The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

«‹›1040 »

Bozza: Mar 5, 2004; "I'm a really useful engine!"

unruly posted:

Install ufw or firewalld. loving around with nftables or iptables is for greybeards. On a machine that travels, it's not worth the headache.

is it as simple as that? (skim) reading the wiki on this it seems I configure the default to be the "public" profile (assuming this is the most secure) and then my home wifi to "home" and done?

told you it might be a stupid question..! ta

# ? Aug 8, 2023 22:16

Adbot: ADBOT LOVES YOU

# ? Jun 10, 2024 14:12

unruly: May 12, 2002; YES!!!

Bozza posted:

is it as simple as that? (skim) reading the wiki on this it seems I configure the default to be the "public" profile (assuming this is the most secure) and then my home wifi to "home" and done?

told you it might be a stupid question..! ta

Yeah, more or less. I mean, you have to systemctl enable them, but the defaults are pretty good. I think ufw is everything inbound off. Firewalld has some profiles (like you saw) that work with NetworkManager profiles.

# ? Aug 8, 2023 22:22

Bozza: Mar 5, 2004; "I'm a really useful engine!"

brill, thanks so much!

# ? Aug 8, 2023 22:36

cruft: Oct 25, 2007

unruly posted:

Install ufw or firewalld. loving around with nftables or iptables is for greybeards. On a machine that travels, it's not worth the headache.

This is good advice.

# ? Aug 9, 2023 00:01

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

Anyone know of a good �immutable� distro for ARM (Pi4)? I�d kinda like to try that for �appliance� maintenance on a project server.

# ? Aug 9, 2023 00:10

cruft: Oct 25, 2007

Subjunctive posted:

Anyone know of a good “immutable” distro for ARM (Pi4)? I’d kinda like to try that for “appliance” maintenance on a project server.

I know a few "technically it is reported to work" ones

Fedora CoreOS
Flatcar Container Linux
BalenaOS
Alpine has some sort of Read-Only mode

I've only tried Flatcar and was unable to get it to display any kernel messages on the monitor. Maybe the kernel booted, maybe not. Probably not. But it was not the PiOS "dd an SD card and plug it in" experience I was hoping for.

cruft fucked around with this message at 00:24 on Aug 9, 2023

# ? Aug 9, 2023 00:18

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

Thanks, maybe I�ll give Fedora a spin.

# ? Aug 9, 2023 03:07

Nitrousoxide: May 30, 2011; do not buy a oneplus phone

cruft posted:

I know a few "technically it is reported to work" ones

Fedora CoreOS
Flatcar Container Linux
BalenaOS
Alpine has some sort of Read-Only mode

I've only tried Flatcar and was unable to get it to display any kernel messages on the monitor. Maybe the kernel booted, maybe not. Probably not. But it was not the PiOS "dd an SD card and plug it in" experience I was hoping for.

IoT might be a better pick for a bare metal install on a Pi4.
https://fedoraproject.org/iot/

The ignition file requirement for CoreOS makes installing it outside of the cloud or VMs kind of a pain.

You can also replicate the auto updates of CoreOS with this
https://discussion.fedoraproject.org/t/how-to-actually-enable-automatic-updates-in-fedora-iot/77061/3

# ? Aug 9, 2023 03:47

MrPablo: Mar 21, 2003

Bozza posted:

Potentially an absolutely stupid question but looking for some advice wrt firewalls

It's not a stupid question; everyone has to start somewhere.

Bozza posted:

I've got a relatively fresh arch install which I've been dicking about with but working through the tips on the wiki I've neglected to install a firewall. tbh most of the time I'm in my house so sat behind my router firewall and therefore not really that bothered. however I do occasionally use my laptop when I go away for work (for personal use, have a work laptop so there's nothing "sensitive" on it as such) so thought I'd beef it up a bit.

In classic arch-wiki style, the nftables / iptables pages are absolutely impenetrable to a newbie and beyond just bumbling my way through a badly configured copy/paste install I would just like to know the following questions:

- is it actually worth installing a linux firewall in 2023? there were some posts on reddit/stackoverflow/assorted blogs saying that they are fundamentally security theatre if you have disabled/not installed anything that can connect externally

Yes a firewall on a laptop is a good idea and no it's not security theater. The router firewall protects you from malicious traffic outside your home network, but a router firewall does nothing to protect your laptop if you connect it to a network outside the house (wifi at a coffee shop, airport, hotel, etc).

A router firewall also does not protect your laptop from malicious traffic inside your home network. Examples of how someone might breach a home network: an unpatched IoT device (e.g. "smart" devices like light bulbs, robot vacuums, doorbells, etc), an old printer, an IP camera, a smart TV, etc.

Many, many years ago we moved a work machine from a lab into a "more secure" data center. The instant I connected the machine to the data center network, I noticed some suspicious dropped traffic in the system log. I showed the suspicious traffic to the data center technicians and they went off to investigate. It turns out that a machine on the data center network had been compromised, and whoever had gotten in was scanning the network looking for additional machines to break into.

I guess my point is that even trusted networks can end up compromised, and a firewall is a great way of reducing your attack surface and increasing the visibility of suspicious network activity.

Bozza posted:

- same question again but I have wireguard configured to connect back to my home router via VPN so theoretically same level of protection I have sat on my sofa. just leave it in VPN and all hunky dory?

I'm not really sure what question you're asking here, but I can confirm that WireGuard is a fantastic VPN.

Bozza posted:

- if the to the above is still yes, it is worth installing: is there a total fuckwits guide to setting up either iptables/nftables, or which one is better, and how to understand what ports etc I want open/closed?

I agree with the other comments; it's easier to start off with something less fiddly like ufw or firewalld.

If you decide to be a sadist and use iptables or nftables, they each have their pros and cons:

iptables: Pros: Has existed for much longer than nftables, far easier to find documentation, some software plays nicer with iptables. Cons: Much slower to apply rules than nftables, rule changes are not atomic (e.g. if an iptables script fails half-way through then it will leave your firewall in an indeterminite state), often requires annoying shell scripting for complicated rule sets.
nftables: Pros: Newer, faster than iptables (both applying rules and interpreting the rules themselves), atomic commits, syntax is more amenable to matching multiple protocols (e.g. rule that matches ipv4 and ipv6 traffic), the syntax supports data structures (sets, lists, etc). Cons: Less documentation, occasionally does not support iptables features (or it does, but in a different way).

Personally I have a mixture of both iptables and nftables. I use iptables on older systems that are working fine and I don't want to mess with, and I use nftables on newer systems. If you are interested, I have some commented laptop and server nftables firewalls here.

The ports that you would want open/closed vary depending on your use case, but here are some general rules of thumb:

Default deny, particularly for inbound traffic. In iptables/nftables parliance: set the policy for your input chain to DROP, and then allow the traffic that you want.
Immediately allow all loopback traffic at the top of your input chain or you will have problems.
Use a stateful firewall (connection tracking).
Prefer DROP to REJECT. REJECT leaks information about a destination address to a port scanner. Specifically it tells the scanner that the destination address exists and is not hosting traffic on the given destination port. DROP slows a port scanner down because it forces the scanner to find a valid port before it can determine if the destination address is valid. (Aside: one of the reasons WireGuard is awesome is that it won't respond to incoming unauthenticated clients, which makes it immune to network scanners).
Log dropped traffic. It can alert you to suspicious activity and it is a useful tool for debugging troublesome rules.
Know the commands to list your rules and reset your rules (and policy); you will make a mistake and end up using both of these commands.
Filtering outbound traffic on a desktop machine can extremely frustrating because modern desktop applications are extremely chatty.

Bozza posted:

Arch wiki recommends the following for nftables but I can vaguely follow it. Is this all I need really and good to go? I mostly just use my laptop for watching YouTube and chatting on Discord so don't have massive need for loads of weird ports open but would be useful to see if I try and run something in the future and it bumps off it where I can find out who/what/why it did that and how to add info.

The arch example you pasted seems like a reasonable starting point for a laptop firewall. In response to this comment: "where I can find out who/what/why it did that and how to add info":

One change I would make to the Arch example you provided would be on the last line of the "my_input" chain. I would change that line from this:

code:

counter comment "Count any other traffic"

to this:

code:

# log dropped traffic
log prefix "DROP "

counter comment "Count any other traffic"

The "log" line logs dropped input traffic to the system log (which you can monitor with "sudo journalctl -f"). There is a screenshot of the nftables DROP entries in the system log on my nftables examples page.

Bozza posted:

code:

/etc/nftables.conf

flush ruleset

table inet my_table {
	set LANv4 {
		type ipv4_addr
		flags interval

		elements = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
	}
	set LANv6 {
		type ipv6_addr
		flags interval

		elements = { fd00::/8, fe80::/10 }
	}

	chain my_input_lan {
		udp sport 1900 udp dport >= 1024 meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"

		udp sport netbios-ns udp dport >= 1024 meta pkttype unicast accept comment "Accept Samba Workgroup browsing replies"

	}

	chain my_input {
		type filter hook input priority filter; policy drop;

		iif lo accept comment "Accept any localhost traffic"
		ct state invalid drop comment "Drop invalid connections"
		ct state established,related accept comment "Accept traffic originated from us"

		meta l4proto ipv6-icmp accept comment "Accept ICMPv6"
		meta l4proto icmp accept comment "Accept ICMP"
		ip protocol igmp accept comment "Accept IGMP"

		udp dport mdns ip6 daddr ff02::fb accept comment "Accept mDNS"
		udp dport mdns ip daddr 224.0.0.251 accept comment "Accept mDNS"

		ip6 saddr @LANv6 jump my_input_lan comment "Connections from private IP address ranges"
		ip saddr @LANv4 jump my_input_lan comment "Connections from private IP address ranges"

		counter comment "Count any other traffic"
	}

	chain my_forward {
		type filter hook forward priority filter; policy drop;
		# Drop everything forwarded to us. We do not forward. That is routers job.
	}

	chain my_output {
		type filter hook output priority filter; policy accept;
		# Accept every outbound connection
	}

}

thanks goons

Edit: Fix typos.

MrPablo fucked around with this message at 08:13 on Aug 9, 2023

# ? Aug 9, 2023 07:59

NihilCredo: Jun 6, 2011; iram omni possibili modo preme:
plus una illa te diffamabit, quam multæ virtutes commendabunt

Subjunctive posted:

Anyone know of a good “immutable” distro for ARM (Pi4)? I’d kinda like to try that for “appliance” maintenance on a project server.

I'm using Fedora IoT on my Pi. It is smooth sailing and I can reuse all my knowledge from my Silverblue PCs.

A single warning: whatever you use the Pi for, make sure it starts automatically on a reboot, 'cause with immutable distros you'll have to reboot to deploy updates.

# ? Aug 9, 2023 09:39

Bozza: Mar 5, 2004; "I'm a really useful engine!"

MrPablo posted:

A router firewall also does not protect your laptop from malicious traffic inside your home network. Examples of how someone might breach a home network: an unpatched IoT device (e.g. "smart" devices like light bulbs, robot vacuums, doorbells, etc), an old printer, an IP camera, a smart TV, etc.

Many, many years ago we moved a work machine from a lab into a "more secure" data center. The instant I connected the machine to the data center network, I noticed some suspicious dropped traffic in the system log. I showed the suspicious traffic to the data center technicians and they went off to investigate. It turns out that a machine on the data center network had been compromised, and whoever had gotten in was scanning the network looking for additional machines to break into.

I guess my point is that even trusted networks can end up compromised, and a firewall is a great way of reducing your attack surface and increasing the visibility of suspicious network activity.

You'll be pleased to know that all my internet of things devices are segregated off into a VLAN so hopefully none of that! I think it's even called InternetOfPiss

quote:

I'm not really sure what question you're asking here, but I can confirm that WireGuard is a fantastic VPN.

It was that if I log into hotel WiFi but am always using Wireguard I'm basically back behind my home router again therefore no concerns but you covered that above so will [spoiler]have[/quote] install one

quote:

I agree with the other comments; it's easier to start off with something less fiddly like ufw or firewalld.

If you decide to be a sadist and use iptables or nftables, they each have their pros and cons:

snip

I think I'm going to get it all set up and running with firewalld then probably have a play round with nftables before I inevitably break it.

Thanks so much for the detailed explanation, it's useful as a learner.

# ? Aug 9, 2023 11:54

Saukkis: May 16, 2003; Unless I'm on the inside curve pointing straight at oncoming traffic the high beams stay on and I laugh at your puny protest flashes.
I am Most Important Man. Most Important Man in the World.

Bozza posted:

It was that if I log into hotel WiFi but am always using Wireguard I'm basically back behind my home router again therefore no concerns but you covered that above so will have install one

Wireguard covers all your outgoing traffic, but I'm not sure if it helps with services listening on interfaces. Run the command 'ss -lptu' and check if you have any processes listening on Local Address "0.0.0.0:", "*:", or "[::]:". Those might be accessible even with Wireguard running.

# ? Aug 9, 2023 12:16

notwithoutmyanus: Mar 17, 2009

Okay, wiped my machine. Fresh ubuntu install since I'm not 100% on top of everything. I'm trying to get RDP or VNC to be able to connect.

Did amdgpu-install and selected all driver options there in case whatever is needed, enabled sharing and tried to remote desktop from android's microsoft remote desktop app. Tried to VNC to the machine, and won't take the same password that RDP did. When I tried to RDP, it would connect but graphically it would bug out. What logs can I check for these scenarios, is there something other than /var/log/auth.log?

code:

Aug 10 14:29:01 BOX sudo: pam_unix(sudo:auth): authentication failure; logname= uid=1000 euid=0 tty=/dev/pts/0 ruser=(username) rhost=  user=(username)
Aug 10 14:29:09 BOX sudo: (username) : TTY=pts/0 ; PWD=/home/(username) ; USER=root ; COMMAND=/usr/bin/nano /etc/hosts
Aug 10 14:29:09 BOX sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000)
Aug 10 14:30:01 BOX CRON[122673]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Aug 10 14:30:01 BOX CRON[122673]: pam_unix(cron:session): session closed for user root
Aug 10 14:36:40 BOX gnome-keyring-daemon[1562]: couldn't initialize slot with master password: The password or PIN is incorrect
Aug 10 14:36:40 BOX gdm-password]: gkr-pam: unlocked login keyring
Aug 10 14:40:02 BOX sudo: pam_unix(sudo:session): session closed for user root
(username)@(username)-desktop:~$

swapped out my username (username) and hostname (box) with this log. I was connecting with the authentication credential that shows up in the remote desktop section, and enabled legacy vnc to test it out. no luck either way. Is this some issue with wayland?

notwithoutmyanus fucked around with this message at 20:58 on Aug 10, 2023

# ? Aug 10, 2023 20:55

MrPablo: Mar 21, 2003

Bozza posted:

You'll be pleased to know that all my internet of things devices are segregated off into a VLAN so hopefully none of that! I think it's even called InternetOfPiss

That's great! We do the same thing; ours is called "nyet-iot-gtfo".

Bozza posted:

I think I'm going to get it all set up and running with firewalld then probably have a play round with nftables before I inevitably break it.

Sounds like a good plan!

Bozza posted:

Thanks so much for the detailed explanation, it's useful as a learner.

Sure, no problem.

# ? Aug 11, 2023 00:25

Head Bee Guy: Jun 12, 2011; Retarded for Busting; Grimey Drawer

Super basic question: where is considered a �best practices� location to store small tools/software? I�ve just been using a folder in my home directory for little python apps and whatnot

# ? Aug 15, 2023 15:20

Last Chance: Dec 31, 2004

Call me basic but a lot of small bash scripts that I use once in a while (like not entire projects, but utilitarian stuff), I just put in ~/scripts/

# ? Aug 15, 2023 15:32

JLaw: Feb 10, 2008; - harmless -

Head Bee Guy posted:

Super basic question: where is considered a �best practices� location to store small tools/software? I�ve just been using a folder in my home directory for little python apps and whatnot

I used to always use ~/bin, now I use ~/.local/bin. Some installable things like to drop per-user CLI binaries there these days, so it has to be in my PATH anyway, and it's vaguely nice to not have that top level "bin" visible in my home directory.

# ? Aug 15, 2023 16:01

cruft: Oct 25, 2007

JLaw posted:

I used to always use ~/bin, now I use ~/.local/bin. Some installable things like to drop per-user CLI binaries there these days, so it has to be in my PATH anyway, and it's vaguely nice to not have that top level "bin" visible in my home directory.

I still use ~/bin but I spend a lot of time developing scripts and software so having the directory visible is desirable. Otherwise I'd use ~/.local/bin

# ? Aug 15, 2023 16:33

F_Shit_Fitzgerald: Feb 2, 2017

What's the actual difference between ~/.local/bin and ~/bin? This has come up from time to time but I still don't quite get the insistence that using ~/bin is bad.

# ? Aug 15, 2023 16:35

cruft: Oct 25, 2007

F_Shit_Fitzgerald posted:

What's the actual difference between ~/.local/bin and ~/bin? This has come up from time to time but I still don't quite get the insistence that using ~/bin is bad.

It's not bad. It's your frickin' home directory. Set it up however you want.

~/.local/bin is apparently a standard (didn't know this until an hour ago) and lets you have binaries in your home directory without them showing up by default in the file manager or with ls. That's the only advantage.

~/bin is also a standard, in that Debian's shrc adds it to PATH if the directory exists.

e: regarding Klyith's post below, I want to re-emphasize that there is absolutely nothing wrong with setting up your home directory however the hell you want. If you don't know how to set $PATH, use the xdg standard, it was made for you.

I actually have ~/bin, ~/.local/bin, ~/scripts, and ~/bin/$(uname -s)-$(uname -m) in my PATH. That last one is for when my home dir is NFS mounted across multiple architectures and/or kernels.

cruft fucked around with this message at 17:18 on Aug 15, 2023

# ? Aug 15, 2023 16:39

Klyith: Aug 3, 2007; GBS Pledge Week

F_Shit_Fitzgerald posted:

What's the actual difference between ~/.local/bin and ~/bin? This has come up from time to time but I still don't quite get the insistence that using ~/bin is bad.

I don't think there's any insistence that using ~/bin is bad. But it was never a real unix standard, it was just a long-standing convention that people did.

So when a bunch of linux groups agreed on the XDG standards to organize homedir poo poo, they put stuff in .local so that:
1) it'd all be in one folder that replicates the system hierarchy
2) it's hidden so that non-expert desktop users don't see it

# ? Aug 15, 2023 17:01

ExcessBLarg!: Sep 1, 2001

Head Bee Guy posted:

Super basic question: where is considered a �best practices� location to store small tools/software?

I use ~/src/scripts since that's where I have my scripts.git repo check out. Not in path.

# ? Aug 15, 2023 18:14

pseudorandom name: May 6, 2007

F_Shit_Fitzgerald posted:

What's the actual difference between ~/.local/bin and ~/bin? This has come up from time to time but I still don't quite get the insistence that using ~/bin is bad.

~/bin is where you put your stuff, ~/.local/bin is where non-system "package managers" like pip or npm installs stuff.

# ? Aug 15, 2023 18:27

BrainDance: May 8, 2007; Disco all night long!

cruft posted:

~/bin is also a standard, in that Debian's shrc adds it to PATH if the directory exists.

That explains it, I was halfway through setting up a few Debian installs, made ~/bin, later noticed it was in PATH when I had sworn I hadn't actually done that yet.

# ? Aug 16, 2023 02:01

BlankSystemDaemon: Mar 13, 2009

Sometimes, you just have days where you wonder... "WHY?!"
Today is one of those days.

Here's Discord running on FreeBSD:

pre:

96656   1001       30  20    0  1123G   445M uwait    7   1:38   8.01% electron: --type=renderer --user-data-dir=/home/debdrup/.config/Discord

It's it's ~450MB of JavaScript, and Electron has decided that it needs over 1TB of virtual memory, on a laptop with 16GB of physical memory.

# ? Aug 16, 2023 19:05

cruft: Oct 25, 2007

BlankSystemDaemon posted:

Sometimes, you just have days where you wonder... "WHY?!"
Today is one of those days.

Here's Discord running on FreeBSD:
pre:
96656   1001       30  20    0  1123G   445M uwait    7   1:38   8.01% electron: --type=renderer --user-data-dir=/home/debdrup/.config/Discord
It's it's ~450MB of JavaScript, and Electron has decided that it needs over 1TB of virtual memory, on a laptop with 16GB of physical memory.

Electron. SMH.

# ? Aug 16, 2023 19:06

Yaoi Gagarin: Feb 20, 2014

BlankSystemDaemon posted:

Sometimes, you just have days where you wonder... "WHY?!"
Today is one of those days.

Here's Discord running on FreeBSD:
pre:
96656   1001       30  20    0  1123G   445M uwait    7   1:38   8.01% electron: --type=renderer --user-data-dir=/home/debdrup/.config/Discord
It's it's ~450MB of JavaScript, and Electron has decided that it needs over 1TB of virtual memory, on a laptop with 16GB of physical memory.

Lmao

# ? Aug 16, 2023 19:13

Klyith: Aug 3, 2007; GBS Pledge Week

Why do you care though? It has no effect on anything.

edit: on linux allocating a huge amount of VM runs up your OOM score, insuring that chrome and electron apps get killed first by oom killer if you run out of memory. so it has the one effect of making sure they get shot first for being wasteful of memory :commissar:

Klyith fucked around with this message at 20:54 on Aug 16, 2023

# ? Aug 16, 2023 20:47

cruft: Oct 25, 2007

Klyith posted:

Why do you care though? It has no effect on anything.

Same reason I don't like buying 50 gallon drums of pickles when I only want 1 pickle.

# ? Aug 16, 2023 21:06

Yaoi Gagarin: Feb 20, 2014

Yeah using lots of VM doesn't actually cost anything, but it's hilarious. Like how do you write a program that will even use 1 TB of VM in the first place? The world's biggest mmap call???

# ? Aug 16, 2023 21:11

Twerk from Home: Jan 17, 2009; This avatar brought to you by the 'save our dead gay forums' foundation.

VostokProgram posted:

Yeah using lots of VM doesn't actually cost anything, but it's hilarious. Like how do you write a program that will even use 1 TB of VM in the first place? The world's biggest mmap call???

It's super easy, and yes exactly. There's a super common genetics tool, plink, that will by default reserve half the physical memory of the host as it's workspace and allocate it, even if the host has 1 or 2TB of RAM and it's only going to be using 2GB.

# ? Aug 16, 2023 21:13

ExcessBLarg!: Sep 1, 2001

VostokProgram posted:

Yeah using lots of VM doesn't actually cost anything, but it's hilarious. Like how do you write a program that will even use 1 TB of VM in the first place? The world's biggest mmap call???

Lots of threads with allocated stacks but very shallow in actual usage.

# ? Aug 16, 2023 22:55

Klyith: Aug 3, 2007; GBS Pledge Week

VostokProgram posted:

Yeah using lots of VM doesn't actually cost anything, but it's hilarious. Like how do you write a program that will even use 1 TB of VM in the first place? The world's biggest mmap call???

Apparently, sandboxing your javascript by putting it in a couple of small boxes, and then putting the small boxes into a giant empty box, which makes it very easy to catch if the javascript ever tries to escape from the small box into the big box.

Or possibly just to give BSD one more thing to bitch about with electron apps.

# ? Aug 16, 2023 23:44

Mr. Crow: May 22, 2008; Snap City mayor for life

To be clear, electron is a turd though.

# ? Aug 17, 2023 02:46

Nitrousoxide: May 30, 2011; do not buy a oneplus phone

Where possible I make PWAs rather than use electron apps.

# ? Aug 17, 2023 03:50

BlankSystemDaemon: Mar 13, 2009

Klyith posted:

Why do you care though? It has no effect on anything.

edit: on linux allocating a huge amount of VM runs up your OOM score, insuring that chrome and electron apps get killed first by oom killer if you run out of memory. so it has the one effect of making sure they get shot first for being wasteful of memory

You really don't see why it's funny that some JavaScript nonsense ends up taking over 1TB of memory?

Also, that's pretty much exactly how FreeBSD works too.

# ? Aug 17, 2023 10:26

Truga: May 4, 2014; Lipstick Apathy

BlankSystemDaemon posted:

Sometimes, you just have days where you wonder... "WHY?!"
Today is one of those days.

Here's Discord running on FreeBSD:
pre:
96656   1001       30  20    0  1123G   445M uwait    7   1:38   8.01% electron: --type=renderer --user-data-dir=/home/debdrup/.config/Discord
It's it's ~450MB of JavaScript, and Electron has decided that it needs over 1TB of virtual memory, on a laptop with 16GB of physical memory.

pro-tip: run discord in firefox, it runs way better and doesn't leak ram like a colander lmao

e: also, i run kde and it's really funny how they had to fix/make workarounds for discord to work on wayland properly, only for discord to gently caress it up in one of the updates so it now also leaks vram under kwin-wayland lmao

Truga fucked around with this message at 10:37 on Aug 17, 2023

# ? Aug 17, 2023 10:35

VictualSquid: Feb 29, 2012; Gently enveloping the target with indiscriminate love.

Actually, how does VM work these days? If you got the system with 16GB ram and 16GB swap, what does allocating 1TB for firefox or whatever actually do? Everything I found by googling suggests that total VM allocation should be smaller then RAM+swap.

# ? Aug 17, 2023 10:36

Truga: May 4, 2014; Lipstick Apathy

app tells kernel "i'm gonna malloc 1tb rams" and the kernel says "ok, sure, here's a 1tb chunk of ram" that's actually probably only a mb or so initially, similar to how an "empty" sparse file would be on disk

and then if it actually tries to use the entire tb it gets killed lol

# ? Aug 17, 2023 11:17

Adbot: ADBOT LOVES YOU

# ? Jun 10, 2024 14:12

ExcessBLarg!: Sep 1, 2001

VictualSquid posted:

Actually, how does VM work these days?

This document (which was linked to by the one Klyith posted earlier) explains the approach: On POSIX the 1 TB sandbox is a PROT_NONE anonymous/private mmap. This means no VM page mappings (or physical pages) are actually allocated and access to this sandbox causes a page/seg fault as before. Importantly though, it means the 1 TB space (plus the guard bands) is reserved and can't, unintentionally, be mmaped by other code (e.g., a third-party native library) where they might be vulnerable to exploit.

When carve outs are actually needed in the sandbox, mprotect is used to change the protection flags, which would result in a COW zero-page allocation on read, or an actual dirty page allocation on write.

Again, for modern POSIX systems this is just an extent mapping and is essentially free. It's only an issue for folks who interpret the VSZ column of ps output as something more meaningful than it actually is.

Interestingly on older versions of Windows it actually is somewhat memory costly, which makes me think that Windows preallocates COW zero-page mappings which can have pretty serious memory hits depending on whether it uses 4 MB or 4 kB pages.

ExcessBLarg! fucked around with this message at 13:04 on Aug 17, 2023

# ? Aug 17, 2023 11:50

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Linux Questions Thread: a bunch of pitfalls, but technically it's possible

«‹›1040 »