Development June 2020

development@lists.ipfire.org

10 participants
81 discussions

[PATCH] kernel: enable CONFIG_SECCOMP on aarch64 and armv5tel
by Peter Müller 07 Jun '20

07 Jun '20

Fixes: #12366 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 ++ config/kernel/kernel.config.armv5tel-ipfire-multi | 2 ++ 2 files changed, 4 insertions(+) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index dcd21e820..8e4f650a5 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -251,6 +251,7 @@ CONFIG_HAVE_CMPXCHG_LOCAL=y CONFIG_HAVE_CMPXCHG_DOUBLE=y CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION=y CONFIG_HAVE_ARCH_SECCOMP_FILTER=y +CONFIG_SECCOMP_FILTER=y CONFIG_HAVE_GCC_PLUGINS=y CONFIG_GCC_PLUGINS=y # CONFIG_GCC_PLUGIN_CYC_COMPLEXITY is not set @@ -524,6 +525,7 @@ CONFIG_HOLES_IN_ZONE=y CONFIG_PREEMPT_NONE=y # CONFIG_PREEMPT_VOLUNTARY is not set # CONFIG_PREEMPT is not set +CONFIG_SECCOMP=y CONFIG_HZ_100=y # CONFIG_HZ_250 is not set # CONFIG_HZ_300 is not set diff --git a/config/kernel/kernel.config.armv5tel-ipfire-multi b/config/kernel/kernel.config.armv5tel-ipfire-multi index 9c7ecb524..ee63c2392 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-multi +++ b/config/kernel/kernel.config.armv5tel-ipfire-multi @@ -247,6 +247,7 @@ CONFIG_HAVE_PERF_USER_STACK_DUMP=y CONFIG_HAVE_ARCH_JUMP_LABEL=y CONFIG_ARCH_WANT_IPC_PARSE_VERSION=y CONFIG_HAVE_ARCH_SECCOMP_FILTER=y +CONFIG_SECCOMP_FILTER=y CONFIG_HAVE_GCC_PLUGINS=y CONFIG_GCC_PLUGINS=y # CONFIG_GCC_PLUGIN_CYC_COMPLEXITY is not set @@ -781,6 +782,7 @@ CONFIG_ARCH_NR_GPIO=512 CONFIG_PREEMPT_NONE=y # CONFIG_PREEMPT_VOLUNTARY is not set # CONFIG_PREEMPT is not set +CONFIG_SECCOMP=y CONFIG_HZ_FIXED=0 CONFIG_HZ_100=y # CONFIG_HZ_200 is not set -- 2.26.2

1 0

[PATCH] kernel: enable CONFIG_RANDOMIZE_BASE on aarch64
by Peter Müller 07 Jun '20

07 Jun '20

Partially fixes: #12363 Cc: Arne Fitzenreiter <arne.fitzenreiter(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index dcd21e820..2fba41719 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -607,7 +607,7 @@ CONFIG_ARM64_VHE=y CONFIG_ARM64_UAO=y # CONFIG_ARM64_PMEM is not set CONFIG_ARM64_MODULE_CMODEL_LARGE=y -# CONFIG_RANDOMIZE_BASE is not set +CONFIG_RANDOMIZE_BASE=y # # Boot options -- 2.26.2

1 0

[PATCH] kernel: disable CONFIG_ACPI_CUSTOM_METHOD on x86_64 and i586
by Peter Müller 07 Jun '20

07 Jun '20

This is dangerous as it allows replacing the running kernel without rebooting. Kernel Self Protection Project people recommend to keep it disabled. Fixes: #12372 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.i586-ipfire | 1 - config/kernel/kernel.config.x86_64-ipfire | 1 - 2 files changed, 2 deletions(-) diff --git a/config/kernel/kernel.config.i586-ipfire b/config/kernel/kernel.config.i586-ipfire index 0b6e0ca08..b978a4e1f 100644 --- a/config/kernel/kernel.config.i586-ipfire +++ b/config/kernel/kernel.config.i586-ipfire @@ -685,7 +685,6 @@ CONFIG_ACPI_CONTAINER=y CONFIG_ACPI_HOTPLUG_IOAPIC=y CONFIG_ACPI_SBS=m CONFIG_ACPI_HED=y -CONFIG_ACPI_CUSTOM_METHOD=m # CONFIG_ACPI_BGRT is not set # CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set CONFIG_HAVE_ACPI_APEI=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 27b073ec7..09ac0eff1 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -707,7 +707,6 @@ CONFIG_ACPI_CONTAINER=y CONFIG_ACPI_HOTPLUG_IOAPIC=y CONFIG_ACPI_SBS=m CONFIG_ACPI_HED=y -CONFIG_ACPI_CUSTOM_METHOD=m # CONFIG_ACPI_BGRT is not set # CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set CONFIG_ACPI_NFIT=m -- 2.26.2

1 0

[PATCH] kernel: enable CONFIG_HARDENED_USERCOPY on aarch64 and armv5tel
by Peter Müller 07 Jun '20

07 Jun '20

Fixes: #12365 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 3 ++- config/kernel/kernel.config.armv5tel-ipfire-multi | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index dcd21e820..75dea9da9 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -6539,7 +6539,8 @@ CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_NETWORK_XFRM=y # CONFIG_SECURITY_PATH is not set CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y -# CONFIG_HARDENED_USERCOPY is not set +CONFIG_HARDENED_USERCOPY=y +CONFIG_HARDENED_USERCOPY_PAGESPAN=y # CONFIG_FORTIFY_SOURCE is not set # CONFIG_STATIC_USERMODEHELPER is not set # CONFIG_SECURITY_SMACK is not set diff --git a/config/kernel/kernel.config.armv5tel-ipfire-multi b/config/kernel/kernel.config.armv5tel-ipfire-multi index 9c7ecb524..919538bf8 100644 --- a/config/kernel/kernel.config.armv5tel-ipfire-multi +++ b/config/kernel/kernel.config.armv5tel-ipfire-multi @@ -7022,7 +7022,8 @@ CONFIG_SECURITY_NETWORK=y CONFIG_SECURITY_NETWORK_XFRM=y # CONFIG_SECURITY_PATH is not set CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y -# CONFIG_HARDENED_USERCOPY is not set +CONFIG_HARDENED_USERCOPY=y +CONFIG_HARDENED_USERCOPY_PAGESPAN=y # CONFIG_STATIC_USERMODEHELPER is not set # CONFIG_SECURITY_SMACK is not set # CONFIG_SECURITY_TOMOYO is not set -- 2.26.2

1 0

Kernel: 'udevd'-messages after Core 145 update
by Matthias Fischer 07 Jun '20

07 Jun '20

Hi, after updating - yesterday - to Core 145 I just noticed some new kernel messages today (in the middle of working): ... 14:06:04 kernel: <27>udevd[502]: specified group 'input' unknown 14:06:04 kernel: <27>udevd[502]: specified group 'render' unknown 14:06:04 kernel: <27>udevd[502]: specified group 'kvm' unknown ... Besides of this, the update was installed without any error messages - no reboot required. The machine runs unobtrusively (Deepl translation!) - no visible problems. Hardware is a Duo Box, running Core 145 / x86_64. Only me - or can somone confirm? Best, Matthias

2 1

[PATCH] core145: Remove double-added configuration lines for OpenVPN
by Michael Tremer 04 Jun '20

04 Jun '20

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/rootfiles/core/145/update.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/config/rootfiles/core/145/update.sh b/config/rootfiles/core/145/update.sh index 38653b730..4b59a03dc 100644 --- a/config/rootfiles/core/145/update.sh +++ b/config/rootfiles/core/145/update.sh @@ -78,7 +78,10 @@ for package in perl-DBI perl-DBD-SQLite; do done # Enable OpenVPN metrics collection -grep -q "^client-connect" /var/ipfire/ovpn/server.conf || cat <<EOF >> /var/ipfire/ovpn/server.conf +sed -E -i /var/ipfire/ovpn/server.conf \ + -e "/^client-(dis)?connect/d" + +cat <<EOF >> /var/ipfire/ovpn/server.conf # Log clients connecting/disconnecting client-connect "/usr/sbin/openvpn-metrics client-connect" client-disconnect "/usr/sbin/openvpn-metrics client-disconnect" -- 2.20.1

1 0

[PATCH] random: Drop busy-loop script
by Michael Tremer 03 Jun '20

03 Jun '20

This is no longer required because the kernel will now try to generate some randomness in an easier way when needed. This has been added in: b923dd3de0acbf415cee193191250347b733fab8 Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/rootfiles/common/aarch64/initscripts | 2 -- config/rootfiles/common/armv5tel/initscripts | 2 -- config/rootfiles/common/i586/initscripts | 2 -- config/rootfiles/common/x86_64/initscripts | 2 -- lfs/initscripts | 1 - src/initscripts/system/random | 33 -------------------- 6 files changed, 42 deletions(-) delete mode 100644 src/initscripts/system/random diff --git a/config/rootfiles/common/aarch64/initscripts b/config/rootfiles/common/aarch64/initscripts index 8d945f7a5..485c0af6e 100644 --- a/config/rootfiles/common/aarch64/initscripts +++ b/config/rootfiles/common/aarch64/initscripts @@ -71,7 +71,6 @@ etc/rc.d/init.d/networking/wpa_supplicant.exe etc/rc.d/init.d/ntp etc/rc.d/init.d/pakfire etc/rc.d/init.d/partresize -etc/rc.d/init.d/random etc/rc.d/init.d/rc etc/rc.d/init.d/reboot etc/rc.d/init.d/rngd @@ -191,7 +190,6 @@ etc/rc.d/rcsysinit.d/S45udev_retry etc/rc.d/rcsysinit.d/S50cleanfs etc/rc.d/rcsysinit.d/S60setclock etc/rc.d/rcsysinit.d/S65rngd -etc/rc.d/rcsysinit.d/S66random etc/rc.d/rcsysinit.d/S70console etc/rc.d/rcsysinit.d/S71pakfire etc/rc.d/rcsysinit.d/S73swconfig diff --git a/config/rootfiles/common/armv5tel/initscripts b/config/rootfiles/common/armv5tel/initscripts index 8d945f7a5..485c0af6e 100644 --- a/config/rootfiles/common/armv5tel/initscripts +++ b/config/rootfiles/common/armv5tel/initscripts @@ -71,7 +71,6 @@ etc/rc.d/init.d/networking/wpa_supplicant.exe etc/rc.d/init.d/ntp etc/rc.d/init.d/pakfire etc/rc.d/init.d/partresize -etc/rc.d/init.d/random etc/rc.d/init.d/rc etc/rc.d/init.d/reboot etc/rc.d/init.d/rngd @@ -191,7 +190,6 @@ etc/rc.d/rcsysinit.d/S45udev_retry etc/rc.d/rcsysinit.d/S50cleanfs etc/rc.d/rcsysinit.d/S60setclock etc/rc.d/rcsysinit.d/S65rngd -etc/rc.d/rcsysinit.d/S66random etc/rc.d/rcsysinit.d/S70console etc/rc.d/rcsysinit.d/S71pakfire etc/rc.d/rcsysinit.d/S73swconfig diff --git a/config/rootfiles/common/i586/initscripts b/config/rootfiles/common/i586/initscripts index 996925b7a..511692335 100644 --- a/config/rootfiles/common/i586/initscripts +++ b/config/rootfiles/common/i586/initscripts @@ -71,7 +71,6 @@ etc/rc.d/init.d/networking/wpa_supplicant.exe etc/rc.d/init.d/ntp etc/rc.d/init.d/pakfire etc/rc.d/init.d/partresize -etc/rc.d/init.d/random etc/rc.d/init.d/rc etc/rc.d/init.d/reboot etc/rc.d/init.d/rngd @@ -190,7 +189,6 @@ etc/rc.d/rcsysinit.d/S45udev_retry etc/rc.d/rcsysinit.d/S50cleanfs etc/rc.d/rcsysinit.d/S60setclock etc/rc.d/rcsysinit.d/S65rngd -etc/rc.d/rcsysinit.d/S66random etc/rc.d/rcsysinit.d/S70console etc/rc.d/rcsysinit.d/S71pakfire etc/rc.d/rcsysinit.d/S74cloud-init diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/common/x86_64/initscripts index 996925b7a..511692335 100644 --- a/config/rootfiles/common/x86_64/initscripts +++ b/config/rootfiles/common/x86_64/initscripts @@ -71,7 +71,6 @@ etc/rc.d/init.d/networking/wpa_supplicant.exe etc/rc.d/init.d/ntp etc/rc.d/init.d/pakfire etc/rc.d/init.d/partresize -etc/rc.d/init.d/random etc/rc.d/init.d/rc etc/rc.d/init.d/reboot etc/rc.d/init.d/rngd @@ -190,7 +189,6 @@ etc/rc.d/rcsysinit.d/S45udev_retry etc/rc.d/rcsysinit.d/S50cleanfs etc/rc.d/rcsysinit.d/S60setclock etc/rc.d/rcsysinit.d/S65rngd -etc/rc.d/rcsysinit.d/S66random etc/rc.d/rcsysinit.d/S70console etc/rc.d/rcsysinit.d/S71pakfire etc/rc.d/rcsysinit.d/S74cloud-init diff --git a/lfs/initscripts b/lfs/initscripts index 242de60e5..7d5f39716 100644 --- a/lfs/initscripts +++ b/lfs/initscripts @@ -171,7 +171,6 @@ $(TARGET) : ln -sf ../init.d/setclock /etc/rc.d/rc0.d/K47setclock ln -sf ../init.d/setclock /etc/rc.d/rc6.d/K47setclock ln -sf ../init.d/rngd /etc/rc.d/rcsysinit.d/S65rngd - ln -sf ../init.d/random /etc/rc.d/rcsysinit.d/S66random ln -sf ../init.d/console /etc/rc.d/rcsysinit.d/S70console ln -sf ../init.d/pakfire /etc/rc.d/rcsysinit.d/S71pakfire ln -sf ../init.d/cloud-init /etc/rc.d/rcsysinit.d/S74cloud-init diff --git a/src/initscripts/system/random b/src/initscripts/system/random deleted file mode 100644 index 489c7dac9..000000000 --- a/src/initscripts/system/random +++ /dev/null @@ -1,33 +0,0 @@ -#!/bin/sh -. /etc/sysconfig/rc -. $rc_functions - -if [ -e /proc/sys/kernel/random/poolsize ]; then - poolsize=$(</proc/sys/kernel/random/poolsize); - poolsize=$(expr $poolsize / 8 ); -else - poolsize=512; -fi - -case "$1" in - start) - - #CRNG init need 128bit so wait until there is more) - avail=$(</proc/sys/kernel/random/entropy_avail) - while [ $avail -lt 130 ]; do - avail=$(</proc/sys/kernel/random/entropy_avail) - boot_mesg -n "\rWait for entropy: $avail/130 " - # Generate some disc access to gather entropy - echo avail > /var/tmp/random-tmpfile - sync - rm -f /var/tmp/random-tmpfile - done; - ;; - - *) - echo "Usage: $0 {start}" - exit 1 - ;; -esac - -# End $rc_base/init.d/random -- 2.20.1

1 0

Advice with adding RPS/RFS for PPP connections
by Adam Jaremko 03 Jun '20

03 Jun '20

I've been doing RPS/RFS in my own shell scripts for some time and also implemented primitive support into the web UI but I'm very much a perl novice since my last real usage was in the 90's. First and foremost, would it be relevant to add such support in an official capacity? Second, is there any guidelines to accessing the filesytem with the scripts? I ask because my non thorough browsing of the code only revealed the use of readhash, whereas I would need to poke and prod at procfs to work with complex CPU affinity per queue. I can submit a review patch of my primitive implementation (non NUMA) wherein it's the same CPU affinity used across each queue using nproc and some check boxes just to get feedback and a start in the right direction. Thanks, AJ

2 4

[PATCH] core145: Update OpenVPN server configuration only when necessary
by Michael Tremer 03 Jun '20

03 Jun '20

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/rootfiles/core/145/update.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/rootfiles/core/145/update.sh b/config/rootfiles/core/145/update.sh index 893539f30..38653b730 100644 --- a/config/rootfiles/core/145/update.sh +++ b/config/rootfiles/core/145/update.sh @@ -78,7 +78,7 @@ for package in perl-DBI perl-DBD-SQLite; do done # Enable OpenVPN metrics collection -cat <<EOF >> /var/ipfire/ovpn/server.conf +grep -q "^client-connect" /var/ipfire/ovpn/server.conf || cat <<EOF >> /var/ipfire/ovpn/server.conf # Log clients connecting/disconnecting client-connect "/usr/sbin/openvpn-metrics client-connect" client-disconnect "/usr/sbin/openvpn-metrics client-disconnect" -- 2.20.1

1 0

Testing 145
by paul.titjen 02 Jun '20

02 Jun '20

Hi all,I was playing around with test 145 and came across some strange behaviour. Ipfire is used in a home lab set up so often I go into testing though I only scratch the surface of the functionality. I use the open on road warrior when working away so thought I would see what the new page for roadwarrior stats would give me. Each time i tried i got a 500 server internal error. With a bit of time today i looked at the script and saw it was referencing a clients.db file. Mine was 0 bytes.So wondering why it was empty i went to the openvpn GUI page and looked at the advanced server options. Decided to up the log verboseness from 3 where it has always been to 5. Tested again and my clients.db started to grow. No more internal server error 500On setting back verbose to 4 then 3 it continues to work as it should.No idea if the switch to 5 then back initialised the clients.db or just that I stopped, edited and resaved the advance server options.The machine had been rebooted a couple of times but clients.db was empty prior to this.Hope this is not too trivial and I had not messed up my openvpn in the first place.Best regardsPaul

1 0

← Newer
1
2
3
4
5
6
7
8
9
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development June 2020