Ask Ubuntu General Room

solsTiCe

00:15

@ThomasWard mh okay.

/me just learned that su/sudo is depreacated by systemd. so sudo apt update should in fact be machinectl shell .host /usr/bin/apt update. Who is going to use that ??? :-)

Seth

@solsTiCe wth. Do you have a source/link with more info about that?

Thomas Ward

00:39

@Seth I think he means polkit, aka pkexec

nothing new to replace polkit yet, wrt SystemD

chaskes

01:27

machinectl is for managing containers

"it is in many ways similar to a su(1) session, but, unlike su, completely isolates the new session from the originating session, so that it shares no process or session properties, and is in a clean and well-defined state. It will be tracked in a new utmp, login, audit, security and keyring session, and will not inherit any environment variables or resource limits, among other properties"

above quote specifically applies to machinectl shell , I had to trim to make it fit

Ubuntu Questions on U&L

02:12

1

Q: Ubuntu pinging from link-local address instead of global

I have a network like this, (client 2001:10:1:100:0/64) -> router -> (server 2001:172:16:200:0/64) However, when I ping from client to the 172.16.200.0 network, (or anywhere) it always uses the link local address instead of the global. ens192 Link encap:Ethernet HWaddr 00:0c:29:e8:87:5a ...

karel

02:47

@Fabby Of course I like reputation, but in this case the problem deserves some additional background explanation. The problem I solved in Netbeans turned out to be caused by an incorrect Java path inside the Netbeans IDE. I searched for hours for a solution until I found an answer at Stack Overflow that worked right away. Months later when I needed to find the same answer at SO I couldn't find it again because I hadn't bookmarked it. The result of all this is that I don't know what the OP did

I just told him to fix the Java path in Netbeans and it worked. If I could understand why the command sudo apt install ubuntu-make && umake ide netbeans worked on my Ubuntu 18.04 and didn't work on the OP's Ubuntu 18.04 I would be happy to post that.

The reason why I didn't bookmark the answer at SO that helped me was at the time I thought it was just a bug in my Netbeans and it wasn't important but the same problem has been asked about several times since then, so I should have bookmarked or favorited the SO answer that helped me.

dessert

06:45

@karel I never bookmark anything, but heavily use my browser history instead – did you try to find it in there?

@karel Isn’t this AU question covering the same problem? There’s a fairly popular SO question with the exact same solution…

solsTiCe

@ThomasWard no I don't mean pkexec

@Seth unix.stackexchange.com/a/287282/116970 It's not a reference. Justa an answer with some link.

karel

07:04

@dessert It was months ago so I couldn't find it.

@dessert That link might be the right one. I don't know for sure because the OP didn't tell me.

solsTiCe

@Seth well machinectl shell replaces su not sudo

karel

@dessert yay, it's finally fixed! The OP posted an answer to his own question and it's upvotable imo.

I didn't want to post anything speculative.

Fabby

07:33

@karel Do you ever sleep?

;-)

@karel Other question duped, but I need an upvote on my comment here

Rinzwind

09:43

Bon Jovi - I'll Sleep When I'm Dead

►

user716691

10:06

@Rinzwind you suggested me to install at /opt/ folder ,I did and again I am facing same permission issue ,can you please suggest me what to do next ?

I am really confused ,I have installed node no of times as par as suggestions i got through different posts /people

I installed it first at /usr/local then deleted it as it created permission error then I installed it through package (nodesource) which installed it at /usr directory again same permission issue so again deleted it and then again installed it at /usr/local and was going to hack permissions but there another user made response that don't hack permission rather install node right way

and then you suggested that I should install it at /opt/ so i did same but again i am facing same permission issue .

its really frustrating now ,so how should i install it now and is there any way not to face this permission issue without hacking permissions ?

I am talking about nodejs installation

which also include npm and i have downloaded tar.xz file from official nodejs website

Ubuntu Questions on U&L

11:44

0

Q: Pop! OS Dell XPS Trackpad Issues

I have just installed pop! os on my Dell XPS 13 and have been having issues with the trackpad not being able to move windows across the screen, it just judders or doesn't move. I took the below output as im not really sure what needs chaining to resolve this, ive seen loads of posts about this ...

ubuntu drivers

Rinzwind

11:58

@user716691 installs in /opt are always for "root'. There should be an executable or a service you need to copy/symlink to the system itself. And there should be a config file you can alter. Then start the service

Fabby

@Rinzwind :-)

Oli

13:06

Any Gnome users in here also scratching their heads over its developers' decisions to remove features? Desktop icons are in flux. Nautilus typeahead search... And now Nautilus won't —as I read it— allow you to launch executables by double clicking them.

Ubuntu Questions on U&L

0

Q: "No protocol specified" after waking from sleep (sometimes)

I'm running Ubuntu 16.04 (output of uname -r is 4.4.0-124-generic, but this has been happening even after several updates) and I have strange issue where, sometimes after opening my laptop and waking the system from sleep, my terminal will display new-host instead of my username, and none of my k...

ubuntu x

Oli

I like Gnome because, visually, it does a fair job at staying out of your way but when people start telling me 20 years of established metaphor is too insecure to "allow", I start to feel oppressed.

Rinzwind

@Oli I am yes. The want to remove anything from the desktop that is not for the desktop. "files" are for a filemanager so no icons... I don't like that approach

Oli

It's also the second thing like this where it it looks like one developer has the power to say "I think it should be like this" and if they can affect those code changes, they get to commit that change.

Rinzwind

and the promiss of an extension to handle that is all fine but does not exist yet

Oli

13:19

I'm probably missing half the picture (council meetings, etc) but it seems increasingly like Gnome only exists to make itself happy.

Rinzwind

or 1 developer ;-)

I have so many icons on my desktop :P I need them there :=)

Oli

@Rinzwind Yeah as soon as my desktop icons go for good, I'm finding something else, or forking Nautilus.

It's my scratch.

terdon

@Oli I've felt that way since gnome3

Rinzwind

" And now Nautilus won't —as I read it— allow you to launch executables by double clicking them." This I MIGHT agree on. Scripts that are not entering a GUI have no need in a GUI and should be conmand line only.

Terdy! :)

terdon

@Rinzwind But is it only for non-GUI?

Rinzy!

@Oli what are you quoting there?

Oli

13:22

@terdon Where?

MBaev

Hello. How is it right to say when extracting files from *.tar.gz file?
Unarchive? UnTar? UnTarGz?

Oli

omgubuntu.co.uk/2018/05/… ?

@MBaev What's wrong with extract?

I know unzip and unrar exist but I don't think I've ever seen something similar applied.

terdon

@Oli yep, thanks

MBaev

@Oli

@Oli thanks

Rinzwind

@terdon What I read yes. You can still click on icons in nautilus that do something that is gui based; like start a video. Just not scripts

terdon

13:29

@Rinzwind No, the difference is whether you want to launch a binary (double click vlc) or open a file in a binary (double click a video file and have it run in vlc). The second will still work, the 1st will not.

I admit that I don't think I have actually launched a binary by double clicking its executable in the last 10 years or more, but I'm sure others do it. And the reasoning is ridiculous!

Did you see the security issue linked?

> Nautilus trusts desktop files that have the executable bit set, and doesn't replace the displayed icon or the displayed name until it's trusted, which prevents from running random programs by a malicious desktop file.

However, the executable permission is preserved if the desktop file comes from a compressed file. A maliciously crafted file opened by the user could result in code execution.

Um. So don't preserve the executable bit.

Rinzwind

ah ok

cl-netbox

Hello :)

terdon

o/

cl-netbox

Hi terdon :) Good afternoon to you :)

Thomas Ward

*sips on his coffee*

how's things

Rinzwind

13:36

it is related to this cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14604 @terdon

Boxy \o

cl-netbox

@ThomasWard all good :) and on your side ?

@Rinzwind Hi Rinzy ! :)

Thomas Ward

@terdon the problem is, this is a global issue - any file type can be any real extension and therefore be executed in a malicious way, so long as the execute bit is set

this is, unfortunately, something that is a "global problem" so short of adding magic number checks first, there isn't any real way to control that

terdon

@Rinzwind OK. But removing the ability to launch programs by clicking on things seems like cutting off your leg because your toenails need trimming.

Thomas Ward

@cl-netbox ask me once the coffee's kicked in :P

terdon

@ThomasWard Yes. I still don't see why removing the ability to launch executables altogether is a good solution.

cl-netbox

13:38

@ThomasWard okay ... then kick that hot drink in first :)

terdon

But whatever. I think gnome has been going down the drain for years. Or, to be fair, has just been going in a direction I have no wish to follow.

Others might, so more power to them.

Thomas Ward

@terdon it isn't, but that wasn't my point

@terdon if we had our way users would be stuck with only what admins let them have, and nobody in the world would have access to install new things, other than the system itself for verified updates and the Global Cabal of IT Security Professionals

but alas we can't have our way :P

terdon

Thank all the gods!

cl-netbox

:D :D :D

terdon

You're describing a garden with an even higher wall than Apple's!

Thomas Ward

13:41

no i'm describing a garden protected by laser forcefields that'll fry people who try and venture out of it :P

the point is we can't prohibit users from executing programs

but at the same time, we can't just allow them to run whatever

it's the Catch-22 of the Security world

every solution is a lose-lose one

cl-netbox

@terdon Do you think that it's a good idea to install stuff from within nautilus ? Or did I missunderstand ?

Thomas Ward

@cl-netbox you misunderstand

any malicious threat actor can execute any program within Nautilus by adding a .desktop extension or by having the execute bit set

that's less a Nautilus bug and more a "global security catch22 problem"

at least, IMO

cl-netbox

@ThomasWard I know, that's why GNOME drops this possibility in future nautilus versions - I appreciate this decision. :)

Thomas Ward

when I was hired for security work here at this workplace, the first thing I said is "We can't have users able to access everything by default. This will be a problem as everyone technically loses, but it's a necessary loss, to protect the network. Going forwards, we will see many other cases of this Catch-22 because while we want to be secure we can't go overboard with it, so either us in security or the end users will lose at some level."

it's all "acceptable risk" at the corporate level

versus the paranoid security level :P

cl-netbox

true :)

Thomas Ward

13:46

@cl-netbox My two cents is "Yes, disallow .desktop from running directly from within Nautilus" provided there are other mechanisms for using .desktop launchers

but again, that's the 'balanced' viewpoint

cl-netbox

@ThomasWard I agree with you ... absolutely ! :)

Thomas Ward

however this doesn't solve the underlying problem that extension spoofing can happen all the time

terdon

@ThomasWard You're looking at this from the perspective of a sysadmin, but we're discussing the OS. The OS should not impose any such restrictions. It should perhaps be configurable so that such restrictions can be applied, but those decisions are at the admin level and not at the OS-design level.

Thomas Ward

@terdon "tomato" vs "tomahto" argument

do you really trust end-users to be able to make that decision?

cl-netbox

@terdon That's a valid view point too - indeed. :)

Thomas Ward

13:49

My two cents is actually the inverse of your statement

default-restrict, but allow users to change that if they want to accept the security risk

still allow it to be configurable, but require a default setup to be on the more secure side

cl-netbox

@ThomasWard I assume he means the system admin should make the decision. :)

Thomas Ward

@cl-netbox again, same problem.

terdon

@ThomasWard I'm saying that's the wrong question. The OS has no business imposing those restrictions, that's a job for the admin.

You know, Mr Unix and Mr foot and all that.

Thomas Ward

@terdon i know that's what you're saying. I'm on the opposite stance because if we are leeting other 'admins' handle the deciding, then why do we have a Security Team that patches things

it should be the end-user-admin deciding whether to 'patch' or not

which in turn leads back to the whole core argument again I just stated

terdon

Because some things are indeed OS-level. But not all.

Thomas Ward

13:51

while I agree it should be the admin to decide, 99% of the users are the proverbial idiots and not sysadmins

terdon

Not the OS designer's problem :P

Thomas Ward

tell that to every OS in existence then

and watch as they shoot you down with lasers, bombs, missiles, and "Security!" arguments

@terdon further

this is more an end-application level decision

not an OS Designer decision

at least, wrt Nautilus

so you probably mean application designer decision, not OS Designer decision

terdon

Yes, s/OS/DE/

Thomas Ward

so then your argument needs to be adjusted that "This is an admin decision, not an app dev decision"

terdon

Also, one should bear in mind that the security considerations for a single-user home system are completely different to those of a multi-user production one.

Thomas Ward

13:54

and I take the same argument and will say "If this is an admin decision, 99% of admins don't know what is or isn't a 'good decision'."

@terdon not saying you're wrong, but saying single-user security considerations means it should be stricter

because the end-users who aren't sysadmins are, quite literally, not informed enough to make those decisions which keep themselves secure

terdon

@ThomasWard Yeah, I don't buy that. Even if they are, that's too bad. I don't like Nanny states and I don't like Nanny DEs :P

cl-netbox

@ThomasWard When the sys admin installs RHEL or CentOS, he can choose from various SCAP security policy options what users are allowed to do and what not ... so the businesses can decide whether to use systems like that or ubuntu or Windows ... or, or, or ... :)

Thomas Ward

and you can pull any of a trillion examples of this in the last decade for most OSes.

consider though I'm the one that's had to unfubar my parents' computers many times since they just 'open messages' and get infected.

without paying attention to the "Red flags" and "common sense"

so i'm on the more 'paranoid' side of that scale of 'security mindsets'

regardless of single or multi-user environs

which reminds me, fun fact. my sister's Mac got a crypto-locker-like virus recently. and she's pretty careful of what she opens

so I stand by the "users are not able to make informed decisions" argument.

but that's my own viewpoint, and subject to change in the future.

(Also I'm not caffeinated yet, so that has an impact on my opinions too :P)

cl-netbox

@ThomasWard my 2 cents concerning standard users : the stricter - the better ! :D

terdon

@ThomasWard Nobody said they are. But that doesn't mean they don't get to make the decision anyway.

Thomas Ward

14:02

@terdon which in turn circles back to my thoughts: "Allow users to choose whether to execute or not, but by default set it to be restrictive and disallow this risk unless they choose otherwise"

configurable, but restrictive because end users are not (generally) smart about security.

that's my opinions on it.

still their decision, yes.

but it addresses the 'security' concern by shifting it to "If you choose to do this, you know you're opening yourself up to a risk" acceptable-risk argument.

and if they continue, that's on them

... unrelated, I just noticed one of my mail servers is configured accidentally as an open relay, oops.

Rinzwind

@terdon The comments on the cve are interesting.

terdon

I don't see them. Where?

Rinzwind

oh not the cve

here gitlab.gnome.org/GNOME/nautilus/commit/…

"Sounds like what you want to use is the "scripts" feature of Nautilus, where you put some scripts in the scripts folder and you can run them on the context menu in any place. That is still available."

"I am considering making a proposal for gnome-terminal to register as handling the MIME type of scripts like yours. This would mean that you would be able to Open With Terminal from nautilus context menu, just like you can open with a text editor. Would you find this convenient?"

to name 2

cl-netbox

14:27

@Rinzwind that would be an alternative of course, so why not ? it's more convenient that not any option at all ... but I guess the scripts feature will disappear as well - sooner or later - because it is just a workaround which offers the same chance for vulnerabilities as executing programs from within nautilus.

pomsky

@Videonauth OP finally solved it! It seems then copied a .txt file and renamed it .hidden. (cc @Rinzwind)

Videonauth

... facepalm

cl-netbox

Hey @Videonauth - nice to see you - good afternoon ! :)

Videonauth

to you too

cl-netbox

@Videonauth Thank you :)

Videonauth

14:34

@pomsky and i guess he did it in nautilus itself which will preserve file endings like .txt

Rinzwind

@pomsky seriously? :X

@Videonauth YES see cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14604 soon this won't be possible >:D

Videonauth

@Rinzwind good, this is in some cases relly annoying behavior, not only this attack verctor

Ask Ubuntu Meta

15:43

0

Q: Is this question appropriate here?

I asked the following question: Cannot assign address inside a Docker container do you think it would be more appropriate for Stack Overflow, or SuperUser? Or is this the right site?

discussion scope asking-questions

Seth

16:01

@NathanOsman happy Cascadia day ;)

Ubuntu Questions on U&L

18:10

0

Q: dsl pppoe internet connection problem in zorin 12.3 core

How can i make a dsl connection (pppoe) in zorin 12.3 core os ? as there is no option of it in the network manager... in the terminal i typed sudo pppoeconf but it shows sudo: pppoeconf: command not found What to do ?

ubuntu zorin

Ask Ubuntu Meta

0

Q: Is Ubuntu WSL with Linux Mint repos/packages OK for Ask Ubuntu?

I recently installed Ubuntu on WSL (Windows Subsystem for Linux). After installation, I added the Linux Mint repositories, and installed several packages from them (like mintinstall and cinnamon). Can I ask questions about this WSL setup on Ask Ubuntu? I found conflicting ideas for these questio...

discussion scope

Ubuntu Questions on U&L

20:10

0

Q: Cannot run python file, asks to relink libraries

I'm trying to run a python file, but it doesn't allow me to, showing an error: python3: Relink `/lib/x86_64-linux-gnu/libudev.so.1` with `/lib/x86_64-linux-gnu/librt.so.1` for IFUNC symbol `clock_gettime` Segmentation fault (core dumped) Seems to me that this issue is related to some python p...

ubuntu python libraries python3

Ask Ubuntu Meta

20:30

0

Q: Memory leak (Very relevant to 18.04/GNOME 2.6+) Question put on hold for being opinion based, but it is not

I recently had this question that I asked put on hold. Memory leak on 18.04-- Is it even worth upgrading? (do you have memory leak issues?) Now, this is not an opinion-based question. Some computers may respond differently to the memory leak than others (my Dell Optiplex 9010 seems tro use LESS ...

discussion support bug

Thomas Ward

20:40

@terdon @Seth either of you around?

TheWanderer

what'd you do

Thomas Ward

Dragged you into the dark realms of chaos for ~~punishment~~ reasons, I believe.

TheWanderer

oh ( ͡° ͜ʖ ͡°)

Thomas Ward

nah nothing major ;)

Fabby

21:09

@TheWanderer He needs another upvote here

@ThomasWard Djeez, you had to dig deep into that well of patience for this one, didn't you???

Fabby

21:22

Neither the photographer nor the model knew what they were doing

4

And with that, I wish you all a good night!!!

RobotHumans

@Fabby That one kills me every time.

Ubuntu Questions on U&L

23:25

0

Q: Why do I get this error while trying to compile incron?

I'm trying to compile incron 0.5.10 that can be found in this page. But I get the following error when I run the make command inside its directory: ++ -c -O2 -g0 -pipe -Wall -o icd-main.o icd-main.cpp icd-main.cpp: In function ‘void on_signal(int)’: icd-main.cpp:107:71: error: ‘read’ was not de...

ubuntu compiling make incron

Transcript for

Ask Ubuntu General Room