Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 676138 - sys-fs/udev-240-r2: wrong perms on many critical /dev nodes and boot failures!
Summary: sys-fs/udev-240-r2: wrong perms on many critical /dev nodes and boot failures!
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: High major
Assignee: udev maintainers
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-01-24 05:46 UTC by Robin Johnson
Modified: 2019-07-30 14:50 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2019-01-24 05:46:08 UTC
Possibly related to bug 674748.

Permissions on many of the critical nodes in /dev have become much more restrictive  and break the system as a result.

Generally, they used to have mode 0666, and now had mode 0660 on boot, and had valid use cases for o=rw usage.

/dev/urandom
/dev/random
/dev/zero
/dev/full
/dev/null
/dev/ptmx # this stops creation of many terminals!

There are others as well that have changed from their intended modes to 0660.
/dev/console [-0600-] {+0660+}
/dev/cpu_dma_latency [-0600-] {+0660+}
/dev/cpu/microcode [-0600-] {+0660+}
/dev/full [-0666-] {+0660+}
/dev/hpet [-0600-] {+0660+}
/dev/kmem [-0640-] {+0660+}
/dev/kmsg [-0644-] {+0660+}
/dev/mapper/control [-0600-] {+0660+}
/dev/mcelog [-0600-] {+0660+}
/dev/mem [-0640-] {+0660+}
/dev/mpt2ctl [-0600-] {+0660+}
/dev/network_latency [-0600-] {+0660+}
/dev/network_throughput [-0600-] {+0660+}
/dev/port [-0640-] {+0660+}
/dev/psaux [-0600-] {+0660+}
/dev/rtc0 [-0600-] {+0660+}
/dev/tty0 [-0620-] {+0660+}
/dev/ttyS1 [-0620-] {+0660+}
/dev/vga_arbiter [-0600-] {+0660+}


It's not clear why this is the case, because udevadm trigger and udevadm test do report that the mode SHOULD be 0666 correctly.
Comment 1 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2019-01-24 05:48:09 UTC
# ls -la /dev/zero ; udevadm test   /sys/class/mem/zero ; ls -la /dev/zero
crw-rw-rw- 1 root root 1, 5 Jan 23 21:47 /dev/zero
This program is for debugging only, it does not run any program
specified by a RUN key. It may show incorrect results, because
some values may be different, or not available at a simulation run.

Load module index
Parsed configuration file /lib64/systemd/network/99-default.link
Created link configuration context.
Reading rules file: /lib64/udev/rules.d/10-dm.rules
Reading rules file: /lib64/udev/rules.d/11-dm-lvm.rules
Reading rules file: /lib64/udev/rules.d/11-dm-mpath.rules
Reading rules file: /lib64/udev/rules.d/11-dm-parts.rules
Reading rules file: /lib64/udev/rules.d/13-dm-disk.rules
Reading rules file: /lib64/udev/rules.d/25-gpsd.rules
Reading rules file: /lib64/udev/rules.d/39-usbmuxd.rules
Reading rules file: /lib64/udev/rules.d/40-gentoo.rules
Reading rules file: /lib64/udev/rules.d/40-usb-media-players.rules
Reading rules file: /lib64/udev/rules.d/41-libsane.rules
Reading rules file: /lib64/udev/rules.d/50-udev-default.rules
Specified group 'render' unknown
Reading rules file: /lib64/udev/rules.d/52-usx2yaudio.rules
Reading rules file: /lib64/udev/rules.d/56-multipath.rules
Reading rules file: /lib64/udev/rules.d/60-block.rules
Reading rules file: /lib64/udev/rules.d/60-cdrom_id.rules
Reading rules file: /lib64/udev/rules.d/60-drm.rules
Reading rules file: /lib64/udev/rules.d/60-evdev.rules
Reading rules file: /etc/udev/rules.d/60-heimdall.rules
Reading rules file: /lib64/udev/rules.d/60-input-id.rules
Reading rules file: /lib64/udev/rules.d/60-persistent-alsa.rules
Reading rules file: /lib64/udev/rules.d/60-persistent-input.rules
Reading rules file: /lib64/udev/rules.d/60-persistent-storage-tape.rules
Reading rules file: /lib64/udev/rules.d/60-persistent-storage.rules
Reading rules file: /lib64/udev/rules.d/60-persistent-v4l.rules
Reading rules file: /lib64/udev/rules.d/60-sensor.rules
Reading rules file: /lib64/udev/rules.d/60-serial.rules
Reading rules file: /run/udev/rules.d/61-dev-root-link.rules
Reading rules file: /lib64/udev/rules.d/61-gnome-bluetooth.rules
Reading rules file: /lib64/udev/rules.d/61-kde-bluetooth-rfkill.rules
Reading rules file: /lib64/udev/rules.d/61-trousers.rules
Reading rules file: /lib64/udev/rules.d/62-nut-usbups.rules
Reading rules file: /lib64/udev/rules.d/63-md-raid-arrays.rules
Reading rules file: /lib64/udev/rules.d/64-btrfs-dm.rules
Reading rules file: /lib64/udev/rules.d/64-btrfs.rules
Reading rules file: /lib64/udev/rules.d/64-md-raid-assembly.rules
Reading rules file: /lib64/udev/rules.d/65-drbd.rules
Reading rules file: /lib64/udev/rules.d/65-kvm.rules
Reading rules file: /lib64/udev/rules.d/65-libwacom.rules
Reading rules file: /lib64/udev/rules.d/66-azure-ephemeral.rules
Reading rules file: /lib64/udev/rules.d/66-kpartx.rules
Reading rules file: /lib64/udev/rules.d/68-del-part-nodes.rules
Reading rules file: /lib64/udev/rules.d/69-cd-sensors.rules
Reading rules file: /lib64/udev/rules.d/69-dm-lvm-metad.rules
Reading rules file: /lib64/udev/rules.d/69-libmtp.rules
Reading rules file: /lib64/udev/rules.d/70-joystick.rules
Reading rules file: /lib64/udev/rules.d/70-libgphoto2.rules
Reading rules file: /lib64/udev/rules.d/70-mouse.rules
Reading rules file: /etc/udev/rules.d/70-persistent-cd.rules
Reading rules file: /lib64/udev/rules.d/70-printers.rules
Reading rules file: /lib64/udev/rules.d/70-touchpad.rules
Reading rules file: /lib64/udev/rules.d/70-udev-acl.rules
Reading rules file: /lib64/udev/rules.d/71-udev-seat.rules
Reading rules file: /lib64/udev/rules.d/75-net-description.rules
Reading rules file: /lib64/udev/rules.d/75-probe_mtd.rules
Reading rules file: /lib64/udev/rules.d/77-mm-cinterion-port-types.rules
Reading rules file: /lib64/udev/rules.d/77-mm-ericsson-mbm.rules
Reading rules file: /lib64/udev/rules.d/77-mm-huawei-net-port-types.rules
Reading rules file: /lib64/udev/rules.d/77-mm-longcheer-port-types.rules
Reading rules file: /lib64/udev/rules.d/77-mm-mtk-port-types.rules
Reading rules file: /lib64/udev/rules.d/77-mm-nokia-port-types.rules
Reading rules file: /lib64/udev/rules.d/77-mm-pcmcia-device-blacklist.rules
Reading rules file: /lib64/udev/rules.d/77-mm-platform-serial-whitelist.rules
Reading rules file: /lib64/udev/rules.d/77-mm-simtech-port-types.rules
Reading rules file: /lib64/udev/rules.d/77-mm-telit-port-types.rules
Reading rules file: /lib64/udev/rules.d/77-mm-usb-device-blacklist.rules
Reading rules file: /lib64/udev/rules.d/77-mm-usb-serial-adapters-greylist.rules
Reading rules file: /lib64/udev/rules.d/77-mm-x22x-port-types.rules
Reading rules file: /lib64/udev/rules.d/77-mm-zte-port-types.rules
Reading rules file: /lib64/udev/rules.d/78-sound-card.rules
Reading rules file: /lib64/udev/rules.d/80-android.rules
Reading rules file: /lib64/udev/rules.d/80-docker.rules
Reading rules file: /lib64/udev/rules.d/80-drivers.rules
Reading rules file: /lib64/udev/rules.d/80-libinput-device-groups.rules
Reading rules file: /lib64/udev/rules.d/80-mm-candidate.rules
Reading rules file: /lib64/udev/rules.d/80-net-setup-link.rules
Reading rules file: /lib64/udev/rules.d/80-udisks.rules
Reading rules file: /lib64/udev/rules.d/80-udisks2.rules
Reading rules file: /etc/udev/rules.d/80-uvcdynctrl.rules
Reading rules file: /lib64/udev/rules.d/84-nm-drivers.rules
Reading rules file: /lib64/udev/rules.d/85-nm-unmanaged.rules
Reading rules file: /lib64/udev/rules.d/85-regulatory.rules
Reading rules file: /lib64/udev/rules.d/90-alsa-restore.rules
Reading rules file: /lib64/udev/rules.d/90-libgpod.rules
Reading rules file: /lib64/udev/rules.d/90-libinput-model-quirks.rules
Reading rules file: /lib64/udev/rules.d/90-network.rules
Reading rules file: /lib64/udev/rules.d/90-pulseaudio.rules
Reading rules file: /lib64/udev/rules.d/95-cd-devices.rules
Reading rules file: /lib64/udev/rules.d/95-dm-notify.rules
Reading rules file: /lib64/udev/rules.d/95-osinfo.rules
Reading rules file: /lib64/udev/rules.d/95-upower-csr.rules
Reading rules file: /lib64/udev/rules.d/95-upower-hid.rules
Reading rules file: /lib64/udev/rules.d/95-upower-wup.rules
Reading rules file: /lib64/udev/rules.d/97-hid2hci.rules
Reading rules file: /etc/udev/rules.d/99-android.rules
Reading rules file: /lib64/udev/rules.d/99-fuse.rules
Reading rules file: /lib64/udev/rules.d/99-ntfs3g.rules
Reading rules file: /lib64/udev/rules.d/99-pcscd-hotplug.rules
Reading rules file: /etc/udev/rules.d/99-saleae-logic.rules
Reading rules file: /lib64/udev/rules.d/99-wispy.rules
Reading rules file: /lib64/udev/rules.d/wacom.rules
Rules contain 393216 bytes tokens (32768 * 12 bytes), 40297 bytes strings
28866 strings (235482 bytes), 25121 de-duplicated (198931 bytes), 3746 trie nodes used
Invalid inotify descriptor.
DEVPATH=/devices/virtual/mem/zero
DEVNAME=/dev/zero
DEVMODE=0666
MAJOR=1
MINOR=5
ACTION=add
SUBSYSTEM=mem
USEC_INITIALIZED=35857547882
Unload module index
Unloaded link configuration context.
crw-rw-rw- 1 root root 1, 5 Jan 23 21:47 /dev/zero
Comment 2 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2019-01-24 14:35:28 UTC
I'm still trying to figure out why this doesn't happen for every ~arch user but only for some.

For example, I have three ~amd64 desktop systems that are quite equal in configuration and the kind of packages being installed (all three use the same profile).
Two of them work flawlessly with udev-240-r2 and one does not. The only remarkable difference between the two working and the one non-working systems is, that the "broken" system runs kernel 4.14 (4.14.94 a.t.m.) and the other two run kernel 4.19 (4.19.17 a.t.m.).
Comment 3 Larry the Git Cow gentoo-dev 2019-01-24 14:59:10 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d3b151ff2a468c62638ca87ac89bc1321e730fba

commit d3b151ff2a468c62638ca87ac89bc1321e730fba
Author:     Mike Gilbert <floppym@gentoo.org>
AuthorDate: 2019-01-24 14:57:17 +0000
Commit:     Mike Gilbert <floppym@gentoo.org>
CommitDate: 2019-01-24 14:57:17 +0000

    sys-fs/udev: patchset for 240 based on v240-stable branch upstream
    
    Bug: https://bugs.gentoo.org/676138
    Bug: https://bugs.gentoo.org/674816
    Bug: https://bugs.gentoo.org/674748
    Package-Manager: Portage-2.3.56_p3, Repoman-2.3.12_p50
    Signed-off-by: Mike Gilbert <floppym@gentoo.org>

 sys-fs/udev/Manifest           |   1 +
 sys-fs/udev/udev-240-r3.ebuild | 325 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 326 insertions(+)
Comment 4 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2019-02-03 23:55:29 UTC
floppym:
1. -r3 does not fix the issue :-(.
2. I'm not 100% convinced it's entirely udev's fault.

Specifically, I tried to trace all the way back to the start of boot (including through initramfs), and found that when devtmpfs mounts, it might be wrong already, and that something else might have been fixing it in the past, but isn't anymore.
Comment 5 Mike Gilbert gentoo-dev 2019-02-04 03:01:56 UTC
Please test udev-241_rc2, or whatever the newest version is at the time. Version 240 will never be stablized.
Comment 6 Mike Gilbert gentoo-dev 2019-02-04 03:15:44 UTC
(In reply to Robin Johnson from comment #4)

The kernel sets the mode on nodes like /dev/zero and /dev/null to 0666. It also sets the mode on many other device nodes that are ignored by udev.

So, I agree with your conclusion that something other than udev is probably screwing it up if all of your devices are getting mode 0660.