@Mego Those are only visible to moderators of that site btw.

And CMs, etc.

@Dennis I have a question for you that I do not want to discuss in public chat, how can I reach you?

I'm fairly certain gitter has PMs. You can also send me an email to dennis@tryitonline.net.

gitter.im/tryitonline

@AndrewSavinykh PM'd you on gitter.

@Dennis here is the draft of my setup notes: github.com/AndrewSav/tiosetup/blob/master/TioSetup.MD

Ideally I think it would be good if we can add it to the "official" repo, but if not I won't be too upset. In any case I'd appreciate if you could review and let me know if anything looks missing / wrong

@AndrewSavinykh That looks quite detailed. I'll do my best comparing it to my setup. The main server also uses Fedora 24 and everything is a bit different.

It's missing the languages setup instructions / scripts, but I understand you are going to help with this later this month

Yeah, I'll make an auto-setup script to deploy a second arena.

I seem to have more time for that than I thought though. I've been measuring the server load for the last 32 hours, and apart of a few spikes, it isn't as bad as I had feared.

@AndrewSavinykh SELINUX should be set to enforcing by the way. It can't do its job when set to permissive.

@Dennis Cool, thank you for the feedback, exactly what I'm after. Never in my life used selinux so would not know. I'll test with enforced and correct as appropriate. I'm sure stuff will break if/when I do this.

@Dennis, btw, do you pull the sites directly into the serving directories? Or do you pull and copy?

The latter I'm guessing more secure, but that's not what I did

@AndrewSavinykh The thing is, you're not exactly very restricted when you SSH into a server (doing stuff from Apache would be a whole different story). Iirc, the only change I had to make was to allow sandbox_t to access proc_t. Also, runner should not have write access to either /srv or /opt. (Not sure if that is what setfacl actually does.) It also shouldn't have write access to its home directory.

@AndrewSavinykh I actually push from those directories into the repo.

ah right. I was assuming that you pull with the runner so it needs the writre access. now when you said it I see it was silly to assume ;)

I'll fix this

so you do have .git and README.md in your web site directories and not really worried about these. okay good to know

Yeah, the whole purpose of the runner user is not having the required rights to make any persistent changes to the system. Home isn't that big of a deal (sandbox creates a temporary home directory anyway), but /srv and /opt would be a problem.

@Dennis I can understand that.

@AndrewSavinykh Yeah, those are all owned by root for now.When I implement developer accounts, I'll create a new user to own the repos.

do you think the server can survive well not a full out DDOS, but a script that makes a lot of queries from a single IP

is there any protection from that?

@Dennis ^^

DO droplets come with some anti-DoS measures, but I haven't tweaked anything so far.

cool

does fedora have systemd?

Definitely helpless against DDoS.

Yes, Fedora uses systemd.

are you using letsencrypt or something else?

Letsencrypt. It's a bit less sophisticated on Fedora though. No Apache integration.

that's what I feared

on ubuntu it's totally painless

Not really an issue. Still easy to use.

hm

certbot.eff.org/#fedora23-apache

this pages implies it's supposed to work similarily easy

Yeah, it's not really difficult. Just different.

oh and

dnf is the new yum in fedora, yes?

Yes.

It sounds like there is a value in me trying to get it up and running on Fedora instead Ubuntu, so that the setup notes are compatible with real life...

That might be best. I prefer Fedora over Ubuntu anyway, mainly because of SELinux.

right. gotcha. Thank you for the feedback. I'll see what I can do now.

@Dennis so it's does not want to play ball with enforcing

I'm getting Failed to execute command /srv/bin/wrapper-legacy: Permission denied

and in the audit log

type=AVC msg=audit(1484639181.406:337): avc: denied { execute } for pid=1252 comm="seunshare" name="wrapper-legacy" dev="vda1" ino=129362 scontext=unconfined_u:unconfined_r:sandbox_t:s0-s0:c41,c69,c140,c233 tcontext=unconfined_u:object_r:var_t:s0 tclass=file permissive=0

I have not idea how to make sense of it. Any tips are appreciated

@Mego this is continuing conversation above about changing selinux from permissive to enforcing

works fine with permissive - but as DEniss pointed out it's poinltess this way since no sandboxing applied

so the advice has to be selinux specific here

but he is asleep now I think, it's past bed time in his timezone

so tomorrow perhaps

@Mego, that's all right, thank you for trying to help ;)

@Mego I'm trying to replicate his setup so that I know how to this if need be

Got it working without sandboxing, but sanboxing is being difficult since I have zero experience with selinux

but all these problems are already solved by Dennis so I'm sure he'll point out what's wrong in no time

@Dennis audit2allow suggests this rule

allow sandbox_t var_t:file execute;

Did you have to do anything like that?

So after installing the above rule

and also

allow sandbox_t var_t:file execute_no_trans;

it works

but I have no idea if it's right

@AndrewSavinykh You have to relabel /srv/bin (or wherever you store your executables), as well as the executables themselves, as bin_t

@AndrewSavinykh That's a bad idea. An executable file should not bear that label, so everything that does should not be executed.

@Dennis I just pushed Grime. There's a new Bash script in the repo, rungrime, that compiles Grime if needed (the executable doesn't exist or a source file is newer than it) and calls the executable with the given arguments. Is that something you can use?

Also, errors and debug messages should go to STDERR now.

@Zgarb No, runner doesn't have permission to alter the interpreter. I could run it as root once, but simply compiling Grime "manually" is just as easy.

Okay. Well, at least it makes my job easier.

Could you pull Grime?

@Dennis feature-request Some of those octave packes that can be found here as they are available in standard matlab, for my most recent answer, it would be nice to have image.

@Zgarb Already pulled and compiled. ./grime $* will do unexpected things if the arguments contain whitespace. ./grime "$@" would be better.

@flawr image should already be installed. MATL uses it.

Alright, thanks. I literally learned just enough Bash to write that script.

@Dennis Ah sorry, it seems you have to load them manually...

But this is still strange, on my Octave installation I never had to load anything.

Let me check

You do? I went though my Octave command-line history and there's pkg rebuild -auto image.

Ok now there is the next problem, but one you probably will not solve:

warning: the 'imfill' function belongs to the image package from Octave Forge but
has not yet been implemented.

> probably

Nothing is holding you back :D

Aside from the fact that I know nothing about Octave. Or image processing.

I sense a learning opportunity here :D

Haha, right, because Dennis is bored all the time anyway.

Yay I was now able to tweak it a little bit: codegolf.stackexchange.com/a/107119/24877

@flawr My bad. I passed -f to the Octave interpreter assuming it meant file. It's actually a shorthand for --norc though (because that totally makes sense), so package auto-loading was disabled. It should work fine now.

At least it's consistent. -x is a shorthand for --echo-commands.

@Dennis ah great, thanks for letting me know=)

@Dennis Ah, right. bin_t it is then. I was not sure what is the right label. Thank you so much, I'll try that.

Do you relable all the git repos each time you pull them?

@Mego not that I'm complaining, just in case you are interested: this sounds patronizing. I believe that a professional most of the time should know what they are doing, this includes software development. It is true, that modern software systems are incredibly complex so many developers cannot be bothered to learn better even the domain they are working in.

@Mego I see it all the time in other people code. Approach to change random things until something finally work no idea why is indeed prevalent. This is not a good thing. I always strive to know my domain well so I can weight if my decision are bad or good. As far as selinux goes I have no experience in this domain, so it's a must to vet the decisions with someone who does, Dennis in this case. This is ideally how software development should work.

@Mego sorry for the "lecture" ;)

@Mego that's all right ;)

@Mego On a second thought there was no need telling you all that. Just was not fast enough to stop myself in the half-awake state. My bad.

This is a pretty cool stats page for TIO accesses by language

I found it with Google

@Dennis: TIO request: Incident. (There are also two other languages which are being used in the polyglot challenge, and thus would be convenient on TIO, Modular SNUSP and Whirl, but they both seem fairly difficult to find TIO-usable interpreters for, so those are "if it turns out to be too hard, don't worry about it" requests.)

@ais523 It has whirl: tio.run/nexus/whirl

oh good

I just kind-of assumed it didn't :-)

@Dennis I'd like to see Forth on TIO, but idk which version you'd use. repl.it/languages/Forth uses JS-Forth, but that lacks some helpful functions. Ideone has gforth-0.7.2, which is better.

Ideone's interpreter also allows float literals, unlike Repl.it

Floats are nice

Btw, in case you're using chcon, the proper way to relabel something is semanage fcontext, followed by restorecon if the file already existed. For example, I'm using semanage fcontext -a -t sandbox_file_t '/tmp/runner\...../.*' for the temporary directories. This applies to all current and future files that match the pattern.

@Mego I set up a page that displays this kind of stats automatically. I'm quite curious myself.

@ais523 I'll look into Incident and SNUSP asap. Luckily, Fedora has darcs in its repos. My desktop distro does not.

@mbomb007 I'll use whichever interpreter you think is better. Fedora has gforth 0.7.3 in its repos.

@Dennis Yep, I already figured out the part about semanage and fcontextbut was not sure if you can do it on top level once and then copy or not. Thank you for explaining this, and providing your command, that really helps. I'll make sure to use it

@Dennis Too bad you can't have a union of the two. If choosing just one, I'd prefer gforth 0.7.3. It's almost always better. One of the only things I remember being better about JS-Forth is that it has >> and << as aliases for rshift and lshift.