devel December 2013

devel@lists.fedoraproject.org

170 participants
202 discussions

upgrading RH 9 system->Fedora with iso files and apt only
by Didier Casse 17 Jan '22

17 Jan '22

I have the yarrow's iso files on my HD in a RH9 system. Let's say I want to upgrade selected packages using an "apt-get install" pointing to my iso-mounted files, how do I do it? i.e I mount the iso into some /mnt/yarrow1, /mnt/yarrow 2 etc.. Then what is the complete procedure to make my apt look into my own HD to upgrade packages. Can anybody redirect me to the correct resource or some literature hanging on the web? Thanks. Assume also that I do not wish to burn CDs! I do not want to use apt-cdrom. Thanks. With kind regards, Didier. --- PhD student Singapore Synchrotron Light Source (SSLS) 5 Research Link, Singapore 117603 Email: slsbdfc at nus dot edu dot sg \or\ didierbe at sps dot nus dot edu dot sg Website: http://ssls.nus.edu.sg

6 9

git push permission denied
by Neal Becker 10 Feb '21

10 Feb '21

I just had to setup a new machine, and new ssh keys. I visited https://admin.fedoraproject.org/accounts/user/edit/xxxx I chose my new id_rsa.pub to upload. But I get: git push --verbose Pushing to ssh://nbecker@pkgs.fedoraproject.org/mercurial Permission denied (publickey). fatal: The remote end hung up unexpectedly Hints?

4 5

F21 Self Contained Change: Replace Bacula with Bareos
by Jaroslav Reznik 09 Apr '15

09 Apr '15

= Proposed Self Contained Change: Replace Bacula with Bareos = https://fedoraproject.org/wiki/Changes/Bareos Change Owner(s): Simone Caronni <negativo17 at gmail.com> The powerful Bacula network backup solution has switched from being Open Source friendly to being almost closed source. Originally the project was conceived totally as Open Source, but since the creation of Bacula Systems and its proprietary Bacula Enterprise Edition product, the Open Source (now called "Community Edition") has received less and less updates and is mostly abandoned. == Detailed description == The most important points that are left "abandoned" are the following: * Installation scripts and updates to makefiles are not updated anymore. * New plugins and functionalities are not added anymore, except those in the "core" daemons. * Gaphical (and buggy) console has not received any update in almost two years. * Patches and bugs opened in the bug tracker are mostly left abandoned. Even trivial fixes are not imported in the source. * Windows binaries are no longer provided, nor the source for the clients has been updated. Even if compiled with difficulties, there is no support for recent Windows versions. A former Bacula developer, frustrated by the situation created the fork Bareos a long time ago from Bacula 5.2.x (the current Fedora and RHEL 7 version). This version has now received '''a lot of bugfixes''' compared to the original Bacula source. This makes compilation and installation a lot easier than it was with Bacula. On top of this, a '''lot of new features''' have been added; some unique to Bareos but many available only in the closed source Bacula Enterprise. Here is the list of new features compared to the current Bacula 5.2.13: * http://www.bareos.org/en/whats_new.html Some highlights include NDMP support for enterprise class storage (NetApp, etc.), support for enterprise class tape libraries and Windows support (including Windows Server 2012) with Bareos generated binaries. For further details on why a Bacula fork was created please look at the following links: * http://www.bareos.org/en/faq/items/why_fork.html Bareos can also be '''fully compatible with Bacula''' by setting a specific configuration directive in the Daemon configuration files; thus providing the option for RHEL 6/7 users to interoperate with Fedora systems. * http://www.bareos.org/en/faq/items/bareos_bacula_compatibility.html == Scope == To accomplish the goal, the following Bacula packages need to be replaced with Bareos equivalents: bacula bacula-docs Currently, the same Fedora packages can be rebuilt as they are, to work also on CentOS/RHEL 5 and 6, upgrading the EPEL or official Bacula packages in the distributions. This is to have a consistent backup infrastructure across all the Fedora/CentOS/RHEL ecosystem. To ease installation, a repository for installing those packages on a CentOS/RHEL system do exist: http://repos.fedorapeople.org/repos/slaanesh/bacula/README.txt The idea is the same for Bareos: import into Fedora 21 packages that can be rebuilt for all supported Fedora/RHEL/CentOS releases and provide a repository that can upgrade any Bacula release currently installed in the system with the new one. In detail; the upgrade scenarios supported when going from Bacula to Bareos would be: From Bacula 2.4: * RHEL/CentOS 5 with EPEL repository From Bacula 5.0: * RHEL/CentOS 6 From Bacula 5.2.13: * Fedora 18+ * RHEL/CentOS 5 * RHEL/CentOS 6 As written before, the change is impacting only Fedora 21, the list of upgrades supported are only for users who want a consistent backup solution across the enterprise. === External activities === Proposal owners: I'm the current Bacula mantainer in Fedora and will complete the transition in time for the release. Other developers: N/A (not a System Wide Change) Release engineering: the release engineering team should make sure the new Bareos packages are in place instead of the current Bacula packages for the new release. Policies and guidelines: N/A (not a System Wide Change) _______________________________________________ devel-announce mailing list devel-announce(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/devel-announce

6 8

Expanding the list of "Hardened Packages"
by Dhiru Kholia 22 Jul '14

22 Jul '14

Hi, This proposal was originally at https://fedorahosted.org/fesco/ticket/1104 (mitr asked me to move the discussion to fedora-devel to get more attention and feedback) ... http://fedoraproject.org/wiki/Hardened_Packages page mentions that "FESCo requires some packages to use PIE and relro hardening by default." It would be great if this list could be expanded to include even more packages which are at comparatively more risk of being exploited (locally or remotely). Such packages will typically include various system daemons, network daemons and network enabled applications. Lot of network daemons are already using PIE and RELRO (e.g. httpd, MariaDB). So a natural question is why packages in same "network daemons" class like PostgreSQL, Dovecot and MongoDB aren't being hardened? Some of the ways to implement this proposal are, 1. Hardening flags should be turned on (by default) for all packages which are at comparatively more risk of being exploited or which meet some well-defined criteria (suggestions welcome). "Packaging Guidelines" say that "Other packages may enable the flags at the maintainer's discretion." Thinking from a security perspective, I find "Hardening flags can only be disabled for other packages at the maintainer's discretion provided enough justification is given to FESCo" to be more appropriate. 2. An alternate approach is to come up with an expanded list of packages which should be hardened. Any feedback is welcome! -- Dhiru

39 140

Package reviev : tayga
by William 06 Jul '14

06 Jul '14

Hi, I am looking to have the following package reviewed for inclusion into fedora. Tayga is a NAT64 implementation in userland. With the help of DNS64 (BIND), it allows an ipv6 only client to communicate with the ipv4 internet. http://www.litech.org/tayga/ I have attached the SRPM of what I have created. There are a few things that could change. First, I had thought that I would need more selinux policy than I did. At the moment the policy just provides a filecontext. Is there a better way to do this? The ifup / ifdown script read their variables from the /etc/tayga configuration file. In most scenarios, a system will run only one instance of this. However I would like feedback on: Should I enable it so that the ifup/down can accept a tayga.conf parameter to read OR Should the ifup/ifdown script generate the tayga.conf on the fly to say /var/run/tmp somewhere from values provided in the ifup / ifdown? Additionally, what I have in these scripts should really be reviewed, as I have never written them before. Finally, tayga is a long running process, as such, I have enabled the hardened build. It is possible to run as an alternate user and in a chroot of it's DB dir. What is the best way to go about adding a user for this package for the daemon to run as? Looking forwards to comments and advice, -- Sincerely, William Brown http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0xEFC416D781A8099A

2 5

Removing python-setuptools-devel backwards compat
by Toshio Kuratomi 19 Apr '14

19 Apr '14

2 2

python-django update to Django-1.6
by Matthias Runge 26 Mar '14

26 Mar '14

Hey, recently, I saw a few requests to update python-django to Django-1.6, the corresponding bug is [1]. As there are quite a few changes, I'd expect this update to be harmful, at least - python-django-openstack-auth - openstack-dashboard will break, and won't even build any more (because they also execute sanity checks during build). So, the current plan is, to fix both packages upstream and then to update python-django to Django 1.6 in rawhide. I'd expect this to happen within the next two weeks and I'd update python-django to Django-1.6 around Dec 16th. Because of bad timing, we won't have Django-1.6 in f20. Matthias [1] https://bugzilla.redhat.com/show_bug.cgi?id=1027766

7 31

Strange ssh / openldap linking problem
by Richard W.M. Jones 21 Mar '14

21 Mar '14

I'm not sure whether or not this is a bug, but it sure looks strange. $ rpm -qf /usr/bin/ssh openssh-clients-6.1p1-6.fc18.x86_64 $ ldd /usr/bin/ssh|grep ldap libldap-2.4.so.2 => /lib64/libldap-2.4.so.2 (0x00007fad274fc000) /usr/lib64/libldap-2.4.so.2 is a symbolic link to a symbolic link which passes through a -devel package. /usr/lib64/libldap-2.4.so.2 -> libldap.so # openldap-2.4.34-1.fc18 /usr/lib64/libldap.so -> libldap-2.4.so.2.9.0 # openldap-devel-2.4.34-1.fc18 /usr/lib64/libldap-2.4.so.2.9.0 is a real file # openldap-2.4.34-1.fc18 To cut a long story short, I fixed this by uninstalling openldap-devel and reinstalling it. Now there is no -devel package in the chain: $ ldd /usr/bin/ssh | grep ldap libldap-2.4.so.2 => /lib64/libldap-2.4.so.2 (0x00007fe8caf69000) /lib64/libldap-2.4.so.2 -> libldap-2.4.so.2.9.0 I'd like to understand how the original situation happened, because it broke a supermin-built appliance (RHBZ#954185). I assume ldconfig must have something to do with it. There is nothing unusual in the %scripts of openldap (it just runs ldconfig as you'd expect), nor is there any special openssh/openldap config file in /etc/ld.so.conf.d. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-df lists disk usage of guests without needing to install any software inside the virtual machine. Supports Linux and Windows. http://people.redhat.com/~rjones/virt-df/

3 7

F20 Self Contained Change: Snapshot and Rollback Tool
by Jaroslav Reznik 07 Mar '14

07 Mar '14

= Proposed Self Contained Change: Snapshot and Rollback Tool = https://fedoraproject.org/wiki/Changes/Rollback Change owner(s): Stephen Gallagher <sgallagh(a)redhat.com>, Colin Walters <walters(a)redhat.com> With the advent of thinly-provisioned LVM pools, it has become possible for us to implement full-system LVM snapshotting for recording rollback points. We are planning to support this for yum updates and eventually fedup upgrades going forwards. This change request notes the addition of new tools provided by the roller-derby project to present an interface and a CLI for managing and initiating rollbacks. == Detailed description == The roller-derby project will be providing a library and a CLI for creating, labeling and managing LVM snapshots (plus non-LVM backups of /boot), oriented primarily towards rpm-managed data, but useful beyond that. The yum plugin "yum-plugin-fs-snapshot" will be updated to consume this library and save the system state in a compatible format. The roller-derby CLI tool will provide an interactive and scriptable interface for manipulating these snapshots and determining when to remove older ones. It will also allow the tagging of snapshots as "known-good", to be skipped when automatically-trimming for space. The roller-derby project will likely provide a small daemon to keep track of the available space in the LVM pool to proactively clean up snapshots before the system runs out of space. In order to prevent "loss" of data when rebooting into an snapshot, the roller-derby CLI will allow saving a snapshot of the current state before rolling back and will provide tools to allow mounting of that current state to recover changes that have occurred since the rollback point. == Scope == The scope of this project is the completion of the initial release of the roller-derby project and the inclusion of thinly-provisioned LVM as an option in the Anaconda installer [1]. Proposal owners: We need to complete the roller-derby project. Other than the Anaconda change referenced above, all dependencies are available in Fedora already. Other developers: OS Installer Support for LVM Thin Provisioning Release engineering: N/A (not a System Wide Change) Policies and guidelines: N/A (not a System Wide Change) [1] https://fedoraproject.org/wiki/Changes/InstallerLVMThinProvisioningSupport _______________________________________________ devel-announce mailing list devel-announce(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/devel-announce

7 12

Sshd getting 'dyntransition' AVC's in SElinux enforcing mode
by Philip Prindeville 06 Mar '14

06 Mar '14

I’m seeing the following after an update (via yum) from F19 to F20: ---- time->Tue Dec 24 16:05:44 2013 type=SYSCALL msg=audit(1387926344.492:5867): arch=c000003e syscall=1 success=no exit=-13 a0=6 a1=7f4e5e7afbb0 a2=20 a3=7fff44c2c550 items=0 ppid=686 pid=693 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:init_t:s0 key=(null) type=AVC msg=audit(1387926344.492:5867): avc: denied { dyntransition } for pid=693 comm="sshd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:sshd_net_t:s0 tclass=process ---- time->Tue Dec 24 16:05:45 2013 type=SYSCALL msg=audit(1387926345.093:5883): arch=c000003e syscall=1 success=no exit=-13 a0=7 a1=7f4e5e7acef0 a2=2a a3=666e6f636e753a72 items=0 ppid=686 pid=706 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=627 tty=(none) comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:init_t:s0 key=(null) type=AVC msg=audit(1387926345.093:5883): avc: denied { dyntransition } for pid=706 comm="sshd" scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process Is this a known issue? I’m running: selinux-policy-devel-3.12.1-106.fc20.noarch selinux-policy-targeted-3.12.1-106.fc20.noarch selinux-policy-doc-3.12.1-106.fc20.noarch selinux-policy-3.12.1-106.fc20.noarch openssh-clients-6.4p1-3.fc20.x86_64 openssh-6.4p1-3.fc20.x86_64 openssh-server-6.4p1-3.fc20.x86_64 Thanks, -Philip

4 5

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

devel December 2013