worldofpeace_ changed the topic of #nixos-dev to: #nixos-dev NixOS Development (#nixos for questions) | NixOS stable: 20.03 ✨ https://discourse.nixos.org/t/nixos-20-03-release/6785 | https://hydra.nixos.org/jobset/nixos/trunk-combined https://channels.nix.gsc.io/graph.html | https://r13y.com | 19.09 RMs: disasm, sphalerite; 20.03: worldofpeace, disasm | https://logs.nix.samueldr.com/nixos-dev
_ris has joined #nixos-dev
ris has quit [Ping timeout: 246 seconds]
orivej has quit [Ping timeout: 264 seconds]
tilpner_ has joined #nixos-dev
tilpner has quit [Ping timeout: 240 seconds]
tilpner_ is now known as tilpner
ivan has joined #nixos-dev
abathur has quit [Quit: abathur]
_ris has quit [Read error: Connection reset by peer]
_ris has joined #nixos-dev
rajivr has joined #nixos-dev
andi- has quit [Ping timeout: 272 seconds]
andi- has joined #nixos-dev
_ris has quit [Ping timeout: 246 seconds]
_ris has joined #nixos-dev
LnL has quit [Ping timeout: 260 seconds]
LnL has joined #nixos-dev
LnL has quit [Changing host]
LnL has joined #nixos-dev
drakonis has quit [Quit: WeeChat 2.8]
_ris has quit [Ping timeout: 246 seconds]
_ris has joined #nixos-dev
orivej has joined #nixos-dev
MichaelRaskin has quit [Quit: MichaelRaskin]
orivej has quit [Ping timeout: 240 seconds]
orivej has joined #nixos-dev
cole-h has quit [Quit: Goodbye]
orivej has quit [Ping timeout: 246 seconds]
orivej has joined #nixos-dev
phreedom has quit [Remote host closed the connection]
<ivan> https://github.com/NixOS/nixpkgs/pull/91141 I think this can be merged, pinging because I tell my users to install from nixpkgs master (though maybe I shouldn't)
<{^_^}> #91141 (by ivan, 2 days ago, open): grab-site: 2.1.16 -> 2.1.19
phreedom has joined #nixos-dev
orivej has quit [Ping timeout: 240 seconds]
orivej has joined #nixos-dev
orivej has quit [Ping timeout: 240 seconds]
orivej has joined #nixos-dev
abbe has quit [Quit: “Everytime that we are together, it's always estatically palpitating!”]
abbe has joined #nixos-dev
orivej has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
orivej has quit [Ping timeout: 258 seconds]
Gaelan has quit [Quit: ZNC 1.7.5 - https://znc.in]
Gaelan has joined #nixos-dev
FRidh has joined #nixos-dev
alp has joined #nixos-dev
orivej has joined #nixos-dev
orivej_ has joined #nixos-dev
orivej has quit [Ping timeout: 256 seconds]
alp has quit [Ping timeout: 272 seconds]
alp has joined #nixos-dev
__monty__ has joined #nixos-dev
urkk has joined #nixos-dev
<urkk> can nix-daemon run as a non-privileged user?
<niksnut> no
<urkk> doing some tests with systemd unit, but fails because it tries to chmod("/nix/var/nix/profiles/per-user/ram", 0755), but is already properly set
<niksnut> well, strictly speaking it probably can but it wouldn't be useful
<niksnut> we're actually running it as non-root in the nix test suite
<urkk> our sysadmins fear root daemons
<urkk> under nix/tests?
<urkk> the `unshare --user true` works as non-root, so I was wondering what other capabilities were needed if any
<niksnut> for the daemon to be useful, it needs to be able to do run builds under different uids
<niksnut> in theory it could run as root in a uid namespace
orivej_ has quit [Read error: Connection reset by peer]
<urkk> seems feasible
orivej has joined #nixos-dev
orivej has quit [Ping timeout: 240 seconds]
<NinjaTrappeur> niksnut: could we leverage linux's CAP_SETUID for that?
<niksnut> probably, but on NixOS at least it would be pointless
<niksnut> since if you have write access to the nix store, it's trivial to escalate privilege
<NinjaTrappeur> aha, good point
kiwiirc has joined #nixos-dev
alp has quit [Ping timeout: 246 seconds]
gilligan has joined #nixos-dev
alp has joined #nixos-dev
orivej has joined #nixos-dev
<domenkozar[m]> is there something worthy of mentioning in nixos weekly? https://github.com/NixOS/nixos-weekly/pull/120
<{^_^}> nixos-weekly#120 (by domenkozar, 3 weeks ago, open): Call for Content: 2020/06
orivej_ has joined #nixos-dev
orivej has quit [Ping timeout: 256 seconds]
orivej has joined #nixos-dev
orivej_ has quit [Ping timeout: 240 seconds]
orivej has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
orivej has quit [Ping timeout: 264 seconds]
orivej has joined #nixos-dev
<kiwiirc> ty for nixos weekly link
orivej has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
orivej has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
orivej_ has joined #nixos-dev
orivej has quit [Ping timeout: 264 seconds]
orivej_ has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
<worldofpeace> Hey kids, I announced 20.09-21.03 release manager https://discourse.nixos.org/t/nixos-20-09-release-manager/7800
<gchristensen> heck yes!
<Valodim> cool :)
adisbladi is now known as adisbladis
<kiwiirc> worldofpeace any interest in each release post like that linking to the prior release post?
<worldofpeace> kiwiirc: do you mean linking to the prior post about who's 20.03 rm (aka me) ?
<worldofpeace> I boosted personally too https://mastodon.social/web/statuses/104387888635447080
<kiwiirc> oh sorry i thought this was a new version release, just read the post :)
<worldofpeace> lol, it isn't 20.09 time (yet)
orivej has quit [Ping timeout: 256 seconds]
orivej has joined #nixos-dev
rajivr has quit [Quit: Connection closed for inactivity]
orivej has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
orivej has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
orivej has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
orivej_ has joined #nixos-dev
orivej has quit [Ping timeout: 240 seconds]
orivej_ has quit [Ping timeout: 260 seconds]
orivej has joined #nixos-dev
orivej has quit [Ping timeout: 256 seconds]
orivej has joined #nixos-dev
ckauhaus has joined #nixos-dev
orivej has quit [Ping timeout: 246 seconds]
orivej has joined #nixos-dev
justanotheruser has quit [Ping timeout: 272 seconds]
alp has quit [Ping timeout: 272 seconds]
alp_ has joined #nixos-dev
orivej has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
drakonis has joined #nixos-dev
justanotheruser has joined #nixos-dev
orivej has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
abathur has joined #nixos-dev
orivej has quit [Read error: Connection reset by peer]
orivej_ has joined #nixos-dev
<Mic92> urkk: I think it might bet needed to have set build users
<Mic92> ah, was already said before.
abathur has quit [Ping timeout: 240 seconds]
cole-h has joined #nixos-dev
orivej_ has quit [Ping timeout: 265 seconds]
orivej has joined #nixos-dev
abathur has joined #nixos-dev
orivej has quit [Ping timeout: 260 seconds]
orivej_ has joined #nixos-dev
orivej_ has quit [Ping timeout: 260 seconds]
orivej has joined #nixos-dev
lopsided98 has left #nixos-dev [#nixos-dev]
orivej has quit [Ping timeout: 265 seconds]
orivej has joined #nixos-dev
lopsided98 has joined #nixos-dev
_ris is now known as ris
orivej_ has joined #nixos-dev
orivej has quit [Ping timeout: 256 seconds]
bennofs has joined #nixos-dev
drakonis has quit [Quit: WeeChat 2.8]
bennofs_ has quit [Ping timeout: 246 seconds]
orivej_ has quit [Ping timeout: 256 seconds]
orivej has joined #nixos-dev
orivej has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
orivej has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
drakonis_ has joined #nixos-dev
orivej has quit [Ping timeout: 260 seconds]
orivej has joined #nixos-dev
<urkk> I'm testing running the daemon with root but limiting the capabilities to: CAP_CHOWN CAP_FOWNER CAP_SETUID
<urkk> As well as ProtectSystem=full, ProtectHome=yes and PrivateDevices=true
<gchristensen> oh cool
<urkk> Removing the capabilities restriction works
orivej has quit [Quit: No Ping reply in 180 seconds.]
<symphorien> won't PrivateDevices prevent usage of kvm?
orivej has joined #nixos-dev
<urkk> this is what /dev looks like with PrivateDevices: https://privatebin.net/?4e5f8b0b0ff4a56a#CCyPAmcp9yc6eDXBAryo67sTDZkxrQcczdTTYkfhqoVh
<NinjaTrappeur> urkk: nice!
<urkk> So this works: [pid 14863] openat(AT_FDCWD, "/dev/ptmx", O_RDWR|O_NOCTTY) = 12
drakonis has joined #nixos-dev
<urkk> But this should fail (?): [pid 14863] chmod("/dev/pts/6", 0600) = 0
<NinjaTrappeur> o0
drakonis_ has quit [Ping timeout: 240 seconds]
FRidh has quit [Ping timeout: 260 seconds]
<sphalerite> how long is the latency between a new release of some package coming out and nixpkgs-update/r-ryantm making the bump PR?
<sphalerite> typically*
FRidh has joined #nixos-dev
<cole-h> Isn't it tied to around when repology.org updates the version?
<samueldr> which in turn, depends on other distros doing the same
<samueldr> I'd say it varies wildly
orivej has quit [Quit: No Ping reply in 180 seconds.]
<samueldr> when I was still maintaining a package sometimes it was the day of, sometimes it didn't seem to happen
<samueldr> a particular package*
orivej has joined #nixos-dev
<sphalerite> symphorien: sure, but it can be allow-listed using a bind mount
<sphalerite> cole-h samueldr: it also gets info from github releases nowadays
<sphalerite> and pypi
<cole-h> Huh, cool. Now, how often that happens is the question :P
<sphalerite> yep. I guess ryantm is the person best equipped to tell us that :D
<samueldr> I guess it must depend on where in the cycle of checking it is :)
alp_ has quit [Ping timeout: 260 seconds]
<NinjaTrappeur> urkk: Did you try setting CAP_SYS_TTY_CONFIG ?
<urkk> NinjaTrappeur yes
<NinjaTrappeur> :(
<NinjaTrappeur> I do not see any capability around openpt :(
<NinjaTrappeur> hmm, could you push your wip somewhere? I'm interested, I'd like to have a look as well.
<urkk> NinjaTrappeur sure
FRidh has quit [Quit: Konversation terminated!]
<urkk> I was looking for the impl of posix_openpt, from strace looks like it only opens /dev/ptmx
<NinjaTrappeur> yes. I'm not sure how familiar you are with pseudo terminals, but I surely wasn't familiar at all with those 30 minutes ago, these two pages helped a lot:
<NinjaTrappeur> ptmx is the one providing you with a new ptm/pts couple.
<NinjaTrappeur> So it kinda make sense :)
<NinjaTrappeur> I still don't get the permission issue from your trace though :/
orivej has quit [Ping timeout: 256 seconds]
orivej has joined #nixos-dev
<urkk> NinjaTrappeur do you success to run nix-env with this hardening?
<urkk> Note: I'm using the last release not master
<urkk> Now it fails at the start: [pid 3768818] openat(AT_FDCWD, "/dev/ptmx", O_RDWR|O_NOCTTY) = -1 EACCES (Permission denied)
alp_ has joined #nixos-dev
<urkk> The is a cap (set bit) from CapBnd: 0000003ff7ffffff to CapBnd: 0000000005220089 that makes it fail
<urkk> There*
<urkk> I will continue tomorrow and see if I find which one it is :-)
drakonis1 has joined #nixos-dev
<urkk> CAP_DAC_OVERRIDE! ofc it ignores the 000 perm of /dev/ptmx
drakonis has quit [Ping timeout: 272 seconds]
drakonis_ has joined #nixos-dev
drakonis_ has quit [Read error: No route to host]
drakonis1 has quit [Ping timeout: 240 seconds]
drakonis has joined #nixos-dev
<urkk> With ProtectHome=yes recompiles everything, but with ProtectHome=read-only works ok
drakonis_ has joined #nixos-dev
drakonis has quit [Ping timeout: 260 seconds]
evanjs has quit [Read error: Connection reset by peer]
evanjs has joined #nixos-dev
orivej has quit [Ping timeout: 265 seconds]
orivej has joined #nixos-dev
ckauhaus has quit [Quit: WeeChat 2.7.1]
drakonis has joined #nixos-dev
drakonis_ has quit [Ping timeout: 240 seconds]
orivej has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
<{^_^}> firing: RootPartitionLowInodes: https://status.nixos.org/prometheus/alerts
alp_ has quit [Ping timeout: 272 seconds]
orivej has quit [Quit: No Ping reply in 180 seconds.]
sdier[m] has joined #nixos-dev
orivej has joined #nixos-dev
orivej has quit [Ping timeout: 260 seconds]
<{^_^}> resolved: RootPartitionLowInodes: https://status.nixos.org/prometheus/alerts
orivej has joined #nixos-dev
orivej has quit [Ping timeout: 246 seconds]
orivej has joined #nixos-dev
orivej has quit [Ping timeout: 260 seconds]
orivej has joined #nixos-dev
alp_ has joined #nixos-dev
justanotheruser has quit [Ping timeout: 264 seconds]
drakonis_ has joined #nixos-dev
orivej has quit [Quit: No Ping reply in 180 seconds.]
orivej has joined #nixos-dev
justanotheruser has joined #nixos-dev
__monty__ has quit [Quit: leaving]
orivej has quit [Quit: No Ping reply in 210 seconds.]
orivej has joined #nixos-dev
orivej has quit [Ping timeout: 260 seconds]
orivej_ has joined #nixos-dev
orivej_ has quit [Ping timeout: 258 seconds]
alp_ has quit [Ping timeout: 272 seconds]