Re: [LEDE-DEV] Enable DCO check on Github OpenWrt organisation

2018-05-08 Thread Etienne Champetier
Hi All, 2018-01-18 13:59 GMT-08:00 Etienne Champetier : > Hi All, > > Could someone enable this https://github.com/integration/dco on the > whole OpenWrt github org? (or at least on the packages repo) Friendly ping (I'm only a "member" not an "owner" (

Re: [LEDE-DEV] [PATCH v2] build: log time taken by each packages/steps

2018-05-01 Thread Etienne Champetier
Hi John, 2018-05-01 2:47 GMT-07:00 John Crispin : > > > On 30/04/18 21:55, Etienne Champetier wrote: >> >> The idea is to easily get the list of packages taking the most time to >> build, >> and see if we can improve them >> >> v1: Use SetupHostCo

[LEDE-DEV] [PATCH v2] build: log time taken by each packages/steps

2018-04-30 Thread Etienne Champetier
The idea is to easily get the list of packages taking the most time to build, and see if we can improve them v1: Use SetupHostCommand as recommended by John v2: add space after 'time:', remove useless /usr/bin/time from SetupHostCommand Signed-off-by: Etienne Champetier --- incl

Re: [LEDE-DEV] [PATCH] build: log time taken by each packages/steps

2018-04-30 Thread Etienne Champetier
Hi John, 2018-04-29 23:41 GMT-07:00 John Crispin : > > > On 31/03/18 06:22, Etienne Champetier wrote: >> >> The idea is to easily get the list of packages taking the most time to >> build, >> and see if we can improve them >> >> Use SetupHostComma

Re: [LEDE-DEV] [PATCH] build: log time taken by each packages/steps

2018-04-30 Thread Etienne Champetier
Hi Florian, 2018-04-04 9:44 GMT-07:00 Florian Fainelli : > Hi Etienne, > > On 03/30/2018 09:22 PM, Etienne Champetier wrote: >> The idea is to easily get the list of packages taking the most time to build, >> and see if we can improve them > > I like the idea a lot

Re: [LEDE-DEV] Ubnt Bullet M2 flashing ?

2018-04-30 Thread Etienne Champetier
et M2 flashing ? > > I have not been able to figure out a way to do it. > > > On 04/18/2018 02:14 PM, Etienne Champetier wrote: >> Hi All, >> >> Is it still possible to flash latest ubnt bullet m2 with OpenWRT? (AirOS 6.X) >> Is it possible to downgrade to 5.5.10 f

Re: [LEDE-DEV] [openwrt/openwrt] ar71xx: Ubiquiti Airmax M: add relocate-kernel to invalidate cache

2018-04-26 Thread Etienne Champetier
2018-04-26 13:10 GMT-07:00 Matthias Schiffer : > On 04/26/2018 09:22 PM, Etienne Champetier wrote: >> Hi Matthias, >> >> 2018-04-26 11:43 GMT-07:00 LEDE Commits : >>> neoraider pushed a commit to openwrt/openwrt.git, branch lede-17.01: &g

Re: [LEDE-DEV] [openwrt/openwrt] ar71xx: Ubiquiti Airmax M: add relocate-kernel to invalidate cache

2018-04-26 Thread Etienne Champetier
Hi Matthias, 2018-04-26 11:43 GMT-07:00 LEDE Commits : > neoraider pushed a commit to openwrt/openwrt.git, branch lede-17.01: > https://git.lede-project.org/eed9d40133fe6468cc253d0345c7d7332d2aaa7c > > commit eed9d40133fe6468cc253d0345c7d7332d2aaa7c > Author: Matthias Schiffer > AuthorDate: Thu A

[LEDE-DEV] Ubnt Bullet M2 flashing ?

2018-04-18 Thread Etienne Champetier
Hi All, Is it still possible to flash latest ubnt bullet m2 with OpenWRT? (AirOS 6.X) Is it possible to downgrade to 5.5.10 from the 6.X versions ? is it still required ? The wiki is not really up to date: https://openwrt.org/toh/ubiquiti/bullet And I've tried to ask on the forum but no luck :( h

Re: [LEDE-DEV] Revamping ipcalc.sh

2018-04-05 Thread Etienne Champetier
Hi Philippe, 2018-04-05 16:31 GMT-03:00 Philip Prindeville : > Hi all, > > What do people think of (a) rewriting ipcalc.sh to be in C instead, and (b) > allowing it to perform multiple operations either with flags or perhaps with > symlinks and examining argv[0] a la busybox? > > It isn’t used i

Re: [LEDE-DEV] [PATCH] build: log time taken by each packages/steps

2018-04-04 Thread Etienne Champetier
Hi Florian, 2018-04-04 13:44 GMT-03:00 Florian Fainelli : > Hi Etienne, > > On 03/30/2018 09:22 PM, Etienne Champetier wrote: >> The idea is to easily get the list of packages taking the most time to build, >> and see if we can improve them > > I like the idea a lot

[LEDE-DEV] [PATCH] build: log time taken by each packages/steps

2018-03-30 Thread Etienne Champetier
The idea is to easily get the list of packages taking the most time to build, and see if we can improve them Use SetupHostCommand as recommended by John Signed-off-by: Etienne Champetier --- include/prereq-build.mk | 5 + include/subdir.mk | 1 + 2 files changed, 6 insertions

Re: [LEDE-DEV] AuthSAE for mesh authentication

2018-02-26 Thread Etienne Champetier
Hi Bill, https://github.com/openwrt/openwrt/commit/8061c62f5d598fcbc7e08a8cc8728be55d236eab 2018-02-26 11:46 GMT-08:00 Bill Moffitt : > I have downloaded a few recent nightly builds, and AuthSAE seems to be > missing from the packages. > > What happened? How can we get it back? > > Thanks, > > Bi

Re: [LEDE-DEV] [PATCH] [RFC] build: log time taken by each packages/steps

2018-01-22 Thread Etienne Champetier
Hi John, agreed, I was pretty sure there was/is a better way ;) i'll not have any time until next week, so if you or anyone want to implement it please do Regards Etienne 2018-01-22 9:23 GMT+01:00 John Crispin : > > > On 21/01/18 00:01, Etienne Champetier wrote: >> >>

[LEDE-DEV] [PATCH] [RFC] build: log time taken by each packages/steps

2018-01-20 Thread Etienne Champetier
The idea is to easily get the list of packages taking the most time to build, and see if we can improve them Sending as RFC as this is a quick hack that might break in some case (different implementation of time) Signed-off-by: Etienne Champetier --- include/subdir.mk | 3 ++- 1 file changed

Re: [LEDE-DEV] [OpenWrt-Devel] Enable DCO check on Github OpenWrt organisation

2018-01-19 Thread Etienne Champetier
Hi Piotr, 2018-01-19 9:54 GMT+01:00 Piotr Dymacz : > Hi Etienne, > > On 18.01.2018 22:59, Etienne Champetier wrote: >> >> Hi All, >> >> Could someone enable this https://github.com/integration/dco on the >> whole OpenWrt github org? (or at least on the pac

Re: [LEDE-DEV] [OpenWrt-Devel] patchwork

2018-01-18 Thread Etienne Champetier
Hi All, 2018-01-18 1:30 GMT-08:00 Piotr Dymacz : > Hi, > > On 18.01.2018 09:44, Jo-Philipp Wich wrote: >> >> Hi John, Alex, >> >> I have no problem with closing / autorejecting open tickets in patchwork >> as long as they somehow remain available for future reference. > > > ACK. > > Would it be po

[LEDE-DEV] Enable DCO check on Github OpenWrt organisation

2018-01-18 Thread Etienne Champetier
Hi All, Could someone enable this https://github.com/integration/dco on the whole OpenWrt github org? (or at least on the packages repo) Thanks Etienne ___ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.infradead.org/mailman/listinfo/l

Re: [LEDE-DEV] [PATCH] bcm53xx: use iflag=skip_bytes for dd command during sysupgrade

2017-12-25 Thread Etienne Champetier
Hi Rafal, 2017-12-25 5:18 GMT-08:00 Rafał Miłecki : > On 2017-12-24 00:26, Etienne Champetier wrote: >> >> 2017-12-23 14:14 GMT-08:00 Rafał Miłecki : >>> >>> From: Rafał Miłecki >>> >>> Since BusyBox 1.25.0 dd command supports iflag=skip_bytes

Re: [LEDE-DEV] [PATCH] bcm53xx: use iflag=skip_bytes for dd command during sysupgrade

2017-12-23 Thread Etienne Champetier
Hi Rafal, 2017-12-23 14:14 GMT-08:00 Rafał Miłecki : > From: Rafał Miłecki > > Since BusyBox 1.25.0 dd command supports iflag=skip_bytes which allows > skipping requested amount of bytes without reducing blocksize. Thanks to > this we can leave default blocksize and let dd work more efficiently.

Re: [LEDE-DEV] Travis broken?

2017-08-19 Thread Etienne Champetier
Hi Philip, Alexander, 2017-08-19 14:39 GMT-07:00 Alexander Couzens : > > On Sat, 19 Aug 2017 13:29:54 -0600 > Philip Prindeville wrote: > > > Github is trying to CI test a change to PHP7 and it’s never > > completing, even after 50 minutes of build time: > > > > https://travis-ci.org/openwrt/pack

Re: [LEDE-DEV] mwan3 not working

2017-05-13 Thread Etienne Champetier
Hi Mauro, 2017-05-13 4:51 GMT-07:00 Mauro Mozzarelli : > Thanks Yousong, Merci Etienne, > > > I updated and rebuilt with the fix r4117 and I already communicated to > Etienne that this fixes MWAN Interface Systemlog (this now shows), but both > my interfaces remain marked as offline and red, when

Re: [LEDE-DEV] mwan3 not working

2017-05-12 Thread Etienne Champetier
Hi Mauro, Please open a ticket at https://github.com/openwrt/packages/ If you can put mwan3 version (not lede) that would help a lot Regards Etienne 2017-05-12 15:03 GMT-07:00 Mauro Mozzarelli : > The last time I built lede it was r4041 > > Today I updated to r4116 and mwan3 no longer works. > >

Re: [LEDE-DEV] [PATCH][opkg-lede] opkg: add --force-ssl argument

2017-05-11 Thread Etienne Champetier
Hi Alexandru, 2017-05-11 7:59 GMT-07:00 Alexandru Ardelean : > For cases when artifacts are stored on https:// accessible > location and you don't want to install ca-certificates > (for various reasons). > > I'll admit, using SSL like this is not recommended, > but since wget (even uclient-fetch)

Re: [LEDE-DEV] LEDE re-saving entropy in /etc/urandom.seed only seconds after each boot?

2017-02-19 Thread Etienne Champetier
ram startup. The only thing that change in all you list is time (you often get the same IP via DHCP), so not much entropy. Saving a seed each time is simple and safe, and I personally (and i hope many others) have multiple month uptime on my routers, so I'm not overusing the flash Regards Et

Re: [LEDE-DEV] LEDE re-saving entropy in /etc/urandom.seed only seconds after each boot?

2017-02-18 Thread Etienne Champetier
Hi Kostas, In general you should always add lede-dev so that more people can answer and/or benefit from the answer 2017-02-18 13:38 GMT-08:00 Kostas Papadopoulos : > > > Etienne/John, I'd like to say that I very much appreciate your contributions > to OpenWrt/LEDE on improving its security, but I

Re: [LEDE-DEV] anonymous stats / was: Release Candidate Test Plan - first draft

2017-02-07 Thread Etienne Champetier
2017-02-07 7:40 GMT-08:00 Bastian Bittorf : > * Etienne Champetier [07.02.2017 16:27]: >> not a fan of leaking revision number on public network by default (if >> you are connected to public wifi or ...) > > This is a valid point somehow, but: > because model and rev

Re: [LEDE-DEV] Release Candidate Test Plan - first draft

2017-02-07 Thread Etienne Champetier
Hi All, 2017-02-07 1:27 GMT-08:00 Bastian Bittorf : > * Giuseppe Lippolis [07.02.2017 10:00]: >> My proposal for the anonymous datacollection is to send >> 1) an UDP telegram with sysupgraded.$boardname at the end of the sysupgrade >> 2) an UDP telegram with firstboot.$boardname at the end of the

Re: [LEDE-DEV] [PATCH ubox] cmake: Check for getrandom system call

2017-02-04 Thread Etienne Champetier
Ack Thanks Florian 2017-02-04 18:41 GMT-08:00 Florian Fainelli : > In case we are building against a kernel that is too old and does not > support SYS_getrandom, error out with a message indicating so. > > Signed-off-by: Florian Fainelli > --- > CMakeLists.txt | 15 +++ > 1 file chan

Re: [LEDE-DEV] [PATCH v2] procd: update procd.sh to support both: signal-names and signal-numbers

2017-01-13 Thread Etienne Champetier
2017-01-13 10:12 GMT-08:00 Bastian Bittorf : > * Etienne Champetier [13.01.2017 19:07]: >> > A real world example is signal 10, which is BUS on ramips and USR1 on PPC. >> >> If we know supporting signal number will lead to bug, why not remove it? > > for th

Re: [LEDE-DEV] [PATCH v2] procd: update procd.sh to support both: signal-names and signal-numbers

2017-01-13 Thread Etienne Champetier
Hi Bastian, 2017-01-13 9:28 GMT-08:00 Bastian Bittorf : > It is automatically detected if the input is an integer. If not, > the name is converted to the corresonding number. In general it's > good style to use names (readability) and it's more portable: signal > numbers can be architecture-depen

Re: [LEDE-DEV] Fading out PolarSSL

2017-01-03 Thread Etienne Champetier
Hi, 2017-01-03 4:22 GMT-08:00 Jo-Philipp Wich : > Hi list, > > the mbed TLS project (formerly known as PolarSSL) declared the mbedTLS > 1.3 branch (packaged as "libpolarssl" by LEDE) to be EOL with the end of > the year 2016. [1] > > In order to avoid shipping an outdated and possibly vulnerable S

Re: [LEDE-DEV] sqm-scripts change GitHub link to https:// instead of git://

2017-01-02 Thread Etienne Champetier
(forgot to send in plain text, sending again for the ML) Hi Nick, 2017-01-02 17:02 GMT-08:00 Nick Kamenyitzky : > > Is there any reason that the sqm-scripts makefile has a git:// link > instead of a https:// link? At my office git:// doesn't work but > https:// does. > > Should this be something

[LEDE-DEV] [PATCH procd] ujail: add basic /dev files

2016-12-29 Thread Etienne CHAMPETIER
This adds /dev/full /dev/null /dev/urandom /dev/zero in every jail (not having them only allow subtle bugs) Signed-off-by: Etienne CHAMPETIER --- jail/jail.c | 5 + 1 file changed, 5 insertions(+) diff --git a/jail/jail.c b/jail/jail.c index 834d677..8e7cddc 100644 --- a/jail/jail.c +++ b

Re: [LEDE-DEV] [source] procd: update to the latest version, fixes killing jailed processes

2016-12-02 Thread Etienne Champetier
igured. I would also change the debug message to a warning or error so this end up in system log for easier debugging Regards Etienne > > - Felix > > On 2016-12-02 15:25, Etienne Champetier wrote: > > Hi Felix, > > > > Just had a look at the code and 1sec of timeout

Re: [LEDE-DEV] [PATCH ubox] getrandom: Define SYS_getrandom if no definition exists

2016-09-21 Thread Etienne Champetier
Hi Florian, 2016-09-18 21:36 GMT+02:00 Florian Fainelli : > > Le 18/09/2016 à 12:06, Etienne Champetier a écrit : > > (Answering from my phone with gmail so this email is in HTML and will > > get bounced by the ML) > > > > Le 18 sept. 2016 14:03, "John Crisp

[LEDE-DEV] [PATCH v2] base-files: use procd init for urandom_seed

2016-07-20 Thread Etienne CHAMPETIER
Previous implementation was blocking the init and breaking halt/reboot/sysupgrade (reported by Daniel Golle) v2: use procd logging, use set -e + trap for error handling Signed-off-by: Etienne CHAMPETIER --- package/base-files/files/etc/init.d/urandom_seed | 33 ++-- package

[LEDE-DEV] [PATCH] base-files: use procd init for urandom_seed

2016-07-19 Thread Etienne CHAMPETIER
Previous implementation was blocking the init and breaking halt/reboot/sysupgrade (reported by Daniel Golle) Signed-off-by: Etienne CHAMPETIER --- package/base-files/files/etc/init.d/urandom_seed | 29 package/base-files/files/sbin/urandom_seed | 19

Re: [LEDE-DEV] [PATCH v5] base-files: seed /dev/urandom

2016-07-19 Thread Etienne Champetier
.seed in >> > package/base-files/files/lib/upgrade/keep.d/base-files-essential to keep on >> > sysupgrade? Or would this break if the file does not exist? In that case, >> > it >> > might be useful to make a note to add it to /etc/sysupgrade.conf if the >> &

Re: [LEDE-DEV] [PATCH v5] base-files: seed /dev/urandom

2016-07-18 Thread Etienne Champetier
2016-07-19 7:40 GMT+02:00 Etienne Champetier : > 2016-07-19 7:09 GMT+02:00 Jo-Philipp Wich : >> Hi Daniel, >> >> interesting failure mode ;( >> >> To me it seems the easiest fix is changing the getrandom syscall wrapper >> utility to use the GRND_NONBLO

Re: [LEDE-DEV] [PATCH v5] base-files: seed /dev/urandom

2016-07-18 Thread Etienne Champetier
2016-07-19 7:09 GMT+02:00 Jo-Philipp Wich : > Hi Daniel, > > interesting failure mode ;( > > To me it seems the easiest fix is changing the getrandom syscall wrapper > utility to use the GRND_NONBLOCK flag in order to be interruptible by > signals. > > Thoughts? According to the man page it's alre

Re: [LEDE-DEV] Mirror Hosting Offer

2016-07-04 Thread Etienne Champetier
Hi Chris, 2016-07-04 18:36 GMT+02:00 Chris Blake : > Hello LEDE Project, > > I am reaching out to see if there is any interest for mirror hosting > as my employer, DigitalOcean, would love to help support the LEDE > Project. If you (LEDE Maintainers) have an account on our platform > currently, or

Re: [LEDE-DEV] [PATCH v5] base-files: seed /dev/urandom

2016-06-28 Thread Etienne Champetier
We can keep /etc/urandom.seed on upgrade, be we shouldn't include it in config backup > >>> On 06/27/2016 05:53 PM, Etienne CHAMPETIER wrote: >>>> >>>> This commit: >>>> 1) seed /dev/urandom with the saved seeds as early as possible >>&

[LEDE-DEV] [PATCH v5] base-files: seed /dev/urandom

2016-06-27 Thread Etienne CHAMPETIER
on generic function name for logging, as /lib/preinit/ files are all sourced together in /etc/preinit v4: after a lot of discussion on the ML, use a uci config param v5: config param is now the path of the seed Signed-off-by: Etienne CHAMPETIER --- package/base-files/files/bin/config_genera

Re: [LEDE-DEV] [PATCH v4] base-files: seed /dev/urandom

2016-06-23 Thread Etienne Champetier
2016-06-23 17:05 GMT+02:00 Jo-Philipp Wich : > Hi. > >> why put multiple possibly unrelated functions under one option? > > To have a global "write to flash is okay" option instead of needing to > change different options with different semantics in different places. if it's disabled by default i

Re: [LEDE-DEV] [PATCH v4] base-files: seed /dev/urandom

2016-06-23 Thread Etienne Champetier
Hi Daniel, 2016-06-23 17:19 GMT+02:00 Daniel Gimpelevich : > On Thu, 2016-06-16 at 09:38 +0000, Etienne CHAMPETIER wrote: >> +SEED=/etc/urandom.seed >> + >> +error_exit() { >> +logger -t urandom_seed "$1" >> +exit 1 >> +} >> + &g

Re: [LEDE-DEV] [PATCH v4] base-files: seed /dev/urandom

2016-06-23 Thread Etienne Champetier
2016-06-23 16:08 GMT+02:00 Jo-Philipp Wich : > Hi, > > if we plan to attach multiple functions to the option (e.g. persistent > lease file) then it would probably make sense to give it a generic name, > e.g. > > "option persist 0/1" > > or > > "option save_state 0/1" why put multiple possibly un

Re: [LEDE-DEV] [PATCH v4] base-files: seed /dev/urandom

2016-06-23 Thread Etienne Champetier
Hi all, 2016-06-22 10:12 GMT+02:00 Kevin Darbyshire-Bryant : > > > On 22/06/16 08:50, John Crispin wrote: >> >> > >> >> write_urandom_seed_on_boot was a placeholder for what the option should >> be named as i could not think of a good one ;) please try to find a >> shorter one >> >> John

[LEDE-DEV] ujail bug/feature with file replacement with mv

2016-06-16 Thread Etienne Champetier
Hi, Just a heads up, ujail uses "bind mount" to include file and directories into the jail, so if you include a file named aaa (procd_add_jail_mount(_rw) aaa), and then replace it outside of the jail using "mv bbb aaa", in the jail you will still have file aaa. Workaround is to use a directory in

[LEDE-DEV] [PATCH v4] base-files: seed /dev/urandom

2016-06-16 Thread Etienne CHAMPETIER
messages to /dev/kmsg v3: use non generic function name for logging, as /lib/preinit/ files are all sourced together in /etc/preinit v4: after a lot of discussion on the ML, use a config param Signed-off-by: Etienne CHAMPETIER --- package/base-files/files/bin/config_generate | 1 +

[LEDE-DEV] [PATCH] make /var/{run, lock, state} not world writable (0755)

2016-06-16 Thread Etienne CHAMPETIER
since commit be950c5e56b86509e1e237931d0ac8203372be82 (09/03/2013) /var/{run,lock,state} are world writable (0777) which is a security issue before that they were created by /etc/init.d/boot with normal permissions (0755), so revert to that state Signed-off-by: Etienne CHAMPETIER --- initd

[LEDE-DEV] /var/run world writable

2016-06-16 Thread Etienne Champetier
Hi, since this procd commit from 2013 https://git.lede-project.org/?p=project/procd.git;a=blob;f=early.c;h=063e1a6abcc8ecdf22b9c8c11b2e81cc2460bcea;hb=be950c5e56b86509e1e237931d0ac8203372be82 /var/run (also /var/state and /var/lock) is world writable, with no sticky bit, which means unpriviledge

Re: [LEDE-DEV] [PATCH] base-files: seed /dev/urandom

2016-06-14 Thread Etienne Champetier
2016-06-14 21:15 GMT+03:00 David Lang : > On Tue, 14 Jun 2016, Etienne Champetier wrote: > >> Hi David, >> >> 2016-06-14 20:21 GMT+03:00 David Lang : >>> >>> On Tue, 14 Jun 2016, Etienne Champetier wrote: >>> >>>> 2016-06-14 9:08

Re: [LEDE-DEV] [PATCH] base-files: seed /dev/urandom

2016-06-14 Thread Etienne Champetier
Hi David, 2016-06-14 20:21 GMT+03:00 David Lang : > On Tue, 14 Jun 2016, Etienne Champetier wrote: > >> 2016-06-14 9:08 GMT+02:00 Felix Fietkau : >>> >>> On 2016-06-13 22:10, Etienne Champetier wrote: >>>> >>>> Hi John, Fe

Re: [LEDE-DEV] [PATCH] base-files: seed /dev/urandom

2016-06-14 Thread Etienne Champetier
2016-06-14 9:08 GMT+02:00 Felix Fietkau : > On 2016-06-13 22:10, Etienne Champetier wrote: >> Hi John, Felix, >> >> 2016-06-13 13:55 GMT+02:00 John Crispin : >>> >>> >>> On 13/06/2016 00:56, Etienne Champetier wrote: >>>> Hi Felix, >&g

Re: [LEDE-DEV] [PATCH] base-files: seed /dev/urandom

2016-06-13 Thread Etienne Champetier
Hi John, Felix, 2016-06-13 13:55 GMT+02:00 John Crispin : > > > On 13/06/2016 00:56, Etienne Champetier wrote: >> Hi Felix, >> >> 2016-06-12 12:45 GMT+02:00 Felix Fietkau : >>> On 2016-06-11 08:37, Etienne CHAMPETIER wrote: >>>> This commit: >>

[LEDE-DEV] [PATCH v3] base-files: seed /dev/urandom

2016-06-13 Thread Etienne CHAMPETIER
in /etc/preinit Signed-off-by: Etienne CHAMPETIER --- package/base-files/files/etc/init.d/urandom_seed | 22 ++ .../base-files/files/lib/preinit/81_urandom_seed | 19 +++ 2 files changed, 41 insertions(+) create mode 100755 package/base-files/files/etc/init.d/ur

Re: [LEDE-DEV] [PATCH] base-files: seed /dev/urandom

2016-06-12 Thread Etienne Champetier
Hi Felix, 2016-06-12 12:45 GMT+02:00 Felix Fietkau : > On 2016-06-11 08:37, Etienne CHAMPETIER wrote: >> This commit: >> 1) seed /dev/urandom with a saved seed as early as possible >>(using /lib/preinit/81_urandom_seed) >> 2) save a new seed using getrandom()

[LEDE-DEV] [PATCH v2] base-files: seed /dev/urandom

2016-06-12 Thread Etienne CHAMPETIER
ut we can now ignore them if after "urandom-seed: Seeding with ..." message We could also add an urandom.seed at build time to improve first boot v2: log preinit messages to /dev/kmsg Signed-off-by: Etienne CHAMPETIER --- package/base-files/files/etc/init.d/urandom_seed | 22

[LEDE-DEV] [PATCH] base-files: seed /dev/urandom

2016-06-10 Thread Etienne CHAMPETIER
ut we can now ignore them We could also add an urandom.seed at build time to improve first boot Signed-off-by: Etienne CHAMPETIER --- package/base-files/files/etc/init.d/urandom_seed | 22 ++ .../base-files/files/lib/preinit/81_urandom_seed | 15 +++ 2 files ch

Re: [LEDE-DEV] [PATCH ubox] getrandom: add helper for getrandom() syscall

2016-06-09 Thread Etienne Champetier
Hi, Everything is fine except your computer clock ;) ubox commit: authorEtienne CHAMPETIER Thu, 9 Jun 2016 16:03:00 +0300 (13:03 +) committerJohn Crispin Wed, 8 Jun 2016 01:19:24 +0300 (00:19 +0200) staging commit: authorJohn Crispin Wed, 8 Jun 2016 01:22:16 +0300

[LEDE-DEV] [PATCH ubox] getrandom: add helper for getrandom() syscall

2016-06-09 Thread Etienne CHAMPETIER
: Etienne CHAMPETIER --- CMakeLists.txt | 5 + getrandom.c| 58 ++ 2 files changed, 63 insertions(+) create mode 100644 getrandom.c diff --git a/CMakeLists.txt b/CMakeLists.txt index 834b5b6..73e8753 100644 --- a/CMakeLists.txt +++ b

Re: [LEDE-DEV] [PATCH] urandom-seed: add initial implementation

2016-06-03 Thread Etienne Champetier
Hi John, 2016-06-03 11:00 GMT+02:00 John Crispin : > Hi Etienne, > > comment inline ... > > On 02/06/2016 23:21, Etienne CHAMPETIER wrote: >> This package: >> 1) seed /dev/urandom with a saved seed as early as possible >> (using /lib/preinit/81_urandom_

Re: [LEDE-DEV] git.openwrt.org site half broken

2016-06-03 Thread Etienne Champetier
2016-06-03 11:13 GMT+02:00 John Crispin : > > > On 02/06/2016 13:20, Etienne Champetier wrote: >> Hi, >> >> someone messed with git.openwrt.org nginx config, i can't get the js and css. >> >> see https://git.openwrt.org/project/static/gitweb.css (

[LEDE-DEV] [PATCH] urandom-seed: add initial implementation

2016-06-02 Thread Etienne CHAMPETIER
ut we can now ignore them Once tested on enough configuration (jffs2/ext4/ubifs/...) this package should be added to DEFAULT_PACKAGES We could also add an urandom.seed at build time to improve first boot Signed-off-by: Etienne CHAMPETIER --- package/utils/urandom-seed/Makefile

[LEDE-DEV] git.openwrt.org site half broken

2016-06-02 Thread Etienne Champetier
Hi, someone messed with git.openwrt.org nginx config, i can't get the js and css. see https://git.openwrt.org/project/static/gitweb.css (doesn't look like a css :) ) Cheers Etienne ___ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.in

[LEDE-DEV] urandom seed & /etc mount time

2016-06-01 Thread Etienne Champetier
Hi, i'm thinking about adding a urandom seed like any distro do, just need to know when /etc is first monted (inside procd or via init scripts?) Regards Etienne ___ Lede-dev mailing list Lede-dev@lists.infradead.org http://lists.infradead.org/mailman/l

[LEDE-DEV] [PATCH procd] jail: don't always CLONE_NEWUTS

2016-06-01 Thread Etienne CHAMPETIER
no -h => no CLONE_NEWUTS -h "" => CLONE_NEWUTS -h "newjailhostname" => CLONE_NEWUTS + sethostname Signed-off-by: Etienne CHAMPETIER --- jail/jail.c | 9 + 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/jail/jail.c b/jail/jail.c index e4252

Re: [LEDE-DEV] [PATCH procd 7/7] jail: don't CLONE_NEWUTS if we don't change hostname

2016-05-30 Thread Etienne Champetier
gt; no CLONE_NEWUTS -h => CLONE_NEWUTS -h => CLONE_NEWUTS + sethostname() CLONE_NEWUTS is not a security feature, sethostname() require CAP_SYS_ADMIN which allow you to escape jail (mknod + mount for exemple) Etienne > > John > > > On 30/05/2016 01:39, Etienne CHAMPETIER

[LEDE-DEV] [PATCH procd 3/7] jail: call build_envp() just before execve()

2016-05-29 Thread Etienne CHAMPETIER
Signed-off-by: Etienne CHAMPETIER --- jail/jail.c | 8 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/jail/jail.c b/jail/jail.c index 95d6237..e86ee14 100644 --- a/jail/jail.c +++ b/jail/jail.c @@ -230,10 +230,6 @@ and will only drop capabilities/apply seccomp filter.\n

[LEDE-DEV] [PATCH procd 5/7] jail: improve some logs

2016-05-29 Thread Etienne CHAMPETIER
Signed-off-by: Etienne CHAMPETIER --- jail/fs.c | 4 ++-- jail/jail.c | 14 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/jail/fs.c b/jail/fs.c index f390180..c4cdcc9 100644 --- a/jail/fs.c +++ b/jail/fs.c @@ -86,7 +86,7 @@ static int add_script_interp(const

[LEDE-DEV] [PATCH procd 6/7] jail: ensure mounts are not MS_SHARED to avoid pivot_root() failure

2016-05-29 Thread Etienne CHAMPETIER
By default mounts are MS_PRIVATE (kernel default) but systemd decided to make it MS_SHARED by default since v188 https://github.com/systemd/systemd/commit/b3ac5f8cb98757416d8660023d6564a7c411f0a0 This patch fixes ujail on systemd distro (useful for development at least). Signed-off-by: Etienne

[LEDE-DEV] [PATCH procd 4/7] jail: don't include capabilities config (-C) inside the jail

2016-05-29 Thread Etienne CHAMPETIER
Removing capabilities from the capability bounding set doesn't change the capability effective set, so we can "drop capabilities" before we build the jail fs, so we don't need to include the capabilities config file into the jail. Signed-off-by: Etienne CHAMPETIER -

[LEDE-DEV] [PATCH procd 2/7] jail: regroup add_path_and_deps() calls

2016-05-29 Thread Etienne CHAMPETIER
we are already calling add_path_and_deps() while parsing -r/-w options, so move the 2 remaining calls into main() Signed-off-by: Etienne CHAMPETIER --- jail/jail.c | 20 ++-- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/jail/jail.c b/jail/jail.c index 8157a8f

[LEDE-DEV] [PATCH procd 1/7] jail: call chdir(/) after pivot_root()

2016-05-29 Thread Etienne CHAMPETIER
pivot_root(2) man page recommend calling chdir(/), so do it Signed-off-by: Etienne CHAMPETIER --- jail/jail.c | 4 1 file changed, 4 insertions(+) diff --git a/jail/jail.c b/jail/jail.c index 541363a..8157a8f 100644 --- a/jail/jail.c +++ b/jail/jail.c @@ -162,6 +162,10 @@ static int

[LEDE-DEV] [PATCH procd 7/7] jail: don't CLONE_NEWUTS if we don't change hostname

2016-05-29 Thread Etienne CHAMPETIER
Signed-off-by: Etienne CHAMPETIER --- jail/jail.c | 7 --- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/jail/jail.c b/jail/jail.c index e425254..926e42c 100644 --- a/jail/jail.c +++ b/jail/jail.c @@ -386,9 +386,10 @@ int main(int argc, char **argv) uloop_init

Re: [LEDE-DEV] running stuff as !root

2016-05-18 Thread Etienne Champetier
Hi again, 2016-05-18 10:22 GMT+02:00 Ferry Huberts : > > > On 18/05/16 10:03, David Lang wrote: >> >> On Wed, 18 May 2016, John Crispin wrote: >> >>> On 18/05/2016 09:46, Ferry Huberts wrote: On 18/05/16 09:25, John Crispin wrote: > > > > On 18/05/2016 09:21,

Re: [LEDE-DEV] running stuff as !root

2016-05-18 Thread Etienne Champetier
Hi, 2016-05-18 9:25 GMT+02:00 John Crispin : > > > On 18/05/2016 09:21, Radu Anghel wrote: >> /* sending again because i hit 'reply' instead of 'reply all' :) */ >> >> On Wed, May 18, 2016 at 8:29 AM, John Crispin wrote: >>> >>> ok, there had been some discussion about building a super daemon tha

Re: [LEDE-DEV] Buildbot

2016-05-10 Thread Etienne Champetier
Hi, 2016-05-10 12:14 GMT+02:00 Jo-Philipp Wich : > > Hi, > > > I may be asking a stupid question, but why does the build system have to > > build everything every time. > > until recently this wasn't possible due to certain technical > limitations, some of which we already addressed [1]. > > > Und