Tails

#7 Updated by intrigeri 2018-06-06 08:06:43

I think there are two things.

First, the permissions issue can be workarounded by running sudo install -o tails-persistence-setup -g amnesia -m 0710 -d /media/tails-persistence-setup before creating the persistent volume (via the notification triggered when installing a package). ACLs would be slightly nicer but it looks like our aufs+tmpfs stack does not support them. We could either ensure this directory exists via /usr/lib/tmpfiles.d/ or use chgrp and chmod in t-p-s:bin/tails-fix-persistent-volume-permissions. Regardless, as long as this directory exists before udisks mounts creates the mountpoint, then the amnesia user is allowed to reach the file the ASP config GUI needs to read (see below how I tested this).

But at the end of the persistence config process in t-p-s, when I click the “gear” icon for ASP, no package is listed. I don’t know why but that seems to be a bug in the ASP Python code because permissions seem to be OK:

$ ls -l /media
drwx--x--- 3 tails-persistence-setup amnesia 60 Jun  6 07:43 tails-persistence-setup
$ cat /media/tails-persistence-setup/TailsData/live-additional-software.conf
cowsay
$ test -d /media/tails-persistence-setup/TailsData && echo found
found
$ python3
Python 3.5.3 (default, Jan 19 2017, 14:11:04) 
[GCC 6.3.0 20170118] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> os.path.isdir("/media/tails-persistence-setup/TailsData")
True

So I’ll fix the permissions issue and will then reassign to Alan so he can fix the remaining problem, which seems to be outside of my realm.

#10 Updated by alant 2018-06-25 23:54:43

intrigeri wrote:
> On a build from commit:f92d53d55e1f255756c6619b698674e1e821f141, once tps has created the persistent volume but before clicking the gear icon, I’ve done the same tests as in Bug #15566#note-7 and got the same results => the amnesia user definitely has access to the file it needs to read. *

Great thanks!

> Then I’ve clicked the gear icon and the list of ASP is still empty. So I think I’ve fixed the only part of the bug that was vaguely related to t-p-s and the remaining issue is in the ASP config GUI code => reassigning to Alan.

I’ll do the rest.

#13 Updated by Anonymous 2018-07-05 12:30:23

Alan: if this is ready for QA, you should either assign it to intrigeri or segfault?

#14 Updated by Anonymous 2018-07-05 12:30:53

Or do you plan to review intrigeri’s work here?

#16 Updated by Anonymous 2018-08-07 13:17:02

Alan: is this to be merged somewhere and if yes, when? Do you need help?

#17 Updated by alant 2018-08-09 17:37:45

u wrote:
> Alan: is this to be merged somewhere and if yes, when? Do you need help?

It’s included in the branch being reviewed by segfault, no worry.