google-chrome + selinux + ecryptfs
by Pal, Laszlo
Hi,
It seems running google-chrome on Fedora with selinux enforcing is not
an easy job :) Most of the things are working, however certain plugins
/ apps like flash and offline gmail crashes... I can see some strange
log entries in my audit log like this
node= type=SYSCALL msg=audit(1402610675.802:3612): arch=c000003e
syscall=47 success=yes exit=1 a0=12 a1=7f4cb29bb490 a2=40 a3=2 items=0
ppid=8 pid=13635 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000
fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=2
comm="Chrome_ChildIOT" exe="/opt/google/chrome/chrome"
subj=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023
key=(null)
node=tohuvabohu.balabit type=AVC msg=audit(1402610675.802:3613): avc:
denied { write } for pid=13634 comm="chrome"
path="/home/.ecryptfs/vlad/.Private/ECRYPTFS_FNEK_ENCRYPTED.FWbWvaw.Yvr95kQA2hcGEJHBUib4Wf3DUd7gSom1uZp3eGnWRADC8b67AE--/ECRYPTFS_FNEK_ENCRYPTED.FXbWvaw.Yvr95kQA2hcGEJHBUib4Wf3DUd7gTtA3nsOQygKTjpvYs63foAeJEpmcXUfgP6gU.7wmAuY-/ECRYPTFS_FNEK_ENCRYPTED.FWbWvaw.Yvr95kQA2hcGEJHBUib4Wf3DUd7g5coEDCbOTnV-amR0ZN6y1---/ECRYPTFS_FNEK_ENCRYPTED.FWbWvaw.Yvr95kQA2hcGEJHBUib4Wf3DUd7gT3djTOmDHoPUHtuBzF97EU--/ECRYPTFS_FNEK_ENCRYPTED.FWbWvaw.Yvr95kQA2hcGEJHBUib4Wf3DUd7geU1qaFnPHLsuy1RmqbGnBE--/ECRYPTFS_FNEK_ENCRYPTED.FWbWvaw.Yvr95kQA2hcGEJHBUib4Wf3DUd7glEd5RSiZ49p5vw44TzFM3E--/ECRYPTFS_FNEK_ENCRYPTED.FWbWvaw.Yvr95kQA2hcGEJHBUib4Wf3DUd7gKBDK1Q1GxCxyo3TiIlYCnE--/ECRYPTFS_FNEK_ENCRYPTED.FWbWvaw.Yvr95kQA2hcGEJHBUib4Wf3DUd7gmuai.t4ZEmP-LatO12SQ.E--/ECRYPTFS_FNEK_ENCRYPTED.FWbWvaw.Yvr95kQA2hcGEJHBUib4Wf3DUd7gIB221z5L1BsC-c-sHPGaQ---/ECRYPTFS_FNEK_ENCRYPTED.FWbWvaw.Yvr95kQA2hcGEJHBUib4Wf3DUd7gqsU3WtY8FrzmtcENIeC0CE--/ECRYPTFS_FNEK_ENCRYPTED.FWbWvaw.Yvr95kQA2hcGEJHBUib4Wf3DUd7gt-ZfSVe491Z7eplRchJ3qE--/ECRYPTFS_FNEK_ENCRYPTED.FWbWvaw.Yvr95kQA2hcGEJHBUib4Wf3DUd7gSHKUZ6b8Mf6vlIo3pRzAj---/ECRYPTFS_FNEK_ENCRYPTED.FWbWvaw.Yvr95kQA2hcGEJHBUib4Wf3DUd7gC2jhQP5bAQcJMOMBLlUW1U--"
dev="dm-2" ino=16123428
scontext=unconfined_u:unconfined_r:chrome_sandbox_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:ecryptfs_t:s0 tclass=file
Is there any pre-cooked solution to run chrome in this environment and
keep selinux enforcing?
Thanks
L:
9 years, 10 months
Kernel 3.14.5-200.fc20.x86_64 won't boot: module problem
by Patrick O'Callaghan
On trying to boot the above kernel, I get a "Failed to start Load Kernel
Modules" error. This appears to be caused by missing vboxdrv modules
(from VirtualBox). Booting an earlier kernel works fine.
Two comments:
1) I thought DKMS was supposed to rebuild the VBox modules for each new
kernel automatically. This has happened in the past but seems to have
failed now. Why would this be and how can I fix it?
2) The error message was unhelpful as it didn't identify which modules
failed. It took some searching to find what the problem was. Surely this
could be done better. (In fact I'd argue that failing to load these
modules shouldn't result in a failed boot, but I realize that's maybe
harder to deal with).
poc
9 years, 10 months
SSH question
by Fred Smith
Hi all!
I feel dumb having to ask this, I feel I should know the answer, but
can't dredge it up.
I've recently installed F20 on my old eeepc, where it seems to run fine,
btw, but I can't for the life of me figure out how to connect to it from
another system with ssh.
I've made sure that sshd is installed, and "systemctl list-unit-files"
shows it as enabled. As far as I can figure out how to use the relatively
new firewall app (and I have to admit some hesitance there since I'm
not sure I really DO understand it...) the necessary ports are open.
however when I attempt to connect to it with ssh from another box I get
I get an instantaneous "ssh: connect to host 192.168.2.117 port 22:
connection refused". And when I attempt to connect back to itself:
"ssh -X fredex@localhost" I get the same thing.
If someone can give me a whack on the head (designed to joggle my brains
a bitg--in a good way) I'd appreciate the guidance.
thanks!
--
-------------------------------------------------------------------------------
.---- Fred Smith /
( /__ ,__. __ __ / __ : /
/ / / /__) / / /__) .+' Home: fredex(a)fcshome.stoneham.ma.us
/ / (__ (___ (__(_ (___ / :__ 781-438-5471
-------------------------------- Jude 1:24,25 ---------------------------------
9 years, 10 months
bash/shell script question??
by bruce
Hi.
Trying to run multiple copies of a test as a background process.
I can easily cut/copy/paste the test cmd in the shell, and a check of
the procTBL shows the instances are all running.
However, if I do the same thing, and put it in a test shell script,
when I run it, I don't get any of the instances running...
I'm flumoxed!
any thoughts on what I've screwed up/forgotten.
are there system err logs I might check to see what the issue might be??
thanks
!#/bin/sh
##
#
#start the new instance of the app
sleep 5
/ycrawl/dcrawl/run/yolo-master/YoloMasterGearmanQueueProcessAppDir/rateStateCollegeProcessy2.php
< /dev/null &
#sleep 1
/ycrawl/dcrawl/run/yolo-master/YoloMasterGearmanQueueProcessAppDir/rateStateCollegeProcessy2.php
< /dev/null &
#sleep 2
/ycrawl/dcrawl/run/yolo-master/YoloMasterGearmanQueueProcessAppDir/rateStateCollegeProcessy2.php
< /dev/null &
#sleep 2
/ycrawl/dcrawl/run/yolo-master/YoloMasterGearmanQueueProcessAppDir/rateStateCollegeProcessy2.php
< /dev/null &
#sleep 2
/ycrawl/dcrawl/run/yolo-master/YoloMasterGearmanQueueProcessAppDir/rateStateCollegeProcessy2.php
< /dev/null &
#sleep 2
/ycrawl/dcrawl/run/yolo-master/YoloMasterGearmanQueueProcessAppDir/rateStateCollegeProcessy2.php
< /dev/null &
#sleep 2
/ycrawl/dcrawl/run/yolo-master/YoloMasterGearmanQueueProcessAppDir/rateStateCollegeProcessy2.php
< /dev/null &
#sleep 2
/ycrawl/dcrawl/run/yolo-master/YoloMasterGearmanQueueProcessAppDir/rateStateCollegeProcessy2.php
< /dev/null &
exit
9 years, 10 months
Plymouth Uses Wrong Boot-up Theme
by Stephen Morris
Hi,
I have just configured Plymouth is install a graphical theme into
the initrd. I specified that I wanted the 'Solar Flares' theme to be
used, which correctly gets used at shutdown, but at start up the 'Solar
Flares' theme is not used, instead the 'Hotdog' theme is used. Is this a
bug in Plymouth or is this normal functionality?
regards,
Steve
9 years, 10 months
5tFTw: Board Meeting, Rawhide Rebuilt, Firewall Debate, ARM 64, and DNF as Yum Replacement, plus RHEL7 Bonus Item (2014-06-10)
by Matthew Miller
Reposted from <http://fedoramagazine.org/5tftw-2014-06-10/>.
Fedora is a big project, and it’s hard to follow it all. This series
highlights interesting happenings in five different areas every week.
It isn’t comprehensive news coverage — just quick summaries with links
to each. Here are the five things for June 10th, 2014 (and sorry for
the posting delay):
New FPL Board Meeting
---------------------
We held the first public Fedora Project Board meeting of my new tenure
as Fedora Project Leader yesterday, as an informal town-hall
discussion. You can read the summary or full log. We’ll be holding
these every two weeks. Usually, we’ll have an agenda based on decisions
to be made or (as suggested in this discussion, actually) with
representatives from different parts of the project talking about their
area of Fedora. But when we don’t have a pre-planned schedule, we’ll do
open floor like this for whatever people want to talk about. (In this
week’s case, it’s largely this: Fedora QA could use your help!)
* http://meetbot.fedoraproject.org/fedora-meeting/2014-06-09/board.2014-06-...
* http://meetbot.fedoraproject.org/fedora-meeting/2014-06-09/board.2014-06-...
* https://fedoraproject.org/wiki/QA/Join
Rawhide Mass Rebuild
--------------------
Periodically, we do a “mass rebuild” of all of the packages in Rawhide,
our development branch. This makes sure that all of the software uses
the latest compilers and build macros. This is mostly an automated
process, but sometimes some software does not rebuild successfully. If
that software doesn’t get updated by its maintainers, and no one picks
it up, it will eventually be dropped from the distribution. Fedora
Release Engineer Dennis Gilmore posted a Fedora 21 Mass rebuild update,
including a link to the packages which need work. If any of these are
yours, please fix. Or if there’s something that you’re interested in
that isn’t rebuilding, considerer helping by becoming a co-maintainer.
(If you’re curious, the standard operating procedure followed for these
rebuilds is available on the Fedora wiki at Mass Rebuild SOP.)
* https://lists.fedoraproject.org/pipermail/devel/2014-June/199629.html
* http://ausil.fedorapeople.org/f21-failures.html
* http://fedoraproject.org/wiki/Mass_Rebuild_SOP
Fedora Workstation and Firewalld
--------------------------------
In April, there was a large discussion over a proposal to drop the
firewall by default from Fedora Workstaion. The basic argument was
that the the current state of application integration with the firewall
service FirewallD isn’t adequate to provide a good user experience,
and that the security benefits aren’t really meaningful in actual
practice. Others disagreed, and ultimately, Workstation designers and
FirewallD developers met to figure out a solution. Developer Bastien
Nocera summarizes the resulting plan, which includes additional
automated testing, a new firewall zone, and adding network awareness to
GNOME’s “sharing” controls.
* https://lists.fedoraproject.org/pipermail/devel/2014-April/198041.html
* http://fedoraproject.org/wiki/Workstation
* https://fedoraproject.org/wiki/FirewallD
* https://lists.fedoraproject.org/pipermail/desktop/2014-June/009862.html
Update on 64-bit ARM and Fedora 21
----------------------------------
Fedora contributor and ARM hacker Peter Robinson provides an aarch64
(arm64) on Fedora 21 update. Current ARM support in Fedora is 32-bit,
and focused mostly on low-cost consumer devices. The new 64-bit
“aarch64″ architecture promises an exciting future of low-cost,
energy-efficient, high-density servers — the “hyperscale” datacenter.
Peter says that progress is going nicely, with some porting work
remaining particularly around support of newer langages like Go and
server-side Javascript, but an overall status of “looking awesome”.
* http://nullr0ute.com/2014/06/aarch64-arm64-on-fedora-21-update/
* http://golang.org/
* https://code.google.com/p/v8/
DNF Proposed for Fedora 22 (and user survey)
--------------------------------------------
DNF is an experimental package manager, similar to the current
Yum. It’s *largely* a drop-in replacement, promising faster
dependency-solving and (more critically) a new explicitly-defined API
designed to make it easier to develop higher-level software like GUI
tools an plugins. There was a great article in January on Linux Weekly
News about a *previous* long discussion on DNF, and that’s
recommended reading if you missed it before. But also, the DNF
developers are asking for user feedback on Yum features missing in
DNF, so please do register your feedback about what is important to
you. And there is a feature proposal, not for the upcoming Fedora 21,
but for next year’s Fedora 22, to replace the current Yum with DNF
(possibly as “yum 4″).
* http://dnf.baseurl.org/
* http://yum.baseurl.org/
* https://lwn.net/Articles/580223/
* http://dnf.baseurl.org/2014/06/06/vote-for-yum-features-that-you-miss-in-...
* https://fedoraproject.org/wiki/Changes/ReplaceYumWithDNF
Bonus Item! RHEL 7 and Fedora
-----------------------------
You may have noticed that a new version of Red Hat Enterprise Linux was
released — RHEL 7. Former Fedora Project Leader Robyn Bergeron has a
great blog post about the process by which Fedora serves as the upstream
for RHEL, and the history of some features of RHEL 7 in particular:
Fedora, Red Hat, RHEL 7, & Open Source. (Or: How RHEL 7 is literally
“Beefy.”)
* http://www.redhat.com/about/news/press-archive/2014/6/red-hat-unveils-rhel-7
* http://robyn.io/2014/06/10/rhel-is-beefy/
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader
9 years, 10 months
Adding drivers to initrd using kickstart & dracut
by Richard W.M. Jones
I have a working kickstart for building a Fedora 20 guest. But I want
to add Xen drivers to the guest's initrd.
So far I'm doing:
%post
pushd /etc/dracut.conf.d
echo 'add_drivers+="xen-blkfront xen-netfront"' > xen-drivers.conf
popd
dracut
%end
However although this creates the /etc/dracut.conf.d/xen-drivers.conf
file in the guest, it doesn't add the Xen drivers to the initramfs.
(I also tried running dracut --add-drivers ... but that does nothing).
Any ideas what I'm doing wrong?
Rich.
--
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-builder quickly builds VMs from scratch
http://libguestfs.org/virt-builder.1.html
9 years, 10 months
Desktop Sharing from Windows 8.1
by Temlakos
I have a small home network, with two machines on it. One runs Windows
8.1. The other runs Fedora 20.
I recently figured out how to open a Samba share on the F20 machine, and
set up a trusted firewall zone.
Now I keep getting notices like this:
"Desktop Sharing: refused uninvited connection attempt from..." followed
by an IP address and port number. The IP address is that of the Windows
8.1 machine, which seems to be trying a different port each time.
I've looked at every administrative tool on both machines, and I can't
figure out what that "desktop sharing" is all about, whether it would
benefit me to have those two machines connect in this way, or how to
make it happen if I wanted to.
I need the help of someone more familiar with Windows 8.1 than
myself--for I suspect this is some new Windows feature that the Samba
server and client software is not designed to recognize, much less emulate.
This is the only anomaly. The two machines are perfectly capable of
sharing files with one another, at least when I connect as one user with
the comparable user account on the other machine. Which is all I was
really after.
I'm going through all this because I want to replicate my F20 setup on
another, more powerful machine. And I'm going to do it with a "clean
install."
Temlakos
9 years, 10 months
Yum Update Cache out of Space Error
by Stephen Morris
Hi,
Can anyone tell me what the following errors are and why they are
being shown when /var is in my root partition which has 695GB free space?
There is insufficient space on the device.
Free some space on the system disk to perform this operation.
Disk error: [Errno 2] No such file or directory:
'/var/cache/yum/x86_64/20/updates/c82039c0491e88e0504754ac963910eae06d6f6e1cb47250f897e174a272e32b-updateinfo.xml.gz'
regards,
Steve
9 years, 10 months
Re: Wifi connection issues with Intel?
by poma
On 11.06.2014 19:13, Josh Boyer wrote:
> On Wed, Jun 11, 2014 at 1:06 PM, poma <pomidorabelisima(a)gmail.com> wrote:
>> On 11.06.2014 13:33, Josh Boyer wrote:
>>>
>>> On Wed, Jun 11, 2014 at 12:35:36PM +0200, poma wrote:
>>>>
>>>> On 11.06.2014 10:18, poma wrote:
>>>>>
>>>>> On 11.06.2014 04:34, Richard Shaw wrote:
>>>>>>
>>>>>> On Tue, Jun 10, 2014 at 6:09 PM, poma <pomidorabelisima(a)gmail.com>
>>>>>> wrote:
>>>>>>
>>>>>>> Firmware, kernel module or userspace? :)
>>>>>>>
>>>>>>
>>>>>> # uname -r
>>>>>> 3.14.5-200.fc20.x86_64
>>>>>>
>>>>>> No clue on firmware, I'm not exactly sure how to check which is being
>>>>>> loaded...
>>>>>>
>>>>>>
>>>>>> Did you mention an exact hardware in question?
>>>>>>>
>>>>>>>
>>>>>>
>>>>>> 02:00.0 Network controller: Intel Corporation Centrino Advanced-N 6235
>>>>>> (rev
>>>>>> 24)
>>>>>> Subsystem: Intel Corporation Centrino Advanced-N 6235 AGN
>>>>>> Flags: bus master, fast devsel, latency 0, IRQ 48
>>>>>> Memory at f0200000 (64-bit, non-prefetchable) [size=8K]
>>>>>> Capabilities: [c8] Power Management version 3
>>>>>> Capabilities: [d0] MSI: Enable+ Count=1/1 Maskable- 64bit+
>>>>>> Capabilities: [e0] Express Endpoint, MSI 00
>>>>>> Capabilities: [100] Advanced Error Reporting
>>>>>> Capabilities: [140] Device Serial Number c8-f7-33-ff-ff-f4-2d-ba
>>>>>> Kernel driver in use: iwlwifi
>>>>>> Kernel modules: iwlwifi
>>>>>>
>>>>>>
>>>>>> BTW how are you sure RF environment ain't changed?
>>>>>>>
>>>>>>>
>>>>>>
>>>>>> Nothing new has come in or left the house since the problem...
>>>>>>
>>>>>> Thanks,
>>>>>> Richard
>>>>>
>>>>>
>>>>>
>>>>> - KERNEL:
>>>>> $ curl -s https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.6
>>>>> | grep iwlwifi
>>>>>
>>>>> So pick up kernel-3.14.6-200.fc20.x86_64.rpm
>>>>> http://koji.fedoraproject.org/koji/buildinfo?buildID=531773
>>>>>
>>>>> You can also try with kernel-core-3.15.0-1.fc21.x86_64.rpm
>>>>> http://alt.fedoraproject.org/pub/alt/rawhide-kernel-nodebug/x86_64/
>>>>>
>>>>>
>>>>> - FIRMWARE:
>>>>> $ modinfo -F firmware iwlwifi
>>>>>
>>>>> # yum --enablerepo updates-testing install iwl6000g2b-firmware
>>>>>
>>>>> $ rpm -qf /usr/lib/firmware/iwlwifi-6000g2b-6.ucode
>>>>> iwl6000g2b-firmware-17.168.5.2-38.fc20.noarch
>>>>>
>>>>> According to
>>>>> http://wireless.kernel.org/en/users/Drivers/iwlwifi#Firmware
>>>>> Intel® Centrino® Advanced-N 6235 goes with
>>>>> iwlwifi-6000g2b-ucode-18.168.6.1.tgz
>>>>> i.e. iwlwifi-6000g2b-6.ucode
>>>>> also stated within firmware itself:
>>>>>
>>>>> https://git.kernel.org/cgit/linux/kernel/git/firmware/linux-firmware.git/...
>>>>> "IWL.6000g2b.fw.v18.168.6.1.build.0"
>>>>>
>>>>> However in Fedora it is packaged as "17" i.e.
>>>>> iwl6000g2b-firmware-17.168.5.2-38.fc20.noarch
>>>
>>>
>>> Probably because I forgot to increment the version number.
>>>
>>>>> Josh, do these two firmwares should be in their own packages as "18"?
>>>
>>>
>>> No.
>>>
>>>>>
>>>>> Intel® Centrino® Advanced-N 6235 - iwlwifi-6000g2b-ucode-18.168.6.1
>>>>> i.e. iwlwifi-6000g2b-6.ucode - "IWL.6000g2b fw v18.168.6.1 build 0"
>>>>> in iwl6000g2b-firmware-18.168.6.1-1.f$releasever.noarch.rpm
>>>>>
>>>>> and
>>>>>
>>>>> Intel® Centrino® Advanced-N 6205 - iwlwifi-6000g2a-ucode-18.168.6.1
>>>>> i.e. iwlwifi-6000g2a-6.ucode - "IWL.6000g2a fw v18.168.6.1 build 0"
>>>>> in iwl6000g2a-firmware-18.168.6.1-1.f$releasever.noarch.rpm
>>>>
>>>>
>>>> e.g.
>>>>
>>>> - Intel® Centrino® Advanced-N 6235
>>>>
>>>> 1. Rename
>>>> iwl6000g2b-firmware-17.168.5.2-38.fc20.noarch
>>>> to
>>>> iwl6000g2b5-firmware-17.168.5.2-38.fc20.noarch
>>>> /usr/lib/firmware/iwlwifi-6000g2b-5.ucode
>>>>
>>>> 2. Create
>>>> iwl6000g2b6-firmware-18.168.6.1-1.f20.noarch.rpm
>>>> /usr/lib/firmware/iwlwifi-6000g2b-6.ucode
>>>>
>>>>
>>>> - Intel® Centrino® Advanced-N 6205
>>>>
>>>> 3. Rename
>>>> iwl6000g2a-firmware-17.168.5.3-38.fc20.noarch
>>>> to
>>>> iwl6000g2a5-firmware-17.168.5.3-38.fc20.noarch
>>>> /usr/lib/firmware/iwlwifi-6000g2a-5.ucode
>>>>
>>>> 4. Create
>>>> iwl6000g2a6-firmware-18.168.6.1-1.f20.noarch.rpm
>>>> /usr/lib/firmware/iwlwifi-6000g2a-6.ucode
>>>
>>>
>>> No. That's really pointless work and makes the linux-firmware package
>>> even more complicated that it already is.
>>>
>>> The firmware is getting installed and it's correct. Most times people
>>> don't need to worry about which firmware they have, and if they do they
>>> can consult the WHENCE file installed in /usr/share/doc/linux-firmware/.
>>>
>>> josh
>>>
>>
>> IF I correctly understood
>> http://wireless.kernel.org/en/users/Drivers/iwlwifi#Firmware
>> Fedora is shipping at least one unnecessary firmware version compared to the
>> kernels used,
>> e.g. for
>> Intel® Centrino® Advanced-N 6205
>> IS required only iwlwifi-6000g2a-6.ucode - kernel 3.2+
>> and NOT iwlwifi-6000g2a-5.ucode - kernel 2.6.35+
>
> Fedora ships whatever is in the upstream linux-firmware git repo in
> the linux-firmware package. It's stand-alone. We don't tie it to the
> kernel versions in Fedora. People do strange things like running
> their own kernels on top of a Fedora OS install all the time.
>
> josh
>
Someone's always talking about how to reduce the burden on the packages, but it seems that this is not the case.
These people should be able to download a firmware tarball for themselves when they are already using ancient kernels. :)
Sugway!
poma
9 years, 10 months