- Arch-general - lists.archlinux.org

Re: [arch-general] [arch-dev-public] [signoff] syslog-ng-3.0.1-1
by Gerardo Exequiel Pozzi 11 Mar '09

11 Mar '09

Allan McRae wrote: > Gerardo Exequiel Pozzi wrote: >> Pierre Schmitz wrote: >> >>> Does anybody know what this message in dmesg is about? Was syslog-ng >>> compiled for i686? >>> >>> warning: `syslog-ng' uses 32-bit capabilities (legacy support in use) >>> >>> >> Very out-of-date libcap, not only syslog-ng, also proftpd, vsftpd, >> pulseaudio, ntpd, virtualbox, etc, etc... >> >> http://www.archlinux.org/packages/extra/i686/libcap/ (for linux 2.4) >> >> Need to have libcap2 package for kernel 2.6 in Arch Linux >> http://www.kernel.org/pub/linux/libs/security/linux-privs/ >> > > I was confused about this as libcap is in [extra] so how can it make > problems with a package in [core]? > > So going from this comment in the bug report about libcap > (http://bugs.archlinux.org/task/11917#comment41046) I get... > >> readelf -s /usr/sbin/syslog-ng | grep cap > 33: 00000000 0 FUNC GLOBAL DEFAULT UND capset(a)GLIBC_2.1 (4) > 177: 00000000 0 FUNC GLOBAL DEFAULT UND capget(a)GLIBC_2.1 (4) > 473: 08228bd8 4 OBJECT GLOBAL DEFAULT 26 OPENSSL_ia32cap_P > > Looks like libcap is a soft dep there. How? > > Then rebuild in clean chroot: >> readelf -s syslog-ng | grep cap > 467: 08221b18 4 OBJECT GLOBAL DEFAULT 26 OPENSSL_ia32cap_P > > And then the dmesg warning goes away... So, the lesson to learn is to > _always build in a clean chroot_! > > Allan > Agree about clean chroot. But maybe this is useful, and more secure syslog-ng setup, because it drop some capabilities that don't use it ;) You can see the syslog-ng process running without capabilities enabled (from /proc/PID/status): CapPrm: fffffffffffffeff CapEff: fffffffffffffeff Capabilities for `27939': =ep cap_setpcap-ep ## getpcaps program from latest libcap Shows that have all capabilities, of course, i can't drop it. But running the syslog-ng, with capabilities enabled (accidentally enabled now) you can see, many capabilities are droped :) CapPrm: 0000000000202c06 CapEff: 0000000000200002 Capabilities for `23652': = cap_dac_override,cap_sys_admin+ep cap_dac_read_search,cap_net_bind_service,cap_net_broadcast,cap_net_raw+p More secure syslog-ng ;) OK, this isn't default behavior in Arch Linux, but... -- Gerardo Exequiel Pozzi ( djgera ) http://www.djgera.com.ar KeyID: 0x1B8C330D Key fingerprint = 0CAA D5D4 CD85 4434 A219 76ED 39AB 221B 1B8C 330D

1 0

[arch-general] udev-139 and file permissions of /dev/net/tun
by Attila 11 Mar '09

11 Mar '09

Hi, i use a script to prepare a bridged network for a kvm session and therefore i have this line in /etc/udev/rules.d/01-attila.rules: KERNEL=="tun", NAME="net/%k", MODE="0660", GROUP="network" After upgrading udev my file permissions of the new persistent /dev/net/tun looks so after booting up: crw-rw-rw- 1 root root 10, 200 8. Mär 00:43 /dev/net/tun I play with this lines in /etc/udev/permissions.d/00-my.permissions: a) tun:root:network:0660 b) net/tun:root:network:0660 I reboot even after changing the line but there is no change. If i do a "modprobe tun" there be the right permissions: crw-rw---- 1 root network 10, 200 8. Mär 00:43 /dev/net/tun So my questions is how and/or where can i control the file permissions of the persistent devices from the new udev? This is definitly not bad, i want more to know what i have overseen.-) See you, Attila

6 14

Re: [arch-general] [arch-dev-public] [signoff] syslog-ng-3.0.1-1
by Gerardo Exequiel Pozzi 11 Mar '09

11 Mar '09

Pierre Schmitz wrote: > Does anybody know what this message in dmesg is about? Was syslog-ng compiled > for i686? > > warning: `syslog-ng' uses 32-bit capabilities (legacy support in use) > > Very out-of-date libcap, not only syslog-ng, also proftpd, vsftpd, pulseaudio, ntpd, virtualbox, etc, etc... http://www.archlinux.org/packages/extra/i686/libcap/ (for linux 2.4) Need to have libcap2 package for kernel 2.6 in Arch Linux http://www.kernel.org/pub/linux/libs/security/linux-privs/ -- Gerardo Exequiel Pozzi ( djgera ) http://www.djgera.com.ar KeyID: 0x1B8C330D Key fingerprint = 0CAA D5D4 CD85 4434 A219 76ED 39AB 221B 1B8C 330D

1 1

Re: [arch-general] [arch-dev-public] [signoff] initscripts 2009.03-1
by Damjan Georgievski 10 Mar '09

10 Mar '09

> Thomas Bächler (2): > Fix bug #13205: better random-seed entropy - For the random-seed file > location to be more "FHS compliant" is better to put in > /var/lib/misc/random-seed (Variable state information, that persists after > reboot) than the /var/run/random-seed (Run-time variable data, that not > necessarily persists after reboot) for example with /var/run mounted as > TMPFS. - The random-seed file permision should be "0600" not "0644" - The > size of random-seed acording to random(4) manpage should be the size > specified in "/proc/sys/kernel/random/poolsize" in other case 512 bytes. > Use the device nodes from /lib/udev/devices/* instead of hardcoding > them in initscripts. This requires a new udev package (at least 139-1) I tested this on a minimal ArchLinux I installed in a virtual machine. /var/lib/misc/ was not present on that install so rc.shutdown complained, and the random-seed file of course wasn't created. -- damjan

2 1

[arch-general] [signoff] kernel26 2.6.28.7-2
by Tobias Powalowski 10 Mar '09

10 Mar '09

Hi guys, new kernel adresses the following things: - changes for better customizing the default kernel included http://bugs.archlinux.org/task/12384 --> firmware needed to be split off the package. It is now called kernel26-firmware - config features added: http://bugs.archlinux.org/task/13128 http://bugs.archlinux.org/task/12584 bug fixes: - http://bugs.archlinux.org/task/12826 please signoff for both arches. I haven't had issues with nvidia driver here, but please report issues if binary modules break, thanks. greetings tpowa -- Tobias Powalowski Archlinux Developer & Package Maintainer (tpowa) http://www.archlinux.org tpowa(a)archlinux.org

4 6

[arch-general] OpenOffice.org on Acer Aspire One
by henrih81＠gmail.com 10 Mar '09

10 Mar '09

Hello. I'm trying to use OpenOffice.org on my Acer Aspire One. For some peculiar reason, all the characters in the menu and title bar etc. and everything I type to the document are displayed as "squares" instead of regular characters. Sourcing /etc/profile.d/openoffice.sh does nothing. Installing a JRE didn't do anything either. Other applications such as Firefox work fine. Any ideas?

5 4

Re: [arch-general] [arch-dev-public] [signoff] device-mapper-1.02.31-1 & lvm2-2.02.45-1
by Atanas Zhelev 09 Mar '09

09 Mar '09

2009/3/9 Thomas Bächler <thomas(a)archlinux.org>: > Eric Bélanger schrieb: >> >> device-mapper-1.02.31-1 and lvm2-2.02.45-1 are now in testing for both >> arches. It's a minor upstream update. Please signoff. As few devs use >> this (I think I'm the only one using lvm on i686), signoff from users >> would be appreciated. > > Signoff x86_64. > > Hi, i have lvm setup on i686, the system still boots fine and i'm able to access my data. -- BRS Atanas Zhelev

1 0

[arch-general] cryptsetup and udev
by Henri Häkkinen 09 Mar '09

09 Mar '09

Hello, I am trying to setup udev to automatically open a LUKS partition of my external USB drive once it is plugged in. I have written the following udev rules script: ACTION="add", ENV{DEVTYPE}="partition", ENV{ID_SERIAL}="<serial number of the drive>", RUN+="/usr/sbin/cryptsetup --key-file /etc/keyfile luksOpen /dev/%k usbhd" ACTION="remove", ENV{DEVTYPE}="partition", ENV{ID_SERIAL}="<serial number of the drive>", RUN+="/usr/sbin/cryptsetup luksClose usbhd" Udev seems to recognize my drive but instead of creating /dev/mapper/usbhd I get some nonsense like /dev/mapper/temporary-cryptsetup-7501 or similar. I don't know what this is but it seems not to work when I try to mount it. Any ideas? -- Henri Häkkinen

3 2

Re: [arch-general] [arch-dev-public] [signoff] fakeroot 1.12.2-1
by Gerardo Exequiel Pozzi 09 Mar '09

09 Mar '09

Andreas Radke wrote: > This is a minor update to 1.12.2 - the major change I've done is the > switch to --with-ipc=tcp communication way that should solve some > issues that have come up with recent kde builds. please test if you can > still build all your other stuff with it. > > > Attention: Please also take care off all packages that install files > with setuid bit set. Take a look at > http://bugs.archlinux.org/task/13444 ! > > I could not track down where the issue is and the upstream Debian > developer can't reproduce it while Tpowa and some other could. Only > x86_64 is affected and sometimes files with setuid set don't get that > permission when the pkg gets installed. > > -Andy > > > upstream changelog: > > fakeroot (1.12.2) unstable; urgency=low > > * Replace and (hopefully) fix broken alpha stat version hack in > fts_read. > > -- Clint Adams <schizo(a)debian.org> Sun, 01 Mar 2009 15:17:31 -0500 > > Hi Andreas, No, fakeroot-tcp is broken when use make -j2 (i reported this to author), please see my feature request about this, and comments about test that i made with this. http://bugs.archlinux.org/task/13375 -- Gerardo Exequiel Pozzi ( djgera ) http://www.djgera.com.ar KeyID: 0x1B8C330D Key fingerprint = 0CAA D5D4 CD85 4434 A219 76ED 39AB 221B 1B8C 330D

1 0

[arch-general] [signoff] device-mapper-1.02.31-1 & lvm2-2.02.45-1
by Eric Bélanger 08 Mar '09

08 Mar '09

Hi, device-mapper-1.02.31-1 and lvm2-2.02.45-1 are now in testing for both arches. It's a minor upstream update. Please signoff. As few devs use this (I think I'm the only one using lvm on i686), signoff from users would be appreciated. Eric

1 0