From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1.migadu.com ([2001:41d0:403:58f0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms8.migadu.com with LMTPS id aMbKLnYe5mXWTAEA62LTzQ:P1 (envelope-from ) for ; Mon, 04 Mar 2024 20:18:14 +0100 Received: from aspmx1.migadu.com ([2001:41d0:403:58f0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1.migadu.com with LMTPS id aMbKLnYe5mXWTAEA62LTzQ (envelope-from ) for ; Mon, 04 Mar 2024 20:18:14 +0100 X-Envelope-To: larch@yhetil.org Authentication-Results: aspmx1.migadu.com; dkim=pass header.d=fedora.email header.s=aug2020 header.b=OuO73F36; spf=pass (aspmx1.migadu.com: domain of "help-guix-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="help-guix-bounces+larch=yhetil.org@gnu.org"; dmarc=pass (policy=quarantine) header.from=fedora.email ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1709579894; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post:dkim-signature; bh=KoDqspYw1KhMxPqmAgUo+duUZPppSpivx4LjuIGBUNc=; b=fUMVF8rj/1TAaFxbj3+WHFMCJu0vxNPGSq63SBePydLwsuB5fsaV9pYEaB/stTnPekmEcR UHG+HCLu5Eys3JcLf2CtFmeJW3LdlcKFmUGzCR+bPWypOG5Oko4u3a9GTjyVOFkxXgHmwB Rq3EEaE5jGvF0llXHPiszmuMhAQ9o2M7b8rj9fx8omyYYDKG2L1ejAeXdy+HdswC8fkE1k V5ZNyw59wmW0UvcXegKW3nuYYHV6YovMCTgbYWRLgWisRj6IuIT26iN5a5bp8ZFsd092lf T/oMc6hrm1HtcmtZfyupSFQbmwRFVHgp++v6iL5/MgKFKnfxqLH6JGnOzJlYvw== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=pass header.d=fedora.email header.s=aug2020 header.b=OuO73F36; spf=pass (aspmx1.migadu.com: domain of "help-guix-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="help-guix-bounces+larch=yhetil.org@gnu.org"; dmarc=pass (policy=quarantine) header.from=fedora.email ARC-Seal: i=1; s=key1; d=yhetil.org; t=1709579894; a=rsa-sha256; cv=none; b=hWv6uYujwwAVSuNjz3OR/7SfPgyQiFjjQ8mNXjgJLpdZ7uKVifIWtVEU0SQj+n85l5sYK0 34jpXKFrzzfW2v1vrNvqd9j5ctUy0ba9TGW5bPKHVG4PFnTgEcrl5CtGoeu4sLhn8xtXqT nJV9fuOb4gTOIPgLC2VFe4258UYkb32cFTkjZl20u8/Ip3f+C2RT7K4s3QqOiiVpc8hf/E RheEjM6GgXXoEa7fKWG0h8KX4lXkNNw4BZDQqTqNGjw8H+sKSTN8e2+mxOdQ4OHip4kUfs Bb1GV0bCSFzzcdWQWTkcOGqOW0UVdM4GUtQ4VcpDsqztD0sIRBrta6Trhn5gVA== Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 6298C59A36 for ; Mon, 4 Mar 2024 20:18:14 +0100 (CET) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1rhDow-0007Pi-Ah; Mon, 04 Mar 2024 14:17:54 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rhDov-0007PL-3Z for help-guix@gnu.org; Mon, 04 Mar 2024 14:17:53 -0500 Received: from fedora.email ([205.185.120.125]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1rhDot-0002Qg-1E for help-guix@gnu.org; Mon, 04 Mar 2024 14:17:52 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fedora.email; q=dns/txt; s=aug2020; bh=KoDqspYw1KhMxPqmAgUo+duUZPppSpivx4LjuIGBUNc=; h=from:subject:date:message-id:to:cc:mime-version:content-type:content-transfer-encoding:in-reply-to:references; b=OuO73F36xKUdiFh2txgde0GV1Zs0iSiqpLu5d2xoXdj64ZtZJlBEp7I7vIlaJFYnyeVGLry/B v275xZbqgBuKsvC2F/TMgJVTqugeoVrGSt5e+qJbqf/CXAYaFKytTHQO8BZVDpwoePf2wpVZy/O OGfM+rdHvUhxSxNNIwFuZZI= Received: from localhost ([185.242.251.193] 185.242.251.193-ip.operadors.cat) (Authenticated sender: willbilly) by fedora.email (ZoneMTA) with ESMTPSA id 18e0ae6853f0000176.002 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 04 Mar 2024 19:17:43 +0000 X-Zone-Loop: b48e48b344646ef320cae40efed28e34eda2d1d75c26 X-Originating-IP: [185.242.251.193] Date: Mon, 4 Mar 2024 20:17:39 +0100 From: William To: Felix Lechner Cc: help-guix@gnu.org Subject: Re: Configuring mount for NTFS partition at boot makes the system unbootable. Message-ID: <20240304201739.153fd562@fedora.email> In-Reply-To: <87ttlmzwar.fsf@lease-up.com> References: <20240303215558.3efe589d@fedora.email> <87wmqjyplh.fsf@lease-up.com> <20240303233648.55a40747@fedora.email> <87ttlmzwar.fsf@lease-up.com> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.37; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Received-SPF: pass client-ip=205.185.120.125; envelope-from=willbilly@fedora.email; helo=fedora.email X-Spam_score_int: 12 X-Spam_score: 1.2 X-Spam_bar: + X-Spam_report: (1.2 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: help-guix@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: help-guix-bounces+larch=yhetil.org@gnu.org Sender: help-guix-bounces+larch=yhetil.org@gnu.org X-Migadu-Country: US X-Migadu-Flow: FLOW_IN X-Migadu-Spam-Score: -4.68 X-Spam-Score: -4.68 X-Migadu-Queue-Id: 6298C59A36 X-Migadu-Scanner: mx11.migadu.com X-TUID: 2yIMof+hh2Wp On Sun, 03 Mar 2024 16:15:56 -0800 Felix Lechner wrote: > Hi William, > > It seems that help-guix was inadvertently left off of the recipients. > I hope you don't mind that I copied the mailing list on your > response. > > On Sun, Mar 03 2024, William wrote: > > > Hello. > > > > Thanks for the input, this certainly helped me diagnose the issue. > > > > I set some options so Guix keeps booting if mounting the filesystem > > fails, now I can boot. > > > > I potentially figured out what the issue may be, the filesystem > > entry is defined on /etc/fstab so I tried running "mount -a" > > without root, and it printed this: > > > >> Mount is denied because setuid and setgid root ntfs-3g is insecure > >> with the external FUSE library. Either remove the setuid/setgid bit > >> from the binary or rebuild NTFS-3G with integrated FUSE support and > >> make it setuid root. > >> Please see more information at > >> https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-FAQ > > > > It seems it's another issue with setuid/setgid. I think this could > > be solved if ntfs-3g is compiled with integrated FUSE support, so > > it doesn't require libfuse at all, then the declaration to load the > > FUSE module wouldn't be needed either I suppose. > > I also use FUSE every day and believe it's compiled into our kernels > (i.e. no module). Perhaps someone can help you find our kernel > configurations. > > The security concern may also be further explained here. [1] > > > Maybe this should be reported as an issue on the Guix tracker? > > There is already a bug about it. [2] The filing is from 2021. There is > no proposed solution. > > I would write to the bug [3] and ask if there are workarounds. Please > make sure to cc Abdelhakim, whose address you can find here. [4] (I > also copied him on this message.) No one else will receive or read > your message to the bug tracker. > > Kind regards > Felix > > P.S. Sorry about the complexity of our bug reporting tools. Some work > is being done to simplify them. > > [1] > https://unparalleled.eu/blog/2022/20220607-help-to-heap-suid-privilege-escalation/ > [2] https://issues.guix.gnu.org/46980 [3] 46980@debbugs.gnu.org > [4] https://debbugs.gnu.org/46980 Hello again Felix. As a matter of fact, I was testing this using the upstream "corrupted" kernel from the nongnu channel. I just tried the same with Linux-libre 6.1.79, with the same behaviour, so I think the issue is not the FUSE module not being loaded but rather ntfs-3g relying on the external FUSE to mount partitions. The only two possible workarounds I can see is either manually mounting the partition on boot as sudo/superuser, or compile ntfs-3g modified locally with the FUSE support enabled, and use the modified version instead, but I've got no clue of how to do such thing on Guix, I'm still trying to get the system configured exactly as I'd like to before digging into something like that. Meanwhile I'll file a reply as a reminder to that issue, maybe the package mantainers can eventually patch ntfs-3g. Thank you.