Looking to move on from udev - static /dev vs mdevd?

ukky · Posted: Tue Feb 28, 2023 7:12 pm Post subject:

sys-apps/shadow also provides 'su' and this does not pull in sys-libs/pam as a dependency.
But you need to add '-su' USE flag sys-apps/util-linux beforehand and reinstall it before you add 'su' use flag for sys-apps/shadow.

Regarding D-Bus removal, the best solution I found so far is to patch app-accessibility/at-spi2-core sources to completely remove any reference to sys-apps/dbus files.
Running main system without sys-apps/dbus for about two weeks now, seems okay.

I also tried to completely remove Accessibility Toolkit (ATK) from both x11-libs/gtk+:2 and x11-libs/gtk+:3, patching all header and C-files that reference ATK.
Unfortunately, this approach has failed. Maybe one day I will try again, maybe using less aggressive ATK removal would help.

Also installed sys-fs/static-dev instead of udev, but enabled devtmpfs in kernel and mounting devtmpfs to /dev at boot.
This way I do not have to maintain/create device nodes. For a desktop system, this is acceptable compromise. Not having udev is important to me, but static /dev is not.

stefan11111 · l33t Joined: 29 Jan 2023 Posts: 922 Location: Romania

NeddySeagoon · Posted: Tue Feb 28, 2023 8:14 pm Post subject:

ukky,

With devtmpfs and no udev, the /dev/nodes are created but udev does not fix permissions, grouprs and ownership.
You need to do that every boot. udev created symlinks will be missing too.

static-dev is just that. It lives in /dev on the root filesystem and is err ... static.
You only add nodes once in a while so the maintenance burden is minimal.
Oh and /dev/snd/ gets mangled from time to time. It correlates with updates but I don't know which packages does it yet.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

ukky · Posted: Tue Feb 28, 2023 8:19 pm Post subject:

stefan11111 · l33t Joined: 29 Jan 2023 Posts: 922 Location: Romania

ukky · Posted: Tue Feb 28, 2023 8:38 pm Post subject:

Hi NeddySeagoon,

I bow in your presence.

ukky · Posted: Tue Feb 28, 2023 8:56 pm Post subject:

stefan11111 · l33t Joined: 29 Jan 2023 Posts: 922 Location: Romania

NeddySeagoon · Posted: Tue Feb 28, 2023 9:10 pm Post subject:

stefan11111,

I just use alsa. Its not problem free yet. For good sound output, with no stuttering, I need to keep the load average over 40. :)
That's nothing to do with static dev though.
Until alsa works on its own, nothing else can as everything uses alsa at the bottom, well except OSS.

I have dbus installed but not started. VirtualBox wants it.
I should really give up VirtualBox but its easier than QEMU for a quick and dirty throw away Virtual Machine. For long term KVMs its all QEMU.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

ukky · Posted: Tue Feb 28, 2023 9:25 pm Post subject:

stefan11111 · l33t Joined: 29 Jan 2023 Posts: 922 Location: Romania

ukky · Posted: Tue Feb 28, 2023 9:50 pm Post subject:

NeddySeagoon · Posted: Tue Feb 28, 2023 9:52 pm Post subject:

ukky,

Its time to meet github or some other public repo host.

The post size limit is 64k, the post is silently truncated there.
It could go to a pastbin, but that has a limited life.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

ukky · Posted: Tue Feb 28, 2023 10:34 pm Post subject:

Here is the patch: https://fileport.io/RncUTzrnnDa6
There are two files: at-spi2-core-2.46.0.ebuild and a patch.
Patch should be placed into /etc/portage/patches/app-accessibility/at-spi2-core-2.46.0/
ebuild is slightly modified to enable 'dbus' USE flag. ebuild should be placed in local portage overlay.
With '-dbus' use flag for =app-accessibility/at-spi2-core-2.46.0, package will be built with no D-Bus dependency.

colo-des · Tux's lil' helper Joined: 20 May 2011 Posts: 97

For my part, I stayed with the old sys-apps/shadow-4.11.1, that if backed up in the local tree:

Hu · Administrator Joined: 06 Mar 2007 Posts: 21856

That message is warning you that flipping the value arbitrarily is dangerous, because if your system is using it, and you disable PAM, you may create a significant mess. PAM itself is not inherently dangerous.

stefan11111 · l33t Joined: 29 Jan 2023 Posts: 922 Location: Romania

colo-des · Tux's lil' helper Joined: 20 May 2011 Posts: 97

@Hu

Precisely, it will not be the user who is going to change it... how do you protect yourself from others touching it momentarily "until the attacker achieves what he wants" and then revert it back to how he was? with app-armor? selinux? ...no thanks, this is where you don't want to solve a problem that doesn't exist creating several more problems that you didn't have... less is more, at least from my point of view.

Regards.

Hu · Administrator Joined: 06 Mar 2007 Posts: 21856

It will be the root user on the system in question who changes it. An attacker who can do that already has complete control. The warning is not about securing a system from an attacker. The warning is trying to discourage users from breaking their system so badly that they need to come here and get our help to repair it.

ukky · Posted: Wed Mar 01, 2023 1:34 am Post subject:

colo-des · Tux's lil' helper Joined: 20 May 2011 Posts: 97

Hu · Administrator Joined: 06 Mar 2007 Posts: 21856

Almost all packages theoretically increase attack surface by their presence, and therefore should not be installed unnecessarily. The extent to which they increase attack surface, and the value they provide in return, vary widely. The maintainer's DANGEROUS warning is about the administrator recklessly breaking the system, not about attack surface.

colo-des · Tux's lil' helper Joined: 20 May 2011 Posts: 97

stefan11111 · l33t Joined: 29 Jan 2023 Posts: 922 Location: Romania

stefan11111 · l33t Joined: 29 Jan 2023 Posts: 922 Location: Romania