Requests for -current (14.2-->15.0)

GazL · 09-18-2021, 04:54 PM

May I ask why you want it owned by named:named?

Files containing sensitive data are usually read by a process before privileges are dropped so that the file's contents can't be accessed by a compromised server process running under the non-privileged userid. I'm not familiar with bind/rndc, but it wouldn't surprise me to be told that root:root is the correct choice here given that the file contains a cryptographic key.

marav · 09-18-2021, 05:08 PM

Quote:

Originally Posted by GazL

May I ask why you want it owned by named:named?

Files containing sensitive data are usually read by a process before privileges are dropped so that the file's contents can't be accessed by a compromised server process running under the non-privileged userid. I'm not familiar with bind/rndc, but it wouldn't surprise me to be told that root:root is the correct choice here given that the file contains a cryptographic key.

Me, I don't want anything
This is a fact
If you remove bind and the file /etc/rndc.key
After a new install
the rndc.key installed is :

Code:

-rw-------  1 named named   100 sept. 19 00:05 rndc.key

cf. doinst.sh.gz in my last post

Like I said, I don't use bind
I don't know if it's correct or not
I just give the facts

Anyway, I'm not surprised that a file that has to be read by a service owned by named has this kind of owner and permissions (0600)

MDKDIO · 09-19-2021, 02:02 AM

efibootmgr 17

https://github.com/rhboot/efibootmgr/releases

Roman Dyaba · 09-19-2021, 02:34 AM

today exec tar error

Code:

bash-5.1$ xz -d wine-6.17.tar.xz
bash-5.1$ tar -xzvf wine-6.17.tar

gzip: stdin: not in gzip format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
bash-5.1$

also now i test to build wine-6.17, i think is not recommended for Linux, but some users want :

Code:

configure: creating ./config.status
config.status: creating Make.tmp
config.status: creating include/config.h
config.status: linking tools/winewrapper to wine
config.status: linking tools/winewrapper to wine64
config.status: executing include/stamp-h commands
config.status: executing tools/makedep commands
config.status: executing Makefile commands

configure: libhal 64-bit development files not found, no legacy dynamic device support.
configure: OSS sound system found but too old (OSSv4 needed), OSS won't be supported.
configure: libFAudio 64-bit development files not found, XAudio2 won't be supported.
configure: libcapi20 64-bit development files not found, ISDN won't be supported.
configure: libgsm 64-bit development files not found, gsm 06.10 codec won't be supported.
configure: jxrlib 64-bit development files not found, JPEG-XR won't be supported.
configure: vkd3d 64-bit development files not found (or too old), Direct3D 12 won't be supported.

configure: Finished.  Do 'make' to compile Wine.

bash-5.1$

at end make report error:

Code:

rm -f dlls/winecrt0/libwinecrt0.a && ar rc dlls/winecrt0/libwinecrt0.a \
  dlls/winecrt0/crt_dllmain.o dlls/winecrt0/crt_fltused.o dlls/winecrt0/debug.o \
  dlls/winecrt0/delay_load.o dlls/winecrt0/dll_canunload.o dlls/winecrt0/dll_main.o \
  dlls/winecrt0/dll_register.o dlls/winecrt0/exception.o dlls/winecrt0/exe16_entry.o \
  dlls/winecrt0/register.o dlls/winecrt0/setjmp.o dlls/winecrt0/stub.o dlls/winecrt0/unix_lib.o \
  dlls/winecrt0/exe_entry.o dlls/winecrt0/exe_main.o dlls/winecrt0/exe_wentry.o \
  dlls/winecrt0/exe_wmain.o && ranlib dlls/winecrt0/libwinecrt0.a
tools/winegcc/winegcc -o dlls/ntdll/ntdll.so --wine-objdir . -m64 -fPIC -fasynchronous-unwind-tables -munix -shared \
  -nodefaultlibs dlls/ntdll/unix/cdrom.o dlls/ntdll/unix/debug.o dlls/ntdll/unix/env.o \
  dlls/ntdll/unix/file.o dlls/ntdll/unix/loader.o dlls/ntdll/unix/loadorder.o \
  dlls/ntdll/unix/process.o dlls/ntdll/unix/registry.o dlls/ntdll/unix/security.o \
  dlls/ntdll/unix/serial.o dlls/ntdll/unix/server.o dlls/ntdll/unix/signal_arm.o \
  dlls/ntdll/unix/signal_arm64.o dlls/ntdll/unix/signal_i386.o dlls/ntdll/unix/signal_x86_64.o \
  dlls/ntdll/unix/socket.o dlls/ntdll/unix/sync.o dlls/ntdll/unix/system.o dlls/ntdll/unix/tape.o \
  dlls/ntdll/unix/thread.o dlls/ntdll/unix/virtual.o dlls/ntdll/unix/version.o \
  libs/port/libwine_port.a dlls/winecrt0/libwinecrt0.a -Wl,--subsystem,unixlib -lpthread \
  -static-libgcc -lunwind -ldl 
tools/winegcc/winegcc -o dlls/avicap32/avicap32.so --wine-objdir . -m64 -fPIC -fasynchronous-unwind-tables -munix -shared \
  dlls/avicap32/v4l.o -lntdll libs/port/libwine_port.a -Wl,--subsystem,unixlib -ldl 
/usr/bin/ld: cannot find -lntdll
collect2: error: ld returned 1 exit status
winegcc: /usr/bin/gcc failed
make: *** [Makefile:9533: dlls/avicap32/avicap32.so] Error 2
bash-5.1$

error codes then make:

Code:

clang -c -o dlls/crtdll/string.cross.o dlls/msvcrt/string.c -Idlls/crtdll -Idlls/msvcrt -Iinclude -Iinclude/msvcrt \
  -D__WINESRC__ -D_CRTDLL -D_CRTIMP= -D_MSVCR_VER=0 -DWINE_CROSS_PE -Wall -target x86_64-windows \
  -fno-strict-aliasing -Wdeclaration-after-statement -Wempty-body -Wignored-qualifiers -Winit-self \
  -Wno-pragma-pack -Wstrict-prototypes -Wtype-limits -Wvla -Wwrite-strings -Wpointer-arith \
  -Wabsolute-value -Wno-format -Wnonnull -mcx16 -gdwarf-2 -gstrict-dwarf -fno-builtin -g -O2
dlls/msvcrt/string.c:981:24: warning: variable length array used [-Wvla]
        BYTE bnum_data[FIELD_OFFSET(struct bnum, data[BNUM_PREC64])];
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/winnt.h:830:35: note: expanded from macro 'FIELD_OFFSET'
#define FIELD_OFFSET(type, field) ((LONG)offsetof(type, field))
                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
dlls/msvcrt/string.c:981:24: note: cast that performs the conversions of a reinterpret_cast is not allowed in a constant expression
include/winnt.h:830:42: note: expanded from macro 'FIELD_OFFSET'
#define FIELD_OFFSET(type, field) ((LONG)offsetof(type, field))
                                         ^
include/msvcrt/stddef.h:26:38: note: expanded from macro 'offsetof'
#define offsetof(s,m)       (size_t)((ptrdiff_t)&(((s*)NULL)->m))
                                     ^
dlls/msvcrt/string.c:987:24: warning: variable length array used [-Wvla]
        BYTE bnum_data[FIELD_OFFSET(struct bnum, data[BNUM_PREC80])];
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/winnt.h:830:35: note: expanded from macro 'FIELD_OFFSET'
#define FIELD_OFFSET(type, field) ((LONG)offsetof(type, field))
                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
dlls/msvcrt/string.c:987:24: note: cast that performs the conversions of a reinterpret_cast is not allowed in a constant expression
include/winnt.h:830:42: note: expanded from macro 'FIELD_OFFSET'
#define FIELD_OFFSET(type, field) ((LONG)offsetof(type, field))
                                         ^
include/msvcrt/stddef.h:26:38: note: expanded from macro 'offsetof'
#define offsetof(s,m)       (size_t)((ptrdiff_t)&(((s*)NULL)->m))
                                     ^
clang -c -o dlls/crtdll/thread.cross.o dlls/msvcrt/thread.c -Idlls/crtdll -Idlls/msvcrt -Iinclude -Iinclude/msvcrt \
  -D__WINESRC__ -D_CRTDLL -D_CRTIMP= -D_MSVCR_VER=0 -DWINE_CROSS_PE -Wall -target x86_64-windows \
  -fno-strict-aliasing -Wdeclaration-after-statement -Wempty-body -Wignored-qualifiers -Winit-self \
  -Wno-pragma-pack -Wstrict-prototypes -Wtype-limits -Wvla -Wwrite-strings -Wpointer-arith \
  -Wabsolute-value -Wno-format -Wnonnull -mcx16 -gdwarf-2 -gstrict-dwarf -fno-builtin -g -O2

Code:

clang -c -o dlls/atlthunk/atlthunk.cross.o dlls/atlthunk/atlthunk.c -Idlls/atlthunk -Iinclude -Iinclude/msvcrt \
  -D__WINESRC__ -D_UCRT -DWINE_CROSS_PE -Wall -target x86_64-windows -fno-strict-aliasing \
  -Wdeclaration-after-statement -Wempty-body -Wignored-qualifiers -Winit-self -Wno-pragma-pack \
  -Wstrict-prototypes -Wtype-limits -Wvla -Wwrite-strings -Wpointer-arith -Wabsolute-value \
  -Wno-format -Wnonnull -mcx16 -gdwarf-2 -gstrict-dwarf -g -O2
dlls/atlthunk/atlthunk.c:67:1: warning: variable length array used [-Wvla]
C_ASSERT(FIELD_OFFSET(struct thunk_pool, first_free) == 4096);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/winnt.h:403:51: note: expanded from macro 'C_ASSERT'
#define C_ASSERT(e) extern void __C_ASSERT__(int [(e)?1:-1])
                                                  ^~~~~~~~
dlls/atlthunk/atlthunk.c:67:10: note: cast that performs the conversions of a reinterpret_cast is not allowed in a constant expression
C_ASSERT(FIELD_OFFSET(struct thunk_pool, first_free) == 4096);
         ^
include/winnt.h:830:42: note: expanded from macro 'FIELD_OFFSET'
#define FIELD_OFFSET(type, field) ((LONG)offsetof(type, field))
                                         ^
include/msvcrt/stddef.h:26:38: note: expanded from macro 'offsetof'
#define offsetof(s,m)       (size_t)((ptrdiff_t)&(((s*)NULL)->m))
                                     ^
1 warning generated.

finally today:
./configure --prefix=/usr/local --enable-win64 --with-x --without-v4l2 --without-vkd3d --without-hal --without-gsm --without-oss --without-jxrlib

Code:

config.status: executing Makefile commands

configure: libFAudio 64-bit development files not found, XAudio2 won't be supported.
configure: libcapi20 64-bit development files not found, ISDN won't be supported.

configure: Finished.  Do 'make' to compile Wine.

bash-5.1$ make
tools/winegcc/winegcc -o dlls/avicap32/avicap32.so --wine-objdir . -m64 -fPIC -fasynchronous-unwind-tables -munix -shared \
  dlls/avicap32/v4l.o -lntdll libs/port/libwine_port.a -Wl,--subsystem,unixlib -ldl 
/usr/bin/ld: cannot find -lntdll
collect2: error: ld returned 1 exit status
winegcc: /usr/bin/gcc failed
make: *** [Makefile:9533: dlls/avicap32/avicap32.so] Error 2
bash-5.1$

https://dl.winehq.org/wine/source/6.x/wine-6.17.tar.xz

REASON: MISSED DEPENDENCIES and CODE BUG, THANK's to ALL !

Nobby6 · 09-19-2021, 02:51 AM

Quote:

Originally Posted by marav

Me, I don't want anything
This is a fact
If you remove bind and the file /etc/rndc.key
After a new install
the rndc.key installed is :

Code:

-rw-------  1 named named   100 sept. 19 00:05 rndc.key

cf. doinst.sh.gz in my last post

Like I said, I don't use bind
I don't know if it's correct or not
I just give the facts

Anyway, I'm not surprised that a file that has to be read by a service owned by named has this kind of owner and permissions (0600)

Actually it generates it as root.root

-rw------- 1 root root 77 Sep 19 17:41 rndc.key

You can create it as named user like rndc-confgen -a -u named
-rw------- 1 named root 77 Sep 19 17:41 rndc.key

Those using named as -u named (myself included) will almost always have run it like this, or changed the owner manually, its how its been done for a very many years on most distros

Those using Pats package as option -u named in /etc/default would have been doing this years, those choosing to keep using Pats package and not specifying -u named and running it as root, would not have had to do anything before, just like now.

I see no problem here.

Nobby6 · 09-19-2021, 02:58 AM

Quote:

Originally Posted by HQuest

Patch for ISC BIND to properly start with new rc.bind script:

Code:

--- rc.bind.orig      2021-09-15 15:53:12.000000000 -0400
+++ rc.bind   2021-09-18 05:25:10.902378397 -0400
@@ -46,15 +46,15 @@
   chown -R ${BIND_USER}:${BIND_GROUP} /var/named
   # Start named:
   if [ -x /usr/sbin/named ]; then
-    echo "Starting BIND:  /usr/sbin/named $NAMED_OPTIONS"
-    /usr/sbin/named $NAMED_OPTIONS
+    echo "Starting BIND:  /usr/sbin/named $BIND_OPTIONS"
+    /usr/sbin/named $BIND_OPTIONS
     sleep 1
   fi
   # Make sure that named started:
   if ! ps axc | grep -q named ; then
     echo "WARNING:  named did not start."
-    echo "Attempting to start named again:  /usr/sbin/named $NAMED_OPTIONS"
-    /usr/sbin/named $NAMED_OPTIONS
+    echo "Attempting to start named again:  /usr/sbin/named $BIND_OPTIONS"
+    /usr/sbin/named $BIND_OPTIONS
     sleep 1
     if ps axc | grep -q named ; then
       echo "SUCCESS:  named started."

Otherwise, there is no “-u named” for ISC BIND to start and it fails (see /var/log/syslog).

If there is no -u named it assumes user root and starts up as root just fine, as it requires no -passing of " -u " or whatever

if this does not work for you, i'm sorry, its overcast here today so my ESP cant get through hte clouds to reach your logs, looks like youll have to post an excerpt the old manual way

GazL · 09-19-2021, 03:33 AM

Quote:

Originally Posted by Nobby6

If there is no -u named it assumes user root and starts up as root just fine, as it requires no -passing of " -u " or whatever

if this does not work for you, i'm sorry, its overcast here today so my ESP cant get through hte clouds to reach your logs, looks like youll have to post an excerpt the old manual way

I don't need ESP to see his point: the script explicitly sets BIND_OPTIONS on line 27, then never uses it. Instead specifying $NAMED_OPTIONS on lines 54 and 61.

That looks like an obvious mismatch to me.

GazL · 09-19-2021, 03:51 AM

Quote:

Originally Posted by marav

Me, I don't want anything

Fair enough.

Quote:

The thing I've observed, it would be better if :
rndc.key is own by named:named not by root:root

... made it sound like you were advocating for it.

As I said, the point of dropping privs is to restrict what a daemon can do just in case it is compromised. Having the rndc.key file readable by the userid used for priv-sep seems like a weakness to me.

I have no need for using bind either, but it made me cock an eyebrow so I shared my thoughts.

Roman Dyaba · 09-19-2021, 03:52 AM

https://trac.edgewall.org/

https://slackware.com/

gouttegd · 09-19-2021, 04:43 AM

Quote:

Originally Posted by Roman Dyaba

today exec tar error

Code:

bash-5.1$ xz -d wine-6.17.tar.xz
bash-5.1$ tar -xzvf wine-6.17.tar

gzip: stdin: not in gzip format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
bash-5.1$

Err, that’s perfectly expected, you’re asking tar to pass the archive to gzip (-z) to uncompress it, even though you uncompressed it yourself. Of course gzip fails to uncompress something that is no longer compressed…

Besides, even if you didn’t uncompress the archive yourself, you’d need -J instead of -z to ask tar to pass the archive to xz instead of gzip. Or you can simply not use any of the -z, -j, -J options and just let tar figure out which decompressing filter to use, if any.

marav · 09-19-2021, 05:26 AM

Quote:

Originally Posted by GazL

Fair enough.

... made it sound like you were advocating for it.

As I said, the point of dropping privs is to restrict what a daemon can do just in case it is compromised. Having the rndc.key file readable by the userid used for priv-sep seems like a weakness to me.

I have no need for using bind either, but it made me cock an eyebrow so I shared my thoughts.

Yes, I understand.
I didn't really have an opinion on the subject.
I just ran /etc/rc.d/rc.bind and watched what happens in the logs when it failed

edit : according to
https://access.redhat.com/documentat...guide/dns-rndc

rndc.key must at least belong to ”named” group

Roman Dyaba · 09-19-2021, 07:12 AM

marav · 09-19-2021, 07:34 AM

Quote:

Originally Posted by GazL

I don't need ESP to see his point: the script explicitly sets BIND_OPTIONS on line 27, then never uses it. Instead specifying $NAMED_OPTIONS on lines 54 and 61.

That looks like an obvious mismatch to me.

indeed
probably something like this

Code:

blackstar rc.d # diff -u rc.bind.old rc.bind
--- rc.bind.old 2021-09-19 14:30:42.939299145 +0200
+++ rc.bind     2021-09-19 14:32:10.439199122 +0200
@@ -23,8 +23,8 @@
 if [ -z "$BIND_GROUP" ]; then
   BIND_GROUP="named"
 fi
-if [ -z "$BIND_OPTIONS" ]; then
-  BIND_OPTIONS="-u $BIND_USER"
+if [ -z "$NAMED_OPTIONS" ]; then
+  NAMED_OPTIONS="-u $BIND_USER"
 fi
 
 # Sanity check. If /usr/sbin/named is missing then it

since /etc/default/named has :

Code:

# Options to run named with:
NAMED_OPTIONS="-u $BIND_USER"

marav · 09-19-2021, 07:50 AM

Quote:

Originally Posted by Roman Dyaba

tar

which version ?

It seems that we have the latest : 1.34

https://www.gnu.org/software/tar/

Code:

2021-02-13  Sergey Poznyakoff  <gray@gnu.org>

	Version 1.34

marav · 09-19-2021, 01:51 PM

Harfbuzz 3.0.0

https://github.com/harfbuzz/harfbuzz...z-3.0.0.tar.xz

Code:

Unicode 14.0 support (David Corbett).

The hb-subset API and the harfbuzz-subset library's ABI are now declared stable. 
The harfbuzz-subset library would not have been possible without the work of Garret Rieger and Qunxin Liu from Google Fonts, 
and the earlier work of Michiharu Ariza from Adobe.

The hb-style API is now stable and no longer experimental.