Messinet Secure Services

Messinet Secure Services is an ever-changing virtual classroom in which I learn about the GNU/Linux platform and all the services it can deliver. These services are the technological incarnation of an idea centered around keeping my family in touch with each other and technology.

Fedora 27 Upgrades Complete

We’ve upgraded Messinet Secure Services from Fedora 26 to Fedora 27. Again there are a number of SELinux, systemd, gssproxy, and nfs-utils bugs 1494852, 1497267, 1507817, 1514241 affecting our systems that probably should have received more attention before release.

One of the most challenging SELinux & systemd integration bugs is 1471545, whereby the wrong SELinux file context label is placed on /run/systemd/resolve/resolv.conf, causing SELinux AVCs and daemon failures throughout. Unfortunately, the bug’s assignee continues to close the bug as fixed with each new selinux-policy release and no information as to how the fix is to work.

After using MariaDB’s GSSAPI Authentication Plugin with great success in Fedora 26, I was looking to expand GSSAPI/SSO usage in F27, but I was unable to get things to work, and filed 1514820 for more information.

SELinux still doesn’t really have functional policy support for machinectl, systemd-nspawn and full OS containers. The same SELinux and systemd integration issues occurred with the Fedora 25 to Fedora 26 upgrade and it is clear that upstream Fedora doesn’t prioritize SELinux testing enough, especially with respect to systemd, it’s init daemon of choice.

All this too, shall pass and with the Messinet Secure Services upgrades complete, I’m no longer building for Fedora 26, which has been removed from the Fedora Linux RPM Repository.

Fedora 26 Upgrades Complete

With even more SELinux & systemd challenges, we’ve upgraded Messinet Secure Services from Fedora 25 to Fedora 26. This same lack of attention to SELinux and systemd integration occurred with the Fedora 24 to Fedora 25 upgrade and it is abundantly clear that upstream Fedora doesn’t value SELinux support for systemd daemons.

Another continuing disappointment is that SELinux still doesn’t really have functional policy support for machinectl, systemd-nspawn and full OS containers.

Even so, the Messinet Secure Services upgrades are complete and I’m no longer building for Fedora 25, which will soon be removed from the Fedora Linux RPM Repository. Of special note, I’ll only be building RPMs for x86_64, as i686 has been downgraded to a secondary arch in Fedora upstream.

Goodbye Fedora 24 & Hello Fedora 25

With some SELinux & systemd challenges, we’ve upgraded Messinet Secure Services from Fedora 24 to Fedora 25. It is clear that upstream Fedora is not getting enough testing for systemd daemons and SELinux 1398854, 1398856. In addition, it’s a bit disappointing that SELinux doesn’t really have policy support for systemd-nspawn and full OS containers.

Fedora 25’s systemd contains a regression 1398886 where CPUQuota= values greater than 100% are invalid. This was fixed upstream in August 2016, but didn’t get backported.

Kerberized NFS support via rpc.gssd is broken due to 1264556, now fixed as described in 1398370. This can be temporarily resolved by running rpc.gssd in the foreground by updating /usr/lib/systemd/system/rpc-gssd.service as shown below, though you’ll run into 1398857.

[Unit]
Description=RPC security service for NFS client and server
DefaultDependencies=no
Conflicts=umount.target
Requires=var-lib-nfs-rpc_pipefs.mount
After=var-lib-nfs-rpc_pipefs.mount

ConditionPathExists=/etc/krb5.keytab

PartOf=nfs-utils.service

Wants=nfs-config.service
After=nfs-config.service

[Service]
EnvironmentFile=-/run/sysconfig/nfs-utils

#Type=forking
#ExecStart=/usr/sbin/rpc.gssd $RPCSVCGSSDARGS
Type=simple
ExecStart=/usr/sbin/rpc.gssd -f $RPCSVCGSSDARGS

All that aside, the upgrades are complete and I’m no longer building for Fedora 24, which is removed from the Fedora Linux RPM Repository.

Welcome Fedora 24!

We’ve completed our upgrades from Fedora 23 to Fedora 24 throughout Messinet Secure Services. In general, Fedora 24 has brought us a number of systemd improvements, though there are several SELinux issues when using systemd’s native tools such as systemd-networkd, systemd-resolved, systemd-timesyncd, etc. Many issues: 1317927, 1341829, 1351378, 1355593 generate

SELinux AVC avc: denied { mounton } ...

Even so, the upgrades are complete and I’ll be removing Fedora 23 from the Fedora Linux RPM Repository.

Comcast static IPv6 trial ending

Comcast’s Business Class internet service static IPv6 trial ended as of yesterday. Comcast anticipates the nationwide launch of static IPv6 to begin in early July 2016.

With the unfortunate gap in reliable IPv6 business class service from Comcast, Messinet Secure Services is preparing alternate IPv6 service arrangements. There will likely be intermittent service and network interruptions along the way as DNS and routing changes propagate throughout the internet.

When Comcast does finally roll out static IPv6, we hope that they have addressed the significant hardware issues detailed in this summary of Comcast’s support of IPv6 on their CPE for their copper cable network.

Removal of Enterprise Linux RPM Repository

Wow, it’s been quite a while!

I have a new job that takes up much more of my time and as Messinet Secure Services has moved to Fedora 23, I’ve had to drop packaging support for Enterprise Linux. I don’t operate Enterprise Linux systems here so as the packaging differences between Fedora and Enterprise Linux became more complex, it became harder for me to produce and properly test packages.

So I’m sorry to say that I’m no longer building Enterprise Linux packages. Perhaps someone with more time can take up the task. The spec files, patches and tools are always available in the now renamed Fedora Linux RPM Repository.

Fedora 22 Coming Soon!

Fedora 22 is set to be released on 2015-05-26 and Messinet Secure Services has been preparing our own RPMs for the upgrade. Most of the work is complete and available in our Fedora & Enterprise Linux RPM Repository.

In order to work toward the Fedora 22 release, I have had to drop support for Fedora 20 and Enterprise Linux 6 RPMs. After Messinet Secure Services completes the migration to Fedora 22, support for Fedora 21 will also be dropped.