User:Kgdrenefort/captain logs

From Gentoo Wiki
Jump to:navigation Jump to:search

 My «captain» logs

Last edition: 2024, May the 21 at 04:10 (wiki time !)

Purpose of this page

As a captain of a ship, the administrator of an operating system is responsible of everything happening to the ship. It's the captain duty, as the administrator.

Since Gentoo is kind of very powerful, related to most Linux distribution or other OS, it's very easy to do things and forget them right away.

Specially when the captain is ADHD. If life was a game, a RPG, I would have a gigantic malus in intelligence because I can't brain properly.

That's why this page comes into existence. I lost time too many often because I forgot something I did before, as energy and mental sanity, to me as other.

Here will be reported major operations of my system. By date and time, explaining what was done and for what purpose I did wanted to do it.

If by any chance I redirect you on this page, it is because it should contains informations useful to help me. See this as… a (back)log of my doing.

This page is a test

For now, it'll take care only of my main machine, called Mephistopheles, having the list of hardware and parameters, configuration and such.

This page could contains «uninteresting» stuff

Because my memory is clearly bad, I even forget where I puts my note. Since this page is kind of related, will list what I want to do (later) or is a work in progress, it's for me, really, but feel free to take a look.


Mephistopheles

Main workstation, future server/workstation (work in progress).

General informations

Hardware

Gentoo related informations

Profile
[44]  default/linux/amd64/23.0/hardened/selinux/systemd (stable) *
Make.conf (complete)
# These settings were set by the catalyst build script that automatically
# built this stage.
# Please consult /usr/share/portage/config/make.conf.example for a more
# detailed example.
COMMON_FLAGS="-march=native -O2 -pipe"
CFLAGS="${COMMON_FLAGS}"
CXXFLAGS="${COMMON_FLAGS}"
FCFLAGS="${COMMON_FLAGS}"
FFLAGS="${COMMON_FLAGS}"
MAKEOPTS="-j3"

USE="X a52 aac acpi alsa bluetooth branding cairo cdda cdr clamav colord cups css cups curl cxx dbus -dist-kernel dri dts dvd dvdr encode exif fbcon ffmpeg flac fltk gdbm gif gpm gtk gui gstreamer hddtemp icu jack jpeg lcms libnotify lm-sensors lto lua mad matroska man modules modules-compress modules-sign mng mp3 mp4 mplayer mpeg networkmanager ogg opengl pango pch pdf png policykit posix profile pulseaudio ppds qt5 readline sdl scanner seccomp sound spell startup-notification svg symlink systemd tiff truetype udisks upower usb vorbis vulkan wxwidgets x264 xcb xft xml xv xvid uefi vcd vim-syntax -gtk-doc -handbook -ibm -ieee1394 -musepack -musicbrainz -nvenc -oracle -pda -plasma -quicktime -samba -screencast -semantic-desktop -smartcard -speech -speex -wayland -geoip -geolocation -gphotos2 -gps -ios -ipod -webkit -wifi"

# SELinux policy types
POLICY_TYPES="mcs"

L10N="fr en"

# POLICY_TYPES="mcs"

# VIDEO_CARDS="nouveau"
VIDEO_CARDS="nvidia"

GRUB_PLATFORMS="efi-64"

ACCEPT_LICENSES="-* @FREE @BINARY-REDISTRIBUTABLE"

# NOTE: This stage was built with the bindist Use flag enabled

# This sets the language of build output to English.
# Please keep this setting intact when reporting bugs.
LC_MESSAGES=C.utf8

GENTOO_MIRRORS="https://mirrors.ircam.fr/pub/gentoo-distfiles/ \
    https://gentoo.mirrors.ovh.net/gentoo-distfiles/ \
    https://mirrors.soeasyto.com/distfiles.gentoo.org/"
emerge --info
Portage 3.0.63 (python 3.11.9-final-0, default/linux/amd64/23.0/hardened/selinux/systemd, gcc-13, glibc-2.38-r13, 6.6.30-gentoo-dist-hardened x86_64)
=================================================================
System uname: Linux-6.6.30-gentoo-dist-hardened-x86_64-AMD_Ryzen_5_2600_Six-Core_Processor-with-glibc2.38
KiB Mem:    16295236 total,   6763632 free
KiB Swap:   16777212 total,  16777212 free
Timestamp of repository gentoo: Sun, 12 May 2024 08:00:00 +0000
Head commit of repository gentoo: 6bf1444d0089219d9d67cd6651bfc7e2fcf32f8b
sh bash 5.1_p16-r6
ld GNU ld (Gentoo 2.42 p3) 2.42.0
app-misc/pax-utils:        1.3.7::gentoo
app-shells/bash:           5.1_p16-r6::gentoo
dev-build/autoconf:        2.13-r8::gentoo, 2.71-r7::gentoo
dev-build/automake:        1.16.5-r2::gentoo
dev-build/cmake:           3.28.5::gentoo
dev-build/libtool:         2.4.7-r4::gentoo
dev-build/make:            4.4.1-r1::gentoo
dev-build/meson:           1.4.0-r1::gentoo
dev-lang/perl:             5.38.2-r3::gentoo
dev-lang/python:           3.11.9::gentoo, 3.12.3::gentoo
dev-lang/rust-bin:         1.77.1::gentoo
sec-policy/selinux-base:   2.20240226-r1::gentoo
sys-apps/baselayout:       2.15::gentoo
sys-apps/sandbox:          2.38::gentoo
sys-apps/systemd:          255.4::gentoo
sys-devel/binutils:        2.42-r1::gentoo
sys-devel/binutils-config: 5.5::gentoo
sys-devel/clang:           17.0.6::gentoo
sys-devel/gcc:             13.2.1_p20240210::gentoo
sys-devel/gcc-config:      2.11::gentoo
sys-devel/lld:             17.0.6::gentoo
sys-devel/llvm:            17.0.6::gentoo
sys-kernel/linux-headers:  6.6-r1::gentoo (virtual/os-headers)
sys-libs/glibc:            2.38-r13::gentoo
sys-libs/libselinux:       3.6-r1::gentoo
Repositories:

gentoo
    location: /var/db/repos/gentoo
    sync-type: rsync
    sync-uri: rsync://rsync.gentoo.org/gentoo-portage
    priority: -1000
    volatile: False
    sync-rsync-verify-jobs: 1
    sync-rsync-verify-metamanifest: yes
    sync-rsync-extra-opts: 
    sync-rsync-verify-max-age: 3

Binary Repositories:

gentoobinhost
    priority: 1
    sync-uri: https://distfiles.gentoo.org/releases/amd64/binpackages/23.0/x86-64_hardened

ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="@FREE"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=native -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d"
CXXFLAGS="-march=native -O2 -pipe"
DISTDIR="/var/cache/distfiles"
ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GDK_PIXBUF_MODULE_FILE GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR XDG_STATE_HOME"
FCFLAGS="-march=native -O2 -pipe"
FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs binpkg-multi-instance buildpkg-live config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync merge-wait multilib-strict network-sandbox news parallel-fetch pkgdir-index-trusted preserve-libs protect-owned qa-unresolved-soname-deps sandbox selinux sesandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-march=native -O2 -pipe"
GENTOO_MIRRORS="https://mirrors.ircam.fr/pub/gentoo-distfiles/     https://gentoo.mirrors.ovh.net/gentoo-distfiles/     https://mirrors.soeasyto.com/distfiles.gentoo.org/"
LANG="fr_FR.utf8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs"
LEX="flex"
MAKEOPTS="-j3"
PKGDIR="/var/cache/binpkgs"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"
PORTAGE_TMPDIR="/var/tmp"
SHELL="/bin/bash"
USE="X a52 aac acl acpi alsa amd64 audit bluetooth branding bzip2 cairo caps cdda cdr cet clamav colord crypt css cups curl cxx dbus dri dts dvd dvdr encode exif fbcon ffmpeg flac fltk gdbm gif gpm gstreamer gtk gui hardened hddtemp iconv icu ipv6 jack jpeg lcms libnotify libtirpc lm-sensors lto lua mad man matroska mng modules modules-compress modules-sign mp3 mp4 mpeg mplayer multilib ncurses networkmanager nls ogg opengl openmp pam pango pcre pdf pic pie png policykit posix ppds profile pulseaudio qt5 readline scanner sdl seccomp selinux sound spell ssl ssp startup-notification svg symlink systemd test-rust tiff truetype udev udisks uefi unicode upower usb vcd vim-syntax vorbis vulkan wxwidgets x264 xattr xcb xft xml xtpax xv xvid zlib" ABI_X86="64" ADA_TARGET="gcc_12" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_anon authn_dbm authn_file authz_dbm authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir env expires ext_filter file_cache filter headers include info log_config logio mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse sse2 aes avx avx2 f16c fma3 pclmul popcnt rdrand sha sse3 sse4_1 sse4_2 sse4a ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 ntrip navcom oceanserver oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 tsip tripmate tnt ublox" GRUB_PLATFORMS="efi-64" INPUT_DEVICES="libinput" KERNEL="linux" L10N="fr en" LCD_DEVICES="bayrad cfontz glk hd44780 lb216 lcdm001 mtxorb text" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php8-1" POSTGRES_TARGETS="postgres15" PYTHON_SINGLE_TARGET="python3_11" PYTHON_TARGETS="python3_11" RUBY_TARGETS="ruby31" VIDEO_CARDS="nvidia" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipp2p iface geoip fuzzy condition tarpit sysrq proto logmark ipmark dhcpmac delude chaos account"
Unset:  ADDR2LINE, AR, ARFLAGS, AS, ASFLAGS, CC, CCLD, CONFIG_SHELL, CPP, CPPFLAGS, CTARGET, CXX, CXXFILT, ELFEDIT, EMERGE_DEFAULT_OPTS, EXTRA_ECONF, F77FLAGS, FC, GCOV, GPROF, INSTALL_MASK, LC_ALL, LD, LFLAGS, LIBTOOL, LINGUAS, MAKE, MAKEFLAGS, NM, OBJCOPY, OBJDUMP, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PYTHONPATH, RANLIB, READELF, RUSTFLAGS, SIZE, STRINGS, STRIP, YACC, YFLAGS


General linux stuff

Kernel
  • Kernel in use:
Linux Mephistopheles 6.6.30-gentoo-dist-hardened #1 SMP PREEMPT_DYNAMIC Fri May 10 10:55:56 CEST 2024 x86_64 AMD Ryzen 5 2600 Six-Core Processor AuthenticAMD GNU/Linux
Mounting media (fstab)
  • /etc/fstab:
# EFI - /dev/sda1 while installing
PARTUUID=2aec02da-3e09-4bfe-a151-afb1360491fa	/efi	vfat	umask=0077	0 2

# Root - /dev/sda2 while installing
PARTUUID=8fc528f0-c1fe-4df2-9f3c-45340bf50327	/	xfs	defaults,lazytime	0 1

# Home - Non existing while installing
# PARTUUID=	/home	xfs	defaults,lazytime	0 2

# Swap - Non existing while installing
/swapfile	none	swap	sw	0 0

# External Hard Drive (Data, backup, etc)
# PARTUUID=487bcffe-50dd-4edd-8dd6-5431db96e926	/mnt/extData	ext4	defaults	0 0

# Internel (SSD) hard drive (Data, backup, others, etc)
PARTUUID=f867b603-cb5f-414f-b6bd-e3bda2b70511	/mnt/data	xfs	defaults	0 2
SELinux
  • SELinux status: disabled
Power available (CPU, RAM…)
  • Number of threads (CPU): ×12
  • Available memory: 16Gb (2×8)
  • Available swap memory: 16Gb swapfile.
  • vm.swappiness: 1

Opened threads for forum.gentoo.org (not solved)

 Category

SELinux
Kernel building
Servers

Solved

NFTables

Goals to achieve, stuff to do

Non-exhaustive list, specially needed for my own usage of course, it's just here because otherwise I will forget where I noted these stuffs, as usual !

Security

Setting up SELinux (kernel compilation)

See Guidance needed to setup SELinux for more details as Building kernel error: Cannot find module directory. Currently I try to master the process of kernel compilation after changing it's .config. Actual problem is this error I get after doing make install.

dracut[F]: Cannot find module directory /lib/modules/6.6.30-gentoo/
dracut[F]: and --no-kernel was not specified
/usr/lib/kernel/install.d/50-dracut.install failed with exit status 1.
/usr/lib/kernel/install.d/50-dracut.install failed with exit status 1.
(sd-exec-strv) failed with exit status 1.
make[1]: *** [arch/x86/Makefile:292: install] Error 1
make: *** [Makefile:234: __sub-make] Error 2

oldfashionedcow thinks I did a mess on my system, I use dist-kernel but it seems I wrongly installed gentoo-sources (with symlink) because I want/need to add features in the kernel to allow it to boot with SELinux enabled. As he stated:

are you prepared for this to not boot a few times this is going to be a messy transition
(…)you have overlapping versions of the kernel (…)
you have sys-kernel/gentoo-kernel and sys-kernel/gentoo-sources both installed
you will need to prepare to chroot like a good few times

So, I have to figures out what I did bad and fix that.

Setting up NFTables

See An idiot try nftable for more details. I try to plainly understood how it works.

Sandbox some apps
  • Runs into sandbox some applications as Firefox, Thunderbird, because they are opens door to be hacked !

I did not even tried for now :).

Monitoring the system
  • Add monitoring system to manage more deeply what's going on.

Data

  • Resetup backups with xfsdump (not only)

I'm just lazy, will do very soon.

Virtual machines

  • Setup Virtual Machines using KVM & QEMU, along side SELinux

I'm having a problem: I need these machine to get their own IP address on my network, and I have to setup NFTable first, bridge won't do I think.

  • Sets same securities process to the VM (SELinux, NFTables, on a Gentoo Hardened)

General things to manage my system(s)

  • Sets quota (specially for VMs !)

For VM I mean I have to be sure the pools and space allowed for VMs can't fill my hard drives if I don't pay attention.

  • Sets a binary host for the VMs, but also for host (as it allows to re-install important broken package as GCC or portage)

Other stuff

Minetest

I opened a bug for the Animalia mod, here (Excessive RAM usage with Animalia (memory leak ?)).