- Arch-general - lists.archlinux.org

[arch-general] [Announcement] Discussion about restricting arch-security for public participation
by Levente Polyak 30 Jan '16

30 Jan '16

Dear arch-security subscribers, Dear arch-general subscribers, the policy of the arch-security mailinglist is currently changed to a restricted advisory announcements only list due to certain reason roughly explained on the arch-devops [0] and arch-dev-public [1] lists. As there was no announcement and discussion about this change yet, we want to invite you to discuss the restriction of the arch-security mailinglist on the CC-ed arch-general list. After making sure you are subscribed to arch-general [2], you can simply reply to this announcement by posting directly to the arch-general mailinglist. Our main goal behind this change is to separate relevant official announcements and advisories from possibly long and frequent discussions. The security teams idea is that each announcement to the arch-security list should be considered as an urgent alert and reviewed as soon as possible, without the need to filter them from general conversations and exchange of "unverified" information. sincerely, Levente (anthraxx) [0] https://lists.archlinux.org/pipermail/arch-devops/2016-January/000007.html [1] https://lists.archlinux.org/pipermail/arch-dev-public/2015-December/027581.… [2] https://lists.archlinux.org/listinfo/arch-general

5 7

[arch-general] Gnucash 2.6.10-1 download error
by Francis Gerund 30 Jan '16

30 Jan '16

Hello. I am running Arch x86_64. sudo pacmatic -Syyuv gnucash results in: Root : / Conf File : /etc/pacman.conf DB Path : /var/lib/pacman/ Cache Dirs: /var/cache/pacman/pkg/ Lock File : /var/lib/pacman/db.lck Log File : /var/log/pacman.log GPG Dir : /etc/pacman.d/gnupg/ Targets : gnucash :: Synchronizing package databases... core 122.4 KiB 408K/s 00:00 [#########################################] 100% extra 1764.7 KiB 1812K/s 00:01 [#########################################] 100% community 3.3 MiB 1832K/s 00:02 [#########################################] 100% :: Starting full system upgrade... resolving dependencies... looking for conflicting packages... Packages (18) aqbanking-5.5.1-2 goffice0.8-0.8.17-3 guile1.8-1.8.8-4 gwenhywfar-4.13.1-3 ktoblzcheck-1.48-3 libart-lgpl-2.3.21-3 libdbi-0.9.0-2 libdbi-drivers-0.9.0-2 libgnomecanvas-2.30.3-3 libgsf-1.14.34-1 libmariadbclient-10.1.10-1 libofx-0.9.10-1 libxml++-2.40.1-1 opensp-1.5.2-5 postgresql-libs-9.4.5-1 python-3.5.1-1 slib-3b5-1 gnucash-2.6.10-1 Total Download Size: 0.66 MiB Total Installed Size: 221.06 MiB :: Proceed with installation? [Y/n] :: Retrieving packages ... libdbi-0.9.0-2-x86_64 642.2 KiB 1212K/s 00:01 [#########################################] 100% libdbi-drivers-0.9.0-2-x86_64 35.4 KiB 1771K/s 00:00 [#########################################] 100% (18/18) checking keys in keyring [#########################################] 100% (18/18) checking package integrity [#########################################] 100% error: libdbi: signature from "Thorsten Töpper <atsutane(a)freethoughts.de>" is unknown trust :: File /var/cache/pacman/pkg/libdbi-0.9.0-2-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)). Do you want to delete it? [Y/n] y error: libdbi-drivers: signature from "Thorsten Töpper < atsutane(a)freethoughts.de>" is unknown trust :: File /var/cache/pacman/pkg/libdbi-drivers-0.9.0-2-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)). Do you want to delete it? [Y/n] y error: failed to commit transaction (invalid or corrupted package) Errors occurred, no packages were upgraded. No pacnew files to update. Also, sudo pacmatic -S libdbi [sudo] password for default: Recent ML chatter: resolving dependencies... looking for conflicting packages... Packages (1) libdbi-0.9.0-2 Total Download Size: 0.63 MiB Total Installed Size: 1.92 MiB :: Proceed with installation? [Y/n] :: Retrieving packages ... libdbi-0.9.0-2-x86_64 642.2 KiB 1387K/s 00:00 [#########################################] 100% (1/1) checking keys in keyring [#########################################] 100% (1/1) checking package integrity [#########################################] 100% error: libdbi: signature from "Thorsten Töpper <atsutane(a)freethoughts.de>" is unknown trust :: File /var/cache/pacman/pkg/libdbi-0.9.0-2-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)). Do you want to delete it? [Y/n] y error: failed to commit transaction (invalid or corrupted package (PGP signature)) Errors occurred, no packages were upgraded. No pacnew files to update. And, sudo pacmatic -S libdbi-drivers Recent ML chatter: resolving dependencies... looking for conflicting packages... Packages (2) libdbi-0.9.0-2 libdbi-drivers-0.9.0-2 Total Download Size: 0.66 MiB Total Installed Size: 2.08 MiB :: Proceed with installation? [Y/n] :: Retrieving packages ... libdbi-0.9.0-2-x86_64 642.2 KiB 698K/s 00:01 [#########################################] 100% libdbi-drivers-0.9.0-2-x86_64 35.4 KiB 4.94M/s 00:00 [#########################################] 100% (2/2) checking keys in keyring [#########################################] 100% (2/2) checking package integrity [#########################################] 100% error: libdbi: signature from "Thorsten Töpper <atsutane(a)freethoughts.de>" is unknown trust :: File /var/cache/pacman/pkg/libdbi-0.9.0-2-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)). Do you want to delete it? [Y/n] y error: libdbi-drivers: signature from "Thorsten Töpper < atsutane(a)freethoughts.de>" is unknown trust :: File /var/cache/pacman/pkg/libdbi-drivers-0.9.0-2-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)). Do you want to delete it? [Y/n] y error: failed to commit transaction (invalid or corrupted package (PGP signature)) Errors occurred, no packages were upgraded. No pacnew files to update. (Note: other packages download fine, and I see no apparent problems with pacman. ) Should this be reported as a bug (or 2-3 bugs)? Or just I just patiently wait for Gnucash 2.6.11-1 (gnucash-latest) to move to the "extra" repository? And if so, any idea when it might be ready?

5 11

[arch-general] systemd user unit files from custom directory
by Andre "Osku" Schmidt 30 Jan '16

30 Jan '16

hello, thought i'd ask here first, in case it's a distro problem. was wondering if we can use systemd to start and stop a daemon for testing purposes during development. meaning, i would like to not have to "install" my daemon nor its systemd service file, and instead run all from the working directory. from systemd.unit man page i got the impression that this example would work: ❱ tree $PWD /data/projects/hmm └── systemd └── user └── foobar.service ❱ cat systemd/user/foobar.service [Unit] Description=Foo Bar [Service] ExecStart=/usr/bin/sleep 42 ❱ XDG_CONFIG_HOME=$PWD systemctl --user start foobar Failed to start foobar.service: Unit foobar.service failed to load: No such file or directory. am i doing it wrong, or? Cheers Andre Schmidt

2 3

[arch-general] systemctl --user problems
by edsonduarte1990＠riseup.net 29 Jan '16

29 Jan '16

hi! this last week systemctl --user stopped working saying: > Failed to connect to bus: No such file or directory first thing I tried was downgrading systemd but it didn't work. so after reading several pages, I still haven't figured out what's happening but it helped me find several other weird things that I don't know if are related... 1. user(a)1000.service fails with timeout, is there a way to find what's making the service hang? 2. after restarting user@, polkitd.service says: > Started Authorization Manager. > Registered Authentication Agent for unix-process:2622:23390 (system bus > name :1.20 [/usr/bin/pkttyagent --notify-fd 4 --fallback], object path > /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) > Unregistered Authentication Agent for unix-process:2622:23390 (system > bus name :1.20, object path > /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) > (disconnected from bus) without registering again which I am not sure if is the correct behaviour but can be due to manually starting user@... 3. and also I've found that XDG_RUNTIME_DIR and XDG_SESSION_ID are not set (neither before or after restarting user@) as should be the case from [1] and [2]. thanks for the help. [1] https://wiki.archlinux.org/index.php/XDG_Base_Directory_support#User_dir ectories [2] https://wiki.archlinux.org/index.php/General_troubleshooting#Session_per missions -- edson duarte

3 2

Re: [arch-general] [Announcement] Discussion about restricting arch-security for public participation
by AIS Information 28 Jan '16

28 Jan '16

As a consumer of the list, i would actually prefer that it was closed. I want emails only when they are official security announcements from arch security team. Thanks for asking. Keep up the good work! ps. IMHO, the mailing lists rules, etiquette, best practices, how to report a security issue through proper channels, etc would be nice to have on the wiki or on lists.archlinux.org. The description for arch-security will probably need to be updated there too. Otherwise, people may get chatised for things that aren't documented in the expected places.

1 0

[arch-general] Can't install AppArmor on linux-grsec kernel
by Foxtrot Mike 27 Jan '16

27 Jan '16

Hi I installed linux-grsec kernel on my Arch system a few days back for improved security. My next step is to sandbox internet-facing applications such as firefox, thunderbird, torrent client, etc. However, it seems like grsecurity patchset doesn't have application sandboxing capability (Does it? Couldn't find it in docs or forums). In the past, I used Apparmor on Ubuntu for basic sandboxing. I tried installing it on linux-grsec kernel but it seems like the necessary kernel options required for installing Apparmor are disabled on linux-grsec kernel. The kernel options required by Apparmor on Arch are [1]: CONFIG_SECURITY_APPARMOR=y CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1 CONFIG_DEFAULT_SECURITY_APPARMOR=y CONFIG_AUDIT=y While my linux-grsec kernel's configuration reports: # CONFIG_SECURITY_APPARMOR is not set I think I could enable the required options by recompiling the linux-grsec kernel but it seems like the grsecurity team now provides the stable patches only to commercial customers [2], so I believe I won't be able to recompile the kernel myself (Perhaps I'm wrong?). I was hoping someone here would be able to help me install Apparmor on linux-grsec kernel or atleast point me in the right direction. Regards [1] https://wiki.archlinux.org/index.php/AppArmor#Kernel [2] https://grsecurity.net/announce.php

2 1

[arch-general] Experiences with SELinux on Arch
by Niels Kobschaetzki 27 Jan '16

27 Jan '16

Hi, since I won't get an answer on the forum except "Read the Wiki" which isn't helpful, I ask here. Is here anybody with real world experiences with SELinux on Arch? The forum states the userland tools as "work in progress" which doesn't say anything about the progress… I'd like to know how easy SELinux is to use on Arch. I am just starting out to (re-)enabling it on my CentOS-servers and there it is actually not that hard after all nowadays because of the great tools available. But how about Arch? Niels

5 5

[arch-general] Yahoo mail problems (was [aur-general] No notification for out-of-date package)
by Florian Pritz 27 Jan '16

27 Jan '16

On 14.01.2016 14:41, Florian Pritz wrote: > On 13.01.2016 18:53, Giovanni 'ItachiSan' Santini wrote: >> My package "telegram-desktop-bin-dev" was flagged as out of date on the >> 10th of January but I received no mail notification about that. > > It appears that yahoo has decided to "temporarily" reject all mails from > that system (bbs, wiki, aur, mailing lists). I've sent an email to their > postmaster and hope this will clear up soon. > > Until then, I'm afraid yahoo users will not receive emails from our > services. Sorry for the inconvenience. We are still unable to deliver mails to yahoo and so far my email to postmaster(a)yahoo.com has not received a reply. Can anyone put me in touch with someone from yahoo or tell me if the postmaster address is read (I kind of expect it to go to /dev/null)? Florian

5 6

[arch-general] Update php 5.6 to 7.0.1 problems
by Maykel Franco 27 Jan '16

27 Jan '16

[000][+][[user@arch-xbmc: /etc/php]] $ php --version PHP Warning: PHP Startup: Unable to load dynamic library '/usr/lib/php/modules/mysql.so' - /usr/lib/php/modules/mysql.so: cannot open shared object file: No such file or directory in Unknown on line 0 PHP Warning: PHP Startup: Unable to load dynamic library '/usr/lib/php/modules/openssl.so' - /usr/lib/php/modules/openssl.so: cannot open shared object file: No such file or directory in Unknown on line 0 PHP Warning: PHP Startup: Unable to load dynamic library '/usr/lib/php/modules/posix.so' - /usr/lib/php/modules/posix.so: cannot open shared object file: No such file or directory in Unknown on line 0 Can I help me please?

6 8

[arch-general] Clarification on pacman signature verification
by Solomon Lam 25 Jan '16

25 Jan '16

Hi, This is regarding package verification performed by pacman. Does pacman download the .sig file of a package while installing one? All I could find are the local cached copies of packages only but not their signatures. If thats the case, how does pacman verify the integrity of the downloaded package? It could be that .sig file could have been downloaded into /tmp during installation or to another location that I'm not aware yet. This brings me to my next point. I've manually downloaded just the package file (of some random package) from a mirror and disconnected from the Internet. I used both 'pacman -U <pkg-name>' and 'pacman -S <pkg-name>' to install the package and the installation went just fine. I was expecting Pacman to emit an error stating that signature was missing but nothing happened. Could someone care to explain this. BTW, I have SigLevel = Required DatabaseOptional in my pacman.conf. - Solomon

3 4