sudoers security question
by ToddAndMargo
Hi All,
It seems to me that since /etc/sudoers is visible from a
standard user account, that all a bad guy has to do is
cat the file, find some program that is elevated, then
overwrite that program with his evil deeds, and boom,
you are hacked.
Am I missing something?
-T
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Computers are like air conditioners.
They malfunction when you open windows
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
6 months, 1 week
LUKS - lost token?
by lejeczek
Hi guys.
I know this is most likely not best suited question for this
list, but I'm hoping some experts might be able to help.
I have a LUKS device which had keyslot with pass-phrase
removed and token for TPM keyslot removed too - I think this
is the case, for none of my passphrase works and device is
as below:
I hope there is a way to save & bring it back to live -
device is open right now and I've access to filesystem,
obviously goal would be to avoid re-format/crypt.
Is it possible to restore/recreate that lost token and/or
add new Keyslot somehow? I have no header backup for this
device.
-> $ cryptsetup luksDump /dev/nvme0n1p3
LUKS header information
Version: 2
Epoch: 83
Metadata area: 16384 [bytes]
Keyslots area: 16744448 [bytes]
UUID: 3a879268-84fd-4b48-a5d4-960cccb0caa9
Label: (no label)
Subsystem: (no subsystem)
Flags: (no flags)
Data segments:
0: crypt
offset: 16777216 [bytes]
length: (whole device)
cipher: aes-xts-plain64
sector: 512 [bytes]
Keyslots:
1: luks2
Key: 512 bits
Priority: normal
Cipher: aes-xts-plain64
Cipher key: 512 bits
PBKDF: pbkdf2
Hash: sha512
Iterations: 1000
Salt: a4 5b 6b cc a8 f1 6b e8 b7 3b e2 3d ca 8d
43 fb
10 52 62 b9 99 45 70 16 bd e1 0f 7a 6c 7f
3d 11
AF stripes: 4000
AF hash: sha512
Area offset:290816 [bytes]
Area length:258048 [bytes]
Digest ID: 0
Tokens:
Digests:
0: pbkdf2
Hash: sha256
Iterations: 183317
Salt: ef 56 aa 59 c2 64 66 c7 49 57 31 4b a7 7d
00 3c
fe 00 89 2e b9 e9 da bc 69 1d 19 59 96 a9
27 aa
Digest: 79 aa 0c 8a 29 64 9c 83 bb 5a f8 5c b5 c6
b0 9c
5e 54 80 49 bd 21 f6 b4 5b 49 65 39 bd 6f
5f 20
6 months, 1 week
rsync very slow
by fedora@eyal.emu.id.au
F38
Linux e7.eyal.emu.id.au 6.5.8-200.fc38.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Oct 20 15:53:48 UTC 2023 x86_64 GNU/Linux
I am looking at issues with my system which is ATM degraded (6/7 raid6 devices).
I am waiting for a replacement disk from seagate RMA.
Unrelated, I am trying to copy a directory from an external USB3.0 HDD(ext4 on /sata) to a local RAID fs (ext4 on /data1).
I see rsync in top as:
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
734489 root 20 0 122048 29392 2284 R 98.3 0.1 28:37.88 rsync
So high %CPU. This is pretty much constant.
I am also running iostat of both the source(sdh) and target(md127) devices, and it looks like this:
12:47:06 Device tps kB_read/s kB_wrtn/s kB_dscd/s kB_read kB_wrtn kB_dscd
___
13:12:06 sdh 0.38 1.93 0.00 0.00 116 0 0
13:13:06 sdh 0.30 1.87 0.00 0.00 112 0 0
___
13:12:06 md127 4.12 0.00 16.47 0.00 0 988 0
13:13:06 md127 1.90 0.00 7.60 0.00 0 456 0
Note the very low kB_read/s. hdparm tests the external as 121.29 MB/s and the array as 748.18 MB/sec (tested now, during the rsync).
This also is at this slowness for the last hour, and earlier tests had it running like this for many hours.
Here is an idea of what it is doing:
$ sudo ps ax -o pid,wchan=WIDE-WCHAN-COLUMN -o times -o command | grep rsync
734486 do_sys_poll 0 sudo rsync -aHSK --stats --progress --checksum-choice=none --no-compress -W /sata/backups/tapes /data1/no-backup/old-backups/
734487 do_select 16 rsync -aHSK --stats --progress --checksum-choice=none --no-compress -W /sata/backups/tapes /data1/no-backup/old-backups/
734488 do_select 14 rsync -aHSK --stats --progress --checksum-choice=none --no-compress -W /sata/backups/tapes /data1/no-backup/old-backups/
734489 - 2093 rsync -aHSK --stats --progress --checksum-choice=none --no-compress -W /sata/backups/tapes /data1/no-backup/old-backups/
It is clear that two threads are mostly idle and one is very busy.
Why does rsync use so much CPU? Am I using the wrong options?
TIA
--
Eyal at Home (fedora(a)eyal.emu.id.au)
6 months, 1 week
Re: rsync very slow
by Iosif Fettich
> Next, I will do a plain 'cp -a' between the original source (sdh on /sata) and
> target(md127 on /data1) to see how it goes.
Do the files/directories that you want to copy change frequently...?
Maybe you can isolate your sources into groups that wouldn't change during one
rsync run?
I think to have noticed in the past that rsync doesn't stop on incomplete
files... If the files keep changing, rsync will keep trying to get them over to
the destination, again and again...
Attempts to rsync a log file that is permanently written into will keep rsync
running forever. I'm not really sure about this, but that's what's in my memory.
Good luck with it.
Iosif Fettich
6 months, 1 week
kworker consumes 100% CPU on degraded RAID6
by Eyal Lebedinsky
Fully updated F28.
I had to send one (of 7) member disk for RMA.
I notice that the system is very non responsive. 'top' shows
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
1365697 root 20 0 0 0 0 R 93.8 0.0 384:40.55 kworker/u16:3+flush-9:127
This continues even when there are no user actions (ff, tb closed).
A few days ago it stopped, but today I see that it kept running all night where there were
period of inactivity for a few hours.
As another point: a few days ago I received a disk from RMA and the recovery went as fast as expected.
I then removed another disk to send for RMA.
Is this expected? Is there anything I can do to improve the situation?
TIA
--
Eyal Lebedinsky (fedora(a)eyal.emu.id.au)
6 months, 1 week
Cantarell replacement font when using non-English scripts
by Frederic Muller
Hi!
I am having 'minor' font display issues in F38 with Khmer language which
apparently didn't add the Khmer OS font usually used by default. I
manually added them and it solved most of the problems. Still I am
having issues when the interface text (from Tweaks) is used or other
application also going for Cantarell apparently, which is a Latin font.
Where/how does one tell his system which font to use when Cantarell is
the selected font and the text is non-latin on GNOME desktop?
Thank you.
Fred
6 months, 1 week
Are these dnf errors a problem?
by fedora@eyal.emu.id.au
F38
Yesterday I did a 'dnf update' when the machine had issues (I know, a bad idea).
During the update I noticed these failures (see below). Each time there was some wait before proceeding.
I think that systemd was the cause as other cron jobs encountered this error:
Failed to retrieve unit state: Connection timed out
Do I need to do something now? After a reboot things look fine.
TIA
Running scriptlet: systemd-udev-253.10-1.fc38.x86_64 105/150
Failed to set unit properties on systemd-timesyncd.service: Connection timed out
Failed to set unit properties on systemd-udevd.service: Connection timed out
Running scriptlet: systemd-253.10-1.fc38.x86_64 123/150
Failed to set unit properties on systemd-hostnamed.service: Connection timed out
Failed to set unit properties on systemd-timedated.service: Connection timed out
Failed to set unit properties on systemd-journald.service: Connection timed out
Failed to set unit properties on systemd-localed.service: Connection timed out
Failed to set unit properties on systemd-userdbd.service: Connection timed out
Failed to set unit properties on systemd-oomd.service: Connection timed out
Running scriptlet: systemd-resolved-253.12-1.fc38.x86_64 150/150
Running scriptlet: kernel-modules-core-6.5.8-200.fc38.x86_64 150/150
Running scriptlet: kernel-core-6.5.8-200.fc38.x86_64 150/150
Running scriptlet: selinux-policy-targeted-38.30-1.fc38.noarch 150/150
Running scriptlet: nss-3.94.0-2.fc38.x86_64 150/150
Running scriptlet: kernel-modules-6.5.8-200.fc38.x86_64 150/150
Running scriptlet: libqalculate-4.8.0-1.fc38.x86_64 150/150
Failed to reload daemon: Connection timed out
Failed to list units: Connection timed out
Failed to start jobs: Connection timed out
Failed to list units: Connection timed out
Failed to reload daemon: Connection timed out
--
Eyal at Home (fedora(a)eyal.emu.id.au)
6 months, 1 week
Source code (SRPM?) for COPR package?
by Ian Pilcher
Is the source code for COPR packages available anywhere?
--
========================================================================
If your user interface is intuitive in retrospect ... it isn't intuitive
========================================================================
6 months, 1 week
Did something just change with HDMI support?
by Tom Horsley
I use my samsung TV (QN90B) as a monitor. Until today, when I turned
it on, the picture would come right up and I could use it immediately.
Now, for some reason, a big banner appears at the top of the screen
telling me it is connected to HDMI 4 and saying what resolution it
is displaying (and the time of day). Is some fancy new power management
turning off the HDMI port when it detects the monitor was powered
down, then turning it back on and inducing the TV to report this info?
It is very irritating.
(I'm using the nvidia drivers from rpmfusion.)
6 months, 2 weeks
Pipewire - Sample Format Conversions
by Jorge Fábregas
Hi,
I recently tweaked my pipewire.conf to allow various sample rates for my
AudioEngine D1 DAC:
default.clock.allowed-rates = [ 96000 88200 48000 44100 32000 ]
...and it's working smoothly. Now, I'm curious about bit depth.
My DAC supports S24_3LE and S16_LE formats, but Pipewire seems to
default to S24_3LE even for 16-bit files from CDs. Is there a parameter
akin to the above "allowed rates" but for "sample formats" that I can
use to dynamically adjust bit depth?
Any insights or tips would be much appreciated.
Thanks,
Jorge
P.S.: I'm aware I might not hear a difference; I'm optimizing to avoid
runtime conversions :)
6 months, 2 weeks