[09:07] <Odd_Bloke> sbeattie: kees: We (CPC) put the sysctl file together, using the documentation from Google.
[12:44] <Odd_Bloke> sbeattie: kees: We've just shipped new GCE images which fix the problem. :)
[15:25] <kees> Odd_Bloke: ok, cool, thanks. sorry the docs were wrong! they should be fixed soon.
[15:28] <Odd_Bloke> kees: No worries. :)
[18:45] <jcastro> Hi everyone, I had a guy email me about this bug asking if there are plans to backport it to the HWE kernel in 14.04.2, what do I do?: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1390223
[18:45] <jcastro> I am assuming if I just nominated it for trusty without asking first might be bad
[18:54] <infinity> jcastro: It already has a utopic task, that's all it needs.
[18:54] <infinity> jcastro: If it's fixed in utopic, it's fixed automatically in lts-u.
[18:55] <jcastro> oh I see
[18:55] <jcastro> that makes sense
[18:59] <mozmck> I'm trying to build packages for 3.18.9 with the rt5 patch - using the debian and debian.master from the vivid kernel at 3.18.7  I'm making progress, but I get several errors in locktorture.c about implicit declarations of functions: _raw_write_lock, _raw_write_unlock, etc
[18:59] <mozmck> Is it possible that is due to some config issue?
[19:02] <mozmck> Hmm, probably not clear, this is the vanilla 3.18.9 kernel with the preempt-rt patch
[21:34] <euhthe> Hi
[23:36] <irssi_> Does ubuntu offer custom kernels?
[23:45] <irssi_> Does ubuntu offer custom kernels?


[17:31] <chiluk> Hey folks I was doing some OS hardening and I discovered that at least one Ubuntu AMI in AWS lacks nosuid on /dev
[17:31] <chiluk> $ mount | grep devtmp
[17:31] <chiluk> devtmpfs on /dev type devtmpfs (rw,relatime,size=2000720k,nr_inodes=500180,mode=755,inode64)
[17:32] <chiluk> I'm opening a ticket right now, but It's not immediately clear where the ticket should be opened as both of my media installed machines have nosuid set on /dev.
[17:34] <chiluk> what makes matters worse, every code path I've found that mounts /dev sets the nosuid bit so I'm a bit at a loss.
[17:41] <Odd_Bloke> chiluk: What does /etc/cloud/build.info have for a serial?
[17:49] <chiluk> Odd_Bloke
[17:49] <chiluk> build_name: server
[17:49] <chiluk> serial: 20220924
[17:49] <chiluk> https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1991975
[17:49] -ubottu:#ubuntu-security- Launchpad bug 1991975 in systemd (Ubuntu) "dev file system is mounted without nosuid" [Undecided, New]
[17:49] <Odd_Bloke> A related thought: recent cloud images try to boot initramfs-less, and it's usually the initramfs which mounts /dev: https://git.launchpad.net/ubuntu/+source/initramfs-tools/tree/init#n40.  A possibly pertinent comment in that code: "Note that this only becomes /dev on the real filesystem if udev's scripts are used; which they will be, but it's worth pointing out"
[17:50] <Odd_Bloke> Let me comment there.
[17:50] <chiluk> yeah there's actually a bug in /etc/init.d/udev where it never remounts devtmpfs
[17:51] <chiluk> so there's that as well.
[17:53] <chiluk> @Odd_Bloke is there a better package you can think of to open this against other than systemd?  like the kernel perhaps?
[17:54] <chiluk> especially if they are the reason it's being mounted initramfs-less
[17:54] <chiluk> I can cross-post there.
[17:55] <Odd_Bloke> I'm not sure, really: IDK what is mounting the initial /dev (though one assumes it has to be the kernel if it isn't systemd/udev, I agree!)
[17:57] <chiluk> '
[18:24] <chiluk> I'm going to attempt a workaround in /etc/init.d/udev and we'll see how that goes.
[20:39] <chiluk> Odd_bloke or someone else is there a better way to tag https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1991975 so it gets security attention?
[20:39] -ubottu:#ubuntu-security- Launchpad bug 1991975 in linux (Ubuntu) "dev file system is mounted without nosuid" [Undecided, Confirmed]
[20:43] <sdeziel> chiluk: Odd_Bloke: I can confirm on an *old* (serial: 20200902) GCP instance: $ mount | grep devtmp
[20:43] <sdeziel> devtmpfs on /dev type devtmpfs (rw,relatime,size=490260k,nr_inodes=122565,mode=755,inode64)
[20:50] <chiluk> from what I can tell devtmpfs is indeed being mounted by the kernel init code..
[20:56] <chiluk> yep definitely being mounted by the kernel and not re-mounted in userspace due to systemd
[20:56] <chiluk> https://kernel.ubuntu.com/git/ubuntu/ubuntu-focal.git/tree/drivers/base/devtmpfs.c#n384
[20:56] <chiluk> moving to #ubuntu-kernel