goombacloud (u/goombacloud)

goombacloud commented on Flatcar: OS Innovation with Systemd-Sysext flatcar.org/blog/2024/04/... · Posted by u/goombacloud

jamesponddotco · 2 years ago

Slightly off-topic, but I wonder if there is something like Flatcar for LXC/LXD/Incus, my preferred container runtime. Would be much better than what I do right now, a locked down openSUSE host server.

goombacloud · 2 years ago

If you mean using Incus on Flatcar, there is a PR for adding Incus as systemd-sysext extension.

Flatcar inside Incus is a bit more difficult: for Flatcar being a container one can import https://stable.release.flatcar-linux.net/amd64-usr/current/f... and for it being a VM I don't know if the regular image works. A major hurdle is that one has to tweak the way VMs/containers are configured because normally Ubuntu's cloud-init is used but in Flatcar only coreos-cloudinit or Ignition is supported and there are differences in the way the user-data has to be set up and the contents as well. But in the end Incus would be one more "cloud" platform to support and one could make the Incus integration as nice as with other platforms where Flatcar runs on (OpenStack, VMware, etc.).

goombacloud commented on Flatcar: OS Innovation with Systemd-Sysext flatcar.org/blog/2024/04/... · Posted by u/goombacloud

yokem55 · 2 years ago

I've used systemd-sysext's to add system level software to my Steam Deck withough having to unseal the root partition. It's slightly annoying in that that I have to rebuild the ext's every time the system updates, but otherwise they work great.

goombacloud · 2 years ago

With static binaries that is not needed (and you can use OS=_any in the extension release file to mark them compatible).

If you want to repackage distro binaries without recompilation, you can have a look here: https://github.com/flatcar/sysext-bakery/pull/74 There are two tools, one can bundle the needed libs in a separate folder, and the other one works more like Flatpak and uses a full chroot. Since you already know what files are needed at runtime I think you could try the first approach, otherwise the second might be easier.

Posted by u/goombacloud 2 years ago

Flatcar: OS Innovation with Systemd-Sysext flatcar.org/blog/2024/04/...

goombacloud commented on Timeline of the xz open source attack research.swtch.com/xz-tim... · Posted by u/todsacerdoti

goombacloud · 2 years ago

This might not be complete because this statement "More patches that seem (even in retrospect) to be fine follow." lacks some more backing facts. There were more patches before the SSH backdoor, e.g.: "Lasse Collin has already landed four of Jia Tan’s patches, marked by “Thanks to Jia Tan”" and the other stuff before and after the 5.4 release. So far I didn't see someone make a list of all patches and gather various opinions on whether the changes could be maliciously leveraged.

goombacloud · 2 years ago

In https://archive.softwareheritage.org/browse/revision/e446ab7... one can open the patches and then click the "Changes" sub-tab. Stuff like this looks like a perf improvement but who knows if a tricky bug is introduced that was aimed to be exploited https://archive.softwareheritage.org/browse/revision/e446ab7... There are more patches to be vetted unless one would give up and say that 5.2 should be used as last "known-good".

goombacloud commented on Timeline of the xz open source attack research.swtch.com/xz-tim... · Posted by u/todsacerdoti

goombacloud · 2 years ago

goombacloud commented on Pure Bash Web Server github.com/dzove855/Bash-... · Posted by u/shakna

goombacloud · 2 years ago

When socat is around a simple server can also be constructed with it:

        tee /tmp/server > /dev/null <<'EOF'
        #!/bin/bash
        set -euo pipefail
        SERVE="$1"
        TYPE="$2"
        read -a WORDS
        if [ "${#WORDS[@]}" != 3 ] || [ "${WORDS[0]}" != "GET" ]; then
          echo -ne "HTTP/1.1 400 Bad request\r\n\r\n"; exit 0
        fi
        # Subfolders are not supported for security reasons as this avoids having to deal with ../../ attacks
        FILE="${SERVE}/$(basename -- "${WORDS[1]}")"
        if [ -d "${FILE}" ] || [ ! -e "${FILE}" ]; then
          echo -ne "HTTP/1.1 404 Not found\r\n\r\n" ; exit 0
        fi
        echo -ne "HTTP/1.1 200 OK\r\n"
        echo -ne "Content-Type: ${TYPE};\r\n"
        LEN=$(stat -L --printf='%s\n' "${FILE}")
        echo -ne "Content-Length: ${LEN}\r\n"
        echo -ne "\r\n"
        cat "${FILE}"
        EOF
        chmod +x /tmp/server
        # switch from "text/plain" to "application/octet-stream" for file downloads
        socat TCP-LISTEN:8000,reuseaddr,fork SYSTEM:'/tmp/server /tmp/ text-plain'

# test: curl -v http://localhost:8000/server

goombacloud commented on Stop Hiding the Sharp Knives: The WebAssembly Linux Interface arxiv.org/abs/2312.03858... · Posted by u/yurivish

goombacloud · 2 years ago

I really think we should have means of spawning wasm components from wasm components. How the runtime runs them should be up to the runtime - it could be directly backed by kernel primitives but it could also be in a browser. Leaking posix things into wasm… is something I'd rather never want to see. Let's come up with something better as wasm did aim for from the start.

goombacloud commented on Shellcheck finds bugs in your shell scripts shellcheck.net/... · Posted by u/mooreds

goombacloud · 2 years ago

To spot more common problems I recommend:

  alias shellcheck='shellcheck -o all -e SC2292 -e SC2250'

goombacloud commented on VeraCrypt: Free open-source disk encryption for Windows, Mac OS X, Linux veracrypt.fr/en/Home.html... · Posted by u/thunderbong

goombacloud · 2 years ago

For regular Linux users you can do:

  sudo touch /etc/udisks2/tcrypt.conf
  sudo systemctl restart udisks2

and then any veracrypt volumes can be used in Nautilus or GNOME Disks similar to LUKS volumes.

goombacloud commented on Raspberry Pi 5 raspberrypi.com/products/... · Posted by u/chabes

goombacloud · 2 years ago

Does this finally have UEFI by default?

u/goombacloud

KarmaCake day210November 18, 2019View Original