[03:13] Bug #1579268 opened: Mouse cursor is different inside graphical windows of snaps (snaps not using system theme) [10:56] kyrofa: hey, re. expires TZ, it doesn't record timezones atm and is interpreted as utc. [10:57] kyrofa: and sorry I wasn't around yesterday. [15:47] cprov, no problem! Would it be possible to return UTC TZ? [16:04] kyrofa: yes, there is a general problem with timestamps in the API, some are naive (no tz info) and some are RFC3339 (appended 'Z'), we will have to clean this up [16:04] kyrofa: but for the time being, there is nothing blocking you parse them as UTC, right ? [16:54] hoping this means anything to anyone because it baffles me [16:54] Dec 23 16:52:00 ironhide audit[3513]: SECCOMP auid=1000 uid=1000 gid=1000 ses=2 pid=3513 comm="F12017" exe=2F72756E2F6D656469612F6269676469736B2F67616D65732F737465616D617070732F636F6D6D6F6E2F463120323031372F62696E2F463132303137 sig=31 arch=c000003e syscall=101 compat=0 ip=0x7f72201b4e72 code=0x0 [16:56] it seems to be the thing breaking feral games [16:58] if im reading this right 101 is ioperm [17:58] snap run --shell linux-steam-integration [17:58] [1] 11726 invalid system call snap run --shell linux-steam-integration [17:58] k thats janky. [18:01] i dont seem to be getting any apparmor denials or library errors yet under confinement feral games arent working [18:01] and i cant figure out why they break [18:10] isn't 101 ptrace? [18:15] https://github.com/torvalds/linux/blob/9c294ec08408ed90c0f2d994a7979366675e3734/arch/x86/entry/syscalls/syscall_64.tbl#L110 - for 64-bit, anyway [18:32] yeah [18:32] also chown is causing --shell to die [18:32] when it chowns .bash_history [18:32] and the error message seems consistent.. [18:32] chown ufee1dead:ufee1dead lol [18:32] Bad system call [18:32] so i guess i just need to allow ptrace in the new interface.. [18:52] cprov, I'm just leaving them naive for now, but if you promise me that assuming naive datetimesnamps from the store are UTC, then that's also easy [18:52] promise me that doing so is safe, I mean [19:09] i cant seem to make this dmesg go away whatever i do.. [19:14] snappy-debug is apparently not portable either.. [19:24] ikey, what are you seeing? [19:25] kyrofa, snappy-debug or my snap issue? [19:25] cuz my snap issue is https://forum.snapcraft.io/t/unable-to-use-ptrace-in-confinement/3297 [19:25] ikey, both, haha [19:25] and my snappy-debug issue is it absolutely requires /var/log/syslog [19:25] solus doesn't use syslogd we just have journald [19:26] ikey, yeah, seccomp denials are totally different from apparmor ones [19:26] yeah this is alien territory to me [19:26] only just got used to doing apparmor rules [19:26] ikey, seccomp doesn't support logging if we use the ERRNO method, so we've chosen to use KILL for now while upstreaming the logging capability [19:26] ah ok [19:27] ikey, which means if you make a disallowed syscall, unlike apparmor which gives you a nice denial and sends you on your way, you're dead dead dead [19:27] right [19:27] and this is happening within the tree of a multiprocess app so it go boom [19:28] ikey, yep [19:28] ok looking at the bpf ptrace is definitely missing [19:28] Yeah probably need to add something there [19:30] i thought capability sys_ptrace would do that, guessing not [19:31] and i dont see any of the bpf explicitly setting ptrace on [19:32] Yeah, that I don't know [19:33] wonder if this is a kernel issue now. [19:33] * ikey tries a reboot [19:40] aha [19:40] i manually recompiled the bpf and added ptrace to it [19:40] and that was enough to make it "work" [19:41] Nice! Though I'm sure there are security ramifications there [19:42] yeah we'll need to add some initial deny ptrace lines in apparmor profile and then some explicit allows [19:44] that way we wont be able to ptrace unrelated peers [20:28] boom: https://twitter.com/ufee1dead/status/944666111810965504 [20:38] kyrofa: yup, assume utc for now [21:16] ikey: love it [21:29] the browser interface is causing me some trouble by breaking my ptrace [21:29] as it has a deny all [21:29] and is inserted after my own rules.. === devil is now known as Guest74671