00:16:05 the docs on the module are really thin, I was hoping for some explanation of how the different actions/states are abstracted out per-OS, but no such luck. 08:25:00 hm, do I understand correct, that the only way to use ifconfig_ in rc.conf to configuring a wireguard interface would be by setting network_interfaces to some list of interfaces, which is deprecated and would loose the default AUTO behaviour? 08:36:24 I have always just used wireguard_enable and wireguard_interfaces 08:36:35 in rc.conf 08:37:03 that isn't in the base system 08:37:49 ah 08:39:29 hm, seems to come from wireguard-tools and use wg-quick, which is really shitty for about any use case for which it wasn't explicitly written 09:09:35 Hi there, quick question about: https://www.freebsd.org/security/advisories/FreeBSD-SA-26:21.ptrace.asc 09:10:16 There is no workaround listed in the SA. But from my understanding, setting the sysctl security.bsd.unprivileged_proc_debug to 0 should help mitigate the issue for unpriviledged users. Or do i see this wrong? 09:16:17 I understand it the same way "a user with the ability to debug a process", so you would still have kernel code execution for root 09:21:49 Yeah, for root it would still be an issue. But Local Priv Escalation wouldn't be possible then. 11:05:40 nimaje: all you need is: cloned_interfaces="wg0"; ifconfig_wg0="..." 11:06:21 nimaje: and put 'wg setconf wg0 /etc/wg/wg0.conf' in /etc/start_if.wg0 11:11:47 hm, that script doesn't get the interface it is configuring in some way? seems easy to mess up by accidentally using the wrong interface in there 11:12:21 it's sourced, so it doesn't get any arguments, iirc there is some existing variable that has the interface name 11:13:22 ah, it's sourced as "start_if.$1", so you could use $1, but i'm not sure that's a public api 11:19:06 i also prefer to rename the interface: cloned_interfaces="wg0"; ifconfig_wg0_name="wg.mypeer"; ifconfig_wg_mypeer="..." 11:19:13 just to make it easier to see what's what 11:20:10 hm, I really dislike interfaces where it is easy to mess up due to something variable has to match in all places 11:20:36 and cloned_interfaces="wg.mypeer" wouldn't work? 11:21:40 it might (i don't remember offhand) but the name-matching logic is per-device and can be a bit odd for some, i rather rename them explicitly 14:37:13 okiedok, moved irssi out of the way, I can comfortably mess with the router/firewall now 14:39:56 ivy, name your NICs after their MAC addresses. 14:40:04 SuSE thought that was a good idea. 15:35:31 i wish i jotted down the bastille commands i used, since i need another identical jail 15:44:17 i don't know what interface i put for vnet 15:48:20 Anyone from the Secteam here? 16:06:16 danel1: try #freebsd-security ? 16:39:41 vkarlsen: doesn't and quite frankly I have no clue what I am doing 16:53:48 0day LPE for FreeBSD 14.x https://fatgid.io/ 16:55:21 good thing I hate users and so have none 17:51:06 "Users of 14.3, 14.4 and 15.0 should update to 14.3-RELEASE-p14, 14.4-RELEASE-p5 or 15.0-RELEASE-p9 respectively." -- Immediately available. Just upgraded this morning 17:51:56 what's the rumpus 17:52:41 I didn't really look at it, glad I updated my stuff today though. 17:57:20 ive been doing this all day] 17:58:09 lots of stuff is -stable so it's not just an update with freebsd-update 17:58:09 dkeav: local privilege escalation to root for all affected kernels 17:58:38 13.x unaffected from what ive read 18:00:33 The 0day posted earlier says that 15.0p9 is safe. Is that accurate, or is there more that should be done for mitigation? 18:00:35 uff 18:00:48 i need to do a source merge my end 18:00:50 fac3: 15.0p9 is safe 18:01:03 Cool, that's what I updated to 18:01:25 My public facing machine is using pkgbase, and I was hoping that would cover it. 18:01:34 I will need to do my home server at some point though. 18:02:13 updated and rebooted, :/ 18:02:39 the AI stuff is going to make patching a wargame 18:03:16 Just ran the exploit on my local machine (15.0p9) and was *not* root. 18:03:29 fac3: pkgbase saves the day. 18:03:44 they note that 15.0's context meant they didn't have a path to LPE 18:03:55 pkgbase is super nice. Only pain point I've had with it is upgrading to BETAs 18:03:57 Do we run clang static analysis at all before builds? 18:04:15 individual developers might, but the project dose not 18:04:19 does, even 18:04:22 kevans_: Good point. 18:04:35 there's too much noise and it's only gotten worse with recent llvm 18:04:48 iirc it now warns about annex k usage everywhere 18:04:50 So AI tools and found-exploits aren't noise? 18:04:59 i'm going to do a fresh clean install at 15.1 time and switch to pkg base, the current install has been upgraded since like 12.3 18:05:26 dkeav: I used the pkgbasify script to change over my machines. 18:05:29 i mean, thy certainly can be high in noise 18:05:38 The installer is a good choice though if you don't mind re-installing. 18:05:48 fac3: yea, i just think its time for a clean start, clear out all the cruft 18:05:57 Totally fair 18:07:49 kevans_: I'll put something together on my end, and publish. 18:51:04 polarian: That makes two of us :) 19:14:05 join #openbsd 20:23:38 vkarlsen: lol 20:47:55 rtprio, there is a #bastillebsd chan where they could probably quickly help narrow down what your command could have been. i mean, it's either -V or -B 21:00:33 yeah, -V failed but -B seemed to work and the config looks nearly identical 21:00:38 i've added it to my notes 21:11:04 awesome! yeah, i put my notes for every jail i create or update or whatever into bookstack for future reference 21:34:21 usually that sort of thing is in my scrollback, but not this time 🤷 21:47:00 First rule of IRC. No emoji. 21:51:28 i think that is up for debate 21:55:12 second rule of IRC, run a client that supports modern things 21:59:32 i thought "no DDOS" was the first rule of irc 22:02:15 Modernity on the internet sucks. :) That's what brought us social media, discord, slack, and all that other corporate nonsense that tries to connect the internet and reality, two things you should never do. 22:04:28 o0x1eef: sorry man, an array of bytes is an array of bytes and it has been for more than 30 years. 22:04:34 it just so happens to render differently 22:05:10 i like my characters to fit inside one byte, unless it is a different language, then I accept it. Anyway, I was only joking, and the point has gone over your head. 22:05:35 it wasn't a very good joke 22:06:33 I sense that you're a little offended or uncomfortable, sorry about that 22:11:35 not offended, just confused 22:11:46 if a machine running freebsd zfs has 2 mirrored disks (for the OS). Is it possible to install a second bsd in one of the disks and boot on this second bsd ? and go back to the first disk (if needed) 22:19:31 hernan604: what are you trying to accomplish by doing this? 22:20:44 dual boot probably 22:23:09 rtprio: upgrade to 15.0 22:23:28 just use boot environments, bectl 22:23:34 right 22:26:25 well, i have always upgraded (in other boxes) with freebsd-update.. however last week i upgraded one box via freebsd-update and i dont know why, sshd wouldnt start. maybe i messed up with the diffs during the upgrade 22:26:45 but that lead me to a thought that maybe its better to do fresh installs when possible 22:27:19 you could fresh install if you wanted and then re-attch your previous drive as a mirror 22:28:00 but depending on what exactly "wouldnt start" entails, you could you know, just fix it 22:28:19 if it's boot in single user and fix your bungled /etc/rc.d/ldpreload for example 22:28:27 yeah lol, but i got a feeling that maybe some other things might be broken and i am not aware 22:29:22 so by fresh install, you mean, install in one of the mirrored hdd, then attach the second hdd to mirror the new one ? 22:30:00 oh man, zfs always gets me =p 22:34:09 yeah, break your mirror, install fresh 22:34:28 when you like your new single drive system, wipe the old os and add it as a mirror 23:47:48 i always install base os as ufs. data is always zfs. it's a lot less hassle, and it doesn't involve refreshing boot blocks when zfs updates. 23:49:13 for me, base os installs these days are always ufs on ssd 23:49:27 just my 0.02