last call on this one, I'm about to approve: https://github.com/ublue-os/config/pull/45

GitHub

fix: update wooting rules, use modern security standards by Arcitec...

Wooting's current rules are a bit dangerous. I have fixed the rules and reported the issue upstream. I've also created a small development tool we use to instantly generate fixed rules unti...

j0rgeOP•5/15/23, 5:28 PM

@ChaiQi are you around by any chance?

Jj0rge last call on this one, I'm about to approve: https://github.com/ublue-os/config/...

bsherman•5/15/23, 5:35 PM

I kinda wanted Kyle to chime in, but otherwise, I'm good with it, seems like a good approach

j0rgeOP•5/15/23, 5:36 PM

oh ok, I was tagged on it

j0rgeOP•5/15/23, 5:36 PM

ok so we should probably start using the assign thing in github then

Jj0rge ok so we should probably start using the assign thing in github then

bsherman•5/15/23, 5:37 PM

yeah, and maybe slow the roll a tiny bit

that went out pretty fast though, scope, just wooting, was pretty small

j0rgeOP•5/15/23, 5:38 PM

ack, yeah, you're right

Jj0rge @ChaiQi are you around by any chance?

ChaiQi•5/15/23, 5:38 PM

Am now

j0rgeOP•5/15/23, 5:38 PM

ok the full set of rules was merged but we need someone with the hardware to double check all the stuff

Jj0rge ok the full set of rules was merged but we need someone with the hardware to dou...

bsherman•5/15/23, 5:39 PM

to be clear, we'd already merged the extra rules, i added them with

wheel

wheel

a few weeks ago

ChaiQi•5/15/23, 5:39 PM

Will have to find and move my own patch to check. Can do

bsherman•5/15/23, 5:39 PM

this change was around using

uaccess

uaccess

instead of group

wheel

wheel

j0rgeOP•5/15/23, 5:39 PM

this is rules.final.(final).final.doc

CyberGlitterhoof•5/15/23, 5:40 PM

rules.final(final).final.v2.doc

j0rgeOP•5/15/23, 5:40 PM

I can't test these rules until june because I ordered one now I'm obsessed

ChaiQi•5/15/23, 5:40 PM

Where would I have patched in the udev rules? lol

Jj0rge I can't test these rules until june because I ordered one now I'm obsessed

ChaiQi•5/15/23, 5:40 PM

What got you hooked? lol

Jj0rge I can't test these rules until june because I ordered one now I'm obsessed

bsherman•5/15/23, 5:41 PM

j0rge: doesn't have hardware for a month, can't wait 5 minutes to merge PR for said hardware

j0rgeOP•5/15/23, 5:41 PM

at this rate we'll need to find a few more people so my access can be removed.

bsherman•5/15/23, 5:41 PM

j0rgeOP•5/15/23, 5:42 PM

ok I kicked off main and then I'll do nvidia and then I promise no new things

Jj0rge at this rate we'll need to find a few more people so my access can be removed. �...

bsherman•5/15/23, 5:42 PM

i think that's actually your plan

j0rgeOP•5/15/23, 5:42 PM

UNTIL THE TRAIN COMES TO THE STATION, then no promises

j0rgeOP•5/15/23, 5:43 PM

oh the train was here, ok one more

CChaiQi Where would I have patched in the udev rules? lol

ChaiQi•5/15/23, 5:43 PM

Does anyone remember where manually added udev rules go? I have been preoccupied and don't know where the file is that I need to remove to test that things are working

j0rgeOP•5/15/23, 5:44 PM

/etc/udev/rules.d

/etc/udev/rules.d

j0rgeOP•5/15/23, 5:44 PM

iirc your plan was to put your rules there until we sorted them out

ChaiQi•5/15/23, 5:46 PM

Yep, found them. Good to update and reboot to check?

bsherman•5/15/23, 5:46 PM

not yet

CChaiQi Yep, found them. Good to update and reboot to check?

bsherman•5/15/23, 5:47 PM

you are on nvidia right?

ChaiQi•5/15/23, 5:47 PM

Yeah

bsherman•5/15/23, 5:47 PM

it'll be a bit

ChaiQi•5/15/23, 5:47 PM

Figured

bsherman•5/15/23, 5:48 PM

main

main

is almost done, then jorge is kicking off

nvidia

nvidia

ragectl•5/15/23, 5:50 PM

I was just looking at the packit.dev service. has anyone looked at it before?

rpm build as a service to aim for getting packages to Fedora and CentOS

CChaiQi Figured

j0rgeOP•5/15/23, 5:55 PM

I'll ping you when they're ready, just wanted to keep you in the loop since figuring that out took too long

Bbsherman At the moment, even if Yafti had all bugs fixed and dreams achieved, I'm still n...

Arcitec•5/15/23, 5:57 PM

Yeah, I was just thinking that when Yafti is more mature, it might be useful to have it in main to do some post-install setups, but you're right, it's too opinionated for main.

AArcitec Yeah, I was just thinking that when Yafti is more mature, it might be useful to ...

bsherman•5/15/23, 5:58 PM

did you see that Fedora 39 has a proposed first-boot service?

https://fedoraproject.org/wiki/Changes/AutoFirstBootServices

Jj0rge ok the full set of rules was merged but we need someone with the hardware to dou...

Arcitec•5/15/23, 5:59 PM

This should be fine since it's correct modern way to define input device rules.

And if I've even understood Fedora correctly, they dynamically assign people to the access

input

input

group files when they are physically logged into the desktop -- via ACLs.

So I don't think anyone needs to add themselves to

input

input

either.

j0rgeOP•5/15/23, 5:59 PM

I looked into these firstboot services last cycle

j0rgeOP•5/15/23, 5:59 PM

it won't work for us but I don't remember why

Jj0rge I looked into these firstboot services last cycle

Arcitec•5/15/23, 6:00 PM

You mean yafti, right?

j0rgeOP•5/15/23, 6:00 PM

https://fedoraproject.org/wiki/Changes/AutoFirstBootServices

AutoFirstBootServices

j0rgeOP•5/15/23, 6:00 PM

no this thing

Arcitec•5/15/23, 6:00 PM

Ahh it seems similar to yafti, but silent. Probably more limited.

Arcitec•5/15/23, 6:01 PM

Regarding device rules... Our

70-u2f.rules

70-u2f.rules

is a bit wonky too, which is a separate issue to look at later... It currently requires the

plugdev

plugdev

group. Here's what a Fedora dev said about that:

Sure, we must entirely get rid of that crap. "plugdev" is a very misguided
and fundamentally wrong Ubuntuism. Fedora must not solve problems that way,
we do not put users in system groups to grant access to devices, especially
do not define non-sensical groups like: "the group of users that can plug
devices into the system".

Fedora uses individually managed ACLs for granting ordinary user access
to devices. The ACLs are seat (multiple users working simultaneously on
the same host), and they track session activity. It depends on the type
of devices how to hook up the device in the ACL handling:
http://cgit.freedesktop.org/systemd/systemd/tree/src/login/70-uaccess.rules

Please just patch the rules not to use "plugdev" at all, we can do better and
don't want "plugdev" in Fedora. Thanks!

Source: https://bugzilla.redhat.com/show_bug.cgi?id=815093#c4

Jj0rge no this thing

bsherman•5/15/23, 6:02 PM

i looked into the source on pagure...

some of the default functionality it ships is definitely not helpful for us... but it could provide a semi-standard hook... that's assuming it's included in rpm-ostree images and not just on workstation, etc

AArcitec Ahh it seems similar to yafti, but silent. Probably more limited.

j0rgeOP•5/15/23, 6:02 PM

I think we'd want to use it to launch yafti perhaps, more to replace the dotfile thing we're doing now

j0rgeOP•5/15/23, 6:02 PM

we should look at it with fresh eyes though

Jj0rge I think we'd want to use it to launch yafti perhaps, more to replace the dotfile...

bsherman•5/15/23, 6:03 PM

exactly what i was thinking, a more "standard" way to launch yafti vs rolling our own

bsherman•5/15/23, 6:03 PM

but not urgent at all

last call on this one, I'm about to approve: https://github.com/ublue-os/config/pull/45

Similar Threads

Similar Threads

Similar Threads