[Bug 1875313] Re: msmtp password lookup fails after upgrade to eoan

2020-04-27 Thread Simon Déziel
Now that msmtp is asking for password, can you send emails with it? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1875313 Title: msmtp password lookup fails after upgrade to eoan To manage notifica

[Bug 1875313] Re: msmtp password lookup fails after upgrade to eoan

2020-04-27 Thread Simon Déziel
Thanks for following up! ** Changed in: msmtp (Ubuntu) Status: Incomplete => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1875313 Title: msmtp password lookup fails after upgra

[Bug 1875504] Re: apparmor="DENIED" operation="file_inherit" profile="/usr/sbin/swanctl" name="/dev/net/tun" pid=490601 comm="swanctl" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0

2020-04-27 Thread Simon Déziel
I suspect you using kernel-libipsec which would explain why you are running into this, right? Could you please try the following: cat << EOF | sudo tee -a /etc/apparmor.d/local/usr.sbin.swanctl # libcharon-extra-plugins: kernel-libipsec /dev/net/tun rw, EOF sudo apparmor_parser -r

[Bug 1875644] [NEW] motd-news complains that curl is missing

2020-04-28 Thread Simon Déziel
Public bug reported: Description: motd-news complains that curl is missing on every run. motd-news.timer firing every ~12 hours, this useless message ends up in the logs regularly. Steps to reproduce: $ lxc launch images:ubuntu/focal motd Creating motd Starting motd $ lxc exec motd -- /etc/upda

[Bug 1875504] Re: apparmor="DENIED" operation="file_inherit" profile="/usr/sbin/swanctl" name="/dev/net/tun" pid=490601 comm="swanctl" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0

2020-04-28 Thread Simon Déziel
If the libipsec plugin is not loaded then I cannot explain why it would try to use /dev/net/tun so it's hard to make a case of extending the profile. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/18755

[Bug 1876320] Re: Port parameter sshd_config is 22 AND whatever you specify

2020-05-01 Thread Simon Déziel
On a stock install, adding "Port 7722" to /etc/ssh/sshd_config and restarting sshd gives me this: # ss -nltp | grep sshd LISTEN0 128 0.0.0.0:77220.0.0.0:* users:(("sshd",pid=10651,fd=3)) LISTEN0 128 [::]:7722

[Bug 1876320] Re: Port parameter sshd_config is 22 AND whatever you specify

2020-05-01 Thread Simon Déziel
@Adriaan, are there really 2 sshd running? Or is it only one binding to the 2 ports and applying different parameter using Match conditions? Beware what on 20.04, there is support for additional config snippets dropped in /etc/ssh/sshd_config.d/*.conf. To check for 2 daemons: sudo ss -nltp | grep

[Bug 1873288] Re: wireguard-tools should NOT recommend wireguard-dkms

2020-05-11 Thread Simon Déziel
Indeed, install wireguard-tools on Focal doesn't pull the wireguard-dkms package. I believe only 2) and 3) from comment 9 remain to be addressed. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1873288

[Bug 1877159] Re: netlink: 'systemd-network': attribute type 5 has an invalid length.

2020-05-11 Thread Simon Déziel
Steps to reproduce: lxc launch images:ubuntu/bionic --vm -c security.secureboot=false foo sleep 10 # allow booting lxc exec foo -- apt install -y software-properties-common lxc exec foo -- add-apt-repository -y ppa:wireguard/wireguard lxc exec foo -- apt install -y wireguard-tools cat << EOF | lx

[Bug 1877159] Re: netlink: 'systemd-network': attribute type 5 has an invalid length.

2020-05-11 Thread Simon Déziel
@ddstreet, PersistentKeepalive is not needed as you'll see in the steps to reproduce. ** Description changed: [impact] systemd-networkd uses incorrect netlink attribute length for wireguard's persistent keepalive interval, which logs error messages from the kernel, and may incorrectly

[Bug 1887364] Re: update-resolv-conf script needs update to systemd

2020-07-20 Thread Simon Déziel
When systemd-resolved is used, you are better off using the openvpn- systemd-resolved package instead. To do so, you need to `apt install openvpn-systemd-resolved` and add the following lines to your config: script-security 2 setenv PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/b

[Bug 1875708] Re: Truncated messages in journald since systemd v244

2020-07-20 Thread Simon Déziel
Reproducing the issue *before* the patch: root@foo:~# dpkg -l| grep -wF ' systemd ' ii systemd 245.4-4ubuntu3.1 amd64system and service manager root@foo:~# systemctl status test.service ● test.service - Test Truncate Loaded: loaded (/etc/systemd/system/t

[Bug 1868456] Re: "sudo: setrlimit(RLIMIT_CORE): Operation not permitted" error when using sudo in 20.04 LXD container

2020-07-20 Thread Simon Déziel
*** This bug is a duplicate of bug 1857036 *** https://bugs.launchpad.net/bugs/1857036 ** This bug has been marked a duplicate of bug 1857036 `sudo --login --user USERNAME` throws `setrlimit(RLIMIT_CORE): Operation not permitted` error when run inside a container. -- You received this bu

[Bug 1867799] Re: Focal: sudo: setrlimit(RLIMIT_CORE): Operation not permitted

2020-07-20 Thread Simon Déziel
*** This bug is a duplicate of bug 1857036 *** https://bugs.launchpad.net/bugs/1857036 ** This bug has been marked a duplicate of bug 1857036 `sudo --login --user USERNAME` throws `setrlimit(RLIMIT_CORE): Operation not permitted` error when run inside a container. -- You received this bu

[Bug 1857036] Re: `sudo --login --user USERNAME` throws `setrlimit(RLIMIT_CORE): Operation not permitted` error when run inside a container.

2020-07-20 Thread Simon Déziel
Thanks Bryce for the PPA. I can confirm it does work: # reproduce the problem: root@sudo-sru-lp1857036-test:~# sudo true sudo: setrlimit(RLIMIT_CORE): Operation not permitted # get the fix from the PPA: root@sudo-sru-lp1857036-test:~# apt-add-repository -yus ppa:bryce/sudo-sru-lp1857036-setrlimi

[Bug 1885907] Re: Unbound crash with chroot

2020-07-20 Thread Simon Déziel
I personally don't think this is worth a SRU but if someone believes otherwise, I'll be happy to provide the steps to reproduce and help get this through. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/

[Bug 1857036] Re: `sudo --login --user USERNAME` throws `setrlimit(RLIMIT_CORE): Operation not permitted` error when run inside a container.

2020-07-21 Thread Simon Déziel
[Test Case] $ lxc launch ubuntu:20.04/amd64 sudo-sru-lp1857036-test $ lxc shell sudo-sru-lp1857036-test Reproduce the problem root@sudo-sru-lp1857036-test:~# sudo true sudo: setrlimit(RLIMIT_CORE): Operation not permitted Enable -proposed and update root@sudo-sru-lp1857036-test:~# apt install -

[Bug 1872564] Re: /proc/sys/kernel/random/boot_id rule missing from abstractions/nameservice

2020-05-04 Thread Simon Déziel
`snap info lxd` says: installed: 4.0.1 (14890) 72MB - And indeed, there is a tmpfs mounted there: root@bind:~# mount | grep boot none on /proc/sys/kernel/random/boot_id type tmpfs (ro,nosuid,nodev,noexec,relatime,size=492k,mode=755,uid=1524288,gid=1524288) That said, I

[Bug 1872564] Re: /proc/sys/kernel/random/boot_id rule missing from abstractions/nameservice

2020-05-04 Thread Simon Déziel
squid in focal is indeed another package that triggers that denial but it is non fatal there as mentioned by Andreas. @ahasenack, with 4.11, squid's systemd unit moved from Type=forking to Type=notify and with the error you showed, I would expect you to see a denial trying to write to /run/systemd

[Bug 1633485] Re: Backport login throttling plugin to 5.6 and 5.7

2020-05-04 Thread Simon Déziel
This was fixed some time ago it seems: $ dpkg -l| grep mysql-server-5.7 ii mysql-server-5.75.7.30-0ubuntu0.16.04.1 amd64MySQL database server binaries and system database setup $ dpkg -L mysql-server-5.7 | grep control /usr/lib/mysql/plugin/connection_c

[Bug 1872993] Re: Security vulnerabilities of version 5.7.29

2020-05-04 Thread Simon Déziel
The new version(s) were released and announced today: https://usn.ubuntu.com/4350-1/ ** Changed in: mysql-5.7 (Ubuntu) Status: Confirmed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to the bug report. https://bugs.launc

[Bug 1676410] Re: connection_control plugin is not packaged

2020-05-04 Thread Simon Déziel
*** This bug is a duplicate of bug 1633485 *** https://bugs.launchpad.net/bugs/1633485 ** This bug has been marked a duplicate of bug 1633485 Backport login throttling plugin to 5.6 and 5.7 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed

[Bug 1877159] [NEW] netlink: 'systemd-network': attribute type 5 has an invalid length.

2020-05-06 Thread Simon Déziel
Public bug reported: This morning, our 2 Bionic machine configured with the wireguard's PPA and using systemd-networkd to configure the wireguard tunnel started misbehaving. Why this started just now is unclear ATM but their dmesg was filled with this: validate_nla: 100 callbacks suppressed netli

Re: [Bug 1803601] Re: motd-news.service scheduled even when /etc/update-motd.d/50-motd-news is not executable

2020-05-06 Thread Simon Déziel
On 2020-05-06 2:49 p.m., Andreas Hasenack wrote: > There are many alternatives here. IIRC, `chmod -x` snippets from /etc/update-motd.d/ was the way to go a few releases ago when it was consumed by run-parts. > I think fixing this doesn't warrant an SRU, but should be considered for > the devel re

[Bug 1872564] Re: /proc/sys/kernel/random/boot_id rule missing from abstractions/nameservice

2020-05-06 Thread Simon Déziel
The missing rule for boot_id was added to Apparmor 2.13 (https://gitlab.com/apparmor/apparmor/-/blob/apparmor-2.13/profiles/apparmor.d/abstractions/nameservice#L35) and was later refined in the master branch. As such, marking as fix committed. ** Changed in: apparmor (Ubuntu) Status: New =

[Bug 1876496] Re: Using /var/log/msmtp for all users is broken

2020-05-06 Thread Simon Déziel
The msmtp group was created to allow one to protect /etc/msmtprc from regular users as it can contain plaintext passwords. If you join users to that group, you lose the ability to protect those passwords. Have you considered using 'syslog LOG_MAIL'? It should have everyone's logs ending in /var/lo

Re: [Bug 1876496] Re: Using /var/log/msmtp for all users is broken

2020-05-06 Thread Simon Déziel
On 2020-05-06 4:09 p.m., Rick Poleshuck wrote: > I will try that. If that works, It's what I use on all my machines. > then the bug is only in the documentation referencing /var/log/msmtp. I couldn't find any reference to that file in either the man page or upstream doc [*] so please let us know

[Bug 1877159] Re: netlink: 'systemd-network': attribute type 5 has an invalid length.

2020-05-07 Thread Simon Déziel
Here is a strace of systemd-networkd when it was consuming 100% CPU: https://paste.ubuntu.com/p/2XwxWwW99q/ -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1877159 Title: netlink: 'systemd-network': a

[Bug 1876496] Re: Using /var/log/msmtp for all users is broken

2020-05-07 Thread Simon Déziel
Thanks for getting back. I'll mark the bug as invalid. If you feel the documentation around logging could be improved, I would encourage you to discuss with upstream on ways to improve it. It's hard to come up with a default logging that's a good fit for everyone. Those using /etc/msmtprc probably

[Bug 1820329] [NEW] ubuntu-support-status wrong support period for packages that were MRE during a release's life

2019-03-15 Thread Simon Déziel
Public bug reported: Some packages that were in universe at the time of the release then MRE are reported as being supported for 3y instead of 5y as other packages that were in main from day 1. $ ubuntu-support-status --show-support | tail -3 Supported until April 2021 (Canonical - 3y): libbrotli

[Bug 1820329] Re: ubuntu-support-status wrong support period for packages that were MIR mid-release

2019-03-15 Thread Simon Déziel
** Summary changed: - ubuntu-support-status wrong support period for packages that were MRE during a release's life + ubuntu-support-status wrong support period for packages that were MIR mid-release ** Description changed: - Some packages that were in universe at the time of the release then

[Bug 1820563] Re: package nginx-core 1.10.3-0ubuntu0.16.04.3 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2019-03-18 Thread Simon Déziel
@Tuncay, there seems to be another daemon already listening on port 80: Mar 14 09:12:05 devzone nginx[18553]: nginx: [emerg] bind() to [::]:80 failed (98: Address already in use) Mar 14 09:12:06 devzone nginx[18553]: nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use) Maybe

[Bug 1782650] Re: nrpe plugin in bionic fails with "Error - Could not complete SSL handshake"

2019-02-15 Thread Simon Déziel
It looks like the Bionic TLS client rejects the server picked DH param (512 bits) as being too small. We can see this at work in the attached pcap where 172.22.30.2 is Xenial/TLS server/NRPE server and 172.22.30.66 is the Bionic/TLS client/check_nrpe. ** Attachment added: "nrpe-dh-too-small.pcap"

[Bug 1782650] Re: nrpe plugin in bionic fails with "Error - Could not complete SSL handshake"

2019-02-15 Thread Simon Déziel
It seems the Bionic's OpenSSL version will always reject the small DH params proposed by the Xenial side so the only workaround I can think of for now is to disable TLS on both sides. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. htt

[Bug 1817329] [NEW] [snap] update hides the running browser

2019-02-22 Thread Simon Déziel
Public bug reported: Problem description: I had a couple of tabs open in incognito mode and the Chromium window was minimized/didn't had the focus. Suddenly, the desktop icon vanished then reappeared, but the new icon indicated that Chromium was not running (no "dot"/running indicator next to the

[Bug 1817329] Re: [snap] update hides the running browser

2019-02-22 Thread Simon Déziel
** Tags added: snap -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1817329 Title: [snap] update hides the running browser To manage notifications about this bug go to: https://bugs.launchpad.net/ubu

[Bug 1826238] Re: apparmor doesn't allow to start with a non-root user

2019-04-25 Thread Simon Déziel
I just test this in a container (Bionic host/4.15 and Disco guest) and I can confirm the problem and the solution. Here is how to easily reproduce (and workaround): apt-get install -y strongswan ipsec statusall # shows something == good sign cat << EOF >> /etc/strongswan.d/zz-charon-low-pr

[Bug 1826238] Re: apparmor doesn't allow to start with a non-root user

2019-04-25 Thread Simon Déziel
A better workaround until this is officially fixed might be to use the local/ includes like this: echo ' capability setpcap,' >> /etc/apparmor.d/local/usr.lib.ipsec.charon echo ' capability setpcap,' >> /etc/apparmor.d/local/usr.sbin.charon-systemd apparmor_parser -r -T -W /etc/apparmor.d

[Bug 1826238] Re: apparmor doesn't allow to start with a non-root user

2019-04-26 Thread Simon Déziel
Those dbus rules feel like something that should go in an abstraction. That said, neither strongswan nor strongswan-swanctl use the dynamicuser feature of systemd so it is just noise, or at least, that's my understanding. -- You received this bug notification because you are a member of Ubuntu Bu

[Bug 1827253] [NEW] [apparmor] missing 'mr' on binary for usage on containers

2019-05-01 Thread Simon Déziel
Public bug reported: Issue description: Enabling the rsyslog (disabled by default) Apparmor profile causes rsyslog to fail to start when running *inside a container*. Steps to reproduce: 1) Create a 'eoan' container called rs1 here: lxc launch ubuntu-daily:e rs1 2) Enter the container lxc s

[Bug 1823386] Re: [MRE] Please update to latest upstream release 7.2.17 & 7.3.4

2019-04-17 Thread Simon Déziel
** Description changed: Upstream has released microversions addressing security issues (pending CVE attribution) and other bug fixes. PHP 7.2.16 / 7.3.3 (07 Mar 2019): * The CVEs addressed were backported by the security team already PHP 7.2.17 / 7.3.4 (04 Apr 2019): - * http

[Bug 1819355] Re: package nginx 1.14.0-0ubuntu1.2 failed to install/upgrade: проблемы зависимостей — оставляем не настроенным

2019-03-10 Thread Simon Déziel
@Dmitry, this is a local problem it seems: Ќар 04 19:45:02 dimqakolyada nginx[5777]: nginx: [emerg] open() "/var/www/cookery/backend /log/access.log" failed (2: No such file or directory) ** Changed in: nginx (Ubuntu) Status: New => Invalid -- You received this bug notification becau

[Bug 1834416] Re: package nginx-core 1.10.3-0ubuntu0.16.04.3 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2019-06-27 Thread Simon Déziel
@Prakhar, nginx failed to start as something else was already bound to TCP/80: Jun 26 13:01:23 prakhar-HP-Notebook nginx[22776]: nginx: [emerg] listen() to [::]:80, backlog 511 failed (98: Address already in use) Jun 26 13:01:24 prakhar-HP-Notebook nginx[22776]: nginx: [emerg] listen() to 0.0.0.

Re: [Bug 1827253] Re: [apparmor] missing 'mr' on binary for usage on containers

2019-07-03 Thread Simon Déziel
On 2019-07-03 10:47 a.m., Christian Ehrhardt  wrote: > I feel bad that this hung around so log, but today I saw it and gave it a > review. > This is building in Eoan now. No worries for the delay, I know where to find you if something more critical is taking too long to my taste ;) Thank you Chr

[Bug 1836366] Re: [SRU] No Changes Rebuild in Bionic for OpenSSL compat reasons

2019-07-19 Thread Simon Déziel
I can confirm that it does work as expected with package 1.14.0-0ubuntu1.3 from bionic-proposed. I tested on my personal site. Before (1.2 and 1.3 work despite 1.3 not being explicitly enabled): $ echo q | openssl s_client -connect sdeziel.info:443 -tls1_2 -no_ign_eof 2>/dev/null | grep 'Cipher

[Bug 1832370] [NEW] Unable to configure or disable TLS 1.3 via openssl.cnf

2019-06-11 Thread Simon Déziel
Public bug reported: [Description] Since OpenSSL 1.1.1 was backported to Bionic, some (all?) applications gained access to TLS 1.3 by default. The applications that were not rebuilt against OpenSSL 1.1.1 can't tune the TLS 1.3 settings (protocol, ciphersuites selection, ciphersuites order) like i

[Bug 1832370] Re: Unable to configure or disable TLS 1.3 via openssl.cnf

2019-06-11 Thread Simon Déziel
In my tests, I used NGINX with those TLS related params: # grep -r ssl_ /etc/nginx/nginx.conf /etc/nginx/conf.d/ /etc/nginx/sites-enabled/ /etc/nginx/nginx.conf: ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE /etc/nginx/nginx.conf: ssl_prefer_server_ciphers on; /etc/nginx/c

[Bug 1832404] [NEW] sit tunnel should not require the local param

2019-06-11 Thread Simon Déziel
Public bug reported: [Description] When setting up a sit tunnel (with Hurricane Electric for example), one can use a netplan config like (https://netplan.io/examples#connecting- an-ip-tunnel) this: network: version: 2 ethernets: eth0: addresses: - 1.1.1.1/24 - "2001

[Bug 1832370] Re: Unable to configure or disable TLS 1.3 via openssl.cnf

2019-06-14 Thread Simon Déziel
@xnox, thanks it was indeed an error on my part. The key was to have openssl_conf in the default/unnamed section and then not introduce bogus values: Ciphers is not recognized and causes the config section to be ignored. I believe this bug could be marked as Invalid for all the releases but I'll l

[Bug 1828275] Re: [snap] chromium generates a lot of Apparmor noise

2019-06-20 Thread Simon Déziel
** Attachment added: "udev-data.list" https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1828275/+attachment/5271914/+files/udev-data.list -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1828275 T

[Bug 1806070] Re: snapd.seeded.service never completes preventing full boot to default target

2018-12-13 Thread Simon Déziel
I just realized now that this issue is preventing snap from refreshing all my snaps: $ sudo snap refresh lxd error: cannot refresh "lxd": snap "lxd" has "seed" change in progress An example of this is that lxd is stuck at version 3.2 while it should be at 3.7: $ snap info lxd | sed -n '/^channel

[Bug 1806070] Re: snapd.seeded.service never completes preventing full boot to default target

2018-12-13 Thread Simon Déziel
** Attachment added: "snapd's state.json" https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1806070/+attachment/5222003/+files/snapd-state.json.gz -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1

[Bug 1806070] Re: snapd.seeded.service never completes preventing full boot to default target

2018-12-13 Thread Simon Déziel
@pedronis: $ snap changes ID Status Spawn Ready Summary 31 Doing 2 days ago, at 09:31 EST - Initialize system state -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1806

[Bug 1806070] Re: snapd.seeded.service never completes preventing full boot to default target

2018-12-13 Thread Simon Déziel
** Attachment added: "'snap tasks 31' output" https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1806070/+attachment/5222005/+files/snap-tasks-31.gz -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/

[Bug 1806070] Re: snapd.seeded.service never completes preventing full boot to default target

2018-12-13 Thread Simon Déziel
@zyga, I'm happy to report the -proposed version fixed this bug and also allowed all my snap to be refreshed. Thanks for all your help, I really appreciate! $ sudo apt-get install snapd ... The following packages will be upgraded: snapd (2.34.2+18.04 => 2.35.5+18.04) $ snap version snap2.3

[Bug 1808576] [NEW] gnome-control-center segfaults when unit bolt.service is masked

2018-12-14 Thread Simon Déziel
Public bug reported: I don't have any Thunderbolt devices so I masked the unused the bolt.service. This causes problem with gnome-control-center. Steps to reproduce: 1) launch gnome-control-center $ gnome-control-center 2) navigate to Thunderbolt section go to Devices, then Thunderbolt and clos

[Bug 1771109] Re: Domain names containing emoji characters are not supported in console applications

2019-01-17 Thread Simon Déziel
wget has no problem with it: root@b1:~# wget 📙.la --2019-01-17 20:53:17-- http://xn--yt8h.la/ Resolving xn--yt8h.la (xn--yt8h.la)... 62.116.130.8 Connecting to xn--yt8h.la (xn--yt8h.la)|62.116.130.8|:80... connected. ... root@b1:~# curl 📙.la curl: (3) Failed to convert 📙.la to ACE; string contai

[Bug 1732030] Re: 'apt update' dies with seccomp error

2018-04-17 Thread Simon Déziel
It's already mentioned in the NEWS file but for those who would like to test the seccomp sanbox, all that's needed is: APT::Sandbox::Seccomp "true"; Thanks Julian -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchp

[Bug 1764807] [NEW] [wishlist] please add zfsutils-linux to the seed(s)

2018-04-17 Thread Simon Déziel
Public bug reported: For those using ZFS, it would sometimes be handy to have all the tooling available in the live environment. Currently, the live environment only has the kernel module which is unfortunately not enough to interact with this filesystem. ProblemType: Bug DistroRelease: Ubuntu 16

[Bug 1764950] Re: package nginx-core 1.10.3-1ubuntu3.1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2018-04-18 Thread Simon Déziel
@Mukesh, nginx refuses to start because it's missing its main config file (/etc/nginx/nginx.conf). Here's the error message: Apr 18 11:41:44 m nginx[8674]: nginx: [emerg] open() "/etc/nginx/nginx.conf" failed (2: No such file or directory) Have you deleted the file or the parent directory? **

[Bug 1785414] Re: Backport seccomp sandbox fixes to 18.04

2018-08-24 Thread Simon Déziel
I couldn't reproduce the problem with XZ_DEFAULTS=--threads=0 but according to [1], it requires xz-utils >= 5.2.3 and 18.04 has 5.2.2-1.3. I found no regression but I have NOT tested the ESET/VPN cases. 1: https://git.savannah.gnu.org/cgit/man- db.git/commit/?id=8fa6fb5eca612600b3a3d8da811f8345afe

[Bug 1787127] Re: java Corrupted page table

2018-08-15 Thread Simon Déziel
3.13.0-155-generic #205~lp1787127Commit6f4b6df5cb1 is bad here -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1787127 Title: java Corrupted page table To manage notifications about this bug go to: h

[Bug 1787191] Re: Crash due to BUG: Bad page map in process X & BUG: Bad rss-counter state X

2018-08-15 Thread Simon Déziel
*** This bug is a duplicate of bug 1787127 *** https://bugs.launchpad.net/bugs/1787127 3.13.0-155-generic #205~lp1787192Commit6f4b6df5cb1 is bad here -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/

[Bug 1787127] Re: java Corrupted page table

2018-08-15 Thread Simon Déziel
Not sure if that helps with the bisection but booting with l1tf=off doesn't help. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1787127 Title: java Corrupted page table To manage notifications abou

[Bug 1787127] Re: java Corrupted page table

2018-08-15 Thread Simon Déziel
@Phonon, you can either revert to 3.13.0-153-lowlatency or use the Xenial backported kernel (linux-lowlatency-lts-xenial) that isn't affected. Both solutions worked in our case. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://b

[Bug 1782226] Re: Allow NGINX to install but not start during postinst if another process is bound to port 80

2018-08-16 Thread Simon Déziel
I have not looked at the detection code but it might be possible to use "ss" instead of lsof to detect if anything listens on a given port. "ss" comes from iproute2 so it's more widely available. $ ss -nto state listening 'sport = 80' Recv-Q Send-Q Local Address:Port

[Bug 1787396] [NEW] ss crashes when using --no-header

2018-08-16 Thread Simon Déziel
Public bug reported: Steps to reproduce: 1) Listen on port 8989: $ nc -l 8989 & 2) Check that ss can list this listener: $ ss --no-header -nto state listening 'sport = 8989' 010.0.0.0:8989 0.0.0.0:* 3) Ask ss to list listeners on a port where nothing listens

[Bug 1787396] Re: ss crashes when using --no-header

2018-08-16 Thread Simon Déziel
This also happens on Cosmic that has the same version of ss/iproute2: # apt-cache policy iproute2 iproute2: Installed: 4.15.0-2ubuntu1 Candidate: 4.15.0-2ubuntu1 Version table: *** 4.15.0-2ubuntu1 500 500 http://archive.ubuntu.com/ubuntu cosmic/main amd64 Packages 100 /var/l

[Bug 1787396] Re: ss crashes when using --no-header

2018-08-16 Thread Simon Déziel
This is fixed in Debian since 4.16.0-4 at least. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1787396 Title: ss crashes when using --no-header To manage notifications about this bug go to: https:/

[Bug 1427807] Re: usermod's man refers to --*-sub-uids but accepts only --*-subuids

2018-08-17 Thread Simon Déziel
The bug is fixed in Bionic. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1427807 Title: usermod's man refers to --*-sub-uids but accepts only --*-subuids To manage notifications about this bug go

[Bug 1787127] Re: java Corrupted page table

2018-08-17 Thread Simon Déziel
I'm happy to report that 3.13.0-156.206 fixes the regression for us on Trusty. Many thanks to all that were involved in testing/fixing this bug! -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1787127 T

[Bug 1787801] Re: openvpn does not work with ecryptfs setup

2018-08-19 Thread Simon Déziel
Since upstream uses ProtectHome=true, I'd tend to think that having the config files in home directories is not that common even if it's certainly a valid use case. IMHO, this is a perfect case for using drop- in snippets: $ sudo systemctl edit openvpn@ Then enter the following: [Service] Pro

[Bug 1782226] Re: Allow NGINX to install but not start during postinst if another process is bound to port 80

2018-08-19 Thread Simon Déziel
I tested with 1.14.0-0ubuntu2.1~lp1782226.8 as well as 1.15.2-0ubuntu1 and both work well during installations/upgrades with or without something else binding TCPv4/80 or TCPv6/80. Thanks! -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu

[Bug 1666368] Re: [Ubuntu 16.04] nginx won't start on boot while network does not up yet

2018-08-19 Thread Simon Déziel
Also, if your local config does indeed require DNS to be resolvable when nginx starts, I see 2 possible fixes/workarounds for you. 1) you could use a systemd drop-in snippet to tune the startup order like you did in your patch. 2) you could put the IP(s) and DNS name(s) under /etc/hosts. This wil

[Bug 1666368] Re: [Ubuntu 16.04] nginx won't start on boot while network does not up yet

2018-08-19 Thread Simon Déziel
@stephon, the default vhost provided by the package doesn't produce a configuration that requires DNS resolution to start so could you share your nginx/vhost config? Please also share the journalctl entries for nginx. ** Changed in: nginx (Ubuntu) Status: New => Incomplete -- You received

Re: [Bug 1782226] Re: Allow NGINX to install but not start during postinst if another process is bound to port 80

2018-08-20 Thread Simon Déziel
On 2018-08-20 06:48 PM, Andres Rodriguez wrote: > Note that from a personal standpoint, I would have preferred on > depending on lsof provided that it provides a single binary, while > iproute2 provides a set of binaries that are really not needed when > installing nginx. AS such lsof would have pr

[Bug 1753470] Re: Postconf segfaults every 5 minutes

2018-08-22 Thread Simon Déziel
SRU verification on Bionic: root@bp1:~# dpkg -l| grep postfix ii postfix 3.3.0-1 amd64 High-performance mail transport agent root@bp1:~# sudo -u ubuntu /usr/sbin/postconf virtual_alias_map Segmentation fault root@bp1:~# apt-get -qq update && apt-get install -V postfix ... The following packa

[Bug 1772775] [NEW] 4.4.0-127.153 generates many "sit: non-ECT" messages

2018-05-22 Thread Simon Déziel
Public bug reported: Since deploying linux-image-4.4.0-127-generic (4.4.0-127.153) on a Xenial VM with a sit tunnel, I get such messages: May 22 10:49:38 gw kernel: [ 68.121601] sit: non-ECT from 0.0.0.0 with TOS=0x5 Those are logged quite often: # grep -cF 'sit: non-ECT' /var/log/syslog 9108

[Bug 1772775] Re: 4.4.0-127.153 generates many "sit: non-ECT" messages

2018-05-22 Thread Simon Déziel
Between 4.4.0-124.148 and 4.4.0-127.153, the following commits references "sit": - sit: reload iphdr in ipip6_rcv - ipv6: sit: better validate user provided tunnel names - ipv6 sit: work around bogus gcc-8 -Wrestrict warning -- You received this bug notification because you are a mem

[Bug 1772775] Re: 4.4.0-127.153 generates many "sit: non-ECT" messages

2018-05-22 Thread Simon Déziel
I don't know if that matters but I use fq_codel and have been for a long while. # sysctl net.core.default_qdisc net.core.default_qdisc = fq_codel ** Tags added: regression-update -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https:

[Bug 1772775] ProcCpuinfo.txt

2018-05-22 Thread Simon Déziel
apport information ** Attachment added: "ProcCpuinfo.txt" https://bugs.launchpad.net/bugs/1772775/+attachment/5143071/+files/ProcCpuinfo.txt -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1772775

[Bug 1772775] Re: 4.4.0-127.153 generates many "sit: non-ECT" messages

2018-05-22 Thread Simon Déziel
apport information ** Tags added: apport-collected ** Description changed: Since deploying linux-image-4.4.0-127-generic (4.4.0-127.153) on a Xenial VM with a sit tunnel, I get such messages: May 22 10:49:38 gw kernel: [ 68.121601] sit: non-ECT from 0.0.0.0 with TOS=0x5 Those a

[Bug 1772775] UdevDb.txt

2018-05-22 Thread Simon Déziel
apport information ** Attachment added: "UdevDb.txt" https://bugs.launchpad.net/bugs/1772775/+attachment/5143075/+files/UdevDb.txt -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1772775 Title: 4.

[Bug 1772775] ProcModules.txt

2018-05-22 Thread Simon Déziel
apport information ** Attachment added: "ProcModules.txt" https://bugs.launchpad.net/bugs/1772775/+attachment/5143074/+files/ProcModules.txt -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1772775

[Bug 1772775] ProcInterrupts.txt

2018-05-22 Thread Simon Déziel
apport information ** Attachment added: "ProcInterrupts.txt" https://bugs.launchpad.net/bugs/1772775/+attachment/5143073/+files/ProcInterrupts.txt -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/177

[Bug 1772775] WifiSyslog.txt

2018-05-22 Thread Simon Déziel
apport information ** Attachment added: "WifiSyslog.txt" https://bugs.launchpad.net/bugs/1772775/+attachment/5143076/+files/WifiSyslog.txt ** Changed in: linux (Ubuntu) Status: Incomplete => Confirmed -- You received this bug notification because you are a member of Ubuntu Bugs, whic

[Bug 1772775] ProcCpuinfoMinimal.txt

2018-05-22 Thread Simon Déziel
apport information ** Attachment added: "ProcCpuinfoMinimal.txt" https://bugs.launchpad.net/bugs/1772775/+attachment/5143072/+files/ProcCpuinfoMinimal.txt -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/

[Bug 1771650] Re: openvpn startup script isn't working in ubuntu 18.04

2018-05-23 Thread Simon Déziel
@Fanar, could you please attach the openvpn logs of the failed service start? You can collect them with: journalctl -u openvpn@myconfig > /tmp/openvpn-myconfig.log Thanks ** Changed in: openvpn (Ubuntu) Status: Confirmed => Incomplete -- You received this bug notification because you

[Bug 1772775] Re: 4.4.0-127.153 generates many "sit: non-ECT" messages

2018-05-23 Thread Simon Déziel
I just tested with linux-image-unsigned-4.17.0-041700rc6-generic (4.17.0-041700rc6.201805202330) and didn't see the message. ** Tags added: kernel-fixed-upstrea ** Changed in: linux (Ubuntu) Status: Incomplete => Confirmed -- You received this bug notification because you are a member of

[Bug 1772775] Re: 4.4.0-127.153 generates many "sit: non-ECT" messages

2018-05-23 Thread Simon Déziel
Thanks Joseph, this indeed fixes the issue. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1772775 Title: 4.4.0-127.153 generates many "sit: non-ECT" messages To manage notifications about this bug

[Bug 1771650] Re: openvpn startup script isn't working in ubuntu 18.04

2018-05-25 Thread Simon Déziel
What do you get from "systemctl -a | grep openvpn"? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1771650 Title: openvpn startup script isn't working in ubuntu 18.04 To manage notifications about t

[Bug 1771650] Re: openvpn startup script isn't working in ubuntu 18.04

2018-05-25 Thread Simon Déziel
Can you try to enable and start it with: sudo systemctl enable openvpn@myconfig sudo systemctl start openvpn@myconfig Then collect the logs as mentioned before, please? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.l

[Bug 1771545] Re: root.key might be missing

2018-05-25 Thread Simon Déziel
Currently, the root.key is managed by a helper script shipped with the unbound package. It would make sense to have the root.key managed automatically for apps relying on libunbound2 for DNS resolution. As such, I think a possible way to achieve this would be to have the helper script shipped with

[Bug 1771545] Re: root.key might be missing

2018-05-25 Thread Simon Déziel
Currently, the root.key is managed by a helper script shipped with the unbound package. It would make sense to have the root.key managed automatically for apps relying on libunbound2 for DNS resolution. As such, I think a possible way to achieve this would be to have the helper script shipped with

[Bug 1771545] Re: root.key might be missing

2018-05-27 Thread Simon Déziel
Reported to Debian: https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=900241 ** Bug watch added: Debian Bug tracker #900241 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900241 ** Also affects: unbound (Debian) via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900241 Importance:

[Bug 1773720] [NEW] CVE-2017-15105

2018-05-27 Thread Simon Déziel
Public bug reported: A flaw was found in the way unbound before 1.6.8 validated wildcard- synthesized NSEC records. An improperly validated wildcard NSEC record could be used to prove the non-existence (NXDOMAIN answer) of an existing wildcard record, or trick unbound into accepting a NODATA proof

[Bug 1773720] Re: CVE-2017-15105

2018-05-27 Thread Simon Déziel
** Information type changed from Public to Public Security ** Patch added: "bionic-lp1773720.debdiff" https://bugs.launchpad.net/ubuntu/+source/unbound/+bug/1773720/+attachment/5145370/+files/bionic-lp1773720.debdiff -- You received this bug notification because you are a member of Ubuntu Bu

[Bug 1773720] Re: CVE-2017-15105

2018-05-27 Thread Simon Déziel
** Patch added: "artful-lp1773720.debdiff" https://bugs.launchpad.net/ubuntu/+source/unbound/+bug/1773720/+attachment/5145371/+files/artful-lp1773720.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.ne

[Bug 1773720] Re: CVE-2017-15105

2018-05-27 Thread Simon Déziel
** Patch added: "xenial-lp1773720.debdiff" https://bugs.launchpad.net/ubuntu/+source/unbound/+bug/1773720/+attachment/5145372/+files/xenial-lp1773720.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.ne

[Bug 1773720] Re: CVE-2017-15105

2018-05-27 Thread Simon Déziel
I've attached debdiffs for Xenial to Bionic. Please let me know if something needs a rework. For Cosmic, all that's needed is a sync from Debian. Merge-o-matic didn't do it due to the Ubuntu delta but fortunately this delta was adopted by Debian with Unbound 1.7.1-1. Should I open a new LP to ask

<    1   2   3   4   5   6   7   8   9   10   >