[03:16] Hi there! I'm having an issue with my XPS13 and a thunderbolt docking station. When I have an external display, keyboard, and mouse connected and I close the lid, my laptop suspends. [03:16] I've set HandleLidSwitchDocked=ignore in systemd, used dconf to edit the settings in gnome, all to no avail. Any idea what's up? [03:17] mscs: anything in /var/log/syslog or /var/log/kern.log to indicate what is firing that off? [03:18] let me tail them and try [03:18] (I'm connected from a different host, so it should be ok) [03:20] ok. I've got the tail. [03:22] It's just sitting there, then on lid-close I see some kernel messages about preparing for sleep [03:23] doesn't look like there's anything about why. Would TLP cause it to do that? [03:25] I've not played with artful but with all the changes it wouldn't surprise me if something has got lost amongst all the changes [03:26] mscs: is this with the GUI desktop running? try shutting down the GUI and just having the tty console and see whether it still sleeps on lid close. That at least would narrow down where the event is being initiated [03:26] ooh, good idea [03:26] gimme a few, let me try [03:45] TJ-: short answer, seems like it's something Gnome is doing. [03:54] mscs: I thought it may be [03:54] probably due to the upheaval of dropping unity and moving to gnome [03:59] mscs: whats going on, im on artful testing? [04:08] lotuspsychje: well, I've got a Dell XPS 13 9360 plugged into a Dell TB16 dock. [04:08] I plug the laptop in over thunderbolt, the display, keyboard, and mouse all pick up fine and the laptop starts charging. [04:08] When I close the lid, rather than staying awake, the laptop suspends. [04:09] lid-close-suspend-external-monitor is false (the default), and (thanks to TJ-'s idea to test) I can tell that it doesn't happen when Gnome is stopped [04:09] mscs: power settings are set good? [04:10] as far as I can tell - they're all defaults, though I have TLP installed [04:11] I've got the latest bios from Dell, fully updated. [04:12] when we looked at syslog and kern.log the only thing we saw was the messages about the system getting ready to suspend, nothing that indicated what triggered it to do so [04:12] though... an update to upower just landed? [04:13] lol. That'd be funny. Let me try upgrading it real quick. [04:19] the plot thickens: it works fine in Xorg. [04:29] so upower update seems to have made it worse, not better. off to poke around for a bit [04:40] mscs: how you know your in wayland? [04:55] welcome azaki [04:55] oh, hi. =p [04:56] i'm just gonna copy/paste it from the other channel, because yeah.. [04:56] has canonical announced what the upgrade plan looks like right now for 17.10 ? i mean i assume that both people on ubuntu-gnome and ubuntu-unity are going to both just be upgraded to the same gnome-based ubuntu desktop [04:56] but i'm wondering if there will be any weirdness as a result of the past differences between unity and gnome flavors [04:58] azaki: 17.10 is still in development atm [04:59] azaki: so upgrade is not recommended yet [05:00] azaki: 17.10 gonna have gnome by default indeed [05:03] azaki: 18.04 will have gnome by default for LTS [05:03] i don't mean upgrade now... [05:03] i'm just wondering how the process will work. [05:03] i assume the old "ubuntu gnome" flavor is being discontinued? [05:04] azaki: ubuntu-gnome will be automaticly upgraded to ubuntu-desktop, wich is gnome by default [05:05] azaki: same goes for unity [05:05] ok, thanks. that's more or less what i wanted to know [05:06] because i know that canonical has been working on getting certain extensions out of the box, like dash-to-dock and others. which aren't shipped by default on current ubuntu-gnome [05:06] so yeah. anyways. thank you =) [05:13] azaki: they forked 2 extensions by default already [05:13] azaki: dash to dock fork and knotify indicators [05:17] is gnome "classic mode" still going to be available out of the box? [05:18] i dont think so azaki [05:18] hm [05:18] azaki: but perhaps there might be a workaround [05:19] we're both talking about the same thing right? the classic mode that looks like gnome 2 [05:20] yeah [05:20] default is gnome 3 right [05:21] yeah, the default gnome3 basically looks pretty plain, has no dock or window list. [05:21] and then there is the classic mode which looks like this: http://worldofgnome.org/uploads/2014/02/classic-312-desktop.png [05:21] !find classic [05:21] Found: fcitx-ui-classic, fonts-lohit-taml-classical, hunspell-fr-classical, classicmenu-indicator, fcitx-table-quick-classic, fonts-gfs-bodoni-classic, fonts-gfs-didot-classic, ibus-table-quick-classic, icinga2-classicui, igtf-policy-classic (and 1 others) http://packages.ubuntu.com/search?keywords=classic&searchon=names&suite=artful§ion=all [05:21] azaki: not sure of that mate, we will have to see in final release [05:22] !info gnome-session-flashback [05:22] gnome-session-flashback (source: gnome-flashback (3.24.0-1ubuntu4)): GNOME Session Manager - GNOME Flashback session. In component universe, is optional. Version 1:3.24.0-1ubuntu4 (artful), package size 4 kB, installed size 43 kB [05:24] krytarik: oh, flashback is the classic mode session? [05:26] Yep - https://wiki.gnome.org/Projects/GnomeFlashback [05:28] tnx krytarik [05:28] Sure. [05:44] azaki: you can also install 17.10 then wait until 18.04 LTS is out [05:44] to get used of new ubuntu [05:45] it's for a family member who is more used to the oldschool style of user interfaces [05:45] they are not familiar with "docks" or how they work. [05:45] =o [05:46] i suppose i could customize the extensions myself, but it's more convenient to just login using classic mode [05:47] azaki: you can enable/disable dock easy and make it look classic [05:47] just 2 addons by default [05:48] well, classic adds a window list also [05:48] and a all white theme to the ui [05:48] also adds the old "applications" and "places" menus in the upper bar [05:51] i know [11:23] hi all [11:23] I'm actually trying to install ubuntu 17.10 daily on an already encrypted usb drive. there is a huge btrfs and I tried to convince ubuntu installer to install on that btrfs without reformatting(took care there is no @ snapshot on it). [11:23] I could configure installer, but it hangs at detecting filesystems [11:23] is there a way to even avoid partitioning configuration and directly mount /mnt for installation? [11:24] i don't think the installer supports installing into existing file systems. whats the use case? [11:27] how would it know / be able to decyrpt the file system ? [11:27] I have a fully encrypted pen drive with a btrfs partition on it containing multiple subvolumes with multiple distros [11:27] if it's already encypted like you say [11:27] it is [11:27] how does it decrypt it ? [11:27] how does it know the key ? [11:27] I would like the installer to install directly on a given subvolume and evene not to care about grub [11:28] there is an option not to install grub [11:28] but that sort of will fail due to the package hooks for the kernel packages [11:28] as that will trigger hooks for grub [11:28] thats the thing, thats everything working. I just need the installer to do its thing on a subvolume and configure the system itself but ignoring the rest [11:29] I'm curious to how it's decrypted the encypted disk for the install ? [11:29] there are no prompts to enter a key, so how do you tell it where the key is to decyrpt ? [11:29] by already executing cryptsetup on console [11:29] so you are manually decrypting the volume ? [11:29] then starting the installer [11:29] I prepare everything, after doing cryptsetup you can select partition inside in installer [11:30] but the detecting filesystem step at installation itself hangs [11:30] so I would prefer to mount manually a subvolume as /mnt so installer ca do its stuff without caring about the rest [11:30] how would it work post install, as the installer would not have setup al the cyrpt stuff, so it wouldn't know how to decrypt at boot time [11:30] you can't install to /mnt target though [11:31] it wants a device, not a file system [11:32] the actual ubuntu 17.04 on that usb drive is copied over from an unencrypted installation. there wasn't anything to do, everything is done by grub which is maintained by an arch installation [11:32] it passes everything as kernel arguments [11:32] this sounds like pretty much non-existant use case [11:32] right, so the OS doesn't need to care about the encyption [11:33] it is the use case, that ubuntu is not capable of full disk encryption (even kernel is encrypted, there is a grub hook in arch for letting grub decrypt) [11:34] so grub loads the kernel from the encrypted drive [11:34] I thought it can handle FDE just fine [11:34] ? [11:34] when I tried last time with ubuntu there was still this "kernel has to be unencrypted" thing [11:35] also its kind of special setup, I avoid lvm [11:35] depends on the encyption method, I'm sure it's been FDE ready since 14.04 [11:35] maybe earlier [11:35] just one huge btrfs [11:36] the file system doesn't matter [11:36] otherwise abstraction costs performance [11:36] it's disk encryption [11:36] not file system encyption [11:36] yes, but ubuntu wants to setup an lvm volume for its stuff [11:36] inside the container [11:37] ubuntu uses an LVM volume for one method and in the standard file system layout [11:37] well however, is it possible to just pass an already mounted /mnt to installer and skip the whole fs stuff? [11:37] maybe I need to look at the current installer and see what it's capable of [11:37] RalphBa: no, it won't install to /mnt/$something [11:37] it wants a device not a file system [11:38] is there a bootstrapping way? [11:38] the old debootstrap guide maybe useful to adapt ? [11:38] hmm... [11:39] but again you're creating a usecase / situation that it's not really designed for or desired by anyone other than you (that I've ever seen) [11:39] you'll be on thin ice with it [11:40] I have no problem with fixing adapting an installed linux, just with making it installing in that case [11:40] when its there, I take care about the rest [11:42] how said, I already copied a 17.04 over and made it working well using that setup [11:47] this surely sounds like a debootstrap use case, if any. [11:48] ... I think it would be a nice thing if ubuntu once supports also a pro installation like arch. [11:50] well for now I have to do again what I didn't want to. install it first somewhere else and then copying it over :( [11:55] some call it pro, others call it finicky [11:55] and thats fun, aside of getting things more or less exactly how you want [11:56] and aside of learning a lot [12:03] ikonia, because of FDE. I actually try it on an empty drive and get the message, that the root partition on an encrypted drive needs a separate boot partition. so it does not support fde vie grub crypt feature [12:03] so yes, the usecase is pretty obvious when you want to avoid evil maid attacks [12:04] docs show it supporting FDE [12:04] how? [12:04] encrypting a drive and installing / in that encrypted container is not doing the thing [12:05] i fear here fde means not using ecryptfs [12:05] have a look at the docs, I've not got a test box at hand to start the installer [12:05] ecryptfs is file system encryption, so not FDE [12:06] yes, and I fear with FDE they mean encrypting root instead of only ecryptfs but not encrypting also boot [12:06] but I mean FDE up to the last byte including the kernel [12:07] ok, up to the last bytes - grub [12:10] that first time I saw with a loot of frickeling around in arch linux [12:10] what the installer creates when you select the FDE option is an unencrypted /boot partition with kernel + initrd, the rest encrypted. [12:10] gladly its just a lot of frickling around with grub and do not really affect the kernel itself [12:11] tomreyn, unencrypted kernel = invitation for evil maid [12:12] i'm aware. and there's no way around evil maid unless you trust your firmware + hardware. [12:12] and how said, grub in the meantime is able to load the kernel from the luks container [12:12] do you? [12:12] doesn't matter if the firmware is compromised [12:12] well, better than having an exposed kernel :D [12:13] you can encrypt that in a second step if you want to, there are guides on it on the web, others have done it before. [12:13] for sure also thats not 100% but by avoiding an efi boot due to the lack of space in mbr its at least making evil maid pretty hard [12:14] i'm not convinced [12:16] couldn't you just boot a kernel from a usb if you encypted the kernel to get around the "security" that an encypted kernel gives you ? [12:16] ikonia, the whole thing is an usb drive [12:17] what whole thing ? [12:17] the installation will run on an usb drive. I have kind of workenv on a stick [12:17] thats not what I meant [12:17] I meant you're trying to protect your kernel by encypting it at boot time [12:18] but couldn't you just boot a kernal from an external source to get around that "security" option [12:18] I'm not seeing the value of encypting the kernel before boot [12:18] sure you could, but you'd still need the password [12:18] ok ? [12:18] which only me knows, and I will for sure not boot from another kernel [12:19] what are you protecting against then ? [12:19] but only from one decrypted by grub [12:19] so really you don't care about the kernel [12:19] you're trying to protect the FDE encyption password held in the grub config on /boot ? [12:20] it is not held in grub config... [12:20] then what are you trying to protect ? [12:20] I actually enter the password twice, one time for grub so it can load the kernel and one time for the kernel so it can decrypt root [12:20] but what are you trying to protect by encypting /boot ? [12:21] so grub loaded from mbr, decrypts the kernel and the kernel decrypts root [12:21] but what are you trying to protect by encypting /boot ? [12:21] So there is a decrypted chain except grub itself which is simply very small and because of the lack of space hard to compromise [12:21] but what are you trying to protect by encypting /boot ? [12:22] the system I try to protect [12:22] how ? [12:22] you know evil maid? [12:22] what value is encypting /boot [12:22] yes, I'm aware [12:22] evail maid is an attack where you modify the unencrypted kernel to get the password when its entered by the user [12:23] but it's binary [12:23] you're going to hack a copiled binary (realistically) [12:23] to avoid the modification of the kernel, you put it inside the encrypted container [12:23] ikonia, nah, you simply replace it [12:24] so you're going to replace the whole kernel and bootloader ? setup, [12:24] when you want to do this attack, yes you simply replace it on unencrypted boot partition [12:24] thats why I want it to be inside the encrypted container [12:25] how are you going to protect against keyloggers built into the keyboard ? [12:25] so it cannot be replaced [12:25] or built into the firmware ? [12:25] for sure the security has limits, but a keylogger in my keyboard is something else than grabbing that stick when I'm not looking at [12:26] whateer you feel is appropriate I guess [12:26] how said, the whole system is on a stick which is always with me. but I can't ensure that it is observed all the time [12:27] If I'd be an attacker, I'd take it and replace the kernel with a compromised one... If its unencrypted [12:27] I'd swap out your keyboard connector [12:28] easier quicker and less noticable than steeling your stick [12:30] well, that's a bit like comparing apples with oranges. yes, the entire system, both all hardware and software components (firmware, too) need to be secure to create a secure workstation. but to get there, one needs to start somewhere. [12:31] unless you're in a serious data situation, I just feel it's overkill and creating a problem that you'll make an engineering mess trying to solve [12:31] so just because one component is not easily secured i would still appreciate ubuntu enabling all users to encrypt /boot and thus the kernel easily. [12:31] as this discussion shows [12:32] tomreyn: if it was possible easy and clean, it would be great [12:32] that's a legitimate POV, i agree. [12:32] ikonia, you'd need to enter my flat... even twice [12:33] right, so why are you going to this level [12:33] if your location is protected why make this engineering mess [12:34] ikonia, the system is on a usb drive which is always with me, so not at home [12:34] and also not at company, but sometimes also in a bar [12:34] or disco, or restaurant [12:34] are you not creating a problem then [12:35] carrying around a USB stick on with your "secure" data on ? [12:35] I have multiple places to work with [12:35] actually - ignore me, this isn't really on topic, I think the short answer is "the installer is currently not capable of meeting your use case" [12:36] that... I already got [12:36] and the thing with the clean way, there is since it is no problem in arch and works like a charm. [12:37] grub already has this feature, I do not understand why ubuntu is not using it [12:37] why don't you raise a bug report asking for clarification why the feature is not available and document the arch use case as an example [12:38] I could do that. and propably will [12:39] seems like that would add some value [12:39] please also read the *lengthy* discussions amongst grub developers befroe they intriduced the feature [12:39] tomreyn: really, is there interesting background to this ? [12:45] i remember no details but that it was a long discussion, one of those with a potential to MAKE AN os DEVELOPMENT TEAM SPLIT UP. [12:45] whoops caps [12:45] so clearly something serious in discussion there [12:46] also, it'd be good to read up on how rutkowska + team have implemented their workaround in qubes OS [12:46] ... ikonia do you think I'm speaking about nonexistent stuff? [12:47] that system is working for long time with arch and even with ubuntu 17.04 which I copied over from an unencrypted install [12:47] What I have to do again... thats the point [12:48] the fact that an implementation exists in another linux distribution doesn't automatically mean it's a robust implementation. [12:48] for me its actually working without problems [12:49] and without anything beeing decrypted... except grub itself [12:49] robust as in both reliably working and well hardened [12:50] as we know from linux in general, first it works then it gets hardened... but first someone has to work with [12:51] RalphBa: I don't think it's non-existant, I think it's got to be balanced more, more so when you are partially creating the problem [12:51] "copied over" is not an "install" [12:51] I'm aware, that it might not be as expected, but its better than the alternatives... from unencrypted linux kernel to (god beware) bitlocker [12:52] you mock bitlocker - yet it's widely used in enterprises [12:52] I know, and I know that its a pain in the as and not that secure you'd expect [12:52] there are also products that can be put on the disk to encypt the disk (eg: sophos) that meet your requirement [12:53] if you where serious about this you'd look at this sort of stuff, it feels like you're engineering a problem [12:54] it seems like I do this at home with low budget and not at company [12:54] but you just said this is for work [12:54] as you work in multiple places [12:54] and if this for home - then how secure does it "really" need to be [12:54] work is not always paid ;) [12:54] no-one said it was [12:55] thats why I said it feels like you're engineering a problem more than it needs to be [12:55] so as many I have two lives. one where I work for... money and one where I work for something useful [12:55] and I admire people giving their time for a good cause [12:55] but that doesn't really change the situation [12:56] The situation is simple, I do some critical stuff which I want to protect as good as I can within my limits and meeting my requirements [12:56] if it was critical you wouldn't be taking it to a diso [12:56] disco [12:57] if it was critical you'd look at some other comercial products to help you cause rather than an engineering mess [12:57] Yes, it might be no usual case but it is mine. And it were always a strength of linux to support individualism. Otherwise I could use windows [12:57] It is on my keyring :D [12:57] right, but it's not up to a distro to cater for your one in a million use case [12:58] no, it is not up to a distro to do that, but it would be fine if the distro respects individualism and provides hook ups where you can do something else than default [12:58] it does respect individualism [12:58] could you show me how ubuntu is not catering for individualism [12:58] this kind obviously not :D [12:59] no, it's not [12:59] or I wouldn't ask [12:59] ubuntu is perfect when installed. but I asked for nothing more than a way to do parts of what installer is doing myself [13:00] so you can do that [13:00] And that is even not bound to my special use case [13:00] you can interact outside the installer, or you an patch the installer to do as you want [13:00] that is bound to your usecase [13:01] no, there is another usecase installer does not allow [13:01] it would be helpful to understand why ubuntu hasn't enabled the option you desire in the instaler [13:01] insaller [13:01] RalphBa: the installer will not cater for every usecase, [13:01] makeing a one btrfs system where home is an own subvolume... [13:01] not possible [13:01] so raise a bug/feature request for this, see if it is taken onboard [13:01] at installation... afterwards yes [13:02] if there is a big need for this I'm sure people would invest engineering time [13:02] well, don't see the point of filing 100 bugs for saying, make the installer modular with the possibility to skip steps [13:02] it's not 100 bugs [13:02] it's 1 [13:03] install home onto btrfs subvolume [13:03] why not "let me do as I please and just do what I want"? [13:04] but ok, this is religion, makes no sense [13:04] because that would rquire engineering work to make every component overridable [13:04] that pretty much no-one wants [13:04] I have to leave for 20 minutes, after we can continue if there is need for [13:04] and they would have to start applying crazy logic tracking, eg: if steps 1 + 2 skipped, valildate what was done outside the installer, before moving to step 3 [13:04] I don't think there is need [13:04] you have a choice, raise a bug / feature request [13:04] or don't === JanC_ is now known as JanC [15:24] ikonia, its done. installed to unencrypted disk, copied it over, adapted fstab and crypttab, apt install cryptsetup, update-initramfs -u and everything works like a charm [15:26] gladly there is already enough stuff in the fs so the plain install cannot be used for pattern attack [15:38] clearly everything doesn't work like a charm as you've had to do an excessive manual hack [16:00] Hey, anyone having no sound in Flash under Firefox 56b ? [16:00] forget flash, its dead [16:00] oficially dead [16:01] I even wonder how you got it installed [16:02] RalphBa: I can't, the content is flash. I share your sentiment otherwise. It worked for years before, this is a new issue for me. [16:02] how said, flash is declared dead by adobe [16:03] so you might get it installed/working but its nothing you should do [16:05] Given this progress, and in collaboration with several of our technology partners – including Apple, Facebook, Google, Microsoft and Mozilla – Adobe is planning to end-of-life Flash. Specifically, we will stop updating and distributing the Flash Player at the end of 2020 and encourage content creators to migrate any existing Flash content to these new open formats. [16:06] many browser distributors already stopped supporting flash [16:06] Yeah yeah, I know all about that – that's not why I came here. [16:06] why you came here is because flash in firefox? is firefox still supporting it? [16:08] Well it's certainly still possible to use it, I don't know about support by Mozilla. [16:09] ralph@ralph ~ % sudo apt install adobe-flash [16:09] completing package [16:09] adobe-flashplugin adobe-flash-properties-kde [16:09] adobe-flash-properties-gtk [16:09] it seems to be still in partner repos [16:12] but no, sound is not working for me [16:18] try with google chrome [16:26] I saw someone hade the option to log in using wayland instead of xorg. I didn't seem to have that option, is is something that i have to turn on? [16:27] nocco: I assume it's not available when you install closed source GPU drivers [16:27] nocco: is that the case? [16:28] wayland is still having a problem with nvidia [16:28] okej :( [16:28] I'm running wayland on the greeter (only) with intel [16:29] brainwash: yes I have installed closed source gpu drivers [16:31] you can still make it work though [16:32] Is there any open sourced option for nvidia that I can use? [16:32] how ? [16:32] bug 1697882 [16:32] bug 1697882 in gdm "GDM should not allow X11 sessions when NVIDIA's KMS is enabled" [Medium,Incomplete] https://launchpad.net/bugs/1697882 [16:34] 1) enabled KMS via nvidia-graphics-drivers.conf [16:34] 2) sudo update-initramfs -u [16:34] basically that [16:34] thanks! [16:36] Will games work better or worse in wayland? (Sorry now really sure what wayland is giving me when it lands in my hands.. ) [16:37] I assume that most run directly via opengl, so there shouldn't be a big performance hit [16:39] okej :( [16:39] but running games through xwayland (mainly windows games using wine) will drag the performance down [16:40] well, I'll have to search for some benchmarks I guess [16:41] input could be an potential issue also [16:41] performance wise it's best to stick to Xorg [16:42] at least in 2017 :P [16:42] alright :P [16:43] What will wayland give me as a regular ubuntu user? [16:44] nocco: several people have reported games lagging under the gnome wayland session [16:45] alright === Night__ is now known as |Night|