EasyOS version 2.3.2, June 22, 2020

[blgs]

The working directoy was in my system:
WKG_DIR=' ' without '/' up to and including EasyOS 1.0.8.

But in EasyOs 1.0.11 it fails, both in upgrade and in fresh frugal installations.

WKG_DIR=' /' with '/'
Fails in EasyOs 1.0.11, in upgrade and in fresh frugal installations.

WKG_DIR='easy/'
Also fails in upgrade anf frugal installation.

Somewhere I'm doing something but what!.

OK, post the content of BOOT_SPECS.

For the partition where you have Easy installed, let's say sda3, return these results:

# blkid /dev/sda3
# ls /mnt/sda3

Or, if different boot-partition and working-partition, run 'blkid' and 'ls' on both.

See below as requested for EASYOS 1.0.8 and EASY 1.0.11.
I shall try again to upgrade to 1.0.11 .

QUOTE
EASYOS 1.0.8

BOOT_DISKID='0x02509f4a'
BOOT_PARTNUM=1
BOOT_FS='vfat'
BOOT_DIR=''
WKG_DISKID='0x02509f4a'
WKG_PARTNUM=2
WKG_FS='ext4'
WKG_DIR=''
INIT_DISTRO_VERSION=1.0.8
INIT_DISTRO_BINARY_COMPAT='oe'
INIT_DISTRO_COMPAT_VERSION='pyro'
INIT_DISTRO_TARGETARCH='amd64'
INIT_LANG='nl_NL.UTF-8'

# ls /dev/mmcblk0p2
/dev/mmcblk0p2
# ls /dev/mmcblk0p1
/dev/mmcblk0p1

# fdisk -l /dev/mmcblk0
Disk /dev/mmcblk0: 58,2 GiB, 62537072640 bytes, 122142720 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x02509f4a

Device Boot Start End Sectors Size Id Type
/dev/mmcblk0p1 * 2048 1310719 1308672 639M ef EFI (FAT-12/16/32)
/dev/mmcblk0p2 1310720 122142719 120832000 57,6G 83 Linux


EASYOS 1.0.11

BOOT_UUID='1D44-5E30'
BOOT_PARTNUM=1
BOOT_DIR=''
WKG_UUID='63f3c28c-159e-4e8a-8dfd-8899e402d2cc'
WKG_PARTNUM=2
WKG_DIR=''
INITRD_X_GUI='yes'

# ls /dev/mmcblk0p1
/dev/mmcblk0p1
# ls /dev/mmcblk0p2
/dev/mmcblk0p2

# blkid
/dev/mmcblk0p2: LABEL="easy2" UUID="63f3c28c-159e-4e8a-8dfd-8899e402d2cc" TYPE="ext4"
/dev/mmcblk0p1: LABEL="easy1" UUID="1D44-5E30" TYPE="vfat"
/dev/loop0: TYPE="squashfs"

UNQUOTE

For clarity. The boot-spec information of easyos 1.0.11 I have edited before the computer is rebooted. Yesterday, the computer failed during boot-up with specs as mentioned above for easy 1.0.11.

[Rodney Byne]

To Barry,
When in the containerized desk mode,
desktop shortcuts derived from /usr/share/applications
then dragged to desktop are wiped off and lost when the
laptop is rebooted.
This single-session use only is an impractical waste of time.

I would like to keep them, so can you overcome please
to not let that happen, thanks.
Regards.

[rufwoof]

To Barry,
When in the containerized desk mode,
desktop shortcuts derived from /usr/share/applications
then dragged to desktop are wiped off and lost when the
laptop is rebooted.
This single-session use only is an impractical waste of time.

I would like to keep them, so can you overcome please
to not let that happen, thanks.
Regards.

Attached are (all fake .gz, just rename them without the .gz suffix) for my modified 1.0 EasyOS setup

The first one, "easy" I've just copied into /usr/local/easy_containers and is used as the default easy file inside the container

The other two are modified versions of /usr/local/easy_containers/ec-chroot and /usr/sbin/easy-version-control.

With those mods, the easy container works really well. There are other files I've changed, making modifications to the easy desktop so changes are preserved as you'd expect both across restarts and when restored from a snapshot. For instance I've also modified snapshot restoration so that both the main and desktop snapshots are restored quicker, and that preserve the contents of /mnt/wkg/home inside the container.

Largely that's why I've stuck with 1.0 (made changes to get it working as I like, so I'd rather stick with that ... I also like the more extensive busybox as well in 1.0). Been using that as a daily boot quite heavily for a while now and with my changes its working great.

Clickable thumbnail of my Easy container desktop

(Usually I tend to have firefox and audacious maximised and alt-tab between them). Desktop background, icons are different to the main systems background/icons. For the observant I got the pmcputemp running in the container by adding into /root/.jwm/jwmrc-personal ...

Code: Select all

<StartupCommand>sleep 8s && pmcputemp</StartupCommand>

[rufwoof]

Also, rufwoof does some extra checking, see his post above.

Very crude intrusion detection, but better than nowt. In /root/Startup I added a intrusion-detect script
#!/bin/sh
sakura -e /usr/local/bin/intrusion-detection
(and made it executable)

After creating a snapshot of either the main system or easy container I rename that with a 00000000000000 date value, so I know they're my "clean" versions. I also create a md5sum of those (and another for the easy.sfs). I've also copied the MBR and stored that as mbr.bak, along with .bak versions of the grldr, initrd and vmlinuz.

So my /usr/local/bin/intrusion-detection script contains ...

Code: Select all

#!/bin/sh

# Rufwoof March 2019. Basic intrusion detection checks against
# mbr, grldr, vmlinux, initrd, easy.sfs, main desktop sfs, easy containers sfs

OK=0

cd /mnt/sda1/easy/easyremastered-1.0
echo "Intrusion detection checks -: Validating current versions matched expected"
echo

echo -n "  mbr ... "
dd if=/dev/sda of=mbr bs=512 count=1 >/dev/null 2>&1
T=`diff mbr mbr.bak`
[ ! -z "$T" ] && echo && echo "WARNING : mbr is different to expected" && echo "(dd of mbr differs to mbr.bak)" && OK=1 || echo OK

echo -n "  grldr ... "
T=`diff /mnt/sda1/grldr grldr.bak`
[ ! -z "$T" ] && echo && echo "WARNING : grldr is different to expected" && echo "(/grldlr differs to grldr.bak)" && OK=1 || echo OK

echo -n "  vmlinuz ... "
T=`diff /mnt/sda1/easy/easyremastered-1.0/vmlinuz /mnt/sda1/easy/easyremastered-1.0/vmlinuz.bak`
[ ! -z "$T" ] && echo && echo "WARNING : vmlinuz is different to expected" && echo "(vmlinuz differs to vmlinuz.bak)" && OK=1 || echo OK

echo -n "  initrd ... "
T=`diff /mnt/sda1/easy/easyremastered-1.0/initrd /mnt/sda1/easy/easyremastered-1.0/initrd.bak`
[ ! -z "$T" ] && echo && echo "WARNING : initrd is different to expected" && echo "(initrd differs to initrd.bak)" && OK=1 || echo OK

echo -n "  easy sfs : sfs/easyos/oe/pyro/easy_1.0_amd64.sfs ... "
if [ `head -c 10240 /mnt/sda1/easy/easyremastered-1.0/sfs/easyos/oe/pyro/easy_1.0_amd64.sfs | md5sum | awk '{print $1}'` != `cat /mnt/sda1/easy/easyremastered-1.0/sfs/easyos/oe/pyro/easy_1.0_amd64.sfs.md5` ];then 
	echo
	echo "  WARNING : checksum is different to expected"
	OK=1
else
	echo OK
fi

echo -n "  main snapshot : releases/easy-1.0/rw-00000000000000.sfs ... "
if [ `head -c 10240 /mnt/sda1/easy/easyremastered-1.0/releases/easy-1.0/rw-00000000000000.sfs | md5sum | awk '{print $1}'` != `cat /mnt/sda1/easy/easyremastered-1.0/releases/easy-1.0/rw.md5` ];then 
	echo
	echo "  WARNING : checksum is different to expected"
	OK=1
else
	echo OK
fi

echo -n "  containers snapshot : containers/easy/rw-00000000000000.sfs ... "
if [ `head -c 10240 /mnt/sda1/easy/easyremastered-1.0/containers/easy/rw-00000000000000.sfs | md5sum | awk '{print $1}'` != `cat /mnt/sda1/easy/easyremastered-1.0/containers/easy/rw.md5` ];then 
	echo
	echo "  WARNING : checksum is different to expected"
	OK=1
else
	echo OK
fi

echo
[ $OK -eq 0 ] && exit
echo -n "Press Enter "
read

I only check the first 10KB of sfs's as they're compressed so even a small change and re-compression would result in a significantly different byte series. Checking the first 10KB or so is more than enough for moderate detection and flashes through really quickly.

Very basic, but for a single user desktop setup .. infinitely better than nothing Nice to know at each boot that the mbr, grldr, vmlinuz, initrd, easy.sfs, main session save sfs and easy container sfs contents are all unchanged, and typically I restore both the main desktop save snapshot at each boot (so clean), as well as restoring the easy containers clean snapshot before I open it (so also clean).

The sakura flashes up after starting X and if all is well it just disappears, otherwise it holds the sakura terminal window open. So you get a visual indication that its run and its disappearance is indicative that it ran through OK.

Booting the same clean system that has been modified for your hardware/desires (and that can be further modified by booting clean, making the changes and reforming the 'clean' snapshot), along with validation that looks ok, combined with running internet facing programs inside the easy container, that is isolated your main systems 'data' access, pretty much covers the local end from remote hack security (I have little/no concerns as to local physical security). For online security I just run the latest patched firefox quantum (I install/use Fred's version of that), which auto updates (but does mean having to shutdown the container, restart a clean version of the container, let the updated firefox install and then close the container and recreate the 'clean' snapshot for that). I store all bookmarks in a file - that I set as the firefox home page. After logging into a online site, I always ctrl-shift-del after I'm done ... to clear out cache/etc (whenever prompted I never opt to have the browser save passwords) - so much lower prospect of cross site script hacking of stored userid's/passwords.

What with Xephyr isolating the containers X from the real root (main sessions) X, chroot with capabilities (including cap_sys_chroot) dropped, and unshare ... the EasyOS based hurdle for a hacker to compromise what is just a single user desktop system is high enough IMO. Whilst still being able to run everything as root (real root and what I call duff-root (root inside container, that is highly restricted)).

[rufwoof]

Consider this for example http://murga-linux.com/puppy/viewtopic. ... 79#1021079

flaw located in Google's FileReader, an application that is included in major browsers that lets the internet app access the contents of a PC.

EasyOS running the browser inside the easy container and ...yawn. Hacker gets to see inside of the container, no access to your data, running as root - but that is comparable to a highly restricted userid, where the likes of chroot capabilities are dropped so the hacker wont even succeed at chrooting out of the chroot ...etc. And if your browser cache is clean, with no passwords being stored ... nothing for the hacker there either. And attempts at installing a keylogger or whatever, would only persist for the single session only, that is if they could figure a way to install the keylogger. Attempts at watching or inserting commands into other 'root' X windows ... useless as Xephyr has the container X separate from the real root's X. Attack devices/ports .. and again they're only attacking whats inside the container, that will be all reset/lost when the clean snapshot of the container is restored.

[Rodney Byne]

To Barry,
I followed your instructions above to the letter.
After a reboot just in case, I now found that
maybe a link? is broken to the Easy desk container
so it won't run when clicked.
H-e-l-p please.
Regards.

[rufwoof]

To Barry,
I followed your instructions above to the letter.

@Rodney Byne. Did you mean me? Mine are examples only, that work in my HDD grub4dos frugal setup. If you've just dropped them into any other setup they likely wont work. Just roll back to your clean snapshot.

[Rodney Byne]

To Barry Kauler,
Sorry rufwoof, no I meant the main Barry Kauler.

After a mistake, I wiped the usb and started over.

I followed your instructions to the letter with the
three gz files applied above in the desk container.
But the shortcut icons created there still get wiped
on reboot.
So your mods didn't work for this particular case.
Regards.

[lp-dolittle]

@ Rodney Byne

are you sure your shortcut issue is not a keyboard layout issue?

Your problem, in a way, reminds me of my own keyboard layout setting which does not survive X-sever restarts. Does your keyboard layout differ from the default? If so, this might affect your shortcut settings, and your problem would arise not only after reboots but also after X-server restarts.

kind regards

[rufwoof]

Seeing some inconsistencies with aufs. If I create a sfs and have that loaded (or the devx), then prior changes I've made to EasyOS can be 'lost'.

Wondering whether EasyOS should perhaps be using overlayfs instead of aufs (with overlayfs you mount one or more sfs's into a read only stack, and combine that collective collective stack with the write directory ???

Would mean that both the main and container would have to share the same mountpoint for sfs(s) ???

[BarryK]

To Barry,
whoops sorry, I've just found from the petget download, SMPlayer
doesn't launch as it says the QT5 script is missing.

As happens I had QT5-5.10.1-pyro64.pet on a backup files usb,
so installed that and SMPlayer then ran OK.
Regards.

OK, I need to recompile smplayer. Gnome-mpv and VLC were fixed, but they might not work if you have that qt5 pet installed.

Done:

http://bkhome.org/news/201903/smplayer- ... -easy.html

[BarryK]

BOOT_UUID='1D44-5E30'
BOOT_PARTNUM=1
BOOT_DIR=''
WKG_UUID='63f3c28c-159e-4e8a-8dfd-8899e402d2cc'
WKG_PARTNUM=2
WKG_DIR=''
INITRD_X_GUI='yes'

OK, perhaps it is the 'init' script in initrd, that now cannot handle "mmcblk*" device names. I will check the code, and do a test install to mmc memory on the Mele.

[BarryK]

To Barry,
In 1.0.11,
Firefox downloaded from the repository doesn't
run when its desktop "New" container is clicked.

Incidentally this 64.0 is an old version and repository
should be updated to a Quantum 65.0.1

Let's hope 1.0.12 is better.

Regards.

There is a bug in firefox. After failing to start, look at /mnt/wkg/containers/firefox/.session/tmp/xerrors-firefox.log

This is what I got:

Code: Select all

process 21: arguments to dbus_move_error() were incorrect, assertion "(dest) == NULL || !dbus_error_is_set ((dest))" failed in file ../../dbus-1.10.14/dbus/dbus-errors.c line 282.
This is normally a bug in some application using the D-Bus library.
  D-Bus not built with -rdynamic so unable to print a backtrace
Redirecting call to abort() to mozalloc_abort

ExceptionHandler::GenerateDump cloned child 116
ExceptionHandler::WaitForContinueSignal waiting for continue signal...
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
Exiting due to channel error.

I will try the latest firefox.

[BarryK]

Firefox 65.0.2 is working for me in container:

http://bkhome.org/news/201903/firefox-s ... -6502.html

[BarryK]

Barry,

Could you compile Hiawatha with xslt support. This would allow it to produce the directory index in HTML. Then it would be compatible with sfsget.

Thanks

Hiawatha does have xslt support:

Code: Select all

# ldd ./hiawatha 
	linux-vdso.so.1 (0x00007ffec45a3000)
	libcrypt.so.1 => /lib/libcrypt.so.1 (0x00007ff9c8c63000)
	libpthread.so.0 => /lib/libpthread.so.0 (0x00007ff9c8a46000)
	libz.so.1 => /lib/libz.so.1 (0x00007ff9c8830000)
	libmbedtls.so.10 => /usr/lib/hiawatha/libmbedtls.so.10 (0x00007ff9c860a000)
	libmbedx509.so.0 => /usr/lib/hiawatha/libmbedx509.so.0 (0x00007ff9c83f7000)
	libmbedcrypto.so.0 => /usr/lib/hiawatha/libmbedcrypto.so.0 (0x00007ff9c81a7000)
	libxml2.so.2 => /usr/lib/libxml2.so.2 (0x00007ff9c7e5e000)
	libxslt.so.1 => /usr/lib/libxslt.so.1 (0x00007ff9c7c24000)
	libc.so.6 => /lib/libc.so.6 (0x00007ff9c7891000)
	/lib/ld-linux-x86-64.so.2 (0x00007ff9c8e9a000)
	libdl.so.2 => /lib/libdl.so.2 (0x00007ff9c768d000)
	libm.so.6 => /lib/libm.so.6 (0x00007ff9c7380000)

[BarryK]

Someone reported that youtube-dl does not work. It does, I just tested it.

[BarryK]

Downloaded easy-1.0.11-amd64.img.gz 2019-Mar-08 16:08:47. (latest update?)

Running easyOS 1.0.8. Did open the new image file (easy-1.0.11) by clicking two times. Copied the 3 files to the boot partition.
Manualy edit the initird file wit the correct UUID's for boot and the working partition.

Rebooted the computer. During bootup the boot and working partition are recognized. The screens regarding the language/keyboard and pasword setiing appears.

Then it stops....

I have attached a jpg file with the error.

Currently I'm switching back to easyos 1.0.8.

The information that you are providing is confusing me.

According to the jpg snapshot, as attached on page 95, your boot-partition is sda1 and working-partition is sda2.

However, in a later post you have said that you are updating an installation in mmcblk0

[blgs]

Downloaded easy-1.0.11-amd64.img.gz 2019-Mar-08 16:08:47. (latest update?)

Running easyOS 1.0.8. Did open the new image file (easy-1.0.11) by clicking two times. Copied the 3 files to the boot partition.
Manualy edit the initird file wit the correct UUID's for boot and the working partition.

Rebooted the computer. During bootup the boot and working partition are recognized. The screens regarding the language/keyboard and pasword setiing appears.

Then it stops....

I have attached a jpg file with the error.

Currently I'm switching back to easyos 1.0.8.

The information that you are providing is confusing me.

According to the jpg snapshot, as attached on page 95, your boot-partition is sda1 and working-partition is sda2.

However, in a later post you have said that you are updating an installation in mmcblk0

Both are correct.

sda1 and sda2 is the usb stick. mmcblk is the drive in my netbook. Installation on my netbook fails every time.

I managed to install it on a usb stick but after one or two reboots the same error occurs.

Version 1.0.8 operates perfectly.

[lp-dolittle]

Hi Barry,

thank you for your comment on the 'snapshot alternative' which can provide the same security as the former 'running totally in RAM option' that required the usb-stick only for booting and saving!

Sorry for spotting another problem!

What about the continuously ongoing flickering of the flash stick's light (that does not stop even if the OS seems to be 'idle'), in view of your previous warning remarks about the sticks' limited durability (ca. 1000 read/write cycles, indeed managed by appropriate firmware) and also about the risk of damaging interfaces by some usb-sticks whose firmware uses to run hot?

kind regards

[don570]

mypaint appimage ran well in EasyOS 1.0.11, March 8, 2019

https://github.com/mypaint/mypaint/releases

It worked well with GIMP as the external editor.
___________________________________________________