Code: Select all
apt-get update && apt-get install xserver-xorg-legacy
startxCode: Select all
echo "needs_root_rights=yes" >> /etc/X11/Xwrapper.config
startx
@Flashanikin wrote:The picture posted by Flash suggests xserver can't get root permission. Before proceeding with the firmware and vesa solutions, I'd first try the following:
Run BionicDog again. When it halts, run:
Code:
apt-get update && apt-get install xserver-xorg-legacy
startx
In theory this should be enough to get you going as xserver-xorg-legacy driver will assign root automatically. If still no go, then run this:
Code:
echo "needs_root_rights=yes" >> /etc/X11/Xwrapper.config
startx
Code: Select all
#/bin/sh
#
# Potential hardening of /usr/local/bin/firefox-puppy.sh in BionicDog
#
# delgroup the following groups from user puppy
# adm sudo wheel disk plugdev netdev
#
chmod 770 /root /mnt /usr/sbin /sbin /bin/busybox /bin/dd /bin/kmod /bin/login /bin/mount /bin/umount bin/chmod
xhost +local:puppy
mkdir /run/user/1000 # rids us of dconf error messages by creating 1000 (puppy) run folder
chmod 777 /run/user/1000
mkdir /run/user/1000/dconf
chmod 777 /run/user/1000/dconf
cd /home/puppy
if [ ! -d .local ]; then
mkdir .local
fi
if [ ! -d .local/share ]; then
mkdir .local/share
fi
echo "#!/bin/sh" >/home/puppy/run-ff
echo "HOME=/home/puppy export HOME" >>/home/puppy/run-ff
echo "DISPLAY=:0 export DISPLAY" >>/home/puppy/run-ff
echo "GTK2_RC_FILES=/home/puppy/.gtkrc-2.0" >>/home/puppy/run-ff
echo "USER=puppy" >>/home/puppy/run-ff
# fix dconf error (using puppy uid of 1000)
echo "XDG_RUNTIME_DIR=/run/user/1000" >>/home/puppy/run-ff
echo "XDG_DATA_HOME=/home/puppy/.local/share" >>/home/puppy/run-ff
echo "XFINANSDIR=/home/puppy/.xfinans" >>/home/puppy/run-ff
echo "XDG_CONFIG_HOME=/home/puppy/.config" >>/home/puppy/run-ff
echo "XDG_CACHE_HOME=/home/puppy/.cache" >>/home/puppy/run-ff
echo "PATH=/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin" >>/home/puppy/run-ff
echo "cd /home/puppy" >>/home/puppy/run-ff
echo "/usr/bin/apulse /opt/firefox/firefox" >>/home/puppy/run-ff
echo "exit" >>run-ff
chmod +x /home/puppy/run-ff
unshare -p --mount-proc=/proc -f /sbin/capsh --drop=cap_chown,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,
cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,
cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,
cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource, cap_sys_time,
cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,
cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,
cap_audit_read+ep --keep=1 --user=puppy -- -c /home/puppy/run-ff --
# Change it to the following i.e. execute /bin/sh and you can see what is accessible
# i.e. try things such as su command, or run capsh --print to see what's capped ...etc.
#unshare -p --mount-proc=/proc -f /sbin/capsh --drop=cap_chown,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,
cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,
cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,
cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,
cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,
cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,
cap_audit_read+ep --keep=1 --user=puppy -- -c /bin/sh --
####################################################Code: Select all
capsh --printYes, thanks, once I've seen similar errors as the last lines (not being valid yet) but no idea where it's coming from.Then I did what rcrsn51 said (the vesa option) and it worked. I took a screenshot of the intermediate result. I thought Fred might want to see it.
Yes,better -in my opinion- how Debian handles that, also separate firmware packages for wifi. (in Ubuntu you have to install the whole big package linux-fimware)rcrsn51 wrote:FWIW, the Stretch Live Starter Kit addresses this problem by including the Radeon firmware in the ISO. Unlike Ubuntu, Debian packages it separately as firmware-amd-graphics.
Firefox just updated to 60.0 and the above still works OK (for the one sneekylinux youtube that I used to check sound was being heard ok).fredx181 wrote: @rufwoof, thanks, new territory for me, this "hardening"
I ran a few tests of bt4stretch v1.1 in BionicDog and it works. BD already has mplayer.tlchost wrote:Anyone using bluetooth with BionicDog? What do I need to install to make it play? Thanks
Would this be less complex if an ID without adm sudo wheel disk plugdev netdev was created just to run the browser?rufwoof wrote:This seems to work OK, note that I've split the capsh command line(s) over several lines purely for forum display purposes (otherwise it would make the forum thread wide). They're all a single line capsh command line
I guess that the puppy userid could simply be adjusted to have lower privileges if you're only using that for internet type programs/activities. That's basically what I did but adding even further limitations to make it more 'useless' for anything other than running the browser. Egyptian cat styledancytron wrote:Would this be less complex if an ID without adm sudo wheel disk plugdev netdev was created just to run the browser?
A long time ago I did a Debian Dog Chrome remaster with a user "cat" iirc without sudo and wheel that I used to run the browser.
