garrulous mode, in /usr/src/bin/ed/main.c, seems unreachable

today's pkg update && pkg upgrade on my arm64 host resulted in a segfaulting pkg tool, when update or upgrade are passed. i tried force reinstalling pkg with pkg-static but the problem didn't go away. what can i do?

i don't have x86 machines running freebsd

i'll try building the latest from ports. seems the binary package is one version old

izder456: you still around ?

At times like these, I hope the person is on ZFS root, and has a boot image snapshot created prior with bectl that they can roll back to

Reinhilde: what is garrulous mode, i have never heard of this and it seems maybe undocumented?

Reinhilde: I see, it is reachable with

Reinhilde: garrulous mode is toggled with H

Hi. I was wondering how to access a service that is running in another jail. I realized that two jails sharing the same ip address will not see each other service via `sockstat -P tcp -l`, but I can connect anyway to localhost:port even from the jail that is not exposing it. Bug or feature?

is there a rss feed or something I can subscribe to, to know when a new patch release is available?

so it is

Xinayder: on the front page freebsd.org

SponiX: the image i used is UFS. building the latest pkg from ports fixed my issue.

wow, wordpress, unauthenticated WordPress REST batch route-confusion SQL injection

if you have a wordpress its time to patch it

dacav: definitely feature, I assume you're using host networking for the jail.

dacav: I would typically segment these, and use either unix domain sockets, pf rules, or (HA)proxy to allow acces

*access

but mostly haproxy because its so awesome

izder456: I have a patch for this

izder456: freebsd/pkg #2727

izder456: and one for ports tree also git.sr.ht/~dch/ports/commit/0ab82e4

and if you need a pre-built one for arm64 I have that too

its already fixed. compiling from ports fixed my issue.

ForeverNoob[m]: I would need to check the src to see what the defaults are, to my knowledge the defaults.

looking at what the installation media used 2-3 years ago, I have a keylen of 256 which matches the current most secure, but the checksum I can't seem to see within the geli list command.

AES-XTS-256 is used by default though

I do wonder if HMAC/SHA512 is dramatically more secure than HMAC/SHA256 anyways

dramatically? no

considering sha256 is still the standard for cryptographic verification of packages on most Linux distros

(the sha256sum gets signed, so if the sha256sum can be forged, it would eminate the point of a sha256sum)

dacav yeah, this is intended. There are other ways get to the more basic sources, but I would point you to the BastilleBSD abstraction. Their setup starts with cloning lo0 into lo1 and giving it the bastille0 name (IIRC). The default bastille create command uses bastille0. When I wanted to create a NAT/loopback jail with an unshared loopback, I

did a sysrc cloned_interfaces+=lo2 and a sysrc ifconfig_lo2_name="bastille1" and then in my bastille create command I put a bastille1 on the end so the jail was associated with that network, thus leaving that jail without a loopback connection to the others all on bastille0

scoobybejesus: thanks for the info. In my case I should have probably started directly with bastille, but now I'm not inclined to move, as I'm afraid to disrupt my (few) services

kevans: was reading the source code for the efi loader

I see this, maybe this is the issue?

wait no because it should still parse the config?

kerneldove: reading the sourc ecode this is already the case, on line 1315 in main.c we have the setenv in the bpa paste, and then the line after we have the parser.

this parser seems like it is meant to detect serial interfaces exposed via acpi

polarian eh?

however kevans also said unless the firmware redirects the output to serial, this will not work

that is why loader.env is useful

(to my knowledge)

then cons_probe is called, then some low level init, then the devinit()

so I am not quite sure what im looking for

ahhh I was meant to move devinit() down

I bet it is something in here

I dont know what the variables mean so the logic doesnt make sense, but this comes AFTER reading the config, and it would make sense if this overrides the loader.env config

alright I have moved devinit below that, and jsut before the boot_howto

for jails that don't have a public ip i guess that means you need privileged access to the jail host so you can run pkg and target the jail to install software?

Commit processing has resumed on all FreshPorts hosts. It will take a while for prod to catch up. Probably by 22:00 UTC today. FreshPorts/freshports #668

ugh I havent a clew what the fuck I am doing

kerneldove: no you install it through the host by setting the basedir to the jail directory?

it seems to work according to the man page, in practice? dunno

happy testing!!!

meanwhile I haven't the faintest clue what to do

i'm setting up squid inside a jail and i read i gotta do something so it doesn't conflict with other squid instances in other jails? doesn't that mean jails aren't isolating/securing their domain?

i thought anything ran in a jail is segregated from anything else

kerneldove: it is

its a more powerful chrootr

chroot*

that basically says jail doesn't work to segregate?

"Obviously, while a bit out-of-scope here, the fact that Squid's SHM objects can be freely accessed from any jail can constitute a security issue in its own right and must not be ignored..."

I cant even f*cking build the loader, how tf is string.h not found!!

oh maybe it's been fixed

I have no clue how string.h cant be found

hmmm, can I only compile the entire src tree? I am so confused.

why

and also why aren't you in /usr/src