Discuss August 2020

discuss@lists.centos.org

95 participants
63 discussions

CentOS Security Advisories OVAL feed??
by centos＠niob.at 05 Aug '20

05 Aug '20

Dear List, I have spent some time playing around with oscap and the RHEL OVAL feed (https://www.redhat.com/security/data/oval/v2/RHEL8/, also check Chapter 16 of the RHEL 8 Design Guide). Because I could not find an existing OVAL file for CentOS, I downloaded one of the RHEL8 files and managed to modify (eg. the rhel-8.1-e4s.oval.xml) it to make it work on a CentOS machine. Basically I just had to change the package signing key check to use the CentOS key and I had to replace the redhat-release RPM package name with "centos-release". Obviously, this would violate all kinds of rights if redistributed, due to the fact that the upstream vendor is named all over the place, but technically it "worked". On an internal system running a freshly updated CentOS 8.1 system I ended up with three errors, titled: * RHSA-2019:4269: container-tools:rhel8 security and bug fix update (Important) * RHSA-2019:3403: container-tools:rhel8 security, bug fix, and enhancement update (Important) * RHSA-2019:2799: nginx:1.14 security update (Important) This raises some questions (some of them connected), namely: Q1) There are no equivalent CESA advisories for those RHSA advisories: why is that? Note that there are also no equivalent CentOS packages to those mentioned in the RHSA advisories. (My guess: because, when the advisories where issued, Centos already had moved on to 8.2) Q2) Does this indicate a problem in the release process / handling of upstream updates on the side of the CentOS project? Were the advisories missed at the time of issuance? Q3) Does this indicate that only the latest CentOS (minor) release can be considered "secure" or "patched"? Q4) Is there a native OVAL file released from the CentOS project covering these issues? It could be extremely similar to the RHEL one, but it should take the answers to the above questions into account (eg. it could require the latests minor-release and there would only be one file for CentOS 8 if the answer to Q3 is "yes"). Q5) If the answer to the last question is "no": shouldn't there be such a resource? Thanks for any answers. peter

5 8

Announcing the version 1.0 hexpeek release!
by hexpeek＠hexpeek.com 05 Aug '20

05 Aug '20

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Announcing the version 1.0 hexpeek release! I am pleased to announce the first stable release of hexpeek, which seeks to be an efficient, powerful, and portable hex editor for files of all kinds and sizes. This release improves on the beta release with a live undo, a greatly increased backup depth, better support for writing to non-seekable files, and some miscellaneous cleanup. Visit https://www.hexpeek.com for more information. Out of respect for the bandwidth on this mailing list, I do not plan to announce future hexpeek releases here. There is a mailing list on https://www.hexpeek.com where future announcements will be posted. If you are interested in hexpeek becoming a package/port for your distro, please let me know. -----BEGIN PGP SIGNATURE----- iQJIBAEBCgAyFiEEfeRsn/lRU2hTiGbecMFr/kefAX8FAl8qMysUHGhleHBlZWtA aGV4cGVlay5jb20ACgkQcMFr/kefAX9U9w//QlTM/zrd25att9/yYcqbQPkDAqhr sjCtSfMoY6sLlsI1IFR1GDu0v0l+TiW4R2iDDn8dD7esLBrhHXe+QLWd9OjioCF7 jB3Tpg+ozk9GMmwDFglbU6hiwTAM4w7O4NKrLEuR/kQoWZzweEXGjIV2ytWhCpps tsl3c/t2rSG0SqlhcHrQpy0uZ38v7f7+o3BCH23gqzdAW+mvvPC9iYLfYJqUGDRt fc5zmouLai9ZAARpqK3Mhu/RTlv8DnxpmsIt2cSJ6OFVbonKBqvDk1RFbLqSUwhU iJv+wMF97f2HT7g1RCNG+GGClD0TvceFP+8qhwIYUhBaRXLe1u+gEEqXvmlURd0h m77ydS58Z1ND1YGw01rTTBzDxnW21HHTFCqGHfRKOjVcLEQrt8CkTvcf7tM5fX+n fodXdEv8k8rrhbOYDyWqurdekWPZCrvrzEPuF+Ww/W6ownW8RwP2cgNccfOiuC2P dTJdIe5j4VASLtC17iUcwDiQuZYWdK5oBlf/ws9flInFHOlGVUGXuD1pum05Iq1u OZeJEHJj+yvP1drm4A1O8z3r8XfPa2WmWsQBc0TP8lOvU3l/E20p1T3TPs8EQbqA dRJyN1PcAv63DE0USa2P+tB18jZkvDV15YT/6yDkOtKEgIdtSsw6H5oscs96LfuI cKK++c04aRN9e28= =02ro -----END PGP SIGNATURE-----

2 1

Re: [CentOS] Safe to do yum update now?
by Marc Balmer 04 Aug '20

04 Aug '20

> Am 04.08.2020 um 17:59 schrieb Jerome Lille <jerome.lille(a)ownbay.net>: > > Hello > > Luckily I was not afflicted by this boot hole problem. I haven't done > yum update in a week or so. I just want to make sure that now it is > safe to do yum update? It is. > > /Jerome > > _______________________________________________ > CentOS mailing list > CentOS(a)centos.org > https://lists.centos.org/mailman/listinfo/centos

1 0

Safe to do yum update now?
by Jerome Lille 04 Aug '20

04 Aug '20

Hello Luckily I was not afflicted by this boot hole problem. I haven't done yum update in a week or so. I just want to make sure that now it is safe to do yum update? /Jerome

1 0

Re: [CentOS] Boot failed on latest CentOS 7 update
by david 03 Aug '20

03 Aug '20

At 12:50 PM 8/1/2020, Kay Schenk wrote: >Totally and completely on my HP microfiber. Wouldn't get past anything to >even get me into the grub menu. NOT AMUSED! > >_______________________ >Kay Schenk I was going to confirm the same, but the system that became unbootable was my mail system :-( Apparently, the SHIM/GRUB bug has hit both Centos 7 and 8. Too bad Ubuntu is enough different that makes it hard to switch. David

21 38

Re: [CentOS] 8.2.2004 Latest yum update renders machine unbootable
by david 03 Aug '20

03 Aug '20

At 02:54 AM 8/1/2020, Alessandro Baggi wrote: >Hi Johnny, >thank you very much for clarification. > >You said that in the centos infrastructure only one server got the problem. >What are the conditions that permit the breakage? There is a particular >configuration (hw/sw) case that match always the problem or it is random? > >Thank you I have two servers running Centos 7 on apple hardware (one mac-mini and one mac server). They both failed to reboot a few days ago. So perhaps whatever anti-boot bug hit Centos 8, also hit Centos 7. I can't tell what version got updated since the system simply fails to boot. I don't even get a grub screen. I'll have to rebuild the systems from scratch. David

12 27

8.2.2004 Quick recovery and fix for unbootable machines
by Alan McRae 03 Aug '20

03 Aug '20

This is a quick recovery and fix for the machines rendered unbootable after the grub2/shim yum update. It is written for CentOS 8.2.2004 but similar should work for any CentOS 8 or 7 as long as you get the correct shim file, that is, the one from the latest installation media. I am running on an x86_64 architecture (see uname -i). Please use the correct shim file for your architecture (shim-<arch>-15-11.el8.<arch>.rpm) I have tested this by breaking a machine and then recovering it. It works for me. I hope someone finds it useful. Let me know. Regards Alan HOW TO BOOT AN UNBOOTABLE MACHINE ================================= 1) Download a copy of rEFind. This is a UEFI boot manager. Burn it to a USB key. # wget -O refind.zip http://sourceforge.net/projects/refind/files/0.12.0/refind-flashdrive-0.12.… # unzip refind.zip # cd refind-flashdrive-0.12.0 # dd if=refind-flashdrive-0.12.0.img bs=4096 of=/dev/sdX (sdX is the device for your USB key, this will be erased, use the whole device use sdX not sdX1) 1800+0 records in 1800+0 records out 7372800 bytes (7.4 MB, 7.0 MiB) copied, 0.980893 s, 7.5 MB/s 2) Turn off secureboot in your UEFI hardware. 3) Boot the USB key. You should get a colourful screen with icons and a filename below. Use the left/right arrow keys to select the correct grubx64.efi. Hit space to boot. Your usual grub menu should appear and the system should boot normally. HOW TO FIX THE PROBLEM ===================== 1) We need to downgrade the shim package. Now your system is running get an older copy of the correct shim package for your architecture from the CentOS installation media (e.g. CentOS-8.2.2004-x86_64-dvd1.iso) and install it. # mount CentOS-8.2.2004-x86_64-dvd1.iso /mnt # cd /mnt/BaseOS/Packages # cp shim-x64-15-11.el8.x86_64.rpm /root # cd /root # umount /mnt OR Get the package from a CentOS mirror: # cd /root # wget http://ucmirror.canterbury.ac.nz/linux/CentOS/8.2.2004/BaseOS/x86_64/os/Pac… 2) We can now reinstall the older shim package using yum. This will downgrade the package to the working version. # yum install shim-x64-15-11.el8.x86_64.rpm Last metadata expiration check: 2:11:11 ago on Sun 02 Aug 2020 11:31:06 NZST. Dependencies resolved. ==================================================================================================================================================================================== Package Architecture Version Repository Size ==================================================================================================================================================================================== Downgrading: shim-x64 x86_64 15-11.el8 @commandline 647 k Transaction Summary ==================================================================================================================================================================================== Downgrade 1 Package Total size: 647 k Is this ok [y/N]: y Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Downgrading : shim-x64-15-11.el8.x86_64 1/2 Cleanup : shim-x64-15-13.el8.x86_64 2/2 Verifying : shim-x64-15-11.el8.x86_64 1/2 Verifying : shim-x64-15-13.el8.x86_64 2/2 Installed products updated. Downgraded: shim-x64-15-11.el8.x86_64 Complete! 3) Your system should now boot normally. 4) add "exclude=shim*" to /etc/yum.conf to prevent the broken one being reinstalled. You should now be able to run 'yum update'. Remove the exclude= when a proper fix becomes available.

5 5

GUI boot failure after latest shim (etc) updates
by Fred Smith 03 Aug '20

03 Aug '20

This isn't the problem everyone else has been talking about, but... I made sure that yum update offered the packages Johnny said it should then updated. when I rebooted everything looked normal except it was taking a long time to bring up the login screen. Flipped over to ALT-F2 and saw a message about waiting for Plymouth boot screen to quit. I waited a while and it went up to (and past) 15 minutes. It said "no limit" so it apparently would have gone on forever. I couldn't get to a text-mode screen with ALT-f[2-6] so I went down to my Linux laptop to see if I could ssh into this box. Lo and behold, ssh worked fine. So I ran top and saw a plymouth (or plymouthd, I forget which) at the top of the list. killed it, came back upstairs and it was no longer spewing that message. now ALT-f2 gave me a text login, that I'm using now. I ran startx and after a long-seeming wait I get a desktop, but it is NOT my normal Mate desktop. Might be Gnome (since I installed a Centos Gnome system and retrofitted Mate from EPEL). Johnny had said we needed to make sure the kernel was installed along with the shim, et al. I looked at the list of files YUM wanted to install and saw some kernel files, so I assumed all was well. But maybe I missed something. What info can I provide to help figure this out? Or, what Kernel files should I force to be (re)installed? Also, I don't very often manually force a kernel install, but I know that some of the files are updates and some are installs, I'd appreciate a reminder of which is which so I can force it. Thanks in advance! Fred -- ---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us ----------------------------- The eyes of the Lord are everywhere, keeping watch on the wicked and the good. ----------------------------- Proverbs 15:3 (niv) -----------------------------

1 0

Re: [CentOS] 8.2.2004 Latest yum update renders machine unbootable
by david 02 Aug '20

02 Aug '20

At 07:57 AM 8/2/2020, you wrote: >On Sun, 2 Aug 2020 at 10:20, david <david(a)daku.org> wrote: > > > > > > ><snip> > > > > > > > > > > > >> Yes .. it should be on mirror.centos.org now .. you could change the > > > >> repo where your updates come from.Ã OR > .. wait for that mirror to get > > > >> updated. > > > > > > > > > > > > I just did > > > > yum clean all > > > > yum update > > > > > > > > and 15-8 showed up.Ã Maybe the 'clean all' > > > did it, or maybe just showed up. > > > > > > > > I applied the update (yum update), rebooted and... > > > > no boot.Ã Just a blank screen. > > > > > > > > Hardware is a Mac-Mini :-( > > > > > > > > This is not an essential machine, so I could re-install (from > > > > netinstall) if you think it's worth the effort. > > > > > > > > Or what? > > > > > > > > David > > > > > >You just need to reinstall the kernel and it should work. > > > > > > > Sorry for being so ignorant, but I don't > > understand "just reinstall the kernel". I don't > > know how to translate that into a specific yum or rpm command. > >I agree it is a lot of shorthand because of expectations. In the end >we (the list) don't know what you have on your system or what state it >is in. In order to get that information to help we would need you to >try the following: > >1. boot using a working USB/cdrom/netboot path and installer >2. choose the rescue mode >3. have the rescue mount the disks as local and chroot into the >system. << if possible have the system also bring up networking >> > >Then >yum list kernel shim grub2 mokutil > >It would also help to know which kind of Mac Mini it is (year, model, >firmware versions). Apple changes the internal hardware of these >things and how they boot so if there it may be that a particular model >is more affected than others. How does one obtain that information? There's nothing written on the box. David

2 1

Re: [CentOS] 8.2.2004 Latest yum update renders machine unbootable
by david 02 Aug '20

02 Aug '20

><snip> > >> Yes .. it should be on mirror.centos.org now .. you could change the > >> repo where your updates come from.Â OR .. wait for that mirror to get > >> updated. > > > > > > I just did > > yum clean all > > yum update > > > > and 15-8 showed up.Â Maybe the 'clean all' > did it, or maybe just showed up. > > > > I applied the update (yum update), rebooted and... > > no boot.Â Just a blank screen. > > > > Hardware is a Mac-Mini :-( > > > > This is not an essential machine, so I could re-install (from > > netinstall) if you think it's worth the effort. > > > > Or what? > > > > David > >You just need to reinstall the kernel and it should work. Sorry for being so ignorant, but I don't understand "just reinstall the kernel". I don't know how to translate that into a specific yum or rpm command. However, since this is a crash-and-burn system, I'm going back to a virgin install with netinstall of 7 2003. I'll let you know what the results are. --------------- On a Mac-Mini, which got hit by the bug in shim, I re-installed Centos 7 2003 from netinstall, selecting minimal as the software selection. The reboot worked fine. So, I next tried "yum -y update", noticed shim 7-8 got selected. However, at the completion of the update, I did a reboot and got a blank screen. No grub choices. Not good. David

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss August 2020