- Arch-general - lists.archlinux.org

[arch-general] Can't install AppArmor on linux-grsec kernel
by Foxtrot Mike 27 Jan '16

27 Jan '16

Hi I installed linux-grsec kernel on my Arch system a few days back for improved security. My next step is to sandbox internet-facing applications such as firefox, thunderbird, torrent client, etc. However, it seems like grsecurity patchset doesn't have application sandboxing capability (Does it? Couldn't find it in docs or forums). In the past, I used Apparmor on Ubuntu for basic sandboxing. I tried installing it on linux-grsec kernel but it seems like the necessary kernel options required for installing Apparmor are disabled on linux-grsec kernel. The kernel options required by Apparmor on Arch are [1]: CONFIG_SECURITY_APPARMOR=y CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1 CONFIG_DEFAULT_SECURITY_APPARMOR=y CONFIG_AUDIT=y While my linux-grsec kernel's configuration reports: # CONFIG_SECURITY_APPARMOR is not set I think I could enable the required options by recompiling the linux-grsec kernel but it seems like the grsecurity team now provides the stable patches only to commercial customers [2], so I believe I won't be able to recompile the kernel myself (Perhaps I'm wrong?). I was hoping someone here would be able to help me install Apparmor on linux-grsec kernel or atleast point me in the right direction. Regards [1] https://wiki.archlinux.org/index.php/AppArmor#Kernel [2] https://grsecurity.net/announce.php

2 1

[arch-general] Experiences with SELinux on Arch
by Niels Kobschaetzki 27 Jan '16

27 Jan '16

Hi, since I won't get an answer on the forum except "Read the Wiki" which isn't helpful, I ask here. Is here anybody with real world experiences with SELinux on Arch? The forum states the userland tools as "work in progress" which doesn't say anything about the progress… I'd like to know how easy SELinux is to use on Arch. I am just starting out to (re-)enabling it on my CentOS-servers and there it is actually not that hard after all nowadays because of the great tools available. But how about Arch? Niels

5 5

[arch-general] Yahoo mail problems (was [aur-general] No notification for out-of-date package)
by Florian Pritz 27 Jan '16

27 Jan '16

On 14.01.2016 14:41, Florian Pritz wrote: > On 13.01.2016 18:53, Giovanni 'ItachiSan' Santini wrote: >> My package "telegram-desktop-bin-dev" was flagged as out of date on the >> 10th of January but I received no mail notification about that. > > It appears that yahoo has decided to "temporarily" reject all mails from > that system (bbs, wiki, aur, mailing lists). I've sent an email to their > postmaster and hope this will clear up soon. > > Until then, I'm afraid yahoo users will not receive emails from our > services. Sorry for the inconvenience. We are still unable to deliver mails to yahoo and so far my email to postmaster(a)yahoo.com has not received a reply. Can anyone put me in touch with someone from yahoo or tell me if the postmaster address is read (I kind of expect it to go to /dev/null)? Florian

5 6

[arch-general] Update php 5.6 to 7.0.1 problems
by Maykel Franco 27 Jan '16

27 Jan '16

[000][+][[user@arch-xbmc: /etc/php]] $ php --version PHP Warning: PHP Startup: Unable to load dynamic library '/usr/lib/php/modules/mysql.so' - /usr/lib/php/modules/mysql.so: cannot open shared object file: No such file or directory in Unknown on line 0 PHP Warning: PHP Startup: Unable to load dynamic library '/usr/lib/php/modules/openssl.so' - /usr/lib/php/modules/openssl.so: cannot open shared object file: No such file or directory in Unknown on line 0 PHP Warning: PHP Startup: Unable to load dynamic library '/usr/lib/php/modules/posix.so' - /usr/lib/php/modules/posix.so: cannot open shared object file: No such file or directory in Unknown on line 0 Can I help me please?

6 8

[arch-general] Clarification on pacman signature verification
by Solomon Lam 25 Jan '16

25 Jan '16

Hi, This is regarding package verification performed by pacman. Does pacman download the .sig file of a package while installing one? All I could find are the local cached copies of packages only but not their signatures. If thats the case, how does pacman verify the integrity of the downloaded package? It could be that .sig file could have been downloaded into /tmp during installation or to another location that I'm not aware yet. This brings me to my next point. I've manually downloaded just the package file (of some random package) from a mirror and disconnected from the Internet. I used both 'pacman -U <pkg-name>' and 'pacman -S <pkg-name>' to install the package and the installation went just fine. I was expecting Pacman to emit an error stating that signature was missing but nothing happened. Could someone care to explain this. BTW, I have SigLevel = Required DatabaseOptional in my pacman.conf. - Solomon

3 4

Re: [arch-general] [tor] User and group entries are left over in passwd and gshadow after removal, makes pwck and shadow.service fail
by Bastien Traverse 25 Jan '16

25 Jan '16

On Mon, 25 Jan 2016 17:45:17 +0100 Doug Newgard <scimmia at archlinux.info > wrote: > Dev discussion here: > https://lists.archlinux.org/pipermail/arch-dev-public/2015-February/026953.… Thanks, that's the context I needed to understand your decision. Reading the dev discussion and the clear consensus emerging from it, I wonder about corner (?) cases like tor where an important service fails due to the absence of user removal in package management. Central to this particular issue is the specification of a home directory which is deleted upon package removal because empty, which trips pwck. For it not to fail on those cases, a possible solution would be to add package-specific home dirs to PKGBUILDs backup=() array, but that's kind of an ugly workaround. I'll leave it here for now, Cheers

1 0

[arch-general] [tor] User and group entries are left over in passwd and gshadow after removal, makes pwck and shadow.service fail
by Bastien Traverse 25 Jan '16

25 Jan '16

Hi, I opened FS#47893 [1] to discuss this issue, but it's been closed with no delay and I can't really have a discussion via re-opening requests. Upon installation of the tor package, directory /var/lib/tor is created (see PKGBUILD#40 [2]). Upon uninstallation, it is automatically deleted **only if empty**: # pacman -S tor # touch /var/lib/tor/test # pacman -Rns tor # ls -lah /var/lib/tor total 8,0K drwx------ 2 tor tor 4,0K 25 janv. 16:50 . drwxr-xr-x 39 root root 4,0K 25 janv. 16:50 .. -rw-r--r-- 1 root root 0 25 janv. 16:50 test # rm -rf /var/lib/tor # pacman -S tor ... (1/1) installing tor error: command failed to execute correctly ... # pacman -Rns tor # ls -lah /var/lib/tor ls: cannot access /var/lib/tor: No such file or directory However, tor user and group (UID/GID 43) created via post_install() hook [3] are not removed: # pacman -Rns tor $ id tor uid=43(tor) gid=43(tor) groupes=43(tor) This makes shadow.service fail at bootup: pwck[718]: tor user: directory « /var/lib/tor » does not exist pwck[718]: pwck : no change systemd[1]: shadow.service: Main process exited, code=exited, status=2/INVALIDARGUMENT systemd[1]: Failed to start Verify integrity of password and group files. systemd[1]: shadow.service: Unit entered failed state. systemd[1]: shadow.service: Failed with result 'exit-code'. Same for pwck. What I asked in FS#47893 was to add a post_uninstall() hook to remove tor user (e.g. with `userdel tor`), so that **if /var/lib/tor has been deleted automatically** because it was empty, pwck doesn't trip on home dir verification. Note that if /var/lib/tor isn't empty, `userdel tor` would merely remove the user entry and not delete its home directory (-r switch). Therefore, no data loss. Moreover, I believe it is possible to condition user deletion on directory existence (e.g. `if [ ! -e /var/lib/tor ]; then userdel tor; else :`), so that could do it too. Reason for closing was "Not a bug / So fix it. This isn't something that can be dealt with automatically". I fail to see how it is so, but if I'm wrong please tell me so and why. Thanks, Bastien [1] https://bugs.archlinux.org/task/47893 [2] https://projects.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h… [3] https://projects.archlinux.org/svntogit/community.git/tree/trunk/tor.instal…

2 1

[arch-general] Mounting root according to fstab the first time (fstab in initrd)?
by Garmine 42 25 Jan '16

25 Jan '16

Hi! My concern is that there are a few mount flags which can not be changed with a remount (at least on some FSes such as btrfs). Now as far as I understand, the kernel mounts root RO after boot using the root and rootflags parameters. I also found that you can include /etc/fstab in the initrd. How can I convince the kernel to mount every volume including the root according to fstab instead of the kernel paramters? In case the kernel isn't the one which reads fstab (which I suspect), can I include some binary in the initrd that would read fstab and handle the mounting for me? Or should I just scrap the whole above idea and write something that'll a) read the root volume's options from fstab and put it on the cmdline through e.g. a grub-mkconfig script? Thanks in advance! Regards, Garmine

4 12

[arch-general] Unknown Trust and Corrupted Package
by Jayesh Badwaik 25 Jan '16

25 Jan '16

Hi, I'm receiving message about unknown trust while trying to install the confuse package. $ sudo pacman -S confuse resolving dependencies... looking for conflicting packages... Packages (1) confuse-2.8-1 Total Download Size: 0.03 MiB Total Installed Size: 0.11 MiB :: Proceed with installation? [Y/n] y :: Retrieving packages ... confuse-2.8-1-x86_64 33.8 KiB 4.72M/s 00:00 [######################] 100% (1/1) checking keys in keyring [######################] 100% (1/1) checking package integrity [######################] 100% error: confuse: signature from "Thorsten Töpper <atsutane(a)freethoughts.de>" is unknown trust :: File /var/cache/pacman/pkg/confuse-2.8-1-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)). Do you want to delete it? [Y/n] y error: failed to commit transaction (invalid or corrupted package (PGP signature)) Errors occurred, no packages were upgraded. -- Jayesh Badwaik

7 10

[arch-general] archlinux-keyring 20160123-1 is needed, but unavailable without testing
by Ralf Mardorf 25 Jan '16

25 Jan '16

Hi, archlinux-keyring 20160123-1 is needed, but not available, if testing isn't used. Packages (11) boost-1.60.0-2 boost-libs-1.60.0-2 cmake-3.4.2-1 confuse-2.8-1 dhcpcd-6.10.1-1 libvpx-1.5.0-4 ntp-4.2.8.p6-1 openmpi-1.10.2-1 pacman-mirrorlist-20160124-1 python-setuptools-1:19.6-1 python2-setuptools-1:19.6-1 error: confuse: signature from "Thorsten Töpper <atsutane(a)freethoughts.de>" is unknown trust :: File /var/cache/pacman/pkg/confuse-2.8-1-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)). # pacman-key --refresh-keys --updatedb This fixed the issue with the signature. However, the current keyring package isn't available. "archlinux-keyring 20160123-1" - https://www.archlinux.org/packages/testing/any/archlinux-keyring/ "archlinux-keyring 20151220-1" - https://www.archlinux.org/packages/core/any/archlinux-keyring/ # pacman -Q archlinux-keyring archlinux-keyring 20151220-1 # pacman -Si archlinux-keyring | grep Ver Version : 20151220-1 Regards, Ralf

1 1