@9pfs @otter … never mind, my dirtyfrag mitigation wasn’t actually working (I added it to /usr/local/lib/modprobe.d which was enough to make manually modprobing the modules fail, but they still got autoloaded)

now I bind-mounted /dev/null over the module files to ensure that nothing can load them and copyfail2 indeed does not work

@otter @9pfs and it does still work for me with the dirtyfrag mitigation, so it can’t be that (edit: my mitigation didn’t work)

(and touch /etc/passwd seems to make the sick user go away after reverting the changes to /etc/passwd. I guess nss must be caching it somewhere (but where?))

@otter @9pfs did it completely fail to modify /etc/passwd or could you just not su - sick? the PoC seems to rely on you having nullok in your PAM configuration so an empty password is accepted, but if you just make it add a password as well it works without that.

also, at least on guix, resetting /etc/passwd (by –clean or clearing the page cache) does not seem to be enough to undo the exploit:

ron@t440p ~/P/Copy_Fail2-Electric_Boogaloo (main)> grep sick /etc/passwd
ron@t440p ~/P/Copy_Fail2-Electric_Boogaloo (main) [1]> getent passwd sick
sick:$1$SFhg3s7A$KAk5fEi/EmjSRL1Eb/NvO1:0:0:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:/:/bin/sh
ron@t440p ~/P/Copy_Fail2-Electric_Boogaloo (main)> su - sick
Password: 
sick@t440p /# 

where the hell is it reading from if not /etc/passwd?

@9pfs @otter the fix seems to only have been merged into mainline linux today and isn't in any release yet

@9pfs another one, in a different module. disable xfrm_user and xfrm_algo modules in addition to mitigate this one

https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boogaloo

NOT ANOTHER ONE

second linux LPE of the day

https://www.openwall.com/lists/oss-security/2026/05/07/8

another linux LPE, this time without even a patch or CVE number yet (but there's a mitigation of preventing esp4, esp6, and rxrpc modules from loading)

I have an exam tomorrow morning and I have not revised at all

@6 @thegail anyone who has /tmp on tmpfs or something like systemd-tmpfiles to clean it up

@6 @thegail ... you use /tmp for permanent storage?

@algernon last time I checked forgejo as an oauth2 provider doesn't support scopes so it's not possible to sign in to a service with codeberg without giving it full access to your account, so I won't sign in to any third party services with codeberg

could you add the option to log in with framagit.org instead?

if this post gets greater than or equal to four (4) interactions i will make a music in a random* yamaha soundchip

*not really random

@kemona_halftau morning!

@ielenia if all you need to do is ask an AI to do it and it doesn't matter how bad the result is, ask something like ELIZA that is technically a form of AI but is not an LLM to do it and just submit the output

@maddy @mir you can also do it the other way: someone at school has a laptop that is a dell optiplex motherboard in a briefcase with a screen

@seabass @neil @Billie I wouldn’t touch Stalwart with a 3-metre pole since they started violating the AGPL:

First, there was a “rug pull” relicense 3 months ago moving from AGPL to mixed licensing with some code now non-free. This relicensing contravenes the terms of the CLA that the project signed with contributors (the FLA 2.0, equivalent to this one). The terms of the CLA allow any contributor to terminate the agreement if there is a breach, meaning that there is an ongoing threat to Stalwart’s rights to distribute the project - and therefore ours as well, so long as we ship non-free code, even if they change their license agreement to allow it.

I use OpenSMTPd and Dovecot. OpenSMTPd is simpler to configure than Postfix, but Dovecot annoyingly changed their configuration format (such that I’d have to redo the configuration) which is why I’m still on Debian oldstable.

this is so cool!! Taking photos with atypical spectra is a lot of fun, even with the rather old and bulky camera. The imaging technique used here emulates old Kodak Aerochrome film stock. It’s not available anymore, but used to be a colour IR film, which mapped the IR on the blue channel, while remapping red and green to get this pink-foliage look. I do the same here! Blue is solely IR and swapped with the red channel in post. #photography

@kemona_halftau can't you compile the normal ruby interpreter to webassembly?

@MelissaBearTrix yes, but not as easily as on a digital clock (I have to actually think about it and it takes a few seconds)

good morning