| 1 |
2015-07-25-python-targets |
| 2 |
Title Python 3.4 enabled by default |
| 3 |
Author Mike Gilbert <floppym@g.o> |
| 4 |
Posted 2015-07-25 |
| 5 |
Revision 1 |
| 6 |
|
| 7 |
Python 3.4 is now enabled by default, replacing Python 3.3 as the |
| 8 |
default Python 3 interpreter. |
| 9 |
|
| 10 |
PYTHON_TARGETS will be adjusted to contain python2_7 and python3_4 by |
| 11 |
default via your profile. |
| 12 |
|
| 13 |
PYTHON_SINGLE_TARGET will remain set to python2_7 by default. |
| 14 |
|
| 15 |
If you have PYTHON_TARGETS set in make.conf, that setting will still be |
| 16 |
respected. You may want to adjust this setting manually. |
| 17 |
|
| 18 |
Once the changes have taken place, a world update should take care of |
| 19 |
reinstalling any python libraries you have installed. You should also |
| 20 |
switch your default python3 interpreter using eselect python. |
| 21 |
|
| 22 |
For example: |
| 23 |
|
| 24 |
eselect python set --python3 python3.4 |
| 25 |
emerge -uDv --changed-use @world |
| 26 |
|
| 27 |
2015-08-13-openssh-weak-keys |
| 28 |
Title OpenSSH 7.0 disables ssh-dss keys by default |
| 29 |
Author Mike Frysinger <vapier@g.o> |
| 30 |
Posted 2015-08-13 |
| 31 |
Revision 1 |
| 32 |
|
| 33 |
Starting with the 7.0 release of OpenSSH, support for ssh-dss keys has |
| 34 |
been disabled by default at runtime due to their inherit weakness. If |
| 35 |
you rely on these key types, you will have to take corrective action or |
| 36 |
risk being locked out. |
| 37 |
|
| 38 |
Your best option is to generate new keys using strong algos such as rsa |
| 39 |
or ecdsa or ed25519. RSA keys will give you the greatest portability |
| 40 |
with other clients/servers while ed25519 will get you the best security |
| 41 |
with OpenSSH (but requires recent versions of client & server). |
| 42 |
|
| 43 |
If you are stuck with DSA keys, you can re-enable support locally by |
| 44 |
updating your sshd_config and ~/.ssh/config files with lines like so: |
| 45 |
PubkeyAcceptedKeyTypes=+ssh-dss |
| 46 |
|
| 47 |
Be aware though that eventually OpenSSH will drop support for DSA keys |
| 48 |
entirely, so this is only a stop gap solution. |
| 49 |
|
| 50 |
More details can be found on OpenSSH's website: |
| 51 |
http://www.openssh.com/legacy.html |
| 52 |
|
| 53 |
2015-10-21-future-support-of-hardened-sources-kernel |
| 54 |
Title Future Support of hardened-sources Kernel |
| 55 |
Author Anthony G. Basile <blueness@g.o> |
| 56 |
Posted 2015-10-21 |
| 57 |
Revision 3 |
| 58 |
|
| 59 |
For many years, the Grsecurity team [1] has been supporting two versions of |
| 60 |
their security patches against the Linux kernel, a stable and a testing |
| 61 |
version, and Gentoo has made both of these available to our users through the |
| 62 |
hardened-sources package. However, on August 26 of this year, the team |
| 63 |
announced they would no longer be making the stable version publicly |
| 64 |
available, citing trademark infringement by a major embedded systems company |
| 65 |
as the reason. [2] The stable patches are now only available to sponsors of |
| 66 |
Grsecurity and can no longer be distributed in Gentoo. However, the team did |
| 67 |
assure us that they would continue to release and support the testing version |
| 68 |
as they have in the past. |
| 69 |
|
| 70 |
What does this means for users of hardened-sources? Gentoo will continue to |
| 71 |
make the testing version available through our hardened-sources package but we |
| 72 |
will have to drop support for the 3.x series. In a few days, those ebuilds |
| 73 |
will be removed from the tree and you will be required to upgrade to a 4.x |
| 74 |
series kernel. Since the hardened-sources package only installs the kernel |
| 75 |
source tree, you can continue using a currently built 3.x series kernel but |
| 76 |
bear in mind that we cannot support you, nor will upstream. Also keep in mind |
| 77 |
that the 4.x series will not be as reliable as the 3.x series was, so |
| 78 |
reporting bugs promptly will be even more important. Gentoo will continue to |
| 79 |
work closely with upstream to stay on top of any problems, but be prepared for |
| 80 |
the occasional "bad" kernel. The more reporting we receive from our users, |
| 81 |
the better we will be able to decide which hardened-sources kernels to mark |
| 82 |
stable and which to drop. |
| 83 |
|
| 84 |
Refs. |
| 85 |
[1] https://grsecurity.net |
| 86 |
[2] https://grsecurity.net/announce.php |
| 87 |
|
| 88 |
2016-01-08-some-dhcpcd-hooks-are-now-examples |
| 89 |
Title Some dhcpcd hooks are now examples |
| 90 |
Author William Hubbs <williamh@g.o> |
| 91 |
Posted 2016-01-08 |
| 92 |
Revision 2 |
| 93 |
|
| 94 |
In dhcpcd-6.10.0, the following hooks are no longer installed in |
| 95 |
/lib/dhcpcd/dhcpcd-hooks by default: |
| 96 |
|
| 97 |
10-wpa_supplicant |
| 98 |
15-timezone |
| 99 |
29-lookup-hostname |
| 100 |
|
| 101 |
These are now installed in /usr/share/dhcpcd/hooks, which is an example |
| 102 |
directory. |
| 103 |
|
| 104 |
If you were using these hooks before you upgrade to 6.10.0, you will |
| 105 |
need to copy them back to the /lib/dhcpcd/dhcpcd-hooks directory after the |
| 106 |
upgrade. |
| 107 |
|
| 108 |
>>> Building file list for distfiles cleaning... |
| 109 |
>>> Cleaning distfiles... |
| 110 |
[ 1.0 M ] LVM2.2.02.88.tgz |
| 111 |
[ 119.7 K ] MAKEDEV-3.23-1.tar.gz |
| 112 |
[ 2.1 M ] busybox-1.20.2.tar.bz2 |
| 113 |
[ 994.6 K ] cpio-2.11.tar.bz2 |
| 114 |
[ 227.3 K ] dmraid-1.0.0.rc16-3.tar.bz2 |
| 115 |
[ 493.5 K ] fuse-2.8.6.tar.gz |
| 116 |
[ 276.3 K ] genkernel-3.4.52.3.tar.xz |
| 117 |
[ 6.2 K ] gentoo-headers-4.3-1.tar.xz |
| 118 |
[ 3.7 M ] gentoo-headers-base-4.3.tar.xz |
| 119 |
[ 3.2 M ] gnupg-1.4.11.tar.bz2 |
| 120 |
[ 285.8 K ] mdadm-3.1.5.tar.bz2 |
| 121 |
[ 1.8 M ] nano-2.4.3.tar.gz |
| 122 |
[ 879.0 K ] open-iscsi-2.0-872.tar.gz |
| 123 |
[ 21.9 K ] openssh-7.1p2-hpnssh14v10.tar.xz |
| 124 |
[ 1.4 M ] openssh-7.1p2.tar.gz |
| 125 |
[ 407.3 K ] sandbox-2.10.tar.xz |
| 126 |
[ 29.7 K ] unionfs-fuse-0.24.tar.bz2 |
| 127 |
=========== |
| 128 |
[ 16.9 M ] Total space from 17 files were freed in the distfiles directory |
| 129 |
passwd: password expiry information changed. |
| 130 |
passwd: password expiry information changed. |
| 131 |
removing /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118/tmp/cloud-prep.sh from the chroot |
| 132 |
removing /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118/tmp/chroot-functions.sh from the chroot |
| 133 |
18 Jan 2016 06:56:59 UTC: NOTICE : --- Running action sequence: preclean |
| 134 |
Copying stage4-preclean-chroot.sh to /tmp |
| 135 |
copying stage4-preclean-chroot.sh to /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118/tmp |
| 136 |
copying chroot-functions.sh to /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118/tmp |
| 137 |
Ensure the file has the executable bit set |
| 138 |
Running stage4-preclean-chroot.sh in chroot: |
| 139 |
chroot /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118 /tmp/stage4-preclean-chroot.sh |
| 140 |
>>> Regenerating /etc/ld.so.cache... |
| 141 |
Skipping depclean operation for stage4 |
| 142 |
Skipping removal of world file for stage4 |
| 143 |
removing /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118/tmp/stage4-preclean-chroot.sh from the chroot |
| 144 |
removing /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118/tmp/chroot-functions.sh from the chroot |
| 145 |
18 Jan 2016 06:57:00 UTC: NOTICE : --- Running action sequence: rcupdate |
| 146 |
Copying rc-update.sh to /tmp |
| 147 |
copying rc-update.sh to /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118/tmp |
| 148 |
copying chroot-functions.sh to /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118/tmp |
| 149 |
Ensure the file has the executable bit set |
| 150 |
Running rc-update.sh in chroot: |
| 151 |
chroot /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118 /tmp/rc-update.sh |
| 152 |
Adding acpid to default |
| 153 |
* service acpid added to runlevel default |
| 154 |
Adding cloud-config to default |
| 155 |
* service cloud-config added to runlevel default |
| 156 |
Adding cloud-final to default |
| 157 |
* service cloud-final added to runlevel default |
| 158 |
Adding cloud-init-local to default |
| 159 |
* service cloud-init-local added to runlevel default |
| 160 |
Adding cloud-init to default |
| 161 |
* service cloud-init added to runlevel default |
| 162 |
Adding cronie to default |
| 163 |
* service cronie added to runlevel default |
| 164 |
Adding dhcpcd to default |
| 165 |
* service dhcpcd added to runlevel default |
| 166 |
Adding net.lo to default |
| 167 |
* service net.lo added to runlevel default |
| 168 |
Adding netmount to default |
| 169 |
* rc-update: netmount already installed in runlevel `default'; skipping |
| 170 |
Adding sshd to default |
| 171 |
* service sshd added to runlevel default |
| 172 |
Adding syslog-ng to default |
| 173 |
* service syslog-ng added to runlevel default |
| 174 |
removing /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118/tmp/rc-update.sh from the chroot |
| 175 |
removing /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118/tmp/chroot-functions.sh from the chroot |
| 176 |
18 Jan 2016 06:57:00 UTC: NOTICE : --- Running action sequence: unmerge |
| 177 |
Copying unmerge.sh to /tmp |
| 178 |
copying unmerge.sh to /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118/tmp |
| 179 |
copying chroot-functions.sh to /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118/tmp |
| 180 |
Ensure the file has the executable bit set |
| 181 |
Running unmerge.sh in chroot: |
| 182 |
chroot /home/release/buildroot/amd64-dev/tmp/hardened/stage4-amd64-hardened+cloud-nomultilib-20160118 /tmp/unmerge.sh |
| 183 |
>>> Regenerating /etc/ld.so.cache... |
| 184 |
emerge --quiet --usepkg --buildpkg --newuse -C sys-kernel/genkernel sys-kernel/gentoo-sources |
| 185 |
|
| 186 |
--- Couldn't find 'sys-kernel/genkernel' to unmerge. |
| 187 |
|
| 188 |
--- Couldn't find 'sys-kernel/gentoo-sources' to unmerge. |
| 189 |
18 Jan 2016 06:57:01 UTC: ERROR : CatalystError: cmd() NON-zero return value from: Unmerge script failed. |
| 190 |
18 Jan 2016 06:57:02 UTC: ERROR : Exception running action sequence unmerge |
| 191 |
Traceback (most recent call last): |
| 192 |
File "/usr/lib64/python2.7/site-packages/catalyst/base/stagebase.py", line 1413, in run |
| 193 |
getattr(self, x)() |
| 194 |
File "/usr/lib64/python2.7/site-packages/catalyst/base/stagebase.py", line 1452, in unmerge |
| 195 |
env=self.env) |
| 196 |
File "/usr/lib64/python2.7/site-packages/catalyst/support.py", line 55, in cmd |
| 197 |
print_traceback=False) |
| 198 |
CatalystError |
| 199 |
18 Jan 2016 06:57:02 UTC: NOTICE : Cleaning up... Running unbind() |
| 200 |
|
| 201 |
|
| 202 |
|
| 203 |
Full build log at /home/release/tmp/run/catalyst-auto.oO2hD4/log/hardened_stage4-nomultilib-cloud.log |
Archives