**** BEGIN LOGGING AT Sun Jan 17 02:59:57 2021 Jan 17 05:53:11 philipp64: oh surely I'm just watching Jan 17 11:35:19 i could use some help with this: https://github.com/openwrt/packages/blob/master/net/privoxy/Makefile#L59 Jan 17 11:35:35 (also an aside that package is 3 stable version behind) Jan 17 11:36:25 i asked dango about what happens when packages add userid/groupid etc Jan 17 11:36:39 and he pointed me to 3 functions for three scenarios Jan 17 11:36:50 i tried to interpret these functions Jan 17 11:37:45 take this scenario: Jan 17 11:37:46 Or, if the package is installed by the user at run-time: Jan 17 11:37:47 https://git.openwrt.org/?p=openwrt/openwrt.git;a=blob;f=package/base-files/files/lib/functions.sh#l247 Jan 17 11:39:09 i guess the add_group_and_user() does the editing of /etc/{group,passwd,shadow} Jan 17 11:39:39 but in that function i don't see where it uses sed to do this Jan 17 11:40:04 i know sed replaces /etc/group Jan 17 11:40:12 but i dont know where in the code Jan 17 11:40:50 the challenge is this: Jan 17 11:40:54 [ 256.182929] audit: type=1400 audit(1610882949.577:5): avc: granted { create } for pid=3347 comm="sed" name="groupIgpbMl" scontext=u:r:sys.subj tcontext=u:r:file.conffile tclass=file Jan 17 11:41:30 sed creates the new /etc/group with a random suffix and then the file gets renamed Jan 17 11:41:53 i know that sed allows you to specify a suffix Jan 17 11:42:39 so i would like to see where in the code i would need to change this so that sed creates these new /etc/group,passwd,shadow files with a predictable suffix Jan 17 11:47:17 speaking of privoxy, it's probably better swapped out for tinyproxy with a luci UI. Jan 17 11:48:21 privoxy is bloatware that's mostly ineffective these days, given it doesn't process https. Jan 17 11:48:43 grift: that package badly needs modernization. i don't care for it. Jan 17 11:49:01 mangix: tinyproxy! Jan 17 11:49:35 eminently suited to openwrt. Jan 17 11:52:29 ok i will look into tinyproxy but i would still like to figure out where those sed calls are to re-create updates /etc/group Jan 17 11:54:05 every time i install a package that requires a new groupid/userid that function messes up the label of /etc/group/passwd and then stuff can not read those files Jan 17 12:17:34 dorf any reason for taking tinyproxy over polipo you know of? Jan 17 12:18:00 grift: yeah, polipo is unmaintained Jan 17 12:18:30 tinyproxy also does more. Jan 17 12:21:06 hmm i think i found it: https://git.openwrt.org/?p=openwrt/openwrt.git;a=blob;f=package/base-files/files/lib/functions.sh#l353 Jan 17 12:25:37 polipo was more or less abandoned around the same time Tor transitioned to the TorBrowser, fwiw. Jan 17 12:30:15 thanks Jan 17 12:30:22 so the issue here is that: Jan 17 12:30:27 sed -i "s/$grp/$grp$delim$2/g" ${IPKG_INSTROOT}/etc/group Jan 17 12:30:49 creates a new /etc/groupYRTYREYTR and then renames it to /etc/group Jan 17 12:31:07 if i understand correctly this should address my issue: Jan 17 12:31:18 sed -i'' "s/$grp/$grp$delim$2/g" ${IPKG_INSTROOT}/etc/group Jan 17 13:05:59 this looks weird though: https://github.com/openwrt/packages/blob/master/net/tinyproxy/files/tinyproxy.init#L52 Jan 17 13:06:19 so it creates /var/log/tinyproxy.log with mode 666? Jan 17 13:32:36 let's have a look at that, grift. Jan 17 13:33:33 it's probably in case the user's not running as root, no? Jan 17 13:34:11 or maybe it's just lax for another reason. Jan 17 13:35:24 in any event, tinyproxy is screaming out for a luci-app :) Jan 17 13:36:01 also, nevermind re 666. I just realized I'm looking at openwrt's repo. no idea why it's 666. Jan 17 13:36:02 well yes i think its running as user nobody? so that looks like corner cutting to allow nobody to write to /var/log/tinyproxy.log Jan 17 13:36:15 but collatoral damage is that others can write as well i guess Jan 17 13:36:24 anyway i am also looking into it further Jan 17 13:36:28 sure, user nobody privs, that's it. Jan 17 13:37:02 instead probably better to chown Jan 17 13:37:11 sure Jan 17 13:37:32 root.nobody 0760 or something Jan 17 13:38:28 or nogroup whatever Jan 17 13:38:47 using nobody.nogroup might not be optimal either though Jan 17 13:38:56 too generic Jan 17 13:39:17 it's a log, why not just chown it to root? Jan 17 13:39:18 but i am wrapping this up with selinux confinement Jan 17 13:39:42 well then if tinyproxy runs as nobody it cant write it? Jan 17 13:39:50 except for the fact nobody couldn't write to it, yeah. Jan 17 13:39:53 or "append" technically Jan 17 13:40:20 question is why not use syslog? Jan 17 13:40:36 as a logfile might fill up the tmpfs Jan 17 13:40:43 pretty much everything else runs as root, though. not sure if tinyproxy merits the nobody treatment. it might, but then so does a bunch of other stuff. Jan 17 13:41:05 those days are gone Jan 17 13:41:26 many services run with unpriv identities these day's Jan 17 13:41:30 if you're going to use syslog, make sure you run the logs at warn or error level, perhaps. otherwise it gets noisy in there. Jan 17 13:42:22 i dont mind a bit of noise besides you can just run logread with -Z 9 Jan 17 13:42:50 at around 4 or 5 lines per connection, you'll soon mind :) Jan 17 13:42:59 the wireguard cronjob also floods the logs Jan 17 13:45:37 the issue with the nobody.nogroup idea is that its insecure if more than one service uses it Jan 17 13:46:01 so ideally we'd have a tinyproxy uid Jan 17 13:46:14 and then chown the log root.tinyproxy 0760 Jan 17 13:46:23 uig/gid Jan 17 13:48:12 yeah, that makes more sense. upstream tinyproxy does that. Jan 17 14:25:23 lynxis: ping Jan 17 14:25:35 f00b4r0: pong Jan 17 14:26:03 lynxis: why did you pull #2417? It's not functional and uses the awful u-boot based intermediary loader? Jan 17 14:26:24 f00b4r0: the awful bootloader is gone. Jan 17 14:26:36 in the PR it isn't. Jan 17 14:31:10 f00b4r0: take a look into https://git.openwrt.org/?p=openwrt/staging/lynxis.git;a=shortlog;h=refs/heads/80211ad Jan 17 14:31:32 lynxis: I see in your tree you've expunged. The problem is that the code you pulled doesn't use the recent bells and whistles for mikrotik, namely the platform driver Jan 17 14:31:43 the partition scheme is wrong btw Jan 17 14:31:54 partition0@0 starts at reg 0x80000 Jan 17 14:32:05 that PR wasn't ready for merge IMHO Jan 17 14:32:18 I'm pretty sure robimarko wanted to revisit it. Jan 17 14:33:49 led naming is also not matching the current style Jan 17 14:34:39 and the commit message still lmentions the extra loader. Honestly I'd suggest you throw that back and maybe give robi a chance to polish it? Jan 17 14:39:23 f00b4r0: I wasn't sure why robertmarko closed the PR. but some people of the openwrt community are using a couple of those devices. I would like to push the 60ghz stuff. I also have 5 of the 60ghz devices around. Jan 17 14:39:24 https://git.openwrt.org/?p=openwrt/staging/lynxis.git;a=commitdiff;h=0cf4ce8cc4b31e4d6bce40d357c2d70c8a673f1c#patch3 this is also wrong Jan 17 14:39:51 f00b4r0: sure there are still things to be moved and fixed up there. Jan 17 14:40:08 lynxis: my understanding is he closed it to focus on hap-ac2, and planned to revisit once that was merged. Likewise for the sxtac Jan 17 14:40:08 f00b4r0: do you know why there is mtd erase at all? Jan 17 14:40:16 yes I do Jan 17 14:40:18 :) Jan 17 14:40:49 the mtd erase is called during sysupgrade when the device is booted from initramfs to clear the flash from extraneous kernel signatures Jan 17 14:41:07 otherwise the bootloader might pick up a spurious signature from RouterOS and that will result in a brick. Jan 17 14:41:28 the bootloader is scanning the whole partition for signatures? Jan 17 14:41:32 please revert this from your tree, it's a collection of "don't do" for this target Jan 17 14:41:36 yes Jan 17 14:41:56 apparently uses "last match" Jan 17 14:43:17 i really wouldn't want to 1) have to submit patches to fix afterwards and 2) have people copy-pasting this to submit other devices. The canonical working example is the hap-ac2 and we tried to ask other submitters to follow it (rogerpueo did for the sxtac) Jan 17 14:46:39 even the device name in DTS and makefile doesn't follow the semi-official pattern ;P Jan 17 14:51:32 f00b4r0: let's get the hap to upstream first. Jan 17 14:53:30 lynxis: sure. Please just don't push the current lhg60 to master as it is. Jan 17 15:52:59 dorf_ : https://github.com/openwrt/packages/issues/14491 Jan 17 15:54:08 targeted tinyproxy in selinux-policy though: https://github.com/openwrt/packages/issues/14491 Jan 17 15:54:21 it can't even write the log file itself (only append) Jan 17 15:54:33 err Jan 17 15:54:54 https://git.defensec.nl/?p=selinux-policy.git;a=blob_plain;f=src/agent/tinyproxy.cil;hb=HEAD Jan 17 18:56:42 grift: do we not count on groupmod and usermod being present for packaging? Jan 17 18:57:55 no Jan 17 18:58:01 hmm... seems busybox doesn't even include usermod/groupmod... Jan 17 19:02:18 grift: shunting everything over to the syslog might not be such a bad idea. Jan 17 19:03:13 dorf_ thats what i just did on my router Jan 17 19:03:43 log level Connect looks like a sane default. Jan 17 19:03:51 yes changed it to that Jan 17 19:04:06 I'll get my coat :) Jan 17 19:05:22 you can style the status page btw, but you need to apply styles within the tags.. inline css doesn't work. Jan 17 19:07:20 grift: feel free to modify https://pastebin.ubuntu.com/p/rJmW5xbmDj/ to suit your needs. Jan 17 19:08:01 thanks Jan 17 19:08:52 fairly minimal.. something like that could be piped into a luci front end I guess. Jan 17 19:09:27 i dont like how that paste service requires registration to download raw pastes Jan 17 19:10:49 I never noticed before. annoying. copy and paste should be fine straight off the page. Jan 17 19:11:00 yes i did that Jan 17 21:24:24 updated openwrt/upstream, https://sdwalker.github.io/uscan/index.html Jan 18 02:01:22 grift: this dependency issue with busybox-selinux is still annoying ☹️ Did you talk about it with dangole ? Jan 18 02:24:21 anyone else having massive issues updating repos from openwrt git ? Jan 18 02:24:39 error: RPC failed; curl 56 OpenSSL SSL_read: Connection reset by peer, errno 104 Jan 18 02:24:39 fatal: the remote end hung up unexpectedly Jan 18 02:24:39 fatal: early EOF Jan 18 02:24:39 fatal: index-pack failed **** ENDING LOGGING AT Mon Jan 18 02:59:57 2021