No description
CroneKorkN
656be1cf69
Discovered post-deploy: ProcSubset=pid hides /proc/sys/kernel/random/boot_id
which journalctl reads at startup. The web app invokes
`sudo -n left4me-journalctl` to stream live server logs into the UI;
journalctl bails with "Failed to get boot ID" before producing any
output. Web log streaming was silently broken.
Server unit keeps ProcSubset=pid (srcds doesn't invoke journalctl);
web unit drops it. ProtectProc=invisible remains in COMMON — that's
the load-bearing D4 defense (foreign-uid /proc hidden).
Reproducer that confirms the diagnosis:
systemd-run --pipe --uid=left4me --gid=left4me \
-p ProcSubset=pid -p ProtectProc=invisible \
-p ProtectSystem=strict -p PrivateTmp=true \
[...rest of web hardening...] \
-- sh -c 'sudo -n left4me-journalctl 2 --lines 3 --follow >/var/lib/left4me/tmp/out 2>&1'
# cat /var/lib/left4me/tmp/out → "Failed to get boot ID: No such file or directory"
# rc → 1
With ProcSubset=all: timeout 124 (helper running), 3 lines streamed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| bin | ||
| bundles | ||
| data | ||
| doc | ||
| docs | ||
| groups | ||
| hooks | ||
| items | ||
| libs | ||
| nodes | ||
| .editorconfig | ||
| .envrc | ||
| .gitignore | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| groups.py | ||
| hass_get_temp.py | ||
| nodes.py | ||
| README.md | ||
| requirements.txt | ||
TODO
- dont spamfilter forwarded mails
- gollum wiki
- blog?
- fix dkim not working sometimes
- LDAP
- oauth2/OpenID
- icinga
Raspberry pi as soundcard
- gadget mode
- OTG g_audio
- https://audiosciencereview.com/forum/index.php?threads/raspberry-pi-as-usb-to-i2s-adapter.8567/post-215824
monitor timers
Timer=backup
Triggers=$(systemctl show ${Timer}.timer --property=Triggers --value)
echo $Triggers
if systemctl is-failed "$Triggers"
then
InvocationID=$(systemctl show "$Triggers" --property=InvocationID --value)
echo $InvocationID
ExitCode=$(systemctl show "$Triggers" -p ExecStartEx --value | sed 's/^{//' | sed 's/}$//' | tr ';' '\n' | xargs -n 1 | grep '^status=' | cut -d '=' -f 2)
echo $ExitCode
journalctl INVOCATION_ID="$InvocationID" --output cat
fi
telegraf: execd for daemons
TEST
git signing
git config --global gpg.format ssh git config --global commit.gpgsign true
git config user.name CroneKorkN git config user.email i@ckn.li git config user.signingkey "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILMVroYmswD4tLk6iH+2tvQiyaMe42yfONDsPDIdFv6I"