Iteration two is now live!
https://fedoraproject.limequery.com/142117?lang=en
Due to the restrictiveness felt when providing answers on the initial AI/ML
survey, we have reworked this survey to be a bit more straightforward and
open to giving input on the subject of AI/ML.
The aim of this survey is to to understand community sentiment on AI/ML and
Fedora in order to help the council create guidelines for the project on
this subject.
We had a bit of a road to get to this point, there was a ticket opened[1],
a (few) fruitless discussions[2], a discussion post on discourse[3] and
then an 'only ok' first survey :) We hope you will give a few minutes of
your day to share your thoughts on AI/ML when it comes to Fedora and we
greatly appreciate your time doing this. The closing date is set for July
31st for this one, and thanks again for your patience and understanding!
Kindest regards
Aoife
[1] https://pagure.io/Fedora-Council/tickets/issue/486
[2]
https://meetbot.fedoraproject.org/meeting-1_matrix_fedoraproject-org/2024-0…
[3]
https://discussion.fedoraproject.org/t/ai-survey-questions-what-should-we-b…
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
Planned Outage - Server updates/reboots - 2024-07-10 21:00 UTC
There will be an outage starting at 2024-07-10 21:00 UTC,
which will last approximately 6 hours.
To convert UTC to your local time, take a look at
http://fedoraproject.org/wiki/Infrastructure/UTCHowto
or run:
date -d '2024-07-10 21:00UTC'
Reason for outage:
We will be applying various updates and rebooting servers. During the outage window various services may be down for short periods of time.
Additionally, we will be upgrading builders to Fedora 40. This will mean that koji buildroot repodata will change to being zstd based (per fedora 40 createrepo_c defaults).
Affected Services:
Many services will see short outages as machines are updated and rebooted.
Ticket Link:
https://pagure.io/fedora-infrastructure/issue/12041
Please join #fedora-admin or #fedora-noc on irc.libera.chat
or #admin:fedoraproject.org / #noc:fedoraproject.org on matrix.
Please add comments to the ticket for this outage above.
Updated status for this outage may be available at
https://www.fedorastatus.org/
Greetings everyone.
Last week we moved fedorapeople (people02.fedoraproject.org) from the
now EOL RHEL7 to RHEL9.
As part of this reinstall/migration, the ssh host key has changed.
Please see https://fedoraproject.org/wiki/Infrastructure/fedorapeople.org
For more information, including information on adding our SSH CA or
using dnssec / sshfp to verify the ssh host key of the new host.
If you notice any problems with the server, please do file an
infrastructure ticket ( https://pagure.io/fedora-infrastructure )
and we will take a look.
Thanks,
kevin
Wiki - https://fedoraproject.org/wiki/Changes/UnprivilegedSystemFlatpakManagement
Discussion thread -
https://discussion.fedoraproject.org/t/f42-change-proposal-unprivileged-man…
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
This proposal adds a new dedicated `flatpak` group, allowing users to
manage system Flatpaks without needing to be in the `wheel` group.
== Owner ==
* Name: [[User:boredsquirrel| Henning]]
* Email: boredsquirrel(a)secure.mailbox.org
== Detailed Description ==
Currently, to install, uninstall and modify apps or repositories,
users need to be in the `wheel` group. Removing a user from the wheel
group would interfere with the currently default (systemwide)
configuration of Flatpaks.
All users can add a `user` repository, and manage their own user
Flatpaks. But a dedicated group to manage system flatpaks, without
relying on `wheel` allows more fine grained privileges.
This enables an "admin" permission that is not tied to full root
access on the host system.
It will be a change of the polkit rule `org.freedesktop.Flatpak.rules`
like following:
polkit.addRule(function(action, subject) {
if ((action.id == "org.freedesktop.Flatpak.app-install" ||
action.id == "org.freedesktop.Flatpak.runtime-install"||
action.id == "org.freedesktop.Flatpak.app-uninstall" ||
action.id == "org.freedesktop.Flatpak.runtime-uninstall" ||
action.id == "org.freedesktop.Flatpak.modify-repo") &&
subject.active == true && subject.local == true && (
subject.isInGroup("wheel") || subject.isInGroup("flatpak"))) {
return polkit.Result.YES;
}
return polkit.Result.NOT_HANDLED;
});
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.Flatpak.override-parental-controls") {
return polkit.Result.AUTH_ADMIN;
}
return polkit.Result.NOT_HANDLED;
});
== Feedback ==
none yet
== Benefit to Fedora ==
This is a step towards the Confined Users goal. It enables a dedicated
action, the management of Flatpaks, without needing all the other
privileges that `wheel` users have.
== Scope ==
* Proposal owners: changing a single rule, testing with nonwheel users
in the `flatpak` group
* Other developers: none
* Release engineering: [https://pagure.io/releng/issues #Releng issue number]
* Policies and guidelines: Documentation needs to get an additional
chapter on Flatpak management with the `flatpak` group.
* Trademark approval: N/A (not needed for this Change)
* Alignment with the Fedora Strategy: Yes
== Upgrade/compatibility impact ==
The polkit rule will be overwritten, there will be no changes in
behavior. It just enables a new feature.
== How To Test ==
On Atomic or traditional Fedora, place the above rule in
`/etc/polkit-1/rules.d/org.freedesktop.Flatpak.rules`.
This will be preferred over the default rule and you can test if it works.
== User Experience ==
By default, Anaconda puts users into the `wheel` group. There will be no change.
But it enables to manage Flatpaks without being in that privileged group.
== Dependencies ==
None
== Contingency Plan ==
* Contingency mechanism: this is a simple fix, not adding it will keep
the previous wheel need
* Contingency deadline: N/A
* Blocks release? N/A
== Documentation ==
Will be added afterwards.
Nonwheel users can be added to the `flatpak` group:
sudo groupadd flatpak
sudo usermod -aG flatpak USERNAME
== Release Notes ==
Permission to manage systemwide flatpaks is now granted to users in
the 'flatpak' group.
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
Wiki - https://fedoraproject.org/wiki/Changes/UnprivilegedDiskManagement
Discussion thread -
https://discussion.fedoraproject.org/t/f42-change-proposal-unprivileged-dis…
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
This proposal adds a new dedicated `diskadmin` group, allowing users
to manage external drives without needing to be in the `wheel` group.
It will also enable wheel users to unlock and mount external drives
without a password prompt.
== Owner ==
* Name: [[User:boredsquirrel| Henning]]
* Email: boredsquirrel(a)secure.mailbox.org
== Detailed Description ==
Currently, to mount or (LUKS) unlock external drives, users need to be
in the `wheel` group. Removing a user from the wheel group would
prevent them from using external drives.
This enables an "admin" permission that is not tied to full root
access on the host system.
It will be a change of the polkit rule `org.freedesktop.udisks2.rules`
like following:
<pre>
polkit.addRule(function(action, subject) {
if ((action.id == "org.freedesktop.udisks2.encrypted-unlock-system" ||
action.id == "org.freedesktop.udisks2.filesystem-mount-system") &&
subject.active == true && subject.local == true && (
subject.isInGroup("diskadmin") || subject.isInGroup("wheel"))) {
return polkit.Result.YES;
}
});
</pre>
== Feedback ==
none yet
== Benefit to Fedora ==
This is a step towards the Confined Users goal. It enables a dedicated
action, the mounting and unlocking of external drives, without needing
all the other privileges that `wheel` users have.
== Scope ==
* Proposal owners: changing a single rule, testing with nonwheel users
in the `diskadmin` group on GNOME and KDE
* Other developers: N/A
* Release engineering: [https://pagure.io/releng/issues #Releng issue number]
* Policies and guidelines: Documentation needs to get an additional
chapter on disk management with the `diskadmin` group.
* Trademark approval: N/A (not needed for this Change)
* Alignment with the Fedora Strategy: Not sure, as it adds a
nonstandard user group.
== Upgrade/compatibility impact ==
The polkit rule will be added, users will not need to enter a password
if they are in these groups. No changes for users outside these
groups.
== How To Test ==
On Atomic or traditional Fedora, place the above rule in
`/etc/polkit-1/rules.d/80-org.freedesktop.udisks2.rules`.
This will be preferred over the default rule and you can test if it works.
== User Experience ==
By default, Anaconda puts users into the `wheel` group. These users
will not need to enter a password when mounting external media or
unlocking them.
It also allows to do these actions without being in the `wheel`
group, by adding a user to the `diskadmin` group.
== Dependencies ==
None
== Contingency Plan ==
* Contingency mechanism: this is a simple fix, not adding it will keep
the previous wheel need
* Contingency deadline: N/A
* Blocks release? N/A
== Documentation ==
Will be added afterwards.
Nonwheel users can be added to the `diskadmin` group:
sudo groupadd diskadmin
sudo usermod -aG diskadmin USERNAME
== Release Notes ==
Users in the 'wheel' or 'diskadmin' group can mount and unlock
external drives without a password.
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
Wiki - https://fedoraproject.org/wiki/Changes/SELinux_dontaudit_unlabeled_t
Discussion thread -
https://discussion.fedoraproject.org/t/f41-change-proposal-reduce-the-amoun…
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
Reduce the amount of rules that prevent reporting of SELinux denials
pertaining to unlabeled_t. This could influence the amount of
SELinux-related logs on some systems, but will not cause any new
permission denials.
== Owner ==
* Name: [[User:vmojzis| Vít Mojžíš]]
* Email: <vmojzis(a)redhat.com>
* Name: [[User:mmalik| Miloš Malík]]
* Email: <mmalik(a)redhat.com>
== Detailed Description ==
The SELinux security policy primarily comprises allow rules, which
permit specific operations on a confined system.
However, there are also SELinux rules featuring the "dontaudit" keyword.
In general, these rules signify that the described operation is not
allowed and will not be logged as a permission denial in audit logs.
The primary purpose of these rules is to hide certain false positives
or code defects, such as leaked descriptors.
The drawback is that, in certain instances, these rules might obscure
hints that could expedite debugging and issue resolution.
It is possible to disable all dontaudit rules using "semodule -DB",
but this usually leads to large amounts of benign denials being logged
and hence is not practical for long term use.
The goal of this change is to significantly reduce the amount of
dontaudit rules suppressing "unlabeled_t" denials,
which are often caused by miss-labeled filesystems and can usually be
easily fixed when noticed by the system administrator.
The rules will not be completely removed from the policy, only
disabled by default, so that the change can be reverted by the admin
if needed (<code># setsebool -P dontaudit_unlabeled_files 1</code>).
The change could influence the amount of SELinux-related logs on some
systems, but will not cause any new permission denials.
== Feedback ==
== Benefit to Fedora ==
Access denials caused by labeling issues will more likely be reported
by SELinux.
== Scope ==
* Proposal owners: Determine which dontaudit rules are safe to disable
by default and wrap them in conditional statements in the policy
sources -- changes will be limited to SElinux policy (and possibly
setroubleshoot) packages
* Other developers: Report any unlabeled_t AVCs triggered by their software
* Release engineering: N/A (not needed for this Change)
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with the Fedora Strategy: The change aligns with the
"accessibility" goal as it simplifies debugging of some labeling
issues
== Upgrade/compatibility impact ==
No functionality impact, no configuration or data migration.
The change could influence the amount of SELinux-related logs on some systems.
== Early Testing (Optional) ==
Do you require 'QA Blueprint' support? - No
== How To Test ==
Run your testsuite with SELinux enabled (Enforcing or Permissive mode)
and record any AVCs containing unlabeld_t keyword.
<code># ausearch -m AVC,USER_AVC | grep unlabeled_t</code>
== User Experience ==
The change could increase the amount of SELinux-related logs on some systems.
== Dependencies ==
Changes will be limited to SElinux policy (and possibly
setroubleshoot) packages.
== Contingency Plan ==
* Contingency mechanism: Do not ship the updated SELinux-policy package
* Contingency deadline: N/A (not a System Wide Change)
* Blocks release? No
== Documentation ==
<!-- Is there upstream documentation on this change, or notes you have
written yourself? Link to that material here so other interested
developers can get involved. -->
Dontaudit rules can be added selectively using audit2allow:
<code># ausearch -m AVC | grep unlabeled_t | audit2allow -D -M
dontaudit_unlabeled </code>
<code># semodule -i dontaudit_unlabeled.pp </code>
All the disabled rules can be re-enabled by switching the
"dontaudit_unlabeled_files" boolean (will be added as part of the
change).
<code># setsebool -P dontaudit_unlabeled_files 1</code>
== Release Notes ==
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney