netdev - Re: [PATCH iproute2-next] Makefile: use systemd-tmpfiles to create /var/lib/arpd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 13 Mar 2024 10:16:54 +0100
From: Max Gautier <mg@....gautier.name>
To: Stephen Hemminger <stephen@...workplumber.org>
Cc: netdev@...r.kernel.org
Subject: Re: [PATCH iproute2-next] Makefile: use systemd-tmpfiles to create
 /var/lib/arpd

On Tue, Mar 12, 2024 at 03:19:19PM -0700, Stephen Hemminger wrote:
> On Tue, 12 Mar 2024 22:34:59 +0100
> Max Gautier <mg@....gautier.name> wrote:
> 
> > On Tue, Mar 12, 2024 at 02:24:20PM -0700, Stephen Hemminger wrote:
> > > On Tue, 12 Mar 2024 09:22:20 +0100
> > > Max Gautier <mg@....gautier.name> wrote:
> > >   
> > > > On Mon, Mar 11, 2024 at 06:30:07PM -0700, Stephen Hemminger wrote:  
> > > > > On Mon, 11 Mar 2024 23:28:31 +0100
> > > > > Max Gautier <mg@....gautier.name> wrote:
> > > > >     
> > > > > > On Mon, Mar 11, 2024 at 12:40:03PM -0700, Stephen Hemminger wrote:    
> > > > > > > On Mon, 11 Mar 2024 17:57:27 +0100
> > > > > > > Max Gautier <mg@....gautier.name> wrote:
> > > > > > >       
> > > > > > > > Only apply on systemd systems (detected in the configure script).
> > > > > > > > The motivation is to build distributions packages without /var to go
> > > > > > > > towards stateless systems, see link below (TL;DR: provisionning anything
> > > > > > > > outside of /usr on boot).
> > > > > > > > 
> > > > > > > > The feature flag can be overridden on make invocation:
> > > > > > > > `make USE_TMPFILES_D=n DESTDIR=<install_loc> install`
> > > > > > > > 
> > > > > > > > Links: https://0pointer.net/blog/projects/stateless.html      
> > > > > > > 
> > > > > > > Why does arpd need such hand holding, it is rarely used, maybe should just not be built.      
> > > > > > 
> > > > > > The commit introducing the install of that directory is quite old    
> > > > > 
> > > > > The problem is that build environment != runtime environment for embedded systems.    
> > > > 
> > > > That's the same for anything detected by the configure script, right ?
> > > > Hence the override capability.  
> > > 
> > > Configure is mostly about what packages are missing from the build.
> > > It would be better if arpd was just smarter about where to put its
> > > file.  
> > 
> > What do you mean by smarter ? Trying to found an existing directory
> > rather than a fixed one ?
> > 
> 
> Isn't there some environment variable that systemd uses to tell a service
> where to put its files? If that is present use that.

Yeah there is StateDirectory that could be used for this (set
STATE_DIRECTORY in the process). I would have done that, but there is no
systemd service file for arpd, and I don't know which options
combination should be preferred for the arpd invocation in the potential
service file.

On another note, I see in the examples sections of the man page the
following:

> arpd -b /var/tmp/arpd.db
>       Start  arpd to collect gratuitous ARP, but not messing with ker‐
>       nel functionality.
> 
> killall arpd ; arpd -l -b /var/tmp/arpd.db
>       Look at result after some time.
> 
> arpd -b /var/tmp/arpd.db -a 1 eth0 eth1
>       Enable kernel helper, leaving leading role to kernel.
> 
> arpd -b /var/tmp/arpd.db -a 3 -k eth0 eth1
>       Completely replace kernel  resolution  on  interfaces  eth0  and
>       eth1. In this case the kernel still does unicast probing to val‐
>       idate  entries, but all the broadcast activity is suppressed and
>       made under authority of arpd.

Looks like all examples use /var/tmp/arpd.db. Maybe that means that
should be the default instead ?

(forgot to cc the list)

-- 
Max Gautier