@Jan disable `CONFIG_SECURITY_LOCKDOWN_LSM_EARLY` maybe? It's off in the arch kernel and when it's o

@Jan disable

CONFIG_SECURITY_LOCKDOWN_LSM_EARLY

CONFIG_SECURITY_LOCKDOWN_LSM_EARLY

CONFIG_SECURITY_LOCKDOWN_LSM_EARLY

CONFIG_SECURITY_LOCKDOWN_LSM_EARLY maybe? It's off in the arch kernel and when it's on it disables disabling lockdown

antheasOP•2/10/24, 3:28 PM

probably should be done upstream too

NNatalie sending it now, gonna try daily driving bazzite, hope it sticks and i can actual...

Robotta•2/10/24, 3:30 PM

bazzite / fedora are peak linux if ya ask me

Robotta•2/10/24, 3:30 PM

so hopefully you enjoy your stay

Natalie•2/10/24, 3:30 PM

i enjoy fedora on my laptop a lot

Natalie•2/10/24, 3:30 PM

though i never tried silverblue/kinoite

Quist•2/10/24, 3:47 PM

I'd love to use kinoite as my Linux install, but I had too many annoyances with dev tools so I'm using regular Fedora KDE for now

Quist•2/10/24, 3:47 PM

I'm sure stuff like that will be worked out eventually though

Raltay•2/10/24, 3:51 PM

Has anybody had any opportunity to test Bazzite/Bluefin on Tuxedo computers? I have one of their laptops on the way to me (Pulse 14 gen 3). From what I'm aware, they have kernel drivers/dkms located at https://gitlab.com/tuxedocomputers/development/packages/tuxedo-drivers

GitLab

TUXEDO Computers / Development / Packages / tuxedo-drivers · GitLab

GitLab.com

NNatalie though i never tried silverblue/kinoite

Valerie•2/10/24, 3:56 PM

Using aurora on my laptop

Aru•2/10/24, 4:10 PM

@Kyle Gospo so good news and bad news on the LGO with the gamescope fix. It does fix the refresh rate slider, but the latest testing branch seems to introduce the 60hz 30fps cap bug. I suspect maybe it's due to kernel 6.7?

Natalie•2/10/24, 4:12 PM

huh so that's why i had to raise my cap for fh4 to 120 to get 60

Aru•2/10/24, 4:14 PM

anyways, reverting back to stable branch for now

Natalie•2/10/24, 4:15 PM

the post install has begun :Yay:

AAru anyways, reverting back to stable branch for now

Aru•2/10/24, 4:22 PM

gah, should've reverted back to my prior version, instead of deploying stable again

Aru•2/10/24, 4:22 PM

stable is on 6.7

Aru•2/10/24, 4:22 PM

time to find the last version of bazzite on 6.6

AAru time to find the last version of bazzite on 6.6

matt_schwartz•2/10/24, 4:24 PM

https://github.com/ublue-os/bazzite/pkgs/container/bazzite-deck you can look at the manifests to see which kernel each built images uses

GitHub

Build software better, together

GitHub is where people build software. More than 100 million people use GitHub to discover, fork, and contribute to over 420 million projects.

Aantheas @Jan disable `CONFIG_SECURITY_LOCKDOWN_LSM_EARLY` maybe? It's off in the arch ke...

Jan•2/10/24, 4:25 PM

I'm kinda against it, because having the lockdown module loaded ahead of time could prevent fiddling with things ahead of time, plus I am unsure if this will really allow you to disable it

Jan•2/10/24, 4:26 PM

but I can look into it

Mmatt_schwartz https://github.com/ublue-os/bazzite/pkgs/container/bazzite-deck you can look at ...

Aru•2/10/24, 4:27 PM

bazzite supports rolling back to builds from specific dates, i'm trying to track down which date was the last build with 6.6
e.g.

rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ublue-os/bazzite-deck:39-20240113

rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ublue-os/bazzite-deck:39-20240113

Jan•2/10/24, 4:27 PM

any build older than 2 days

JJan any build older than 2 days

Aru•2/10/24, 4:28 PM

nice, thank you. looks like it's 39-2024020539-20240205

JJan but I can look into it

antheasOP•2/10/24, 4:29 PM

arch does not have that option compiled and has the other ones

antheasOP•2/10/24, 4:29 PM

in any case, up to you. But I can not use that kernel with that option on and Im sure im not the only one

Jan•2/10/24, 4:29 PM

Yes, but Fedora isn't arch and they do these kind of decisions in isolation

Jan•2/10/24, 4:30 PM

I'll first have to dig out why this decision was made, what recommended fixes for hibernation and so on are etc.

Aantheas arch does not have that option compiled and has the other ones

Jan•2/10/24, 4:31 PM

what you actually want is CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOTCONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT turned off

Jan•2/10/24, 4:32 PM

its a custom config included in kernel-ark (upstream Fedora kernel) which forces lockdown on if secure boot is enabled

antheasOP•2/10/24, 4:32 PM

i dont think so, right now my memory policy is strict

antheasOP•2/10/24, 4:32 PM

and thats not a problem

AAru bazzite supports rolling back to builds from specific dates, i'm trying to track...

j0rge•2/10/24, 4:32 PM

This will let you find the kernel version on a given image skopeo inspect docker://ghcr.io/ublue-os/bazzite:39-20240210 | grep ostree.linuxskopeo inspect docker://ghcr.io/ublue-os/bazzite:39-20240210 | grep ostree.linux

Jan•2/10/24, 4:33 PM

let me make sure I understand the problem right

Jan•2/10/24, 4:33 PM

the kernel is in lockdown mode which prevents you from doing various things, correct?

JJan the kernel is in lockdown mode which prevents you from doing various things, cor...

antheasOP•2/10/24, 4:33 PM

in integrity mode

antheasOP•2/10/24, 4:33 PM

specifically

Jan•2/10/24, 4:33 PM

it doesn't really matter which one it is

Jan•2/10/24, 4:34 PM

Since I run kernel-fsync myself (though only on a vanilla Fedora system) I dont think

CONFIG_SECURITY_LOCKDOWN_LSM_EARLY

CONFIG_SECURITY_LOCKDOWN_LSM_EARLY

or similar configs are the problem

Jan•2/10/24, 4:34 PM

lockdown is not enabled for me at all

Jj0rge This will let you find the kernel version on a given image `skopeo inspect docke...

Aru•2/10/24, 4:34 PM

nice, thank you for the tip.

Jan•2/10/24, 4:35 PM

and I never disabled it in any shape or form

Jan•2/10/24, 4:35 PM

I dont use SB so its probably just CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOTCONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT forcing it on for you

antheasOP•2/10/24, 4:35 PM

perhaps

antheasOP•2/10/24, 4:35 PM

this option is not set either

Jan•2/10/24, 4:35 PM

I can go fork the copr and make a custom build with it turned off for you to test

antheasOP•2/10/24, 4:36 PM

its either one of those

antheasOP•2/10/24, 4:36 PM

in any case, i made an arch version of your patch series that works. I dont think using a fedora kernel on arch is ideal. But its something to consider in the future

antheasOP•2/10/24, 4:37 PM

for me, for example, my swap file is in an encrypted partition. So it is perfectly safe to hibernate

antheasOP•2/10/24, 4:37 PM

but lockdown is written in such a way where it cant see that and disables hibernation

Aru•2/10/24, 5:04 PM

@Kyle Gospo So followup related to LGO:

- latest bazzite-deck testing image fixed the refresh rate slider on the LGO, but introduced 60hz 30fps cap bug
- image 39-20240205 (kernel 6.6.14-202) does not have the bug
- image 39-20240209 (kernel 6.7.4-201) introduces the bug
- it sounds like this also introduced the bug to the ROG Ally, see here 🎮bazzite

Would it be possible to have a LGO-specific bazzite image on 6.6 + gamescope patch for refresh rate slider?

AAru @Kyle Gospo So followup related to LGO: - latest bazzite-deck testing image fix...

Jan•2/10/24, 5:07 PM

6.7.4-202 should be done in ~20 minutes

@Jan disable `CONFIG_SECURITY_LOCKDOWN_LSM_EARLY` maybe? It's off in the arch kernel and when it's o

Similar Threads

Similar Threads

Similar Threads