- Arch-general - lists.archlinux.org

[arch-general] Clarification on pacman signature verification
by Solomon Lam 25 Jan '16

25 Jan '16

Hi, This is regarding package verification performed by pacman. Does pacman download the .sig file of a package while installing one? All I could find are the local cached copies of packages only but not their signatures. If thats the case, how does pacman verify the integrity of the downloaded package? It could be that .sig file could have been downloaded into /tmp during installation or to another location that I'm not aware yet. This brings me to my next point. I've manually downloaded just the package file (of some random package) from a mirror and disconnected from the Internet. I used both 'pacman -U <pkg-name>' and 'pacman -S <pkg-name>' to install the package and the installation went just fine. I was expecting Pacman to emit an error stating that signature was missing but nothing happened. Could someone care to explain this. BTW, I have SigLevel = Required DatabaseOptional in my pacman.conf. - Solomon

3 4

Re: [arch-general] [tor] User and group entries are left over in passwd and gshadow after removal, makes pwck and shadow.service fail
by Bastien Traverse 25 Jan '16

25 Jan '16

On Mon, 25 Jan 2016 17:45:17 +0100 Doug Newgard <scimmia at archlinux.info > wrote: > Dev discussion here: > https://lists.archlinux.org/pipermail/arch-dev-public/2015-February/026953.… Thanks, that's the context I needed to understand your decision. Reading the dev discussion and the clear consensus emerging from it, I wonder about corner (?) cases like tor where an important service fails due to the absence of user removal in package management. Central to this particular issue is the specification of a home directory which is deleted upon package removal because empty, which trips pwck. For it not to fail on those cases, a possible solution would be to add package-specific home dirs to PKGBUILDs backup=() array, but that's kind of an ugly workaround. I'll leave it here for now, Cheers

1 0

[arch-general] [tor] User and group entries are left over in passwd and gshadow after removal, makes pwck and shadow.service fail
by Bastien Traverse 25 Jan '16

25 Jan '16

Hi, I opened FS#47893 [1] to discuss this issue, but it's been closed with no delay and I can't really have a discussion via re-opening requests. Upon installation of the tor package, directory /var/lib/tor is created (see PKGBUILD#40 [2]). Upon uninstallation, it is automatically deleted **only if empty**: # pacman -S tor # touch /var/lib/tor/test # pacman -Rns tor # ls -lah /var/lib/tor total 8,0K drwx------ 2 tor tor 4,0K 25 janv. 16:50 . drwxr-xr-x 39 root root 4,0K 25 janv. 16:50 .. -rw-r--r-- 1 root root 0 25 janv. 16:50 test # rm -rf /var/lib/tor # pacman -S tor ... (1/1) installing tor error: command failed to execute correctly ... # pacman -Rns tor # ls -lah /var/lib/tor ls: cannot access /var/lib/tor: No such file or directory However, tor user and group (UID/GID 43) created via post_install() hook [3] are not removed: # pacman -Rns tor $ id tor uid=43(tor) gid=43(tor) groupes=43(tor) This makes shadow.service fail at bootup: pwck[718]: tor user: directory « /var/lib/tor » does not exist pwck[718]: pwck : no change systemd[1]: shadow.service: Main process exited, code=exited, status=2/INVALIDARGUMENT systemd[1]: Failed to start Verify integrity of password and group files. systemd[1]: shadow.service: Unit entered failed state. systemd[1]: shadow.service: Failed with result 'exit-code'. Same for pwck. What I asked in FS#47893 was to add a post_uninstall() hook to remove tor user (e.g. with `userdel tor`), so that **if /var/lib/tor has been deleted automatically** because it was empty, pwck doesn't trip on home dir verification. Note that if /var/lib/tor isn't empty, `userdel tor` would merely remove the user entry and not delete its home directory (-r switch). Therefore, no data loss. Moreover, I believe it is possible to condition user deletion on directory existence (e.g. `if [ ! -e /var/lib/tor ]; then userdel tor; else :`), so that could do it too. Reason for closing was "Not a bug / So fix it. This isn't something that can be dealt with automatically". I fail to see how it is so, but if I'm wrong please tell me so and why. Thanks, Bastien [1] https://bugs.archlinux.org/task/47893 [2] https://projects.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h… [3] https://projects.archlinux.org/svntogit/community.git/tree/trunk/tor.instal…

2 1

[arch-general] Mounting root according to fstab the first time (fstab in initrd)?
by Garmine 42 25 Jan '16

25 Jan '16

Hi! My concern is that there are a few mount flags which can not be changed with a remount (at least on some FSes such as btrfs). Now as far as I understand, the kernel mounts root RO after boot using the root and rootflags parameters. I also found that you can include /etc/fstab in the initrd. How can I convince the kernel to mount every volume including the root according to fstab instead of the kernel paramters? In case the kernel isn't the one which reads fstab (which I suspect), can I include some binary in the initrd that would read fstab and handle the mounting for me? Or should I just scrap the whole above idea and write something that'll a) read the root volume's options from fstab and put it on the cmdline through e.g. a grub-mkconfig script? Thanks in advance! Regards, Garmine

4 12

[arch-general] Unknown Trust and Corrupted Package
by Jayesh Badwaik 25 Jan '16

25 Jan '16

Hi, I'm receiving message about unknown trust while trying to install the confuse package. $ sudo pacman -S confuse resolving dependencies... looking for conflicting packages... Packages (1) confuse-2.8-1 Total Download Size: 0.03 MiB Total Installed Size: 0.11 MiB :: Proceed with installation? [Y/n] y :: Retrieving packages ... confuse-2.8-1-x86_64 33.8 KiB 4.72M/s 00:00 [######################] 100% (1/1) checking keys in keyring [######################] 100% (1/1) checking package integrity [######################] 100% error: confuse: signature from "Thorsten Töpper <atsutane(a)freethoughts.de>" is unknown trust :: File /var/cache/pacman/pkg/confuse-2.8-1-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)). Do you want to delete it? [Y/n] y error: failed to commit transaction (invalid or corrupted package (PGP signature)) Errors occurred, no packages were upgraded. -- Jayesh Badwaik

7 10

[arch-general] archlinux-keyring 20160123-1 is needed, but unavailable without testing
by Ralf Mardorf 25 Jan '16

25 Jan '16

Hi, archlinux-keyring 20160123-1 is needed, but not available, if testing isn't used. Packages (11) boost-1.60.0-2 boost-libs-1.60.0-2 cmake-3.4.2-1 confuse-2.8-1 dhcpcd-6.10.1-1 libvpx-1.5.0-4 ntp-4.2.8.p6-1 openmpi-1.10.2-1 pacman-mirrorlist-20160124-1 python-setuptools-1:19.6-1 python2-setuptools-1:19.6-1 error: confuse: signature from "Thorsten Töpper <atsutane(a)freethoughts.de>" is unknown trust :: File /var/cache/pacman/pkg/confuse-2.8-1-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)). # pacman-key --refresh-keys --updatedb This fixed the issue with the signature. However, the current keyring package isn't available. "archlinux-keyring 20160123-1" - https://www.archlinux.org/packages/testing/any/archlinux-keyring/ "archlinux-keyring 20151220-1" - https://www.archlinux.org/packages/core/any/archlinux-keyring/ # pacman -Q archlinux-keyring archlinux-keyring 20151220-1 # pacman -Si archlinux-keyring | grep Ver Version : 20151220-1 Regards, Ralf

1 1

[arch-general] messing with external USB and .mount/.automount drive
by arnaud gaboury 22 Jan '16

22 Jan '16

I want to timer a simple backup of part of my system with rsync. The partition I want to use for backup is on an external USB drive. For safety reasons (avoid any accidental erase), I want the partition be mounted only for the time of the rsync, then be umounted Here is my setup: /etc/fstab ----------------- UUID=868560c1-ab69-423f-b76d-b8ea5af1b066 /mnt/backup ext2 noauto,x-systemd.automount,x-systemd.device-timeout=5,x-systemd.idle-timeout=60 0 2 ----------------------- /etc/systemd/system/backup-external.service ---------------------------------------------------- [Unit] Description=Backup system to external drive Requires=mnt-backup.mount After=mnt-backup.mount [Service] Type=oneshot ExecStart=/usr/bin/rsync -av --delete --exclude-from /etc/conf.d/exclude-hortensia / /mnt/backup/hortensia ExecStartPost=/usr/bin/umount /mnt/backup ------------------------------------------------------------------------- /etc/systemd/system/backup-external.timer ------------------------------------------ [Unit] Description=Start external-backup service periodically [Timer] OnCalendar=Mon *-*-* 00:00:00 Persistent=True [Install] WantedBy=timers.target --------------------------------------------------- $ ls /run/systemd/generator ..... mnt-backup.automount mnt-backup.mount --------------------------------- The setup works BUT in fact /mnt/backup/hortensia is always mounted, even after boot, and I want to avoid it.(maybe because it is USB and autmounted like any USB device?) What surprised me is if I run: # umount /mnt/backup I come back to command with no text BUT /dev/dev/mapper/vg1-backup_hortensia (my backup partition) is still mounted. Furthermore, I can mount/umount it elsewhere (mnt/toto for example). I can't see what is wrong and how can I achieve my goal. Thank you for help -- google.com/+arnaudgabourygabx

1 1

Re: [arch-general] Experiences with SELinux on Arch
by Nicolas Iooss 22 Jan '16

22 Jan '16

On Fri, Jan 22, 2016 at 11:25 AM, Remi Gacogne < listes+arch-general(a)valombre.net> wrote: > Hi Niels, > > > since I won't get an answer on the forum except "Read the Wiki" which > > isn't helpful, I ask here. > > Is here anybody with real world experiences with SELinux on Arch? The > > forum states the userland tools as "work in progress" which doesn't say > > anything about the progress… > > I'd like to know how easy SELinux is to use on Arch. I am just starting > > out to (re-)enabling it on my CentOS-servers and there it is actually > > not that hard after all nowadays because of the great tools available. > > But how about Arch? > > You might want to look at this project: > > https://github.com/archlinuxhardened/selinux > https://github.com/archlinuxhardened/selinux-policy-arch > > I know Nicolas is working on making it as easy as possible to use > SELinux on Arch, and he is doing a great job. > I am this Nicolas :) I am currently maintaining the SELinux packages in the AUR and can answer you with information which is more up to date than the wiki page (that I don't update often, and thankfully other people are taking care of it). First, about the userspace tools and library (libselinux, setools...) and the programs which need to be recompiled with SELinux support, there are AUR packages which are working (I am not aware of any bug right now, and am using them on my systems). I have been working on making the install process easier for a few years and as there can be some difficulties (like the build-time circular dependency between util-linux and systemd, which is not a bug according to https://bugs.archlinux.org/task/39767) I recently published an install script which builds and installs all SELinux packages (build_and_install_all.sh in https://github.com/archlinuxhardened/selinux) You may be interested in using it to get SELinux on Arch. Then, about the policy, there is currently no publicly-available policy for Arch Linux, unlike Gentoo, Debian, Fedora and CentOS. For those on the ML which are not familiar with SELinux but who know firewall configuration, SELinux is like a firewall for applications and "a SELinux policy" is a set of rules to filter accesses in a way which is similar to iptables rules filtering network communications. There is an "upstream" (reference) policy, from Tresys Technologies ( https://github.com/TresysTechnology/refpolicy) which is used by Debian and Gentoo (not by Fedora). I am currently working on bringing Arch Linux support into refpolicy, and this work is still in progress. For example refpolicy did not have systemd support before its last release (which happened in December), and now there are still issues with partially-supported systemd services. I recently updated selinux-refpolicy-arch AUR packages with some commits from my personal policy which I'll submit upstream ( https://github.com/archlinuxhardened/selinux-policy-arch/commits/2.20151208) but it is still not complete for a "base system". By the way, if anyone wants to take a look at what looks like Arch Linux with SELinux, for example in a virtual machine, it is possible to create a Vagrant VM by following the instructions on https://github.com/archlinuxhardened/selinux/tree/master/_vagrant and then play in a "vagrant ssh" session. Finally, for the reasons why SELinux is not integrated to Arch Linux like Debian (i.e. compiled without being activated by default, contrary to CentOS and Fedora where SELinux is enabled by default), I believe the three main points are: * support of audit in the kernel (currently there is an annoying bug in chromium seccomp filters which spams the logs when audit is enabled, https://code.google.com/p/chromium/issues/detail?id=456535) * LSM support in the kernel (e.g. https://bugs.archlinux.org/task/37578 , which is more detailed than https://bugs.archlinux.org/task/31448) * and package management (libsepol, libselinux and libsemanage would need to be added to core repository and thus maintained by Arch devs). I do not see anything today which would lead to the solving of any of these issues in the short run, so I maintain packages in the AUR and continue working on the policy. If you feels like helping this work, feel free to submit pull requests on GitHub (or submit patches upstream). Nicolas PS : for the record, I am running a kernel with both SELinux and grsec (without RBAC) on my systems. These two security systems target different things and it is possible to use both.

1 0

[arch-general] Conflict after 3 week upgrade pause
by Patrick Hofmann 18 Jan '16

18 Jan '16

Hello all I had no internet for 3 weeks after moving and I Just updated for the first time again. Pacman now tells me that xf86-input-libinput and xorg-server are in confict and wants to remove xorg-server. I use xorg-server not wayland, so I dont think that is a good idea. I tried removing xf86-input-libinput with pacman -Rdd xf86-input-libinput but that results in: target not found. How can there be a conflict if xf86-input-libinput isnt there? Regards Patrick

4 4

[arch-general] which nfs startup services to enable ?
by niya levi 16 Jan '16

16 Jan '16

Hi i have set up a keberised nfsv4/v3 server and kerberised v3 clients. i have these services enabled on the nfs server nfs-server rpcbind rpc-gssd gssproxy nfs-idmapd rpc-statd and these enabled on the nfs client rpcbind rpc-statd nfs-client.target remote-fs.target rpc-gssd nfs-idmapd the nfs wiki page says for the nfs server to enable nfs-server rpcbind do the following need to be enabled for a kerberised nfs server: rpc-gssd gssproxy nfs-idmapd rpc-statd ? the nfs wiki page says for the nfs client to enable rpcbind nfs-client.target remote-fs.target plus rpc-gssd for kerberos do the following need to be enabled for a kerberised nfs client: rpc-statd nfs-idmapd ? thanks Shadrock

1 0