- Arch-projects - lists.archlinux.org

[arch-projects] [RFC 00/23] Encrypted volume work
by Matthew Monaco 19 May '12

19 May '12

From: Matthew Monaco <matthew.monaco(a)0x01b.net> I worked with Dave and Tom this past weekend to clean up and enhance encrypted volume handling. There are quite a few "patches" here, and more to come against initscripts. All of this fixes a handful of bugs, adds new features, does some refactoring. In summary, I wrote a new package called 'cryptmount.' The intention is for it to depend on cryptsetup and to provide the encrypt hooks for mkinitcpio. Additionally initscripts will depend on cryptmount (optdepends will work too). The cryptmount code is here [1] and the initscripts changes are here [2]. There are a few goals: 1) Use the same code for the mkinitcpio encrypt hook and initscripts. 2) Allow for interoperability with systemd's crypttab format. This is accomplished without any forced changes on the user (with the exception of plaintext passwords in crypttab). 3) Allow the random seed to be restored before doing things like setting up a swap volume which uses /dev/urandom as a password. 4) If possible, allow for encrypted /usr from the initrd. This depends on Dave's working branch of mkinitcpio which provides late hooks (and cleanup hooks). *5*) Do not drop support for current configurations. This is important. The only thing that is dropped is storing a plain text password in crypttab. Whether your options line in crypttab is literally for cryptsetup (--size=100 --cipher=...) or a comma separated list (size=100,cipher=...), your configuration will be supported. That said, if you see any holes in this statement, please let me know and I will address it. This addresses the following bugs, there may be more, and you may question that it does for some of these: FS#17131 - Restore random seed before using decryption FS#24700 - Allow UUID for cryptdevice In addition we support UUID,PARTUUID,LABEL for both the encrypted device AND the passphrase if it is on an external device. FS#27137 - I think a dup of the above. FS#23182 - Multiple device support for the initrd The encrypt hook included supports root, /usr, and an arbitrary number of encrypted mappings. FS#15738 - More or less similar to above FS#21936 - Don't immediately revert to interactive pw if key device is not available. All devices are resolved and waited on IFF udevd is running. This goes for the initrd and rc.sysinit. FS#21198 - Mount key devices if needed. This is done whenever the key is a file on another device and that device is not already mounted. FS#21513 - Provide a man page for crypttab. I wrote one and for cryptmount. I have been testing this for the past week, but I'm sure there are some bugs. Please report any problems you see (or experience if you are able to test). Also, if you see an opportunity for improvements in efficiency, cleanup, or additional functionality, let me know. [1] https://github.com/mmonaco/cryptmount/tree/master [2] https://github.com/mmonaco/initscripts/tree/crypto -- 1.7.10.2

2 47

[arch-projects] [mkinitcpio][PATCH] init: add timestamp at start of initramfs if binary exists
by Tom Gundersen 18 May '12

18 May '12

This will allow us to tell how much time was spent in the initramfs, which might be good for working on optimizations and making sure we don't regress. If a binary able to produce the timestamp is not installed this is a noop. I'll post separately an install hook to the systemd package that will install systemd-timestamp as /usr/bin/timestamp. However, it would be trivial to replace this by an independent implementation if people want to use this without systemd. With this patch I get the following on my (ancient) laptop: $ systemd-analyze Startup finished in 294ms (kernel) + 2684ms (initramfs) + 15741ms (userspace) = 18720ms FWIW, 1 second is spent on inserting the needed modules, and 1.5 seconds on mounting the rootfs (mounting btrfs is slow!). Signed-off-by: Tom Gundersen <teg(a)jklm.no> --- init | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/init b/init index 8e9ad90..98328ce 100644 --- a/init +++ b/init @@ -1,6 +1,10 @@ #!/usr/bin/ash PATH=/usr/bin +if [ -x /usr/bin/timestamp ]; then + RD_TIMESTAMP=$(/usr/bin/timestamp) +fi + . /init_functions mount -t proc proc /proc -o nosuid,noexec,nodev @@ -109,6 +113,6 @@ if [ "${udevd_running}" -eq 1 ]; then udevadm info --cleanup-db fi -exec env -i "TERM=$TERM" /sbin/switch_root /new_root $init "$@" +exec env -i "TERM=$TERM" "RD_TIMESTAMP=$RD_TIMESTAMP" /sbin/switch_root /new_root $init "$@" # vim: set ft=sh ts=4 sw=4 et: -- 1.7.10.1

3 7

[arch-projects] [netcfg] [GIT] netcfg network scripts repository annotated tag 2.8.3 created. 2.8.3
by jouke＠archlinux.org 17 May '12

17 May '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "netcfg network scripts repository". The annotated tag, 2.8.3 has been created at 133ee46e0350286b23112875111397c3687efe21 (tag) tagging a347ed655b0163edbb724d114dc6f016726ed166 (commit) replaces 2.8.2 tagged by Jouke Witteveen on Thu May 17 13:01:28 2012 +0200 - Log ----------------------------------------------------------------- Release 2.8.3 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) iQEcBAABAgAGBQJPtNqnAAoJEFa2H7+CSSwVGjgH/0kcI4hxCaleUhGyF2V6TX1V xkhEJiMGd8XLITWbqGTM9UAAKP6EtO/wv+moxZWJlrdLAXqFUEPwfmatMOQUAVmw VP8djlngtNY54Bf+9sH4byXwGkGvSbXodQJErR5pRqzFL18ZbeUoEtKtnoC/wxTk 1nZpuOFHb3NTjPx5y0wIiklw8UyNBR0/qfia4hcnoLZv7exXwcsu5t4sj16fKxlY kOqtmJyOPsiL9yXSWS+zN3qovTpxsjGXtiI9vnC1ONofXYrwF0Utit7XRjx61dJg H5qDDmMOPsgN4YedOWrpNCkFW3jrnaZ42CG7LKaCb6PBZCJuYKLhTOuorIWH3T4= =5xIr -----END PGP SIGNATURE----- Jouke Witteveen (6): Be more precise in the makefile Fix sh compatibility (FS#29880) Code inspection Fix variable name mix-up in bonding documentation (FS#29918) Wait for DAD when using IPv6 (FS#28887) 2.8.3 release updates ----------------------------------------------------------------------- hooks/post-receive -- netcfg network scripts repository

1 0

[arch-projects] [netcfg] [GIT] netcfg network scripts repository branch master updated. 2.8.2-6-ga347ed6
by jouke＠archlinux.org 17 May '12

17 May '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "netcfg network scripts repository". The branch, master has been updated via a347ed655b0163edbb724d114dc6f016726ed166 (commit) via 0d3e56bf3809b03e1c60a5dce0d7bb8510720369 (commit) via 91ff1c8c4ee490d113ac25fbca0f4596ca069a7d (commit) via ce28459bc22b4de1a2dc57cf4ae1cf7fdefdb356 (commit) via 4c141e44b54fa80aac57c31269a25c7669054c66 (commit) from 1f0a7025ed184ddd347a6a4f443bacbb042a72e2 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a347ed655b0163edbb724d114dc6f016726ed166 Author: Jouke Witteveen <j.witteveen(a)gmail.com> Date: Thu May 17 11:25:00 2012 +0200 2.8.3 release updates commit 0d3e56bf3809b03e1c60a5dce0d7bb8510720369 Author: Jouke Witteveen <j.witteveen(a)gmail.com> Date: Thu May 17 11:01:10 2012 +0200 Wait for DAD when using IPv6 (FS#28887) In IPv6 you cannot bind to an address as long as it is not determined to be unique through Duplicate Address Detection. This can cause problems when routes in ROUTES6 reference a tentative source address or when something that starts after netcfg tries to. This patch does a few things: - Improve ROUTES(6) logic so that non-static connections can make use of them as intended according to the commit message of c8be1. - Make additional arguments possible for ADDR6 addresses and ROUTES6 routes, such as ADDR6=('1234:5678:9abc:def::1/64 nodad'). - Introduce a DAD_TIMEOUT variable that governs how long to wait for DAD to finish. - Move IPCFG processing to after IPv6 address set-up (it already was after IPv4 address set-up), so that custom commands can be sure to have working addresses. WARNING: This changes make it impossible to use ROUTES6 and set the address through IPCFG instead of ADDR6. This was bad, unsupported practice, but sometimes needed as ADDR6 did not allow config flags to be used. Resolving this issue should be no problem: you should be able to properly use ADDR6 now. If not, then be a real hacker and set the routes through IPCFG too. Many thanks to Steve Caligo for reporting this bug and helping out in finding a solution. commit 91ff1c8c4ee490d113ac25fbca0f4596ca069a7d Author: Jouke Witteveen <j.witteveen(a)gmail.com> Date: Thu May 17 00:19:51 2012 +0200 Fix variable name mix-up in bonding documentation (FS#29918) BOND_INTERFACES was documented, but SLAVE_INTERFACES was implemented. commit ce28459bc22b4de1a2dc57cf4ae1cf7fdefdb356 Author: Jouke Witteveen <j.witteveen(a)gmail.com> Date: Wed May 16 15:50:41 2012 +0200 Code inspection Some changes after reading through a few files. Only two modifications impact functionality. - Not having dhclient is now fatal for IPv6 connections that use dhcp. - Allow authentication/associaton time-out of wpa to be set through TIMEOUT for wired connections too. dhclient no longer needs to be killed manually, so those lines are removed. commit 4c141e44b54fa80aac57c31269a25c7669054c66 Author: Jouke Witteveen <j.witteveen(a)gmail.com> Date: Mon May 14 16:47:35 2012 +0200 Fix sh compatibility (FS#29880) Installing Virtualbox guest additions should work again. ----------------------------------------------------------------------- Summary of changes: Makefile | 2 +- NEWS | 7 +++ docs/examples/bonding | 2 +- docs/netcfg-profiles.5.txt | 7 ++- rc.d/net-set-variable | 4 +- scripts/wifi-menu | 2 +- src/8021x | 4 +- src/connections/ethernet | 107 ++++++++++++++++++++++++-------------------- 8 files changed, 78 insertions(+), 57 deletions(-) hooks/post-receive -- netcfg network scripts repository

1 0

[arch-projects] [mkinitcpio][PATCH 00/19] Break all the things!
by Dave Reisner 14 May '12

14 May '12

Hi all, What follows this is the changes I have in store for the next release, which I'll be tagging 0.9.0. There's one change not included, but I'll explain what that is. I realize this patchset is huge, and I don't expect anyone to look through it in its entirety. However, there's two things worth pointing out here that I'd appreciate some feedback on: * Changes to install hook API I've added some new functions: - add_checked_modules - add_all_modules - add_runscript These are intended to replace all_modules and checked_modules, which currently return the list of modules that the caller should add. The new functions simply go ahead and queue the modules for addition rather than making the caller do something with them. add_runscript does some introspection to figure out which hook called it and add the appropriate script from /usr/lib/initcpio/hooks. The general idea here is that we're getting rid of using MODULES, FILES, BINARIES, and SCRIPT in the install hooks and we'll be down to a singular method of adding files to the image. With the refactored error parsing, mkinitcpio can properly detect errors from any add_* function, which should improve the experience a bit. Consider the next release the deprecation warning, though I'm not sure when I'll remove things. I've made sure that current hooks continue to work in the same way. There's no explicit callout during runtime about these things being deprecated, but maybe there should be? I'll plan on fixing all the hooks in the repos myself. Since this is new API, I'd like to get it right the first time. If anyone sees anything lacking, room for improvement, or wants to send me death threats, feel free. * Support for late running hooks I've refactored running hooks in early userspace and we now support a second run after root has been mounted. To make things simple, current hook files only need to define an extra function run_latehook() to be considered. Hooks run in reverse order from the normal run. lsinitcpio of course gains support for reading these. We already have some obvious candidates to use this feature: udev and shutdown. udev startup/shutdown no longer needs to be hardcoded in /init, and shutdown can delete modules before copying / over to /run/initramfs, saving some modicum of space in tmpfs. I'm also tempted to move mounting of /usr to a late running hook, but I'm sure that we'll see some breakage by doing this, even with proper warnings. Opinions here welcome. The final unlisted change is what I referred to earlier about udev. Since the udev hook would be handling its own startup/shutdown, we'd simply yank those if blocks out of /init and carry on. I've been testing this and it works quite well. Random feedback and tomatoes unrelated to the above points are welcome, as always. Cheers, d Dave Reisner (19): use MODULEDIR as reference for *.(order|builtin) files mkinitcpio: separate logic to resolve kernel version document special kernel cmdline parameters refactor error tracking in build hooks mmc: package as mode 644, not 755 functions: remove get_dirname and get_basename functions: move --try logic into add_module move -g option checking to parseopts loop functions: introduce add_checked_modules and add_all_modules functions: introduce add_runscript use new API for install hooks init: correct trimming of earlymodules and MODULES init_functions: move running hooks to separate func init: add support for late running hooks shutdown: package as 644, install as 755 shutdown: convert to late hook buildsys: fix clean target lsinitcpio: extract the image to a tempdir lsinitcpio: add support for listing late hooks Makefile | 2 +- functions | 125 +++++++++++++++++++++++++++++++++++++-------------- hooks/shutdown | 3 +- init | 26 +++-------- init_functions | 27 +++++++++++ install/consolefont | 6 +-- install/filesystems | 4 +- install/fsck | 4 ++ install/fw | 8 +++- install/ide | 4 +- install/keymap | 4 +- install/memdisk | 9 ++-- install/mmc | 7 ++- install/pata | 6 ++- install/resume | 2 +- install/sata | 6 ++- install/scsi | 9 ++-- install/shutdown | 7 +-- install/sleep | 2 +- install/usb | 12 +++-- install/usbinput | 5 ++- install/virtio | 2 +- lsinitcpio | 70 +++++++++++++++++++++-------- mkinitcpio | 59 ++++++++++++++---------- mkinitcpio.8.txt | 51 +++++++++++++++++++++ 25 files changed, 317 insertions(+), 143 deletions(-) mode change 100755 => 100644 install/mmc mode change 100755 => 100644 shutdown -- 1.7.10.2

5 30

[arch-projects] [netcfg] [GIT] netcfg network scripts repository branch master updated. 2.8.2-1-g1f0a702
by jouke＠archlinux.org 13 May '12

13 May '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "netcfg network scripts repository". The branch, master has been updated via 1f0a7025ed184ddd347a6a4f443bacbb042a72e2 (commit) from f1ab18c57fc573ead63f0a7ecfefe088881996d2 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1f0a7025ed184ddd347a6a4f443bacbb042a72e2 Author: Jouke Witteveen <j.witteveen(a)gmail.com> Date: Mon May 7 10:21:16 2012 +0200 Be more precise in the makefile Previously the packagers username would be visible in the tarball and all files laying around in docs/ would be included. ----------------------------------------------------------------------- Summary of changes: Makefile | 2 +- src/hooks/fancy | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) hooks/post-receive -- netcfg network scripts repository

1 0

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository branch master updated. 0.8.8-5-g9340f90
by dreisner＠archlinux.org 12 May '12

12 May '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The branch, master has been updated via 9340f901fec092fde44c8322bb500c4d18f0f222 (commit) via a4e770eb3c648f36c33bb8edc54fc7d356d87eff (commit) via fff89b9c2af57f3bcb4b1adf701f596177badebd (commit) via 88b3dc63a1e0ba42952bc2b6478935590974e4cf (commit) via 41a290ce22844ac6b1d021b04df5f7659547cc56 (commit) from b317b01465d81b2adadd5f8d964e59622a6a7a32 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9340f901fec092fde44c8322bb500c4d18f0f222 Author: Dave Reisner <dreisner(a)archlinux.org> Date: Thu May 3 18:10:58 2012 -0400 remove unnecessary quoting/bracing Signed-off-by: Dave Reisner <dreisner(a)archlinux.org> commit a4e770eb3c648f36c33bb8edc54fc7d356d87eff Author: Dave Reisner <dreisner(a)archlinux.org> Date: Thu May 3 17:58:53 2012 -0400 functions: merge _add_symlink into add_symlink This frontend/backend split is no longer necessary without the notion of a basedir. Signed-off-by: Dave Reisner <dreisner(a)archlinux.org> commit fff89b9c2af57f3bcb4b1adf701f596177badebd Author: Dave Reisner <dreisner(a)archlinux.org> Date: Thu May 3 17:55:19 2012 -0400 functions: merge _add_file into add_file This frontend/backend split is no longer necessary without the notion of a basedir. Signed-off-by: Dave Reisner <dreisner(a)archlinux.org> commit 88b3dc63a1e0ba42952bc2b6478935590974e4cf Author: Dave Reisner <dreisner(a)archlinux.org> Date: Thu May 3 17:51:20 2012 -0400 function: merge _add_dir into add_dir This frontend/backend split is no longer necessary without the notion of a basedir. Signed-off-by: Dave Reisner <dreisner(a)archlinux.org> commit 41a290ce22844ac6b1d021b04df5f7659547cc56 Author: Dave Reisner <dreisner(a)archlinux.org> Date: Thu May 3 14:14:42 2012 -0400 mkinitcpio: remove --basedir option This option is just a bad idea. Initramfs creation is too important to get wrong, and running it from outside the root FS has too many gotchas, the worst of them being: - where do you pull hooks from? - how do you resolve binary dependencies within the root? In general, dealing with the extra luggage of the base directory makes the codebase more complicated than it needs to be (see all the '_' prefixed functions which are called from add functions). In favor of simplifying the code, and making it more maintainable, kill this off and force the sane option of chroot'ing into an install if the need arises. Signed-off-by: Dave Reisner <dreisner(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: bash-completion | 11 ++-- functions | 138 +++++++++++++++++---------------------------------- install/autodetect | 4 +- install/consolefont | 8 +-- install/fsck | 4 +- install/keymap | 4 +- mkinitcpio | 50 +++++++------------ mkinitcpio.8.txt | 14 ++---- 8 files changed, 81 insertions(+), 152 deletions(-) hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [PATCH] fhs: update valid and invalid paths
by teg＠jklm.no 12 May '12

12 May '12

From: Tom Gundersen <teg(a)jklm.no> * Remove /var/lock form valid paths. It is already forbidden, so should not be valid. * Forbid most of /lib. We want to empty /lib over time. This explicitly allows /lib/modules as getting rid of it would require a coordinated rebuild. * Prod people into emptying /{s,}bin. To the extent possible these dirs should be emptied and moved to /usr/bin. In particular we want to avoid new or third-party packages putting stuff here. * Disallow installing in /srv. /srv is admin territory, similar to /home. No package should put stuff there. Signed-off-by: Tom Gundersen <teg(a)jklm.no> --- Now that the pam stuff is gone, I think this is ready to be merged :-) Namcap/rules/fhs.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Namcap/rules/fhs.py b/Namcap/rules/fhs.py index e66d67e..e339eb7 100644 --- a/Namcap/rules/fhs.py +++ b/Namcap/rules/fhs.py @@ -26,10 +26,11 @@ class FHSRule(TarballRule): description = "Checks for standard directories." def analyze(self, pkginfo, tar): valid_paths = [ - 'bin/', 'etc/', 'lib/', 'sbin/', 'opt/', 'srv/', + 'etc/', 'opt/', + 'lib/modules', 'usr/bin/', 'usr/include/', 'usr/lib/', 'usr/lib32/', 'usr/sbin/', 'usr/share/', - 'var/cache/', 'var/lib/', 'var/lock/', 'var/log/', 'var/opt/', + 'var/cache/', 'var/lib/', 'var/log/', 'var/opt/', 'var/spool/', 'var/state/', '.PKGINFO', '.INSTALL', '.CHANGELOG', ] -- 1.7.10

2 2

Re: [arch-projects] [arch-general] netcfg status?
by Thomas Bächler 09 May '12

09 May '12

Am 09.05.2012 13:16, schrieb Geert Hendrickx: > Hi, > > What is the status of netcfg 2.8.x? When will it hit [core] ? > > I have been using it succesfully on my workstation and on two VPS > (static IPv4 + IPv6 profiles). > > > Geert Jouke, should we move it? In general, if you want the package to move to core, you need to notify a developer, as you can't move it yourself.

2 2

[arch-projects] [initscripts] [GIT] Arch Linux initscripts repository branch master updated. 2012.05.1
by tomegun＠archlinux.org 05 May '12

05 May '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "Arch Linux initscripts repository". The branch, master has been updated via 86b2cb99028d81a6cb608f09e1a31bc7744a991c (commit) via 3d261ea4f9cf59a75326d4771a6c23b0c76e4aa4 (commit) via c18d4a38d33a231bf2f39c47909a79c4227f7ca3 (commit) from acfbe4b8e05959079a807dcc1df7650946cd0924 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 86b2cb99028d81a6cb608f09e1a31bc7744a991c Author: Tom Gundersen <teg(a)jklm.no> Date: Sat May 5 16:06:53 2012 +0200 sysctl: fix compatibility with procps-ng The interface changed slightly, from "-p <file>" to "-p<file>", compared with procps. Reported-by: Boris <projekte(a)public-files.de> Suggested-by: Eric Belanger <eric(a)archlinux.org> Signed-off-by: Tom Gundersen <teg(a)jklm.no> commit 3d261ea4f9cf59a75326d4771a6c23b0c76e4aa4 Author: Tom Gundersen <teg(a)jklm.no> Date: Mon Apr 30 14:08:17 2012 +0200 deps: require up-to-date udev due to change of direcotry Signed-off-by: Tom Gundersen <teg(a)jklm.no> commit c18d4a38d33a231bf2f39c47909a79c4227f7ca3 Author: Tom Gundersen <teg(a)jklm.no> Date: Mon Apr 30 14:07:45 2012 +0200 release: put tarball in correct dir on buildserver Signed-off-by: Tom Gundersen <teg(a)jklm.no> ----------------------------------------------------------------------- Summary of changes: Makefile | 2 +- PKGBUILD | 2 +- arch-sysctl | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) hooks/post-receive -- Arch Linux initscripts repository

1 0