- Arch-projects - lists.archlinux.org

[arch-projects] [namcap] [PATCH] Add py_mtime rule
by keenerd 27 Aug '14

27 Aug '14

This is a patch inspired by https://www.archlinux.org/todo/fix-bad-mtime-pycpyo-files-for-python-packag… It checks packages with py/pyc/pyo files for time conflicts. When a py file is newer than a pyc/pyo python locks up a little while figuring out what to do. Sometime it is our fault for copying files in the wrong order or doing a sed after the pyc was generated. Sometimes it is upstream's fault; many setup.py scripts copy them in the wrong order. The test checks both the tar file and the mtree logs. If there is a time error in the tar file, it will affect every installation. If the error only appears in the mtree file, then the package will be fine but there is a chance that you won't get as lucky the next time the package is built. The tar case generates an error and the mtree case generates a warning. My apologies for including the patch as an attachment. I tried to send this with 'git send-email' but every time Mailmain said "Message rejected by filter rule match" -Kyle http://kmkeen.com

1 0

[arch-projects] [mkinitcpio] [RFC] initrd: systemd-{networkd, resolved}
by Timofey Titovets 26 Aug '14

26 Aug '14

I resend mail from systemd-devel, because i think it make sense in mkinitcpio, i think it can be added by systemd hook. I can try write a patch, but before, i want to know opinions of arch developers. ---------- Forwarded message ---------- From: Lennart Poettering <lennart(a)poettering.net> Date: 2014-08-26 3:57 GMT+03:00 Subject: Re: [systemd-devel] [RFC] initrd: systemd-{networkd,resolved} To: Timofey Titovets <nefelim4ag(a)gmail.com> Копия: systemd-devel(a)lists.freedesktop.org On Sat, 23.08.14 23:26, Timofey Titovets (nefelim4ag(a)gmail.com) wrote: > Good time of day list, i just want to hear your opinions - pro and con > > Pre story: > Before i install bunch of systemd-{networkd,resolved} and > wpa_supplicant (for connecting to HotSpots) > > After i spend some time to think about network handling by networkd > and resolved, about some cases and i have idea, what if try to > implement early network connection in initrd? > Pro: > spherical cow - If mount rootfs fail to boot, or mount, we have > network access to restore system. > If system headless we can get remote access as case above and i think it cool. > It useful for nfs mount. > > Yes, this implies what we use systemd, as init in boot process. > What i miss? This is good idea or i must burn him in hell. One of the reasons systemd-networkd exists is to make it useful for running in the initrd, so that we can boot from networked volumes. It should actually pretty much work already, even though it cannot deserialize its state after the initrd transition. Lennart -- Lennart Poettering, Red Hat -- Have a nice day, Timofey.

1 0

[arch-projects] [netctl] KillMode in netctl{,@}.service
by Leonid Isaev 15 Aug '14

15 Aug '14

Hi, I am wondering what's the purpose of KillMode=none in netctl.service and netctl@.service. Is it an artifact of some sort? I think it's better to not include a KillMode line (so the default KillMode=control-group is used) because then systemd would clean processes left by "network stop" (should there be any)... Thanks, -- Leonid Isaev GPG fingerprints: DA92 034D B4A8 EC51 7EA6 20DF 9291 EE8A 043C B8C4 C0DF 20D0 C075 C3F1 E1BE 775A A7AE F6CB 164B 5A6D

2 1

[arch-projects] [netctl] [GIT] Network control utility based on systemd annotated tag 1.9 created. 1.9
by jouke＠archlinux.org 05 Aug '14

05 Aug '14

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "Network control utility based on systemd". The annotated tag, 1.9 has been created at b74615dbd0180fd9fd020cdab3a2b92bcd64c6fa (tag) tagging 8b3178a79ffbf82313a316ba90270192e374f281 (commit) replaces 1.8 tagged by Jouke Witteveen on Tue Aug 5 14:27:39 2014 +0200 - Log ----------------------------------------------------------------- Release 1.9 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAABAgAGBQJT4M3EAAoJEFa2H7+CSSwVYcsIAODOkloKQ6wBIU2YTcpr3D9v 3vHalBgDads5lUHaPTEhsm5DH0/9OxdTN5Z8+tu1ADnlbD/yT/DaYSfSh7zZgX6s Wv+v0ebuEUiRVMMyqNXf5xa5+PQvebc6zhGzQS9Btz+rUCld/uLpRSEkKfGgv3jp hPyjtCZwlZS2G+8f0pZY1f5ojkQz8OcR6loCEtpevylTEdWjVt06ArreL4CrZCMS kl8CDzBSfToDrkpg+Z45zV7y47kennK5gvzWUuirUJryu8Q8iRe5u41mG8hysSOP UvEmnhshcF6+4ZsuNNHllvPqFweZFk2heIVfLLq8chnKog/4Nfpt/LznGA50B+Q= =cuTa -----END PGP SIGNATURE----- Jouke Witteveen (6): Document support for IPv6 with dhcpcd Update tunnel connections Disable IPv6 on IP6=no Add a connection type for openvswitch interfaces Code quality 1.9 release updates ----------------------------------------------------------------------- hooks/post-receive -- Network control utility based on systemd

1 0

[arch-projects] [netctl] [GIT] Network control utility based on systemd branch master updated. 1.8-6-g8b3178a
by jouke＠archlinux.org 05 Aug '14

05 Aug '14

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "Network control utility based on systemd". The branch, master has been updated via 8b3178a79ffbf82313a316ba90270192e374f281 (commit) via 810cdb650116037caf2eaa45b7f9d553b897b270 (commit) via 1d490769d87875bbc03de1c1c7b198e4f9f42b91 (commit) via 3fce1e6f67cd52afa4470c1ee7d42112d9d9405b (commit) from 0f51aa966b1afb835425f8a4c91ec38f4f36babc (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 8b3178a79ffbf82313a316ba90270192e374f281 Author: Jouke Witteveen <j.witteveen(a)gmail.com> Date: Tue Aug 5 14:27:18 2014 +0200 1.9 release updates commit 810cdb650116037caf2eaa45b7f9d553b897b270 Author: Jouke Witteveen <j.witteveen(a)gmail.com> Date: Tue Aug 5 13:57:14 2014 +0200 Code quality commit 1d490769d87875bbc03de1c1c7b198e4f9f42b91 Author: Jouke Witteveen <j.witteveen(a)gmail.com> Date: Sun Jul 27 22:11:42 2014 +0200 Add a connection type for openvswitch interfaces Open vSwitch support code contributed by: Jonathan Hudson <jh+arch(a)daria.co.uk> commit 3fce1e6f67cd52afa4470c1ee7d42112d9d9405b Author: Jouke Witteveen <j.witteveen(a)gmail.com> Date: Sat Jul 5 15:56:12 2014 +0200 Disable IPv6 on IP6=no ----------------------------------------------------------------------- Summary of changes: Makefile | 2 +- NEWS | 4 ++++ docs/examples/bonding | 4 ++-- docs/examples/openvswitch | 5 +++++ docs/netctl.profile.5.txt | 9 +++++++++ src/lib/connections/openvswitch | 39 +++++++++++++++++++++++++++++++++++++++ src/lib/dhcp/dhcpcd | 4 +--- src/lib/ip | 3 ++- src/netctl-auto | 2 +- 9 files changed, 64 insertions(+), 8 deletions(-) create mode 100644 docs/examples/openvswitch create mode 100644 src/lib/connections/openvswitch hooks/post-receive -- Network control utility based on systemd

1 0

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository branch master updated. v18-1-gea4c415
by dreisner＠archlinux.org 04 Aug '14

04 Aug '14

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The branch, master has been updated via ea4c4154205372154457c794513ae46b61ea4e4c (commit) from a35c698c16759c3c05c692fd10f140d186053177 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ea4c4154205372154457c794513ae46b61ea4e4c Author: Dave Reisner <dreisner(a)archlinux.org> Date: Mon Aug 4 08:31:37 2014 -0400 avoid compound conditional leading to spurious "errors" As seen: https://bbs.archlinux.org/viewtopic.php?id=185204 https://bbs.archlinux.org/viewtopic.php?id=185265 ----------------------------------------------------------------------- Summary of changes: functions | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository annotated tag v18 created. v18
by dreisner＠archlinux.org 25 Jul '14

25 Jul '14

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The annotated tag, v18 has been created at 7aebab3ab3c38e731c7c310c693501ad35a75fb7 (tag) tagging a35c698c16759c3c05c692fd10f140d186053177 (commit) replaces v17 tagged by Dave Reisner on Fri Jul 25 13:48:18 2014 -0400 - Log ----------------------------------------------------------------- tag as v18 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAABAgAGBQJT0phkAAoJEB6yY4/1bAxTPcwH/j9QKg8EjwoRghjTjRiqnII1 H+Kc3Gry3JFKxX+7ly3U5MOGtQfzEAXeoZI+ydcqrHKG7ZEmbRJu/iJQcw63QtQ4 UDuaPDGjh+aPMGyQSnm4xphjOhuUHLu7cNL8Y12seCBq5Ru3/l+KznOhGoITCmWq nT5fcEc99ci5Ka3S6ANBvF481xsPUL3SE/di/1zrDDBMVN7EFNnTUSE9CuyqBZ/f mbjV2SDm8SrSYKdmOOXSXvVdm0h3FTzq6EGwi0+8ooVzp7/Aplxe3QxiUjACVYIa gdvKmeb1nv6p68rw/PBPtLObvI0S+I/gdLvRk9LbUmFilTW0k0bMhskde35hqfE= =gGKY -----END PGP SIGNATURE----- Dave Reisner (5): Add binary library deps directly, without symlink zoo make missing compression binaries a non-fatal warning add quirk for vfat nls module add second param to add_full_dir to allow filtering files block: include all of drivers/storage/usb ----------------------------------------------------------------------- hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [devtools] [PATCH] enforce hardening flags and use PIE on x86_64
by Daniel Micay 23 Jul '14

23 Jul '14

PIE is required for full address space layout optimization (ASLR) and there is little to no benefit from ASLR without it since global ELF tables (GOT/PLT) and application code are at known locations. A wrapper script is required in order to pass the correct flags for executables without changing the flags for libraries. It adds `-pie` when linking (no `-c` switch) if `-static` or `-shared` are not passed, and `-fPIE` whenever `-fPIC` is not already there. This technique comes from the Debian hardening wrappers. Position independent code is expensive on i686, so it's only enabled by default on x86_64 where the cost is negligible. It can be enabled on a package-by-package basis on i686. The same cost already exists for any code in a dynamic library. The hardening-wrapper package also enforces the chosen hardening flags even when build systems aren't using CFLAGS / CXXFLAGS / LDFLAGS from the environment. It would need to be moved from [community] to [core]. --- archbuild.in | 5 +++-- makechrootpkg.in | 12 +++++++++++- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/archbuild.in b/archbuild.in index ae2f511..419ae5b 100644 --- a/archbuild.in +++ b/archbuild.in @@ -2,7 +2,7 @@ m4_include(lib/common.sh) -base_packages=(base-devel) +base_packages=(base-devel hardening-wrapper) makechrootpkg_args=(-c -n) cmd="${0##*/}" @@ -67,11 +67,12 @@ if ${clean_first} || [[ ! -d "${chroots}/${repo}-${arch}" ]]; then "${base_packages[@]}" || abort else lock 9 "${chroots}/${repo}-${arch}/root.lock" "Locking clean chroot" + # upgrade and install any new packages from base_packages arch-nspawn \ -C "@pkgdatadir@/pacman-${repo}.conf" \ -M "@pkgdatadir@/makepkg-${arch}.conf" \ "${chroots}/${repo}-${arch}/root" \ - pacman -Syu --noconfirm || abort + pacman -Syu --noconfirm --needed "${base_packages[@]}" || abort fi msg "Building in chroot for [${repo}] (${arch})..." diff --git a/makechrootpkg.in b/makechrootpkg.in index 97c7780..ad804fc 100644 --- a/makechrootpkg.in +++ b/makechrootpkg.in @@ -320,7 +320,17 @@ _chrootbuild() { exit 1 fi - sudo -u nobody makepkg $makepkg_args || exit 1 + # enforced compiler hardening flags (can be overriden in a PKGBUILD) + export HARDENING_BINDNOW=0 HARDENING_FORTIFY=2 HARDENING_RELRO=1 + export HARDENING_STACK_CHECK=0 HARDENING_STACK_PROTECTOR=2 + . /etc/makepkg.conf + if [[ $CARCH = i686 ]]; then + export HARDENING_PIE=0 + else + export HARDENING_PIE=1 + fi + + sudo -E -u nobody makepkg $makepkg_args || exit 1 if $run_namcap; then pacman -S --needed --noconfirm namcap -- 2.0.2

2 3

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository branch master updated. v17-5-ga35c698
by dreisner＠archlinux.org 23 Jul '14

23 Jul '14

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The branch, master has been updated via a35c698c16759c3c05c692fd10f140d186053177 (commit) from 02d387b2370215d51d1aa8958fce42cd099bee29 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a35c698c16759c3c05c692fd10f140d186053177 Author: Dave Reisner <dreisner(a)archlinux.org> Date: Wed Jul 23 18:45:17 2014 -0400 block: include all of drivers/storage/usb Fixes FS#41273. ----------------------------------------------------------------------- Summary of changes: install/block | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [netctl][PATCH] Disable IPv6 on IP6=no
by Jouke Witteveen 05 Jul '14

05 Jul '14

--- It was proposed to disable IPv6 entirely in case of "IP6=no". Currently we only disable processing of router advertisements. This looks OK to me, but I would really like to get some feedback on this one, as I cannot extensively test the consequences. src/lib/ip | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/lib/ip b/src/lib/ip index 66aab56..9600504 100644 --- a/src/lib/ip +++ b/src/lib/ip @@ -47,11 +47,12 @@ ip_set() { case "$IP6" in dhcp*|stateless|static) [[ -d "/proc/sys/net/ipv6" ]] || modprobe ipv6 + sysctl -q -w "net.ipv6.conf.$interface_sysctl.disable_ipv6=0" [[ $IP6 == "static" ]] sysctl -q -w "net.ipv6.conf.$interface_sysctl.accept_ra=$?" ;; no) - [[ -d "/proc/sys/net/ipv6" ]] && sysctl -q -w "net.ipv6.conf.$interface_sysctl.accept_ra=0" + [[ -d "/proc/sys/net/ipv6" ]] && sysctl -q -w "net.ipv6.conf.$interface_sysctl.disable_ipv6=0" ;; "") # undefined IP6 does not prevent RA's from being received -> nop ;; -- 2.0.1

1 1