Jump to content
Read the Funtoo Newsletter: Summer 2023 ×

Oleg Vinichenko

Members
  • Posts

    619
  • Joined

  • Last visited

  • Days Won

    53

Posts posted by Oleg Vinichenko

  1. As said earlier setting too explicit flags can only benefit if package can utilize the exact instruction. For example the only one package in entire tree explicitly use pclmul instruction,

    dev-libs/gf2x it has IUSE_CPU_FLAGS=" pclmul sse2 sse3 sse4_1 ssse3", which then has use_enable cpu_flags_x86_pclmul pclmul for the configure phase. Whether any other ebuilds in tree can use this instruction is unknown. Same is applicable to other less frequently used instructions. In most cases the flags will be ignored.

  2. Hi, everyone!

    X.Org security update now available with version 1.19.3-r3. By default xorg-server ebuild installs the /usr/bin/Xorg binary with suid . In 1.19 it was found a regression which allowed a privilege escalation. This is now fixed with patch. More details can be found here: 

    https://www.mail-archive.com/xorg-announce@lists.x.org/msg01138.html

    A notice on suid USE flag. By default this USE flag is enabled and with unpatched xorg-server there is a security risk. Upstream recommendation is to disable suid USE. This can be achieved by:

    echo "x11-base/xorg-server -suid" >> /etc/portage/package.use
    
    emerge -1 xorg-server

    This will work in most cases, when  login managers are used, such as GDM or similar. In case you are starting the X via xinit or startx, disable of suid USE may impact the X start. You can leave the suid USE turned on, as xorg-server has the vulnerability fix applied.

  3. pam-1.3.0-r3 update provides better values for maximum open files in /etc/security/limits.conf. This is good values on modern systems. However it was found that pam_limits.so  that actually setting the limits has bug that occurs in LXD containers, which results in incorrect limits handle. As a consequence, after reboot of containers SSH connection can be terminated.

    We will fix pam_limits.so soon, so that it will correctly handle limits inside containers. 

    In the mean time, DO NOT UPDATE /etc/security/limits.conf inside LXD containers. LXD containers should have NO limits set in /etc/security/limits.conf until we have fixed the upstream bug.

  4. pgadmin4-3.3 latest upstream version now added. This version has a helper binary pgAdmin4-web, to start the web server, which can be accessed  with browser by 127.0.0.1:5050 by default. Default PATH for pgadmin's STORAGE, SQLITE cache and other are now created in ~/.pgadmin directory in your /home/username.

     

×
×
  • Create New...