so I have my system in 15.0-STABLE, I think, how do I know if I got the latest security patches?

Xinayder: by checking which commit your /usr/src is on? :p

provided you compiled from src

I'm using pkgbase, not compiled from src

idk just run pkg upgrade and see if there is any upgrades simples

freebsd-version -urk shows 15.0-RELEASE-p5 and 15.1-PRERELEASE

I guess today's snapshots include them?

oops meant to send those in two different messages

seems there was an update to stable on the 28th which would have included the patches

so if you are up to date pkgbase wise

then yes you have the security patches

Xinayder: gimme the output of "uname -v"

I will check for you

FreeBSD 15.0-RELEASE-p5 releng/15.0-n281018-0730d5233286 GENERIC

latest is -p7

Kernel patch level is not bumped if there is no change there, I believe

Nevermind I do have p7 everywhere, both kernel and userland

there was a kernel change, i guess pkgbase lags behind src & freebsd-update currently?

Package building is most likely slower yes

freebsd-updates are binary though, how long does it take to stuff a binary into a tarball?

I'll be saving the migration to pkgbase for 16.0-RELASE :)

mjp: I will be saving the migration to pkgbase indefinitely

that poison will not infect any of my BSD hosts

whats the problem with it?

freebsd-update is ok (better than src) but still slow as hell

if I discuss this again I might get banned from the channel :p

its not about speed

is it an emotional or logical argument? should be able to articulate it while keeping within the channel rules

pkgbase sure gives you speed, but it assumes that everyone has bandwidth to burn, which is not always the case in some rural areas. But bandwidth aside, it ruins the one benefit of BSD over Linux, the separate base and ports. base being one complete system updated in its entirety provides stability. pkgbase dividing this into lots of smaller packages adds a whole heap of issues which could go

wrong, not to mention that pkg will update both base and ports at the same time like on Linux.

pkgbase to me is just FreeLinux

and violates the design of BSD

so less I rigidly oppose it

s/less/yes/

Xinayder: you are out of date, please update

I don't think any pkg update will change the uname output, if I use pkgbase?

well even if it didnt modify the patch level, the commit hash is within the uname string, which always changes

and that HEAD is from Mar 25

Xinayder: also I thought you were running -STABLE

honestly I don't know what I'm running, I moved my -RELEASE to pkgbase and since then I don't know what's going on

welp, you are vulnerable so update nethertheless

nevertheless*

my spelling tonight is woeful

I did a pkg update -r FreeBSD-base and FreeBSD-ports-kmods, and the latest snapshot was from today 15h

hmm

FreeBSD-runtime-15.snap20260429150809

can I see the output of your /etc/pkg.conf

sorry

I meant

/etc/pkg/FreeBSD.conf

I need to sleep :p

brain not working tongiht

the original file or the modified one?

Xinayder: whatever config you are using right now lol

paste.rs/pRy7s and paste.rs/015ip

hmm

I wonder if because you are running pkgbase the uname will not be updated

if so, I guess another loss for pkgbase :p

welp, i just rebooted and now i cant ssh to the host

is this a server

if so you shouldnt be running stable on a server (IMO)

yeah its a server

it didnt load the realtek driver correctly smh

im just considering going back to the pre-pkgbase snapshot, honestly

in any case, I wouldnt use -stable on servers, you want to update servers as little as possible

and stable gets a bunch of feature updates you dont need

security patches get backported and go to the security ML (and rss feed) which are the only times you need to update between releases

I can still go to pkgbase, but remain on -release, no?

Xinayder: You can choose whatever you want.

Xinayder: yes

you just switch

meh its not a good idea to run pkg upgrade -r FreeBSD-ports-kmods when the numbers mismatch :/

I thought it'd be auto updated

after some reboots and downgrades i am finally on -release again FreeBSD teldrassil 15.0-RELEASE-p7 FreeBSD 15.0-RELEASE-p7 releng/15.0-n281034-bbfdabc12895 GENERIC amd64

15.0-RELEASE-p7 listed 3x with freebsd-version -urk

Xinayder: That would be ideal.

Hmm... multitail is not available on 15. And freshports shows a basic page missing build information. Did multitail simply fail to build on 15?

freshports has a list of links at the top, one of which is to fallout portsfallout.com/fallout?port=sysutils%2Fmultitail%24

with pkg and FreeBSD-base, how does one go from 15.0 to 15.1 release when available? if i do nothing will it automatically go to 15.1 when released? the url in /etc/pkg/ is /${ABI}/base_release_${VERSION_MINOR} ... will i need to override that variable manually to "1" then set it back?

markmcb: the documented method will be 'pkg -oVERSION_MINOR=1 upgrade', i think. (remember to upgrade the kernel first, then reboot, then upgrade userland)

i haven't actually tested that, but it's what the open doc review for this says

ah, ok, that makes sense. i didn't realize you could set it like this, thanks

The handbook's a bit complicated for it (imho), but worth reading through 26.7.2.1 befor you upgrade.

Minor upgrades are less risky, but there's some good advice there.

unrelated / funny: copy.fail

How nice to publish the vuln with proof of concepts before patches have been properly deployed

I agree

Skiddies are going to be eating well today.

no sympathy left for corporations like canonical, redhat or amazon

With the sort of cabbage they have, I think their time would be better spent on security, looking at the recent resurfacing of software supply chain attacks etc. How many unix-likes _still_ don't have package signing is somewhat alarming.

But we're also in the age of "to install, run this command/script as root on your machine".

Looking at you, rustup.

Anyway, we'll be hacking like it's 1992 again in no time, with all of the vibe coding that's going on everywhere.

pretty sure it was already common when rustup was created and they just copied it without noticing that it is a bad idea

Yeah, absolutely.

Hi there :) I have a quick question about todays Security Advisories. As far as i can tell, the libnv-SAs are most likely to be abused / exploited by local users, so there isn't that much danger from remote. For FreeBSD-SA-26:13.exec there is very few information but it's clear, that local priv-escalation is possible. But is there any chance, that this somehow could be abused remotely? And for: FreeBSD-SA-26:14.pf - How likely is it,

that "Remote attackers can craft packets which cause affected systems to panic." is getting triggered easily?

hi

I'm sorry I come back with the same problem as one or two weeks ago with my ZFS disks

one of my ZFS pool disk (4 disks in RAID 5) failed. I need to change it. thus i power down my computer, remove the faulty disk, replace it and restart the computer but boot failed with error about zfs pool which is not found

i tried a FreeBSD live usb stick, performed zfs import -a which returns: "unable to open adaxxx for writing" (for sure this disk has been changed

and after that: cannot import 'disk' : permission denied. Destroy and recreate the pool from a backup source

what is strange is that if i put the faulty disk into the pool my ZFS pool is working again

my question: what can I do in order to get my ZFS pool working again without the faulty disk?

titou does zpool status report errors only for that faulty disk?

I already changed disks from my pool in the past and I never had this kind of problem

tsoome: yes

the disk is powered on but has IO errors?

chksum error only

just checksum error? no IO error from hardware?

nop but i already tried to change the sata connector etc. it's the same

then you do not need to replace it, just zpool clear and zpool scrub

no because i have errors after each zpool scrub

and this is one problem. The other problem is that I cannot boot without this particular disk whereas raid5 could be able to boot without it

it's the aim of the RAID 5 :)

zpool status will report error counters, they will not get zeroed when zfs does rewrite the block.

danel1: as I understand it, the attacker doesn't need any information about your system, as the problem is in the parsing of SCTP chunk parameters, so an attacker could create one package and send it to as much systems as possible to DOS random systems, but that understanding is based only on the SA

and I am afraid of loosing my ZFS pool if this disk really fails

there is no solution to check ZPOOL/ZFS information on each disk of the RAID to be sure that there is no problem?

i don't understand why it refuses to boot

danel1: note that libnv issues can be used to escape capsicum, which can be combined with e.g. a bhyve vulnerability to escalate from VM to host access

titou: and you don't have enought connectors to replace the disk while it is still connected? (zpool replace)

nop

pool import failure indicates about more failures than just one disk, thats why I am wondering if there are in fact more corrupted blocks (which scsub should identify and fix if there is enough redundancy).

tsoome: that's my point of view too

two disks of my pool failed in the past but i replaced it and resilvered everything..

boru: I don't think rustup should worry about signing or be used for software distribution to end users. unfortunately, it's also not designed at all to play well with contemporary package management systems..

ivy: fair point

to be honest the last disk which failed, failed at the end of the resilvering of the first disk which failed

nimaje: mh yeah, that could be possible..

i lost some files but after that i had absolutely no problem with my pool

boru: in general coupling development, software packaging, distribution and documentation was a terrible idea (look at github now)

so you have no ideas? or at least ideas to check zpool data information on each disk or recreate it without exporting/importing the pool?

titou: as a side note, if it won't boot it could be an issue outside of zfs altogether, e.g., depending on how you installed freebsd that failing disk may be the only one with UEFI/ESP. the bootable stuff would need to be present on one of the remaining devices.

i'm very worried about that

markmcb: in fact i can see the boot process but it failed while trying to open the ZFS pool during the bootloader process

i also executed gpart bootcode on each disk of the pool

what can I also perform to check the boot process?

have you tried booting an usb installer image, dropping to shell, and seeing if you get any errors working on the pool like this?

'zpool import' without args should tell why it can not import

markmcb: yes i talked about that: zfs import -a returned to me an error: unable to open gptid/... for writing (error=1). Cannot import 'disk': permission denied. Destroy and re-create the pool from a backup source

but mirror/raidz should only fail when multiple devices have failures, 'zpool status' should report which ones have problems.

err, zpool import

not import -a

tsoome: i'm agree and that's why i'm worried

ok I will try without -a

would be good if you can pastebin the full output

indeed zpool import without the -a works and of course it tells me that i'm in a degraded state

just degraded? nothing else?

that there is a faulty disk

i'll try to take a picture

that would be helpful.

do you know a good server to share picture?

pasteboard.co seems to work

(ada2 is the disk I removed)

ok, you have ada2 faulted, but when you removed it, then zpool import did complain about gptid/... ?

if I plug it again, zpool status returns no error

on the screenshot I unplugged the faulty disk

I had only 3 disks available of 4 and ada2 is the one I unplugged

I'd still suggest to try to scrub with that disk attached and see if you will get any IO errors reported with it (also check smart)

with four disks plugged in?

yes.

I performed many many scrubs and smartctl checks

no smart errors

and scrub reports chksum errors on the ada2 disk

when scrub is done, but you still have checsum errors reported, do zpool clear and scrub again.

i also performed that and it returned to me chksum error on ada2

that's why I wanted to replace it and try with a new harddrive

do you have spare cable for replacement?

i also performed that and it changed nothing

I also tried with another SATA connector on the motherboard

it's the same with the same disk

I also tried with different power connector

when disk has checksum errors but no physical IO errors, it hints about bad connection, bad power or bad memory (usually).

i'm agree with you

it memory was faulty i would get error on any disk.. It is still the same

you can also try to switch 2 disks - like move ada2 to ada1

already checked (I also tried with another SATA connector on the motherboard)

but I need to go afk now. good luck.

thanks for your help

i forgot that i also noticed an error with GPT on another disk (the primary GPT table is corrupt or invalid. using the secondary instead)

but this disk is still working very well..

that's why I forgot to speak about that

I don't know how can i restore the primary GPT table from the secondary one which is working

(without losing its data)

i guess I should first remove the faulty disk then resilver to get a good pool then recreate the gpt table

that small detail may explain why you can not boot with that pool;)

if primary partition table is gone and pool import is failing to open that disk with broken gpt and ada2 is removed, then you do not have enough disks for raidz.

so when using /usr/src (well your compiled /usr/obj) to make a jail, do you use installworld or install?

because installworld misses some things, and the jail doesn't work at first (I think due to lacking the passwd db

)

anyone got any further information on this?

polarian: jail(8) has examples for this, you need distribution target

cyric: thx I will check it now

ah cool.

cyric: then make installworld to update as usual

alright cool thx!

tsoome: but with the secondary gpt information it succeed to load the GPT table

Hi

nohello.net/en -- But also, o/ siracha

I need to move my irc config off chat.sr.ht and into the specific channels. Ugh. Work.

siracha: do you like hot sauce?

sorry offtopic but the name made me think of hot sauce xD

I think I'll try FreeBSD but I'm not quite sure what to expect. Can I expect to run into any issues vis-a-vis drivers and whatnot on my T490?

EmmaSterling: check the hardware compatibility list and see if the components are supported or not.

The cell modem, if the T490 supports one and you have one, might not work

expect battery life to be negatively affected. wifi drivers tend to be either flawless or completely broken, unlike on linux where you tend to have "kinda works" sorta situations. I have freebsd running on an old t60 and it's been great

the decrement should be minimal according to my experience

Why is ssh-keysign suid root?

Probably because of permanently_set_uid from uidswap.c.

If I had to guess it's because it reads key files from /etc/ssh/, and those are readable only by root, so it reads those files as root then drops privileges afterwards with permanently_set_uid.

s/reads/opens/

hello, all

while trying to run a program with wine, i (as recommended during the attempt) ran: /usr/local/share/wine/pkg32.sh install wine mesa-dri

a lot of stuff got installed (as far as I understand this was adding 'wine32 bit support' to the 'wine' i installed in the beginning

overall i didnt manage to run the desired program due to another error but that's not important for my question (since I settled for using a web-based client for now..)

but my question is: Need I reverse (deinstall all the things) the /usr/local/share/wine/pkg32.sh install wine mesa-dri command

(sorry for the stupid question- i'm very novice with BSD)

solstis: if it installed packages, there are pkg log lines in /var/log/messages; you should be able to remove them

yes, it installed. I understand your suggestion: I can see what exactly it installed and remove them. I'm pondering whether !leaving them installed can cause me any problems.. (I installed the new GhostBSD with MATE like 2 days ago and I'm enjoying the experience [I was previously using Debian with XFCE]

i don't know what packages they are, but they probably won't harm anything

great.. thanks

i have 1350 packages on my workstation, a few more wouldn't hurt

btw, the error I got while attempting the install was: 0120:err:virtual:try_map_free_area mmap() error Cannot allocate memory, range 0x7fffffd30000-0x7ffffffed000, unix_prot 0x3.

googled it but didn't see very concrete diagnosis

002c:err:winediag:getaddrinfo Failed to resolve your host name IP

00ac:err:ntoskrnl:ZwLoadDriver failed to create driver L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\winebth": c00000e5

003c:fixme:service:scmdatabase_autostart_services Auto-start service L"winebth"

before that

and thus I settled for the browser based client (MetaTrader5)..

anyhow.. i'm happy to start using BSD, i'm more satisfied than with linux (even for a home user like me- it seems much more stable and efficient). Thank you, rtprio , for the consultation

another thing I'm wondering (it's more hardwre based): which is better to shutdown my PC every night or I can leave it for days? (I have a very old configuration with a SATA HDD)

in my experience, the components will have a longer life if left on.

thank you for your reply!

if they're very power hungry it's ok to turn them off but yeah, leaving them on conserves lifespan, which is mostly measured in spinup/spindown cycles

im trying to make a low power nas, so far down to 8.9W (with no drives yet)... noticed that im staying in C1 even when nothing is running. i.e. dev.cpu.0.cx_supported: C1/1/1 C2/2/120 C3/3/256 and dev.cpu.0.cx_lowest: C1. despite C8 being enabled in bios. any ideas?

mobo is asus h110t, with i3-6100