• 0 Posts
  • 33 Comments
Joined 2 years ago
cake
Cake day: February 3rd, 2025

help-circle





  • we desperately need kernel livepatching to be easier. that would have broken this exploit chain. also almost no services need esp or rxrpc or exotic things lile af_alg, but proper sandboxing takes a lot of time and trial and error. few services list all the capabilities, filesystems, address families, and syscalls they need to function. even if you get the service to boot there’s a good chance some feature will touch the electric fence during operation











  • no worries! i’m not the fastest to respond myself. i do want to help though. to explain the command,

    • journalctl searches the journal, a database of messages from the units on your system managed by journald
    • -b0 means “this boot’s messages”, not the last boot or the one before…
    • -p4' means "WARNING (4) or higher" (3, 2, 1, or 0). these priority levels are pretty old, long before my time. you can see them in man syslog`, but 0 is “alert” and 7 is “debug”

    i say all that because i naively hoped a malfunction on your system would appear as a high-priority message in the journal, and i wanted to spare you the back-and-forth that this kind of troubleshooting usually entails. in this case, though, i didn’t really see anything in those logs, so i suspect the culprit has been filtered out.

    i will keep trying my best to help, don’t worry, but i understand if you get fatigued and just want to move on.

    there are some odd gaps in the logs where i can’t tell what’s happening. now that you know how to send logs to something like dpaste, let’s open the floodgates. i don’t mind wading through a sea of logs to find something (kind of my day job too)

    to give the kernel’s account of what happened:

    dmesg -H | curl -s -F "content=<-" https://dpaste.com/api/v2/
    

    that’s everything from the start of the system to now, so it’s best if you do it soon after booting.

    finally, i had you filter to WARNING (4) and above with -p4 but it didn’t show anything. how about…everything?

    journalctl -b0 | curl -s -F "content=<-" https://dpaste.com/api/v2/
    

    that will be a lot of information but it should be informative!