You may try to rebase to my variant of cosmic instead: https://github.com/idnovic/secureblue-extende

You may try to rebase to my variant of cosmic instead: https://github.com/idnovic/secureblue-extended - It is based on the other image you just tried.

GitHub

GitHub - idnovic/secureblue-extended: Based on secureblue and exten...

Based on secureblue and extended with opinionated layered packages - idnovic/secureblue-extended

IIvo You may try to rebase to my variant of cosmic instead: https://github.com/idnovi...

antheas•8/14/24, 10:13 AM

https://github.com/secureblue/secureblue/pkgs/container/silverblue-main-userns-hardened/versions?filters%5Bversion_type%5D=tagged

GitHub

Build software better, together

GitHub is where people build software. More than 100 million people use GitHub to discover, fork, and contribute to over 420 million projects.

antheas•8/14/24, 10:14 AM

whats going on in here

antheas•8/14/24, 10:14 AM

where are the tags

IvoOP•8/14/24, 10:18 AM

Sorry I am not that familiar with the build process. We use blue build. I will investigate on the tags.

antheas•8/14/24, 10:20 AM

i cant even rebase to your image because of the dumb container policy

antheas•8/14/24, 10:20 AM

ok wrote the policy by hand

IvoOP•8/14/24, 10:23 AM

Yes I am aware. This is something I want to change. It is on my todo.

antheas•8/14/24, 10:23 AM

its doing stuff

antheas•8/14/24, 10:24 AM

ok its about to stage

antheas•8/14/24, 10:24 AM

and it crashed

IvoOP•8/14/24, 10:25 AM

What base are you rebasing from ? silverblue hardened?

antheas•8/14/24, 10:25 AM

yes

IvoOP•8/14/24, 10:26 AM

OK. You found the github thread. I posted a suggestion on how to change the malloc implementation at the top. Try the "light" variant. This may allow the rebase.

antheas•8/14/24, 10:27 AM

no its good

antheas•8/14/24, 10:27 AM

i found the error

antheas•8/14/24, 10:27 AM

happens during ostree staging the commit

IvoOP•8/14/24, 10:28 AM

OK. Can you pinpoint it? Is our build process responsible or what?

antheas•8/14/24, 10:29 AM

seems like the error about the assertion is the only one

IvoOP•8/14/24, 10:31 AM

You can try the light variant of our malloc, This may cause the issue to disappear. The normal variant enforces more malloc rules.

antheas•8/14/24, 10:32 AM

staging deployment... done

antheas•8/14/24, 10:32 AM

its after that

IvoOP•8/14/24, 10:34 AM

I tried to preppend debug environment variables for rpm-ostree but it did not tell me more useful information. Tell me if you need something. I do not know how to debug this further

antheas•8/14/24, 10:37 AM

would be good to have a coredump

Aantheas would be good to have a coredump

IvoOP•8/14/24, 10:37 AM

ok. Our hardening rules disable coredumps. Let me find out how to enable them. Give me a sec

IvoOP•8/14/24, 10:39 AM

You need to change the 3 files here to reenable it: https://github.com/search?q=repo%3Asecureblue%2Fsecureblue%20coredump&type=code

GitHub

Build software better, together

GitHub is where people build software. More than 100 million people use GitHub to discover, fork, and contribute to over 420 million projects.

IIvo You need to change the 3 files here to reenable it: https://github.com/search?q=...

antheas•8/14/24, 10:44 AM

cant get a core dump still

antheas•8/14/24, 10:44 AM

in dmesg

IvoOP•8/14/24, 10:45 AM

Just edit this file https://github.com/secureblue/secureblue/blob/live/files/system/etc/sysctl.d/hardening.conf

GitHub

secureblue/files/system/etc/sysctl.d/hardening.conf at live · secur...

Fedora Atomic images for GNOME, KDE Plasma, Bluefin, Sway, Cinnamon, Wayfire, River, and Hyprland with some hardening applied - secureblue/secureblue

IvoOP•8/14/24, 10:45 AM

Disable core dump

kernel.core_pattern = |/bin/false

fiftydinar•8/14/24, 10:58 AM

Those 2 need to be modified also

https://github.com/secureblue/secureblue/blob/live/files/system/etc/systemd/system.conf.d/disable-coredump.conf
https://github.com/secureblue/secureblue/blob/live/files/system/etc/systemd/user.conf.d/disable-coredump.conf

fiftydinar•8/14/24, 10:58 AM

I think that deleting the file won't do anything, since file in

/usr/etc/

/usr/etc/

will take the advantage

IvoOP•8/14/24, 11:00 AM

ok then edit /etc/sysctl.d/hardening.conf and change the kernel.core_pattern line to

 kernel.core_pattern = |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h

 kernel.core_pattern = |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h

fiftydinar•8/14/24, 11:01 AM

This one is the default for me:

gidro@gidro-fedora:~$ sysctl kernel.core_pattern
kernel.core_pattern = |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h

gidro@gidro-fedora:~$ sysctl kernel.core_pattern
kernel.core_pattern = |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h

IvoOP•8/14/24, 11:03 AM

I see, I will add a command to reenable debugging on our images in a few days. Just to simplify this process in the future.

Ffiftydinar Those 2 need to be modified also https://github.com/secureblue/secureblue/blob/...

antheas•8/14/24, 11:28 AM

echo '' | sudo tee

echo '' | sudo tee

antheas•8/14/24, 12:25 PM

antheas•8/14/24, 12:25 PM

https://tenor.com/view/chuckles-im-in-danger-ralph-wiggum-the-simpsons-gif-14149962

Tenor

antheas•8/14/24, 12:26 PM

if there is a file left afterwards it will be a miracle

antheas•8/14/24, 12:30 PM

its still going at 36%

antheas•8/14/24, 1:02 PM

it appears that 1/3 of the files in my VM were corrupted

antheas•8/14/24, 1:02 PM

i did do cursed stuff with it such as mounting the drive tho

j0rge•8/14/24, 1:02 PM

ya'll need to thread stuff like this, otherwise we'll lose it in the ether

j0rge•8/14/24, 1:03 PM

and/or start a rechunk channel

antheas•8/14/24, 1:03 PM

theres are parallel github issue on secureblue

antheas•8/14/24, 1:03 PM

thats cleaner

IvoOP•8/14/24, 1:34 PM

Sorry for the spam. I will start a thread next time. I was not aware that this is possible

fiftydinar•8/14/24, 1:54 PM

@antheas I think that guy in Rechunk issue uses dnf5 to install packages, as he symlinks it to

dnf

dnf

fiftydinar•8/14/24, 1:54 PM

I don't know how much is that clean

Ffiftydinar @antheas I think that guy in Rechunk issue uses dnf5 to install packages, as he ...

Kyle Gospo•8/14/24, 2:01 PM

What the fuck

You may try to rebase to my variant of cosmic instead: https://github.com/idnovic/secureblue-extende

Disable core dump

Similar Threads

Similar Threads

Disable core dump

Similar Threads