qyliss changed the topic of #spectrum to: A compartmentalized operating system | https://spectrum-os.org/ | Logs: https://logs.spectrum-os.org/spectrum/
cole-h has joined #spectrum
cole-h has quit [Client Quit]
cole-h has joined #spectrum
cole-h has quit [Quit: Goodbye]
cole-h has joined #spectrum
thePiGrepper has left #spectrum [#spectrum]
cole-h has quit [Quit: Goodbye]
cole-h_ has quit [Quit: Goodbye]
maxdevjs has quit [Remote host closed the connection]
maxdevjs has joined #spectrum
maxdevjs has quit [Remote host closed the connection]
maxdevjs has joined #spectrum
maxdevjs has quit [Remote host closed the connection]
maxdevjs has joined #spectrum
maxdevjs has quit [Remote host closed the connection]
maxdevjs has joined #spectrum
maxdevjs has quit [Remote host closed the connection]
maxdevjs has joined #spectrum
maxdevjs has quit [Remote host closed the connection]
maxdevjs has joined #spectrum
maxdevjs has quit [Remote host closed the connection]
maxdevjs has joined #spectrum
e1956ar has joined #spectrum
e1956ar has left #spectrum [#spectrum]
cole-h has joined #spectrum
cole-h_ has joined #spectrum
cole-h__ has joined #spectrum
cole-h has quit [Ping timeout: 265 seconds]
cole-h__ is now known as cole-h
<cole-h> Day 0.5 of updating chromiumOSPackages: Nothing to report.
<qyliss> thanks for checking in :D
<cole-h> :^)
<qyliss> I have the memfd server running inside a sandbox now, but the sandbox... doesn't seem to be restricting anything?
<qyliss> currently my seccomp policy says that the only syscall that is allowed is write, but the server is just running fine and ignoring that
<MichaelRaskin> I guess I could imagine a server backend that only uses write() syscalls, but the additional condition of sending memfd's makes the task more interesting…
<qyliss> think i might just write today off. at least i got the jail sort of done
<MichaelRaskin> Stage 1: make mem server work; Stage 2: make mem server _not_ work when policy forbids _all_ syscalls?
<qyliss> indeed :)
<alj[m]> Stage 3: make mem server work again, with hopefully not much difficulty knocks on wood
<MichaelRaskin> alj[m]: one _hopes_ that the core part of the stage 3 is to allow the syscalls mem server makes.
<alj[m]> si. to be honest, after reading about the chromeOS sandboxing, I'm very surprised that the jail apparently didnt work
<MichaelRaskin> Well, it's Google, I have yet to see anything they do correctly all the way through
<cole-h> Day 0.6 of updating chromiumOSPackages: Nothing to report (though chromestatus did update).
<cole-h> qyliss: Uh, what is the link to the matrix of what the various devices are running again? On my NixOS machine, so I don't have my logs handy
<MichaelRaskin> 1589668503 <qyliss> You can see what's actually being served to devices here: https://cros-updates-serving.appspot.com/
<cole-h> Cheers, thanks.
<cole-h> (Oh, I guess I could have looked at the logs linked in the MOTD... Oops)
cole-h has quit [Quit: Goodbye]
cole-h has joined #spectrum