Re: [PATCH 0/2] enable procd security features by default

2021-02-09 Thread Daniel Golle
Hi! On Tue, Feb 09, 2021 at 10:28:32AM +0100, Petr Štetiar wrote: > > Daniel Golle [2020-11-07 14:17:12]: > > Hi, > > > Please report back > > FYI just noticed following on imx6q latest master: Thank you for reporting! This indeed looks like a problem. > > user.notice firewall: Reloading

Re: [PATCH 0/2] enable procd security features by default

2021-02-09 Thread Petr Štetiar
Daniel Golle [2020-11-07 14:17:12]: Hi, > Please report back FYI just noticed following on imx6q latest master: user.notice firewall: Reloading firewall due to ifup of wan (eth0) user.err : jail: failed to clone/fork: Invalid argument user.err : jail: failed to clone/fork: Invalid argumen

Re: [PATCH 0/2] enable procd security features by default

2020-11-27 Thread Petr Štetiar
Daniel Golle [2020-11-27 03:21:39]: Hi, > On Thu, Nov 26, 2020 at 05:43:53PM +0100, Petr Štetiar wrote: > > Daniel Golle [2020-11-07 14:17:12]: > > > > > Please report back > > > > testing now the latest master on rtl8382 booted from initramfs and seeing > > following: > > > > Thu Nov 26 1

Re: [PATCH 0/2] enable procd security features by default

2020-11-26 Thread Stijn Tintel
On 7/11/2020 16:17, Daniel Golle wrote: > Hi all! > > A while ago we have added some useful kernel features to !SMALL_FLASH > devices[1]. To make more use of that by default in a way which will > make exploiting potential vulnerabilities in OpenWrt's services much > harder, it'd be great to also ha

Re: [PATCH 0/2] enable procd security features by default

2020-11-26 Thread Daniel Golle
On Thu, Nov 26, 2020 at 05:43:53PM +0100, Petr Štetiar wrote: > Daniel Golle [2020-11-07 14:17:12]: > > Hi, > > > Please report back > > testing now the latest master on rtl8382 booted from initramfs and seeing > following: > > Thu Nov 26 14:45:35 2020 user.notice dnsmasq: DNS rebinding prot

Re: [PATCH 0/2] enable procd security features by default

2020-11-26 Thread Etienne Champetier
Hi Petr, Daniel, Le jeu. 26 nov. 2020 à 11:45, Petr Štetiar a écrit : > > Daniel Golle [2020-11-07 14:17:12]: > > Hi, > > > Please report back > > testing now the latest master on rtl8382 booted from initramfs and seeing > following: > > Thu Nov 26 14:45:35 2020 user.notice dnsmasq: DNS rebind

Re: [PATCH 0/2] enable procd security features by default

2020-11-26 Thread Petr Štetiar
Daniel Golle [2020-11-07 14:17:12]: Hi, > Please report back testing now the latest master on rtl8382 booted from initramfs and seeing following: Thu Nov 26 14:45:35 2020 user.notice dnsmasq: DNS rebinding protection is active, will discard upstream RFC1918 responses! Thu Nov 26 14:45:36 2

Re: QEMU x86/64 ubus issues [Was: Re: [PATCH 0/2] enable procd security features by default]

2020-11-24 Thread Petr Štetiar
Petr Štetiar [2020-11-10 07:43:24]: Hi, > I've started QEMU x86/64 (4 cores, 512MB RAM) with LAN/WAN interfaces > yesterday in the afternoon and found it in unusable state this morning, > without network and constantly OOMing. I did tested it few more times and it looks like it's some bug in od

QEMU x86/64 ubus issues [Was: Re: [PATCH 0/2] enable procd security features by default]

2020-11-09 Thread Petr Štetiar
Daniel Golle [2020-11-07 14:17:12]: Hi, > A while ago we have added some useful kernel features to !SMALL_FLASH > devices[1]. To make more use of that by default in a way which will > make exploiting potential vulnerabilities in OpenWrt's services much > harder, it'd be great to also have procd-

[PATCH 0/2] enable procd security features by default

2020-11-07 Thread Daniel Golle
Hi all! A while ago we have added some useful kernel features to !SMALL_FLASH devices[1]. To make more use of that by default in a way which will make exploiting potential vulnerabilities in OpenWrt's services much harder, it'd be great to also have procd-ujail as well as procd-seccomp installed b