00:17:15 so I have my system in 15.0-STABLE, I think, how do I know if I got the latest security patches? 00:18:59 Xinayder: by checking which commit your /usr/src is on? :p 00:19:08 provided you compiled from src 00:19:14 I'm using pkgbase, not compiled from src 00:19:36 idk just run pkg upgrade and see if there is any upgrades simples 00:19:47 freebsd-version -urk shows 15.0-RELEASE-p5 and 15.1-PRERELEASE 00:19:54 I guess today's snapshots include them? 00:20:04 * polarian shrugs I assume so 00:20:39 oops meant to send those in two different messages 00:22:03 seems there was an update to stable on the 28th which would have included the patches 00:22:12 so if you are up to date pkgbase wise 00:22:18 then yes you have the security patches 00:23:54 Xinayder: gimme the output of "uname -v" 00:23:56 I will check for you 00:35:22 FreeBSD 15.0-RELEASE-p5 releng/15.0-n281018-0730d5233286 GENERIC 00:36:21 latest is -p7 00:37:10 https://www.freebsd.org/security/notices/ 00:40:04 Kernel patch level is not bumped if there is no change there, I believe 00:40:43 Nevermind I do have p7 everywhere, both kernel and userland 00:41:05 there was a kernel change, i guess pkgbase lags behind src & freebsd-update currently? 00:41:38 Package building is most likely slower yes 00:42:07 freebsd-updates are binary though, how long does it take to stuff a binary into a tarball? 00:42:48 I'll be saving the migration to pkgbase for 16.0-RELASE :) 00:55:53 mjp: I will be saving the migration to pkgbase indefinitely 00:56:01 that poison will not infect any of my BSD hosts 00:56:23 whats the problem with it? 00:56:38 freebsd-update is ok (better than src) but still slow as hell 00:56:40 if I discuss this again I might get banned from the channel :p 00:56:46 its not about speed 00:57:22 is it an emotional or logical argument? should be able to articulate it while keeping within the channel rules 00:58:39 pkgbase sure gives you speed, but it assumes that everyone has bandwidth to burn, which is not always the case in some rural areas. But bandwidth aside, it ruins the one benefit of BSD over Linux, the separate base and ports. base being one complete system updated in its entirety provides stability. pkgbase dividing this into lots of smaller packages adds a whole heap of issues which could go 00:58:41 wrong, not to mention that pkg will update both base and ports at the same time like on Linux. 00:58:44 pkgbase to me is just FreeLinux 00:58:58 and violates the design of BSD 00:59:04 so less I rigidly oppose it 00:59:08 s/less/yes/ 00:59:27 Xinayder: you are out of date, please update 01:00:03 I don't think any pkg update will change the uname output, if I use pkgbase? 01:00:37 well even if it didnt modify the patch level, the commit hash is within the uname string, which always changes 01:00:49 and that HEAD is from Mar 25 01:01:24 Xinayder: also I thought you were running -STABLE 01:01:46 honestly I don't know what I'm running, I moved my -RELEASE to pkgbase and since then I don't know what's going on 01:01:59 welp, you are vulnerable so update nethertheless 01:02:04 nevertheless* 01:02:10 my spelling tonight is woeful 01:02:19 I did a pkg update -r FreeBSD-base and FreeBSD-ports-kmods, and the latest snapshot was from today 15h 01:02:30 hmm 01:02:39 FreeBSD-runtime-15.snap20260429150809 01:02:42 can I see the output of your /etc/pkg.conf 01:02:54 sorry 01:02:56 I meant 01:02:59 /etc/pkg/FreeBSD.conf 01:03:05 I need to sleep :p 01:03:12 brain not working tongiht 01:03:20 the original file or the modified one? 01:04:06 Xinayder: whatever config you are using right now lol 01:04:50 https://paste.rs/pRy7s and https://paste.rs/015ip 01:06:47 hmm 01:06:58 I wonder if because you are running pkgbase the uname will not be updated 01:07:51 if so, I guess another loss for pkgbase :p 01:10:20 welp, i just rebooted and now i cant ssh to the host 01:10:53 * polarian shrugs 01:10:55 is this a server 01:11:02 if so you shouldnt be running stable on a server (IMO) 01:11:06 yeah its a server 01:11:32 it didnt load the realtek driver correctly smh 01:11:48 im just considering going back to the pre-pkgbase snapshot, honestly 01:12:17 in any case, I wouldnt use -stable on servers, you want to update servers as little as possible 01:12:32 and stable gets a bunch of feature updates you dont need 01:12:54 security patches get backported and go to the security ML (and rss feed) which are the only times you need to update between releases 01:19:26 I can still go to pkgbase, but remain on -release, no? 01:20:10 Xinayder: You can choose whatever you want. 01:21:10 Xinayder: yes 01:21:24 you just switch 01:52:41 meh its not a good idea to run pkg upgrade -r FreeBSD-ports-kmods when the numbers mismatch :/ 01:52:46 I thought it'd be auto updated 02:08:17 after some reboots and downgrades i am finally on -release again FreeBSD teldrassil 15.0-RELEASE-p7 FreeBSD 15.0-RELEASE-p7 releng/15.0-n281034-bbfdabc12895 GENERIC amd64 02:08:35 15.0-RELEASE-p7 listed 3x with freebsd-version -urk 02:52:42 Xinayder: That would be ideal. 06:09:41 Hmm... multitail is not available on 15. And freshports shows a basic page missing build information. Did multitail simply fail to build on 15? 06:22:41 freshports has a list of links at the top, one of which is to fallout https://portsfallout.com/fallout?port=sysutils%2Fmultitail%24 07:06:53 with pkg and FreeBSD-base, how does one go from 15.0 to 15.1 release when available? if i do nothing will it automatically go to 15.1 when released? the url in /etc/pkg/ is /${ABI}/base_release_${VERSION_MINOR} ... will i need to override that variable manually to "1" then set it back? 07:14:34 markmcb: the documented method will be 'pkg -oVERSION_MINOR=1 upgrade', i think. (remember to upgrade the kernel first, then reboot, then upgrade userland) 07:15:03 i haven't actually tested that, but it's what the open doc review for this says 07:16:03 ah, ok, that makes sense. i didn't realize you could set it like this, thanks 07:27:43 The handbook's a bit complicated for it (imho), but worth reading through 26.7.2.1 befor you upgrade. 07:28:14 Minor upgrades are less risky, but there's some good advice there. 07:30:07 unrelated / funny: https://copy.fail/ 07:32:01 How nice to publish the vuln with proof of concepts before patches have been properly deployed 07:33:08 I agree 07:33:49 Skiddies are going to be eating well today. 07:34:34 no sympathy left for corporations like canonical, redhat or amazon 07:42:24 With the sort of cabbage they have, I think their time would be better spent on security, looking at the recent resurfacing of software supply chain attacks etc. How many unix-likes _still_ don't have package signing is somewhat alarming. 07:43:33 But we're also in the age of "to install, run this command/script as root on your machine". 07:43:40 Looking at you, rustup. 07:45:01 Anyway, we'll be hacking like it's 1992 again in no time, with all of the vibe coding that's going on everywhere. 07:45:01 pretty sure it was already common when rustup was created and they just copied it without noticing that it is a bad idea 07:45:15 Yeah, absolutely. 09:21:13 Hi there :) I have a quick question about todays Security Advisories. As far as i can tell, the libnv-SAs are most likely to be abused / exploited by local users, so there isn't that much danger from remote. For FreeBSD-SA-26:13.exec there is very few information but it's clear, that local priv-escalation is possible. But is there any chance, that this somehow could be abused remotely? And for: FreeBSD-SA-26:14.pf - How likely is it, 09:21:13 that "Remote attackers can craft packets which cause affected systems to panic." is getting triggered easily? 09:23:20 hi 09:23:43 I'm sorry I come back with the same problem as one or two weeks ago with my ZFS disks 09:25:45 one of my ZFS pool disk (4 disks in RAID 5) failed. I need to change it. thus i power down my computer, remove the faulty disk, replace it and restart the computer but boot failed with error about zfs pool which is not found 09:26:29 i tried a FreeBSD live usb stick, performed zfs import -a which returns: "unable to open adaxxx for writing" (for sure this disk has been changed 09:27:00 and after that: cannot import 'disk' : permission denied. Destroy and recreate the pool from a backup source 09:27:21 what is strange is that if i put the faulty disk into the pool my ZFS pool is working again 09:27:44 my question: what can I do in order to get my ZFS pool working again without the faulty disk? 09:28:47 titou does zpool status report errors only for that faulty disk? 09:28:50 I already changed disks from my pool in the past and I never had this kind of problem 09:28:55 tsoome: yes 09:29:28 the disk is powered on but has IO errors? 09:29:51 chksum error only 09:30:11 just checksum error? no IO error from hardware? 09:30:28 nop but i already tried to change the sata connector etc. it's the same 09:30:28 then you do not need to replace it, just zpool clear and zpool scrub 09:30:40 no because i have errors after each zpool scrub 09:31:19 and this is one problem. The other problem is that I cannot boot without this particular disk whereas raid5 could be able to boot without it 09:31:31 it's the aim of the RAID 5 :) 09:31:56 zpool status will report error counters, they will not get zeroed when zfs does rewrite the block. 09:32:24 danel1: as I understand it, the attacker doesn't need any information about your system, as the problem is in the parsing of SCTP chunk parameters, so an attacker could create one package and send it to as much systems as possible to DOS random systems, but that understanding is based only on the SA 09:33:55 and I am afraid of loosing my ZFS pool if this disk really fails 09:34:14 there is no solution to check ZPOOL/ZFS information on each disk of the RAID to be sure that there is no problem? 09:34:20 i don't understand why it refuses to boot 09:34:40 danel1: note that libnv issues can be used to escape capsicum, which can be combined with e.g. a bhyve vulnerability to escalate from VM to host access 09:36:06 titou: and you don't have enought connectors to replace the disk while it is still connected? (zpool replace) 09:36:43 nop 09:37:02 pool import failure indicates about more failures than just one disk, thats why I am wondering if there are in fact more corrupted blocks (which scsub should identify and fix if there is enough redundancy). 09:37:42 tsoome: that's my point of view too 09:38:01 two disks of my pool failed in the past but i replaced it and resilvered everything.. 09:38:39 boru: I don't think rustup should worry about signing or be used for software distribution to end users. unfortunately, it's also not designed at all to play well with contemporary package management systems.. 09:39:02 ivy: fair point 09:39:18 to be honest the last disk which failed, failed at the end of the resilvering of the first disk which failed 09:39:33 nimaje: mh yeah, that could be possible.. 09:39:34 i lost some files but after that i had absolutely no problem with my pool 09:41:38 boru: in general coupling development, software packaging, distribution and documentation was a terrible idea (look at github now) 09:47:04 so you have no ideas? or at least ideas to check zpool data information on each disk or recreate it without exporting/importing the pool? 09:48:10 titou: as a side note, if it won't boot it could be an issue outside of zfs altogether, e.g., depending on how you installed freebsd that failing disk may be the only one with UEFI/ESP. the bootable stuff would need to be present on one of the remaining devices. 09:48:12 i'm very worried about that 09:49:05 markmcb: in fact i can see the boot process but it failed while trying to open the ZFS pool during the bootloader process 09:49:23 i also executed gpart bootcode on each disk of the pool 09:49:39 what can I also perform to check the boot process? 09:52:16 have you tried booting an usb installer image, dropping to shell, and seeing if you get any errors working on the pool like this? 09:53:03 'zpool import' without args should tell why it can not import 09:53:55 markmcb: yes i talked about that: zfs import -a returned to me an error: unable to open gptid/... for writing (error=1). Cannot import 'disk': permission denied. Destroy and re-create the pool from a backup source 09:55:26 but mirror/raidz should only fail when multiple devices have failures, 'zpool status' should report which ones have problems. 09:55:34 err, zpool import 09:55:42 not import -a 09:56:05 tsoome: i'm agree and that's why i'm worried 09:56:12 ok I will try without -a 09:56:57 would be good if you can pastebin the full output 10:02:44 indeed zpool import without the -a works and of course it tells me that i'm in a degraded state 10:03:06 just degraded? nothing else? 10:03:33 that there is a faulty disk 10:03:40 i'll try to take a picture 10:03:53 that would be helpful. 10:06:36 do you know a good server to share picture? 10:09:01 pasteboard.co seems to work 10:09:54 https://temp-image.com/lICsl78ZrH5LPSm 10:10:36 (ada2 is the disk I removed) 10:10:57 ok, you have ada2 faulted, but when you removed it, then zpool import did complain about gptid/... ? 10:10:58 if I plug it again, zpool status returns no error 10:11:20 on the screenshot I unplugged the faulty disk 10:11:45 I had only 3 disks available of 4 and ada2 is the one I unplugged 10:13:00 I'd still suggest to try to scrub with that disk attached and see if you will get any IO errors reported with it (also check smart) 10:13:28 with four disks plugged in? 10:13:38 yes. 10:13:42 I performed many many scrubs and smartctl checks 10:13:45 no smart errors 10:13:56 and scrub reports chksum errors on the ada2 disk 10:14:15 when scrub is done, but you still have checsum errors reported, do zpool clear and scrub again. 10:14:31 i also performed that and it returned to me chksum error on ada2 10:14:40 that's why I wanted to replace it and try with a new harddrive 10:15:01 do you have spare cable for replacement? 10:15:09 i also performed that and it changed nothing 10:15:21 I also tried with another SATA connector on the motherboard 10:15:24 it's the same with the same disk 10:15:33 I also tried with different power connector 10:16:01 when disk has checksum errors but no physical IO errors, it hints about bad connection, bad power or bad memory (usually). 10:16:20 i'm agree with you 10:16:33 it memory was faulty i would get error on any disk.. It is still the same 10:16:38 you can also try to switch 2 disks - like move ada2 to ada1 10:16:51 already checked (I also tried with another SATA connector on the motherboard) 10:17:21 but I need to go afk now. good luck. 10:17:29 thanks for your help 10:20:49 i forgot that i also noticed an error with GPT on another disk (the primary GPT table is corrupt or invalid. using the secondary instead) 10:20:57 but this disk is still working very well.. 10:21:12 that's why I forgot to speak about that 10:21:32 I don't know how can i restore the primary GPT table from the secondary one which is working 10:21:55 (without losing its data) 10:22:46 i guess I should first remove the faulty disk then resilver to get a good pool then recreate the gpt table 13:15:50 that small detail may explain why you can not boot with that pool;) 13:17:14 if primary partition table is gone and pool import is failing to open that disk with broken gpt and ada2 is removed, then you do not have enough disks for raidz. 14:41:18 so when using /usr/src (well your compiled /usr/obj) to make a jail, do you use installworld or install? 14:41:30 because installworld misses some things, and the jail doesn't work at first (I think due to lacking the passwd db 14:41:32 ) 14:41:43 anyone got any further information on this? 14:59:21 polarian: jail(8) has examples for this, you need distribution target 14:59:41 cyric: thx I will check it now 15:00:14 ah cool. 15:00:31 cyric: then make installworld to update as usual 15:00:34 alright cool thx! 15:31:46 tsoome: but with the secondary gpt information it succeed to load the GPT table 16:45:37 Hi 16:46:39 https://nohello.net/en/ -- But also, o/ siracha 16:48:03 I need to move my irc config off chat.sr.ht and into the specific channels. Ugh. Work. 17:19:19 siracha: do you like hot sauce? 17:19:37 sorry offtopic but the name made me think of hot sauce xD 18:10:30 I think I'll try FreeBSD but I'm not quite sure what to expect. Can I expect to run into any issues vis-a-vis drivers and whatnot on my T490? 18:16:42 EmmaSterling: check the hardware compatibility list and see if the components are supported or not. 18:20:14 The cell modem, if the T490 supports one and you have one, might not work 18:21:35 expect battery life to be negatively affected. wifi drivers tend to be either flawless or completely broken, unlike on linux where you tend to have "kinda works" sorta situations. I have freebsd running on an old t60 and it's been great 18:47:04 the decrement should be minimal according to my experience 20:36:55 Why is ssh-keysign suid root? 20:54:24 Probably because of permanently_set_uid from uidswap.c. 21:01:03 If I had to guess it's because it reads key files from /etc/ssh/, and those are readable only by root, so it reads those files as root then drops privileges afterwards with permanently_set_uid. 21:03:19 s/reads/opens/ 21:05:28 hello, all 21:06:26 while trying to run a program with wine, i (as recommended during the attempt) ran: /usr/local/share/wine/pkg32.sh install wine mesa-dri 21:07:23 a lot of stuff got installed (as far as I understand this was adding 'wine32 bit support' to the 'wine' i installed in the beginning 21:08:21 overall i didnt manage to run the desired program due to another error but that's not important for my question (since I settled for using a web-based client for now..) 21:08:44 but my question is: Need I reverse (deinstall all the things) the /usr/local/share/wine/pkg32.sh install wine mesa-dri command 21:09:59 (sorry for the stupid question- i'm very novice with BSD) 21:16:08 solstis: if it installed packages, there are pkg log lines in /var/log/messages; you should be able to remove them 21:19:03 yes, it installed. I understand your suggestion: I can see what exactly it installed and remove them. I'm pondering whether !leaving them installed can cause me any problems.. (I installed the new GhostBSD with MATE like 2 days ago and I'm enjoying the experience [I was previously using Debian with XFCE] 21:20:13 i don't know what packages they are, but they probably won't harm anything 21:20:35 great.. thanks 21:20:53 i have 1350 packages on my workstation, a few more wouldn't hurt 21:21:07 btw, the error I got while attempting the install was: 0120:err:virtual:try_map_free_area mmap() error Cannot allocate memory, range 0x7fffffd30000-0x7ffffffed000, unix_prot 0x3. 21:21:55 googled it but didn't see very concrete diagnosis 21:23:25 002c:err:winediag:getaddrinfo Failed to resolve your host name IP 21:23:25 00ac:err:ntoskrnl:ZwLoadDriver failed to create driver L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\winebth": c00000e5 21:23:25 003c:fixme:service:scmdatabase_autostart_services Auto-start service L"winebth" 21:23:31 before that 21:24:17 and thus I settled for the browser based client (MetaTrader5).. 21:32:17 anyhow.. i'm happy to start using BSD, i'm more satisfied than with linux (even for a home user like me- it seems much more stable and efficient). Thank you, rtprio , for the consultation 21:35:02 another thing I'm wondering (it's more hardwre based): which is better to shutdown my PC every night or I can leave it for days? (I have a very old configuration with a SATA HDD) 21:36:04 in my experience, the components will have a longer life if left on. 21:42:28 thank you for your reply! 21:46:10 if they're very power hungry it's ok to turn them off but yeah, leaving them on conserves lifespan, which is mostly measured in spinup/spindown cycles 22:10:14 im trying to make a low power nas, so far down to 8.9W (with no drives yet)... noticed that im staying in C1 even when nothing is running. i.e. dev.cpu.0.cx_supported: C1/1/1 C2/2/120 C3/3/256 and dev.cpu.0.cx_lowest: C1. despite C8 being enabled in bios. any ideas? 22:10:24 mobo is asus h110t, with i3-6100