the docs on the module are really thin, I was hoping for some explanation of how the different actions/states are abstracted out per-OS, but no such luck.

hm, do I understand correct, that the only way to use ifconfig_<interface> in rc.conf to configuring a wireguard interface would be by setting network_interfaces to some list of interfaces, which is deprecated and would loose the default AUTO behaviour?

I have always just used wireguard_enable and wireguard_interfaces

in rc.conf

that isn't in the base system

ah

hm, seems to come from wireguard-tools and use wg-quick, which is really shitty for about any use case for which it wasn't explicitly written

Hi there, quick question about: freebsd.org/security/advisories/FreeBSD-SA-26:21.ptrace.asc

There is no workaround listed in the SA. But from my understanding, setting the sysctl security.bsd.unprivileged_proc_debug to 0 should help mitigate the issue for unpriviledged users. Or do i see this wrong?

I understand it the same way "a user with the ability to debug a process", so you would still have kernel code execution for root

Yeah, for root it would still be an issue. But Local Priv Escalation wouldn't be possible then.

nimaje: all you need is: cloned_interfaces="wg0"; ifconfig_wg0="..."

nimaje: and put 'wg setconf wg0 /etc/wg/wg0.conf' in /etc/start_if.wg0

hm, that script doesn't get the interface it is configuring in some way? seems easy to mess up by accidentally using the wrong interface in there

it's sourced, so it doesn't get any arguments, iirc there is some existing variable that has the interface name

ah, it's sourced as "start_if.$1", so you could use $1, but i'm not sure that's a public api

i also prefer to rename the interface: cloned_interfaces="wg0"; ifconfig_wg0_name="wg.mypeer"; ifconfig_wg_mypeer="..."

just to make it easier to see what's what

hm, I really dislike interfaces where it is easy to mess up due to something variable has to match in all places

and cloned_interfaces="wg.mypeer" wouldn't work?

it might (i don't remember offhand) but the name-matching logic is per-device and can be a bit odd for some, i rather rename them explicitly

okiedok, moved irssi out of the way, I can comfortably mess with the router/firewall now

ivy, name your NICs after their MAC addresses.

SuSE thought that was a good idea.

i wish i jotted down the bastille commands i used, since i need another identical jail

i don't know what interface i put for vnet

Anyone from the Secteam here?

danel1: try #freebsd-security ?

vkarlsen: doesn't and quite frankly I have no clue what I am doing

0day LPE for FreeBSD 14.x fatgid.io

good thing I hate users and so have none

"Users of 14.3, 14.4 and 15.0 should update to 14.3-RELEASE-p14, 14.4-RELEASE-p5 or 15.0-RELEASE-p9 respectively." -- Immediately available. Just upgraded this morning

what's the rumpus

I didn't really look at it, glad I updated my stuff today though.

ive been doing this all day]

lots of stuff is -stable so it's not just an update with freebsd-update

dkeav: local privilege escalation to root for all affected kernels

13.x unaffected from what ive read

The 0day posted earlier says that 15.0p9 is safe. Is that accurate, or is there more that should be done for mitigation?

uff

i need to do a source merge my end

fac3: 15.0p9 is safe

Cool, that's what I updated to

My public facing machine is using pkgbase, and I was hoping that would cover it.

I will need to do my home server at some point though.

updated and rebooted, :/

the AI stuff is going to make patching a wargame

Just ran the exploit on my local machine (15.0p9) and was *not* root.

fac3: pkgbase saves the day.

they note that 15.0's context meant they didn't have a path to LPE

pkgbase is super nice. Only pain point I've had with it is upgrading to BETAs

Do we run clang static analysis at all before builds?

individual developers might, but the project dose not

does, even

kevans_: Good point.

there's too much noise and it's only gotten worse with recent llvm

iirc it now warns about annex k usage everywhere

So AI tools and found-exploits aren't noise?

i'm going to do a fresh clean install at 15.1 time and switch to pkg base, the current install has been upgraded since like 12.3

dkeav: I used the pkgbasify script to change over my machines.

i mean, thy certainly can be high in noise

The installer is a good choice though if you don't mind re-installing.

fac3: yea, i just think its time for a clean start, clear out all the cruft

Totally fair

kevans_: I'll put something together on my end, and publish.

polarian: That makes two of us :)

join #openbsd

vkarlsen: lol

rtprio, there is a #bastillebsd chan where they could probably quickly help narrow down what your command could have been. i mean, it's either -V or -B

yeah, -V failed but -B seemed to work and the config looks nearly identical

i've added it to my notes

awesome! yeah, i put my notes for every jail i create or update or whatever into bookstack for future reference

usually that sort of thing is in my scrollback, but not this time 🤷

First rule of IRC. No emoji.

i think that is up for debate

second rule of IRC, run a client that supports modern things </ducks>

i thought "no DDOS" was the first rule of irc

Modernity on the internet sucks. :) That's what brought us social media, discord, slack, and all that other corporate nonsense that tries to connect the internet and reality, two things you should never do.

o0x1eef: sorry man, an array of bytes is an array of bytes and it has been for more than 30 years.

it just so happens to render differently

i like my characters to fit inside one byte, unless it is a different language, then I accept it. Anyway, I was only joking, and the point has gone over your head.

it wasn't a very good joke

I sense that you're a little offended or uncomfortable, sorry about that

not offended, just confused

if a machine running freebsd zfs has 2 mirrored disks (for the OS). Is it possible to install a second bsd in one of the disks and boot on this second bsd ? and go back to the first disk (if needed)

hernan604: what are you trying to accomplish by doing this?

dual boot probably

rtprio: upgrade to 15.0

just use boot environments, bectl

right

well, i have always upgraded (in other boxes) with freebsd-update.. however last week i upgraded one box via freebsd-update and i dont know why, sshd wouldnt start. maybe i messed up with the diffs during the upgrade

but that lead me to a thought that maybe its better to do fresh installs when possible

you could fresh install if you wanted and then re-attch your previous drive as a mirror

but depending on what exactly "wouldnt start" entails, you could you know, just fix it

if it's boot in single user and fix your bungled /etc/rc.d/ldpreload for example

yeah lol, but i got a feeling that maybe some other things might be broken and i am not aware

so by fresh install, you mean, install in one of the mirrored hdd, then attach the second hdd to mirror the new one ?

oh man, zfs always gets me =p

yeah, break your mirror, install fresh

when you like your new single drive system, wipe the old os and add it as a mirror

i always install base os as ufs. data is always zfs. it's a lot less hassle, and it doesn't involve refreshing boot blocks when zfs updates.

for me, base os installs these days are always ufs on ssd

just my 0.02