- Arch-general - lists.archlinux.org

[arch-general] providing grsecurity in [community]
by henning mueller 18 Apr '14

18 Apr '14

Hey, I'm replying to a thread on arch-dev-public with the same subject, here. I'm maintaining the linux-grsec PKGBUILD in the AUR [0], wrote an utility to set PaX flags [1] and host a repository for binary grsecurity packages [2]. Although I like the idea of further integrating grsecurity into Arch Linux, I have some points to criticize on the planning proposals of Daniel Micay. > It also includes the PaX project to provide a much stronger > implementation of ASLR along with significant memory protections > for userspace. These features do break many packages, and require > setting flags on binaries when exceptions are necessary. I don't > want to place a burden on other packagers, so I plan on leaving > the parts requiring integration with other packages disabled at > first. 1. The very core of the grsecurity project is PaX. Without it, you miss out on the most effective security features. Some contributing linux-grsec users and me collected numerous binaries, which do not work well with PaX and the according PaX features, which have to be disabled in order to get them running. These are currently collected in the linux-pax-flags utility [1]. For a clean grsecurity integration, any flags on [core], [extra] and [community] should be set before releasing linux-grsec in [community]. > It would have no impact on people not using it, since it would > just be a very short string set in the `user.pax.flags` xattr key. > For example, `setfattr -n user.pax.flags -v "mr" > "$pkgdir/usr/bin/foo"` to disable MPROTECT and RANDMMAP features > (on chromium, firefox, etc.). 2. I think, manually setting the flags with a setfattr call in the PKGBUILDs is a bad solution, because it is error-prone. The Gentoo (hardened) folks integrated a new function for marking binaries with PaX flags into the ebuild environment. I would prefer a solution like this for Arch, too. A new PKGBUILD variable for PaX flags to be set after install() would also be a good solution (like PAX_FLAGS=(usr/bin/firefox:mr). (There is also a utility which supports xattr flags by the Gentoo hardened folks named paxctl-ng.) 3. I do not know, what the policy is, here, but I would prefer to maintain the PKGBUILD myself, if it gets included in [community]. At least, I would have expected to be integrated in the discussion a little more. I did the work on it since beginning of 2012 and run it on several machines since then. I think, a message like "I will adopt your package in [community]" is a little rude. The gradm package was already deleted from the AUR. On the linux-pax-flags AUR package, Daniel commented that I would have to change it to work according to his plans. I want to mention another step, that would be necessary for a decent integration of grsecurity and full ASLR: The activation of PIE/PIC. This has been discussed a little on the Arch Linux BBS [3]. Allan stated that "If there is a good way to add it for x86_64, it will be considered." Maybe it is possible to come up with a good way. Best regards, henning [0] https://aur.archlinux.org/packages/linux-grsec [1] https://github.com/nning/linux-pax-flags [2] https://arsch.orgizm.net [3] https://bbs.archlinux.org/viewtopic.php?id=172955

1 0

Re: [arch-general] Android support in Linux Arch
by Hugo Osvaldo Barrera 18 Apr '14

18 Apr '14

Looks like my message was silently dropped by mailman. Lemme retry this: On 2014-04-16 20:49, Hugo Osvaldo Barrera wrote: > First of all, thanks for all the efort you're putting into moving these > arch tools into the official repos. I've been wanting to see this (and > non-bin packages) for ages! :) > > On 2014-04-17 00:50, Karol Babioch wrote: > > Hi, > > > > Am 17.04.2014 00:38, schrieb Anatol Pomozov: > > > Are there people with Android development background? What exactly do > > > you miss in Arch? > > > > The problem I face with the Android situation in Arch is that currently > > there seems to be no "clean" (TM) way to install the SDK and related > > stuff. The android-sdk package from AUR is fine and dandy, but one > > usually also needs to install a whole bunch of API specific packages > > through the "android" tool from the SDK. > > > > - This doesn't work for normal users, e.g. you can update the packages > > using Eclipse, but you need to start "/opt/android-sdk/tools/android" as > > root > > Does this download additional files, or actually replace files the arch package installs? > > If it's the former, then you can create a user group (eg: android), > and make the directory where files are downloaded owned by that group. > > > > > - Installing any sort of package through the "installer" mentioned above > > isn't compatible with the whole idea of package management, because the > > package manager isn't aware of these files. I ran into conflicts before, > > which I had to resolve by temporarily removing some components. > > If we can make arch packages for all the packages available through that > installed, that would make it innecesary, though still usable. Something > similar happens with npm, gem (when used at a system level), pip, etc: > there's a second package manager that can (optionally) be used, but it's > a bad idea if you want to keep using arch's. > > > > > Maybe I'm doing something wrong here, but at least this is what I've > > experienced throughout the last couple of months. Unfortunately I don't > > see a good way how this can be improved, as I like the idea of > > installing only API components that I really need and get instant (!) > > updates for them directly from the upstream project. > > > > If you want the instante updated from upstream, then you'd need to update > the arch package instantly ;) This is exactly what happens with some of > the above mentioned examples (npm). > > > Anyone familiar with the situation on other distributions? How do they > > handle all of this? > > > > I did a bit of research on this. > Ubuntu suggest you download the SDK and install into into your home: > https://help.ubuntu.com/community/AndroidSDK > (so no useful precedent here). > > The same applies for Fedora: > https://fedoraproject.org/wiki/HOWTO_Setup_Android_Development > > Gentoo uses the upstream binaries in their packages (ebuild?): > https://wiki.gentoo.org/wiki/Android > > They DO seem to set permissions to 775, and ownership to root:android, > so I guess they do something similar to what I suggested above. > > Finally, Debian doesn't seem to package anythis other than the packages > that were mentioned as existing in AUR as source packages, so there's > nothing to be leart there. > > > Best regards, > > Karol Babioch > > > > Hope this helps a bit, > > Cheers, > > -- > Hugo Osvaldo Barrera -- Hugo Osvaldo Barrera A: No, it doesn't make sense. Q: Should I include quotations *after* my reply?

3 3

[arch-general] system-config-printer: conflicting files
by Kyle Terrien 18 Apr '14

18 Apr '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello fellow Archers, I received the following error while upgrading system-config-printer: > error: failed to commit transaction (conflicting files) > system-config-printer: /usr/share/system-config-printer/debug.pyc > exists in filesystem Errors occurred, no packages were upgraded. Apparently, at some point python automatically compiled debug.py into debug.pyc to increase long term performance. However, the new package has debug.pyc presupplied. The solution was to delete debug.pyc, then everything installs cleanly and works fine. Of course, this begs the question: Should a compiled python module be supplied in a package (debug.pyc), or should the local machine interpret/compile/do whatever it wants with a python script (debug.py)? - --Kyle -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJTUH7GAAoJEN5rMzXPJBsQvwkP/jrjwgfai7jUTTFI980qQdaM nu6u/kms6Ys72uJIvxF3a0b94ZprbLe6bjshzCBW0fJuBHrZ+Deb1Xdt2i10b3pV O/JgZzYMsICVqF2MYdn+GZ9T/GYkLpzLWctwBCnHwQKABIw+T5Jk4CwdNLTnd4V5 pmxynMi/A3RzYFsxFQLcNK6a1sk/FhVmwDSAk5WB2feKjf/i614dH8Uf0aJxRcq+ LFg+eFndpEpMp77j0DnxcTwAR6RzdE19NCNf9rfBvctGpyE2nzdYE8bcof66mLoB yWR2jmRC2CYwOxU556I+Bg4TIGy4SQunqkc0hKEG+nQ6/xSOV72CF7ZCFBOKrLsW 8rGPHDNXFFbLeE6kcR+hnEYaKjLTLn+o+BwV9CJSB3l3aCXpoBCJ9kDiEPEfPR6h mZwP77BpBUMTfclTYL/F2mR0NDd4615CWxXd6wHXGCex+WrA4FTyGqGQgUvPa5Bu 9yB/oMyLthgGL9S5CN0N2VcRdPQB4X44DhUieOMqWAO+KVKmJGfohkCRRHy7UOCY JLh8dkA9JBnoeQ9wLFXn7ibSFxJAVfUeddnmsKOaRnVSGVjGuKYbb9IcFQ/xcfBa ghnTIOk6l15Rrzd9pxfoXSDz8eIeC9UWGQN13Q6waD1gOjZVPS2rgmM2vNpYzT5M iyOEOWaj6AVvni9eADE1 =tWUo -----END PGP SIGNATURE-----

2 1

[arch-general] Problem with Wifi Connections (Intel Corporation PRO/Wireless 4965 AG Connection)
by Sean Snell 17 Apr '14

17 Apr '14

Hi everybody, First, this is on a Lenovo X61 laptop. This is a fresh installation on a new SSD hard drive I recently purchased. I already have a 500GB hard drive with Arch and Windows dual booting on it, and the Wifi still works just fine from the old installation when I reinstalled the old hard drive for testing, but for the life of me I cannot get wifi-menu to connect to any wifi connections on this new installation. The card is a Intel Corporation PRO/Wireless 4965 AG. Per the wireless wiki<https://wiki.archlinux.org/index.php/Wireless_network_configuration#iwlegacy>, I've installed linux-firmware so I can use the iwlegacy (driver?). With the help of a friend, we feel the modules are loading correctly, but when we try to actually connect using wifi-menu, journalctl -xn says the following: \\\\\\\\\\\ - Unit netctl(a)wls3\x2dNEOPCS\x2dSecured.service has begun starting up. Starting network profile 'wls3-NEOPCS-Secured'... The interface of network profile 'wls3-NEOPCS-Secured' is already up netctl(a)wls3\x2dNEOPCS\x2dSecured.service: main process exited, code=exited, status=1/FAILURE \\\\\\\\\\\\\ What I've installed in relation to the Wifi: - wpa_supplicant (per the initial insistence of wifi-menu "out of the box" - linux-firmware (per the wiki<https://wiki.archlinux.org/index.php/Wireless_network_configuration#iwlegacy> ) Output of lspci | grep "Intel": 00:00.0 Host bridge: Intel Corporation Mobile PM965/GM965/GL960 Memory Controller Hub (rev 0c) 00:02.0 VGA compatible controller: Intel Corporation Mobile GM965/GL960 Integrated Graphics Controller (primary) (rev 0c) 00:02.1 Display controller: Intel Corporation Mobile GM965/GL960 Integrated Graphics Controller (secondary) (rev 0c) 00:19.0 Ethernet controller: Intel Corporation 82566MM Gigabit Network Connection (rev 03) 00:1a.0 USB controller: Intel Corporation 82801H (ICH8 Family) USB UHCI Controller #4 (rev 03) 00:1a.1 USB controller: Intel Corporation 82801H (ICH8 Family) USB UHCI Controller #5 (rev 03) 00:1a.7 USB controller: Intel Corporation 82801H (ICH8 Family) USB2 EHCI Controller #2 (rev 03) 00:1b.0 Audio device: Intel Corporation 82801H (ICH8 Family) HD Audio Controller (rev 03) 00:1c.0 PCI bridge: Intel Corporation 82801H (ICH8 Family) PCI Express Port 1 (rev 03) 00:1c.1 PCI bridge: Intel Corporation 82801H (ICH8 Family) PCI Express Port 2 (rev 03) 00:1d.0 USB controller: Intel Corporation 82801H (ICH8 Family) USB UHCI Controller #1 (rev 03) 00:1d.1 USB controller: Intel Corporation 82801H (ICH8 Family) USB UHCI Controller #2 (rev 03) 00:1d.7 USB controller: Intel Corporation 82801H (ICH8 Family) USB2 EHCI Controller #1 (rev 03) 00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev f3) 00:1f.0 ISA bridge: Intel Corporation 82801HEM (ICH8M-E) LPC Interface Controller (rev 03) 00:1f.2 IDE interface: Intel Corporation 82801HM/HEM (ICH8M/ICH8M-E) SATA Controller [IDE mode] (rev 03) 00:1f.3 SMBus: Intel Corporation 82801H (ICH8 Family) SMBus Controller (rev 03) 03:00.0 Network controller: Intel Corporation PRO/Wireless 4965 AG or AGN [Kedron] Network Connection (rev 61) Output of lsmod | grep -h "iw": iwl4965 90075 0 iwlegacy 49001 1 iwl4965 mac80211 490609 2 iwl4965,iwlegacy cfg80211 431038 3 iwl4965,iwlegacy,mac80211 led_class 3547 3 sdhci,iwlegacy,thinkpad_acpi Can anybody help clue me into what I might be overlooking? I've run out of ideas of what else to look into, and while I'm still "getting my feet wet" with Linux, being a Windows admin by profession, I'm not afraid to dig deeper with a little help! :) Thanks everybody! Sean

3 3

[arch-general] bumblebee: only working every other time
by Magnus Therning 16 Apr '14

16 Apr '14

I've finally gotten around to installing and configuring bumblebee. It's working, sort of. It's rather weird because it only works every other time: ~~~~ % cat /proc/acpi/bbswitch 0000:01:00.0 OFF % primusrun glxspheres64 primus: fatal: Bumblebee daemon reported: error: [XORG] (EE) NVIDIA(GPU-0): Failed to initialize the NVIDIA GPU at PCI:1:0:0. Please % primusrun glxspheres64 Polygons in scene: 62464 Visual ID of window: 0x20 Context is Direct OpenGL Renderer: GeForce GT 750M/PCIe/SSE2 62.103457 frames/sec - 69.307458 Mpixels/sec ~~~~ And so it goes on. The next run of `primusrun` fails, usually with the message ~~~~ % primusrun glxspheres64 primus: fatal: Bumblebee daemon reported: error: [XORG] (EE) Server terminated successfully (0). Closing log file. ~~~~ the next run works. And so on. Very strange behaviour I think. And the $SEARCH_ENGINE doesn't really offer any help either, most people seem to have the problem that it never works, not that it works 50% of the times :( Any and all help much appreciated. /M -- Magnus Therning OpenPGP: 0xAB4DFBA4 email: magnus(a)therning.org jabber: magnus(a)therning.org twitter: magthe http://therning.org/magnus Most software today is very much like an Egyptian pyramid with millions of bricks piled on top of each other, with no structural integrity, but just done by brute force and thousands of slaves. -- Alan Kay

2 2

[arch-general] Evolution
by Ralf Mardorf 16 Apr '14

16 Apr '14

Hi, here Evolution 3.12.1 has so many bugs, that I won't write tons of bug reports, but ask you to provide Evolution 3.10.4 by the Arch repository again. I Cc to upstream, since it's not the first time that upstream released a version that is completely unusable for _serious_ work. Regards, Ralf

3 4

[arch-general] Gedit
by Ralf Mardorf 15 Apr '14

15 Apr '14

Hi, do I miss options for the preferences or doesn't gedit provide a menu bar and window buttons anymore? A menu bar might be something to argue, since it's part of the app, but the window buttons are provided by the window manager I decided to use. Will this happen to other editors, such as pluma and other apps too? Disgusting! Doers it make sense to send a veto to upstream or is it wanted by most users? Regards, Ralf

5 11

[arch-general] Bluetooth keyword layout in Gnome 3.12
by Mikhail Strizhov 15 Apr '14

15 Apr '14

After Gnome 3.10 -> 3.12 upgrade my Bluetooth keyboard layout became crazy. There are no English letters, instead it types some numbers. Sounds silly, but if I press in gedit letter "p" is prints "*", "o" is "6", "l" is "3", "q", "w" and others do out output anything. The keyboard is visible in Bluetooth settings. I also tried to delete the keyword settings and reconnect it and it was successful, layout is still incorrect. Any ideas? Output of dmesg: [ 64.054951] apple 0005:05AC:0239.0002: unknown main item tag 0x0 [ 64.055249] input: KC1280 BT Keyboard as /devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.4/1-1.4:1.0/bluetooth/hci0/hci0:11/0005:05AC:0239.0002/input/input20 [ 64.055563] apple 0005:05AC:0239.0002: input,hidraw1: BLUETOOTH HID v1.1b Keyboard [KC1280 BT Keyboard] on 7c:e9:d3:b7:d5:77 [ 127.771869] usb 1-1.4: USB disconnect, device number 4 [ 133.078432] usb 1-1.4: new full-speed USB device number 7 using ehci-pci Howerver, there are weird warning messages in /var/log/messages: Apr 15 10:08:28 localhost kernel: input: KC1280 BT Keyboard as /devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.4/1-1.4:1.0/bluetooth/hci0/hci0:11/0005:05AC:0239.0008/input/input26 Apr 15 10:08:28 localhost kernel: apple 0005:05AC:0239.0008: input,hidraw3: BLUETOOTH HID v1.1b Keyboard [KC1280 BT Keyboard] on 7c:e9:d3:b7:d5:77 Apr 15 10:08:27 localhost gdm-Xorg-:0[426]: (II) config/udev: Adding input device KC1280 BT Keyboard (/dev/input/event21) Apr 15 10:08:27 localhost gdm-Xorg-:0[426]: (**) KC1280 BT Keyboard: Applying InputClass "system-keyboard" Apr 15 10:08:27 localhost gdm-Xorg-:0[426]: (**) KC1280 BT Keyboard: Applying InputClass "evdev keyboard catchall" Apr 15 10:08:27 localhost gdm-Xorg-:0[426]: (II) Using input driver 'evdev' for 'KC1280 BT Keyboard' Apr 15 10:08:27 localhost gdm-Xorg-:0[426]: (**) KC1280 BT Keyboard: always reports core events Apr 15 10:08:27 localhost gdm-Xorg-:0[426]: (**) evdev: KC1280 BT Keyboard: Device: "/dev/input/event21" Apr 15 10:08:27 localhost gdm-Xorg-:0[426]: (--) evdev: KC1280 BT Keyboard: Vendor 0x5ac Product 0x239 Apr 15 10:08:27 localhost gdm-Xorg-:0[426]: (--) evdev: KC1280 BT Keyboard: Found keys Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: (II) evdev: KC1280 BT Keyboard: Configuring as keyboard Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: (**) Option "config_info" "udev:/sys/devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.4/1-1.4:1.0/bluetooth/hci0/hci0:11/0005:05AC:0239.0008/input/input26/event21" Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: (II) XINPUT: Adding extended input device "KC1280 BT Keyboard" (type: KEYBOARD, id 17) Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: (**) Option "xkb_rules" "evdev" Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: (**) Option "xkb_model" "pc104" Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: (**) Option "xkb_layout" "us,ru" Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: (**) Option "xkb_variant" "," Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: The XKEYBOARD keymap compiler (xkbcomp) reports: Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: > Warning: Compat map for group 2 redefined Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: > Using new definition Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: > Warning: Compat map for group 3 redefined Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: > Using new definition Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: > Warning: Compat map for group 4 redefined Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: > Using new definition Apr 15 10:08:28 localhost gdm-Xorg-:0[426]: Errors from xkbcomp are not fatal to the X server My keyboard on amazon - http://www.amazon.com/gp/product/B0096M8VR2/ref=oh_details_o06_s00_i00?ie=U…

2 2

[arch-general] /var lost, how "reinstal" Archlinux?
by Marek Otahal 15 Apr '14

15 Apr '14

Hello, I've lost content of /var, other partitions are ok, so system somewhat boots up (to recovery mode). What is the less pain method to get it again up and running? The problem I see are pacman list of installed packages? Any other notes on what important things could be missing? Thank you very much for any help, Mark PS: no backups :-/ -- Marek Otahal :o)

12 14

[arch-general] Bumblebee + NVIDIA Binary driver broken after Linux 3.14
by Pavan Yalamanchili 14 Apr '14

14 Apr '14

Hi Everyone, I am not sure which part of this particular combination is broken, but after an update today I was unable to use my NVIDIA GPU. Reverting back to an older version of the kernel and the relevant driver packages fixed the issue. I have created the following bug report. https://bugs.archlinux.org/task/39848 Has anyone seen a similar problem ? -- Pavan

2 1