when initialization sequence completed. >> >> If we can make things work with non-root system user... Let me know >> how to do >> that. :D >> > > We just need root for creating the tun devices and destroying them. > I managed to make an entire unprivileged deployment. > > Basically all I need is this: > > [Service] > User=openvpn > Group=openvpn > PermissionsStartOnly=true > ExecStartPre=-/usr/bin/openvpn --rmtun --dev tun0 > ExecStartPre=/usr/bin/openvpn --mktun --dev tun0 --dev-type tun --user > openvpn --group openvpn > ExecStart= > ExecStart=/usr/bin/openvpn --cd /etc/openvpn --config %i.conf --daemon > openvpn@%i --writepid /run/openvpn/openvpn@%i.pid --status-version 2 > PIDFile=/run/openvpn/openvpn@%i.pid > I see a problem with this, the configuration file is not hard coded (good) but the tun device is hardcoded (bad). What happens if one wants more than one server or client instances? What if the user wants to use tap instead of tun devices? It will also not respect the naming configured in the configuration file, or at least it will have to match tun0. Trying to ship more secure unit files/configuration is good but it seems this would probably be best described in the wiki and let the user implement it if desired. > The config file doesn't need any actual user/group configuration, because > it is already started with the right user/group. It needs to use a > different > iproute binary (which in my case is a script) that has sudo permissions > for the openvpn user to run the ip command as root. > >> >> The new systemd units create this automatically. (Well, >> actually /run/openvpn-client and /run/openvpn-server.) > > Nice to hear this. > >> >> Just followed the link from our wiki [2]. Probably you can make this >> work, >> but I am not convinced this can be packaged to work smoothly. >> Dynamic device naming, up/route-up/... scripts, ... There is lot of stuff >> that can and will break. >> >> Still, if you have some clues on how to package this... >> > > I never meant for you (us) to package such setup. I was > just making the case for a dedicated openvpn system user > and it's run directories. At least one of those is already > taken care of. If we can deploy such unprivileged systemd > units, alongside upstream official ones, it's another matter. > > Personally I'm okay with all of this and I'll accommodate my > setup, no matter how openvpn gets packaged. I had to compile > openvpn for at least two release cycles because of a bug on it[0]. > I think you'll probably remember that one. > > Cheers, > Giancarlo Razzolini > > [0] https://bugs.archlinux.org/task/50090 -- Mauro Santos

1 0

Re: [arch-general] [arch-dev-public] Preparing OpenVPN 2.4.x - possible incompatible changes
by Damjan Georgievski 29 Nov '16

29 Nov '16

>> I do not oppose using whatever upstream is deploying, if it's >> rationale. I just think that we could create a system user for >> openvpn, even if most users will deploy it using root. > > We need root privileges at initialization phase, no? Privileges are dropped > to nobody/nobody when initialization sequence completed. > > If we can make things work with non-root system user... Let me know how to do > that. :D You can have systemd-networkd create the tun (or tap) interface and change its ownership to a specific user, that way openvpn doesn't need privileges for that. That's my setup with a bridged tap interface https://gist.github.com/gdamjan/6b988389afe36e4bb769 for tap interfaces, networkd can also do the ip setup, for tun interfaces, openvpn would need to use ... sudo? -- damjan

1 0

[arch-general] Analysis of ABI changes in the Linux kernel
by Ponomarenko Andrey 29 Nov '16

29 Nov '16

Hello, This is a tracker of ABI changes in the new upstream releases of the Linux kernel (defconfig, x86_64): https://abi-laboratory.pro/tracker/timeline/linux/ The tracker performs backward binary compatibility analysis of all public exported symbols and data types (declared in the ".ksymtab" and ".ksymtab_gpl" sections of the vmlinux binary + system calls) and lists all added/removed symbols. The source code of the tool is published on github: https://github.com/lvc/kernel-abi-tracker The tool can be used to compare ABIs of downstream kernels as well. See README of the project. Enjoy!

1 0

Re: [arch-general] unreadable characters login screen after install SOLVED
by niya levi 29 Nov '16

29 Nov '16

> On Mon, Nov 28, 2016 at 8:55 PM, niya levi via arch-general > <arch-general at archlinux.org > <https://lists.archlinux.org/listinfo/arch-general>> wrote: > >/is there another entry i should have comment , uncommented or added in />//etc/default/grub to make it permenant ? />/shadrock / > If you change things in /etc/default/grub, you have to # grub-mkconfig > -o /boot/grub/grub.chf to make the changes available to grub, whose > config is read at a time when no other file systems are visible... > > cheers! > mar77i thanks everyone for all the advice, i ran grub-mkconfig -o /boot/grub/grub.cfg and it boots up fine now. shadrock

1 0

Re: [arch-general] unreadable characters login screen after install
by niya levi 28 Nov '16

28 Nov '16

> Just to check, does "locale -c charmap" return UTF-8? If yes, then it seems > there is an issue with your default console font (I assume you didn't put > anything like this on the kernel command line). So, try changing the console > font either by the kernel cmdline or at runtime in a tty console: > https://wiki.archlinux.org/index.php/Fonts#Console_fonts . > > Also, what is your graphics card, and how do you load the graphics driver > (automatically, early in ramdisk via MODULES= in mkinitcpio.conf, etc.)? Try > booting with nomodeset at the kernel cmdline to disable KMS and see if your > fonts get back to normal... > > Cheers, > -- > Leonid Isaev locale -c charmap" returns lc_ctype UTF-8 my graphics card is a cirrus logic cl-gd5436 pci 1mb vga card it's loaded automatically, have tried adding nomodeset by pressing e at the boot screen with brings me to grub startup file i added nomodeset to the end of the 'linux /boot/vmlinux' line but no change. i got further by pressing e at boot and changing the GRUB_GFXPAYLOAD_LINUX to GRUB_GFXPAYLOAD_LINUX=text and the console screen displayed correctly, to make it permenant i edited /etc/default/grub and also changed the GRUB_GFXPAYLOAD_LINUX line there but upon reboot i was back to the previous block characters. so i can get a correct display if i press e and edit from there on each bootup, is there another entry i should have comment , uncommented or added in /etc/default/grub to make it permenant ? shadrock

3 2

[arch-general] Arch pkg user and group IDs?
by Hauke Fath 28 Nov '16

28 Nov '16

Hi, what are Arch's conventions for the numeric ranges of system (package) user and grop IDs? And can the range be limited? I am working up to switching a few dozen Debian clients to Arch. They have user homes on NFS, and authenticate through NIS. So far, nis distributes user and group IDs > 500, making anything lower a local / system ID. After installing Arch, I see % awk -F: '{ if ( $3 > 500 ) print }' < /etc/passwd systemd-journal-remote:x:999:999:systemd Journal Remote:/:/sbin/nologin systemd-journal-upload:x:998:998:systemd Journal Upload:/:/sbin/nologin systemd-coredump:x:997:997:systemd Core Dumper:/:/sbin/nologin % awk -F: '{ if ( $3 > 500 ) print }' < /etc/group systemd-journal-remote:x:999: systemd-journal-upload:x:998: systemd-coredump:x:997: lightdm:x:620: % which collide with NIS users.[1] My question: Do Arch packages come with hardcoded numerical user/group IDs? If not, is there a way to limit the numeric range of system IDs? I guess I would still have to reinstall the distribution. The alternative - a flag day to change NIS user and group IDs as well as on 4 TB file storage and local storage on 50 client machines - wouldn't be pretty. And I don't really have the time, either. Cheerio, hauke [1] lightdm appears to be a pathological case: It hardcodes both name and ID of its user and group, and installation plows on witjout flagging an error even after failing to register the user ID. -- The ASCII Ribbon Campaign Hauke Fath () No HTML/RTF in email Institut für Nachrichtentechnik /\ No Word docs in email TU Darmstadt Respect for open standards Ruf +49-6151-16-21344

4 17

Re: [arch-general] unreadable characters login screen after install
by niya levi 28 Nov '16

28 Nov '16

> hi everyone > after an install following the wiki installation guide and rebooting > the login screen shows unreadable characters, > the char displays as rectangular and square blocks, > locale.conf is set to LANG=en_GB.UTF-8 > vconsole.conf is set to KEYMAP=uk > i also tried adding a FONT= line to vconsole.conf while chrooted the but > no joy after rebooting, > the installation screen was fine. > any ideas ? > ---- On Sat, 26 Nov 2016 17:08:06 +0100 Ralf Mardorf<silver.bullet at zoho.com > <https://lists.archlinux.org/listinfo/arch-general>> wrote ---- > > Which login screen? > > > > A display manager's greeter? If so, xorg.conf or display manager settings might solve the issue. > > Oops, I was confusing keyboard with fonts. Not xorg.conf, but much likely the display manager configuration provides to chose a font. > > > > > Or tty? > > sorry i mean the login at the console, it a file server without xorg, display manger etc. shadrock

3 3

Re: [arch-general] [arch-dev-public] Moving arduino into [community] important notes
by Oon-Ee Ng 28 Nov '16

28 Nov '16

On Mon, Nov 28, 2016 at 3:26 PM, Antonio Rojas <arojas(a)archlinux.org> wrote: > > I thought AUR packages were unsupported. Sure, it is nice to give them a > higher version number when they are moved to the official repos to allow > for a smooth upgrade, but that shouldn't be an enforced rule IMO. And > removing epoch is a reasonable enough reason not to do it. There's a difference between unsupported and (un?)intentionally leaving all users' packages frozen at an old (eventually broken) version because epoch was removed, for some indeterminate period of time. Of course, the question about whether epoch should have been used in the AUR is a separate one (I think it's done mainly to help AUR helpers work). But once that's been done I don't see any good reason to remove it.

1 0

Re: [arch-general] unreadable characters login screen after install
by niya levi 28 Nov '16

28 Nov '16

> On Sun, Nov 27, 2016 at 10:36:10AM +0000, niya levi via arch-general wrote: > >/> hi everyone />/> after an install following the wiki installation guide and rebooting />/> the login screen shows unreadable characters, />/> the char displays as rectangular and square blocks, />/> locale.conf is set to LANG=en_GB.UTF-8 />/> vconsole.conf is set to KEYMAP=uk />/> i also tried adding a FONT= line to vconsole.conf while chrooted the > but />/> no joy after rebooting, />/> the installation screen was fine. />/> any ideas ? />//>/> ---- On Sat, 26 Nov 2016 17:08:06 +0100 Ralf Mardorf<silver.bullet > at zoho.com />/> <https://lists.archlinux.org/listinfo/arch-general>> wrote ---- />/> > Which login screen? />/> > />/> > A display manager's greeter? If so, xorg.conf or display manager > settings might solve the issue. />/> />/> Oops, I was confusing keyboard with fonts. Not xorg.conf, but much > likely the display manager configuration provides to chose a font. />/> />/> > />/> > Or tty? />/> > />/sorry i mean the login at the console, />//>/it a file server without xorg, display manger etc. />//>/shadrock / > Did you customize /etc/locale.gen and ran locale-gen? > > Cheers, > -- > Leonid Isaev yes in locale.gen i uncommented the following and ran locale-gen en_US.UTF-8 en_GB.UTF-8 locale.conf has lang=en_GB.UTF-8 vconsole.conf has KEYMAP=uk when booting it gets past the grub stage it print booting linux then loading ramdisk then the whatever follows displays unreadable block character. shadrock

2 1