11 releases 11 tags

RSS feed

• v5.5.3-21 f0ff30dab7

  Compare

  v5.5.3-21 Stable

  amnesia released this 2026-07-05 18:49:46 +02:00 | 11 commits to main since this release

  protocol7-core 5.5.3-21 (2026-07-05)

  lainos-ghost-units ~ syslog-ng ordering fix

  Root cause: lainos-ghost-units creates /run/systemd/system as part of its
  AUR-compatibility ghost directories. syslog-ng's system() source macro calls
  sd_booted() which checks for /run/systemd/system at parse time. If ghost-units
  ran before syslog-ng started, syslog-ng assumed it was on a real systemd host and
  expanded system() to systemd-journal() instead of unix-dgram("/dev/log").
  No journald exists on Protocol 7, so /dev/log was never created and all syslog
  calls silently went nowhere.

  Fix: Added after syslog-ng to lainos-ghost-units.initd depend() block.
  Since both services are in the boot runlevel, OpenRC has no implicit ordering
  between them -- this constraint was missing. after (not need) enforces ordering
  only when syslog-ng is going to start anyway, without forcing it as a hard dependency.

  Verification:

  • /dev/log confirmed created by syslog-ng before ghost-units runs
  • logger -p daemon.info confirmed reaching /var/log/daemon.log
  • lainos-notifyd messages confirmed appearing in daemon.log with sender uid/pid

  lainos-notifyd v4.6 and v4.7

  v4.6 ~ security/audit pass:

  • FIX: removed SA_RESTART from SIGTERM/SIGINT handlers ~ recv() was transparently
    restarted by the kernel after a signal, so shutdown_flag was never checked until
    another datagram arrived. Daemon would hang on SIGTERM indefinitely if idle.
  • ADDED: switched recv() to recvmsg() with SO_PASSCRED so each message is logged
    with the sender's real uid/pid (SCM_CREDENTIALS) instead of trusting
    unauthenticated content blindly
  • ADDED: MSG_TRUNC detection ~ oversized datagrams logged as truncated instead of
    silently clipped
  • ADDED: control-character sanitization on logged message bodies to prevent
    syslog log-line injection via embedded newlines/escapes

  v4.7 ~ shutdown unlink fix:

  • FIX: removed shutdown-time unlink() of the socket path. After drop_privileges(),
    the process runs as nobody but /run/systemd is root-owned 0755 ~ unlink()
    requires write permission on the containing directory, not the file. This call
    always failed silently (return value was never checked). Startup-time unlink()
    (run as root, before bind()) already handles stale-socket cleanup. Removed
    unlink/unlinkat from seccomp whitelist accordingly, tightening the filter.

  Fuzz Testing (lainos-notifyd)

  libFuzzer harness (prior session):

  • Standalone harness targeting parse_and_log() and sanitize_for_log() in isolation
  • Compiled with clang -fsanitize=fuzzer,address,undefined
  • Seeded with every message-type prefix, boundary lengths, and injection attempts
  • 2,000,000 iterations ~ zero crashes

  Manual fuzz script (2026-07-05):

  • Inputs: empty string, READY=1, 65536-byte payload, null bytes, 4096-byte STATUS,
    MAINPID=0, MAINPID=99999999, WATCHDOG=1, 1024 bytes random binary, embedded newline injection
  • notifyd status: started (survived all inputs)
  • MSG_TRUNC correctly fired on oversized payloads (over 8191 bytes, dropping)
  • Log injection sanitized ~ embedded newlines replaced with dots in daemon.log
  • All message types logged correctly with sender uid/pid attribution via SCM_CREDENTIALS
  • READY=1 confirmed: [notify uid=1000 pid=9454] READY=1 (service ready)

  Structural changes

  • lainos-net-init removed ~ dead code, no callers
  • lainos-audio-init removed ~ now a separate optional package (lainos-audio-init)
    in protocol_7_repo; lainos-init calls it via double-fork if present, fails
    gracefully if not installed
  • lainos-init reverted to v4.6 ~ single responsibility (session init only,
    no audio orchestration)

  ISO changes

  • syslog-ng daemon facility enabled in overlay (was commented out)
  • notify group added to usermod in shellprocess-final ~ required for notifyd
    socket access without doas
  • lainos-notifyd runlevel corrected to default (depend() requires dbus which
    is not available in sysinit)

  Downloads

  • protocol7-core-5.5.3-21-x86_64.pkg.tar.zst
    0 downloads · 2026-07-05 18:48:24 +02:00 · 37 KiB
  • protocol7-core-5.5.3-21-x86_64.pkg.tar.zst.sig
    0 downloads · 2026-07-05 18:48:25 +02:00 · 119 B