- Arch-general - lists.archlinux.org

[arch-general] CVE-2021-3156 (Heap-Based Buffer Overflow in Sudo)
by Łukasz Michalski 29 Jan '21

29 Jan '21

Hi, Just checked my servers and all were vulnerable: [zork@archdevel ~]$ sudoedit -s '\' `perl -e 'print "A" x 65536'` malloc(): corrupted top size Aborted (core dumped) Updating to the latest version (sudo-1.9.5.p2-1) closed this vulnerability. Maybe this should be posted as arch news message? Regards, Łukasz

5 4

[arch-general] dracut roll-out plan?
by David C. Rankin 28 Jan '21

28 Jan '21

Archdevs, I see dracut is creeping into the system. Which I see as fine, SuSE has used dracut for a couple of years and it has proven to be quite robust. But I do have a question on roll-out and what will be required on the user's part. I have begun seeing, e.g.: New optional dependencies for brltty dracut: for dracut based initramfs support I currently have 3 Arch servers, with one remote administered, so if this will require some type of manual on-site intervention, it would be good to know before hand. -- David C. Rankin, J.D.,P.E.

11 17

Re: [arch-general] [arch-dev-public] Chromium losing Sync support on March 15
by Geo Kozey 27 Jan '21

27 Jan '21

> ---------------------------------------- > From: Levente Polyak via arch-dev-public <arch-dev-public(a)lists.archlinux.org> > Sent: Tue Jan 26 22:18:21 CET 2021 > To: <arch-dev-public(a)lists.archlinux.org> > Cc: Levente Polyak <anthraxx(a)archlinux.org> > Subject: Re: [arch-dev-public] Chromium losing Sync support on March 15 > > > On 1/26/21 9:53 PM, Morten Linderud via arch-dev-public wrote: > > > > It's dissapointing frankly. > > > > Disappointing doesn't really catch it tho. If it would be just about the > sync functionality: so be it. But crippling the API usage on a level > that rips out especially things like the safe browsing functionality as > well places chromium knowingly and forcefully into a position that > doesn't make it viable to be distributed to users. Didn't google already make it clear it's only about sync api and the rest including safe browsing is perfectly fine to use with current keys if you don't remove them[1]? I think some people here overdramatize this situation. Users who depend on sync would have to switch to chrome but for majority nothing will change unless you indeed drop the package which hardly helps to limit damage. [1] https://groups.google.com/a/chromium.org/g/chromium-packagers/c/SG6jnsP4pWM… Yours sincerely G. K.

3 6

Re: [arch-general] [arch-dev-public] Chromium losing Sync support on March 15
by Ondřej Kučera 27 Jan '21

27 Jan '21

Hi, On 26. 01. 21 20:20, Evangelos Foutras via arch-dev-public wrote: > On Fri, 22 Jan 2021 at 10:05, Evangelos Foutras <evangelos(a)foutrelis.com> wrote: >> > Building Chromium without API keys results in a browser that is > unsuitable for production use. Removing the OAuth 2.0 credentials (or > when the Chrome team limits them) mainly breaks Chrome data sync > (e.g.: passwords, bookmarks, open tabs). Additionally removing the > main API key disables functionality like Safe Browsing and > Geolocation. I don't consider a browser with downgraded functionality > and security suitable for end users. [2] I'd like to ask the devs, if they read this, to reconsider. I myself am a Firefox user. However, there are sites/web applications that just don't work in Firefox and probably never will. Some of them I have to use on a daily basis. For example, Microsoft Teams works perfectly fine in Chromium (audio, video, desktop sharing); it doesn't, to my knowledge, in Firefox. Skype works for chatting (unfortunatelly not for audio/video) in Chromium; while this is not perfect, chatting is in 95 % of times what I need. I remember even not being able to finish an order in an e-shop in Firefox once (I can't remember which shop it was) and I suspect this will happen more and more often. Frankly, since Chromium is only my browser for when stuff doesn't work in Firefox, I've never used Sync or geolocation or safe browsing. But it's still very useful to me having Chromium available as a second-choice browser in the repositories. -- Regards, Ondřej Kučera

1 0

[arch-general] pacman's NoUpgrade option does not ignore read-only files
by Marcel Menzel 26 Jan '21

26 Jan '21

Hello list, I can't get pacman to ignore read-only files via the the NoUpgrade and/or the NoExtract config options. I have several Arch Linux LXC (managed via LXD) containers, with several read-only files mapped into those containers for convenience. For example, to have a single resolv.conf for all containers, I configured the following in LXD: devices: resolv_conf: path: /etc/resolv.conf readonly: "true" source: /root/containerfiles/resolv.conf type: disk Now the problem is, when I want to run upgrades in containers, the pacman check for disk space fails with: error: Partition /etc/resolv.conf is mounted read only According to man pacman.conf, setting "etc/resolv.conf" in NoUpgrade should *in theory* get around this problem for my understandings, but it somehow doesn't. Also setting both does not work: NoUpgrade = etc/resolv.conf NoExtract = etc/resolv.conf Am I missing something out here? Is there any way to accomplish what I want or do I really have to work with a pacman hook here which copies the read only mounted file to the original place after a package upgrade? Thanks & kind regards, Marcel Menzel

2 2

[arch-general] Can pam_systemd_home.so functionality be split into a separate package to prevent cluttering the logs?
by David C. Rankin 26 Jan '21

26 Jan '21

Archdevs, Just as postfix is being split to separate non-default backends into separate packages, can pam_systemd_home.so functionality be split out into a separate package. The problems caused by this disabled part of pambase is discussed here: https://bbs.archlinux.org/viewtopic.php?pid=1952091 Even though the service is disabled, it fill the journal with entries every time sudo is invoked. For example, every time sudo is used with journalctl, you get 5-long lines of nonsense: Jan 26 03:17:42 phoinix dbus-daemon[363]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.19' (uid=0 pid=5293 comm="sudo journalctl --no-pager --full -f ") Jan 26 03:17:42 phoinix dbus-daemon[363]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found. Jan 26 03:17:42 phoinix sudo[5293]: pam_systemd_home(sudo:account): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found. Jan 26 03:17:42 phoinix sudo[5293]: david : TTY=pts/0 ; PWD=/home/david ; USER=root ; COMMAND=/usr/bin/journalctl --no-pager --full -f Jan 26 03:17:42 phoinix sudo[5293]: pam_unix(sudo:session): session opened for user root(uid=0) by david(uid=1000) Why not let the very few that will ever want pam_systemd_home install that package and enable the service rather than allowing a disabled server to clutter the logs every time sudo is used and forcing folks that don't want the noise from a disable package to set: NoExtract=usr/lib/security/pam_systemd_home.so just to get rid of the unnecessary messages. https://bugs.archlinux.org/task/65819 is referenced in the discussion. If nothing else, have NoExtract set by default and add a wiki entry about removing NoExtract and reinstalling systemd for the few that want it? -- David C. Rankin, J.D.,P.E.

1 0

[arch-general] On arch-dev-public: Chromium losing Sync support on March 15
by u34＠net9.ga 26 Jan '21

26 Jan '21

There is a heads-up discussion at https://lists.archlinux.org/pipermail/arch-dev-public/2021-January/030260.h… . 1. Is it worth asking help from some free software org, since the problem is shared by other distributions? Perhaps google will agree to work with that org, as a representative of the distributions. Or,that a single distribtion will represent the other? 2. I hardly use chromium. Yet, few gov sites here mandate using it. At rare circumstancess, I have to deal with these gov sites. In short, I hardly knows, and don't care, about its Sync feature. 2.1 Can the package built, and run, without whatever is required for the Sync feature? 2.2 In case you will stop maintaining it and no one adopts it, can you upload it to the AUR, and disown it? -- u34

14 17

[arch-general] Why has all Fake-RAID documentation been removed from the RAID wiki?
by David C. Rankin 26 Jan '21

26 Jan '21

Arch, In the past https://wiki.archlinux.org/index.php/RAID had a fantastic section on Fake RAID. I just had a person I refered to the page only to be told there isn't any relevant info there other than use lspci to look for a conroller?? Why has all the relevant information for Fake RAID been removed from the wiki? It is still relevant documentation. -- David C. Rankin, J.D.,P.E.

3 4

Re: [arch-general] WINE Networking Issues
by John Briggs 25 Jan '21

25 Jan '21

On Mon, Jan 25, 2021 at 12:26:26PM +0100, Łukasz Michalski via arch-general wrote: > On 1/25/21 11:13 AM, John Briggs via arch-general wrote: > > After a system update on 16th Dec 2020 I discovered I had networking > > problems when I was using WINE. > > I have determined the issue is NOT WINE but something else in the system. > > When I do a system downgrade using the Arch Linux Archives for 13th Dec 2020 > > the networking problems with WINE disappear. > > System upgrade to 14th Dec 2020 WINE networking problems appear. > > > > The only new packages that are upgraded on my system are: > > > > egl-wayland-1.1.6-1-x86_64.pkg.tar.zst 14-Dec-2020 11:02 24K > > gtkmm3-3.24.3-1-x86_64.pkg.tar.zst 14-Dec-2020 00:28 1M > > python-importlib-metadata-3.3.0-1-any.pkg.tar.z..> 14-Dec-2020 02:46 566 > > xorg-xwayland-1.20.0.r797.g5d73a8b59-1-x86_64.p..> 14-Dec-2020 12:16 898K > > > > The egl-wayland and xorg-xwayland packages do not appear to be causing the > > problem. The gtkmm3 should not raise this type of issue. Close inspection of > > the python-importlib-metadata should not cause any issues either. > > > > The only possible solution I can possible consider is creating a new partition > > and installing the Dec 2020 Arch iso then doing a system upgrade to 13th Dec > > to get a problem free system. > > > > I decided to try the list to see if anyone else may have a solution. > > It would be helpful if you describe what kind of networking problems do you > have. > I usually run the Kindle app. It requires an Internet connection to run correctly. I have ran ping in a WINE console: it resolves the internet address correctly but there is no return from the pings because the dns is working it appears as if I am not receiving the packets. > Is it related to any app run under wine or to specific one? > What are the symptoms? e.g. no connection from app to the Internet, dns not > working... > > Regards, > Łukasz

4 4

[arch-general] WINE Networking Issues
by John Briggs 25 Jan '21

25 Jan '21

After a system update on 16th Dec 2020 I discovered I had networking problems when I was using WINE. I have determined the issue is NOT WINE but something else in the system. When I do a system downgrade using the Arch Linux Archives for 13th Dec 2020 the networking problems with WINE disappear. System upgrade to 14th Dec 2020 WINE networking problems appear. The only new packages that are upgraded on my system are: egl-wayland-1.1.6-1-x86_64.pkg.tar.zst 14-Dec-2020 11:02 24K gtkmm3-3.24.3-1-x86_64.pkg.tar.zst 14-Dec-2020 00:28 1M python-importlib-metadata-3.3.0-1-any.pkg.tar.z..> 14-Dec-2020 02:46 566 xorg-xwayland-1.20.0.r797.g5d73a8b59-1-x86_64.p..> 14-Dec-2020 12:16 898K The egl-wayland and xorg-xwayland packages do not appear to be causing the problem. The gtkmm3 should not raise this type of issue. Close inspection of the python-importlib-metadata should not cause any issues either. The only possible solution I can possible consider is creating a new partition and installing the Dec 2020 Arch iso then doing a system upgrade to 13th Dec to get a problem free system. I decided to try the list to see if anyone else may have a solution. Regards John

2 1