AdminSysGNULinux

Outils pour utilisateurs

Outils du site

Piste : • blog
blog

Table des matières

4 billet(s) pour septembre 2026

Notes HTTP Strict Transport Security - HSTS2026/09/18 11:04Jean-Baptiste
Notes GNU Linux GPU carte graphiques2026/09/08 15:49Jean-Baptiste
Notes GNU Linux graphique2026/09/08 15:42Jean-Baptiste
Notes urlencoding - passer des mots de passe en HTTPS2026/09/03 17:58Jean-Baptiste

chroot escape

Voir aussi container escape :

Source : https://medium.datadriveninvestor.com/pivot-root-vs-chroot-the-2025-container-security-choice-36ff392d1af5 

mkdir hideout
chroot hideout      # first redirect
for i in {1..800}; do
  cd ..             # climb back toward real /
done
chroot .            # second redirect resets limits
cat /srv/top-secret.txt

Solution : utiliser pivot_root 

# 1) Start a fresh namespace
unshare --mount --pid --fork bash
 
# 2) Prepare a new root
mkdir -p /mnt/newroot/oldroot
mount --bind / /mnt/newroot/oldroot  # temporary parking spot
 
# 3) Swap roots
pivot_root /mnt/newroot /mnt/newroot/oldroot
 
# 4) Detach the former root
umount -l /oldroot
2026/06/02 16:37 · Jean-Baptiste
,

Pb Podman

Voir aussi :

  • /proc/sys/user/max_user_namespaces

Err ldap - no subuid

Podman userland avec LDAP 

$ podman ps
ERRO[0000] cannot find UID/GID for user user1@acme.local: no subuid ranges found for user "user1@acme.local" in /etc/subuid - check rootless mode in man pages.
WARN[0000] Using rootless single mapping into the namespace. This might break some images. Check /etc/subuid and /etc/subgid for adding sub*ids if not using a network user
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES
Solution
#echo "$(id -un):$(id -u):65536" | sudo tee -a /etc/subuid
#echo "$(id -gn):$(id -g):65536" | sudo tee -a /etc/subgid
 
sudo usermod --add-subuids "$(id -u)-$(( $(id -u) + 65535))" --add-subgids "$(id -g)-$(( $(id -g) + 65535))" "$(id -un)"

Err Failed to get rootless runtime dir for DefaultAPIAddress: lstat /run/user/1000: no such file or directory

Voir : 

$ podman ps
WARN[0000] Failed to get rootless runtime dir for DefaultAPIAddress: lstat /run/user/1000: no such file or directory
WARN[0000] RunRoot is pointing to a path (/run/user/1000/containers) which is not writable. Most likely podman will fail.
Error: default OCI runtime "runc" not found: invalid argument
sudo mkdir /run/user/1000
sudo chown 1000:1000 /run/user/1000
$ podman ps
WARN[0001] "/" is not a shared mount, this could cause issues or missing mounts with rootless containers
WARN[0001] The cgroupv2 manager is set to systemd but there is no systemd user session available
WARN[0001] For using systemd, you may need to log in using a user session
WARN[0001] Alternatively, you can enable lingering with: `loginctl enable-linger 1000` (possibly as root)
WARN[0001] Falling back to --cgroup-manager=cgroupfs
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES
WARN[0003] Failed to add pause process to systemd sandbox cgroup: dial unix /run/user/1000/bus: connect: no such file or directory
mount --make-shared /
$ podman ps
WARN[0000] The cgroupv2 manager is set to systemd but there is no systemd user
WARN[0000] For using systemd, you may need to log in using a user session
WARN[0000] Alternatively, you can enable lingering with: `loginctl enable-linge
WARN[0000] Falling back to --cgroup-manager=cgroupfs
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES
Solution
sudo loginctl enable-linger management
$ podman ps
ERRO[0001] Refreshing container 95cfa640ab028aed83857a9288956d4aff585eb863e8041a737d4be9f98b64df: acquiring lock 0 for container 95cfa640ab028aed83857a9288956d4aff585eb863e8041a737d4be9f98b64df: file exists
ERRO[0001] Refreshing container 76f17f10362a77c722eb00dff478e2f1245a4860a6b11f7cdb4b2e42d3ae80f7: acquiring lock 1 for container 76f17f10362a77c722eb00dff478e2f1245a4860a6b11f7cdb4b2e42d3ae80f7: file exists
ERRO[0001] Refreshing volume b7fa2f4a2f95a538232ec51f0ff6defc3613a6568fd2dedef13d1bd6f1113ee2: acquiring lock 3 for volume b7fa2f4a2f95a538232ec51f0ff6defc3613a6568fd2dedef13d1bd6f1113ee2: file exists
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES
$ podman ps
CONTAINER ID  IMAGE       COMMAND     CREATED     STATUS      PORTS       NAMES

Autre solution à tester

${HOME}/.config/containers/containers.conf 

[engine]
events_logger = "file"
cgroup_manager = "cgroupfs"

Err Error: initializing source - manifest unknown

Voir aussi : 

$ podman pull docker.io/ansible/ansible-container-builder
Trying to pull docker.io/ansible/ansible-container-builder:latest...
Error: initializing source docker://ansible/ansible-container-builder:latest: reading manifest latest in docker.io/ansible/ansible-container-builder: manifest unknown
Solution

Il manquait le tag 

$ podman search --list-tags docker.io/ansible/ansible-container-builder
NAME                                         TAG
docker.io/ansible/ansible-container-builder  0.1
docker.io/ansible/ansible-container-builder  0.2
docker.io/ansible/ansible-container-builder  0.3
podman pull docker.io/ansible/ansible-container-builder:0.3

FIXME

2026/05/28 17:16 · Jean-Baptiste
, , ,

Go lang - process

Une lib qui marche autant pour windows et GNU/Linux 

package main
 
import (
	"fmt"
	"github.com/shirou/gopsutil/v4/process"
)
 
func main() {
	proceses_list, _ := process.Processes()
 
	for _, p := range proceses_list {
		processName, _ := p.Name()
		fmt.Printf("PID:%v ; %v\n", p.Pid, processName)
	}
}
$ wine main.exe 
PID:32 ; main.exe
PID:56 ; services.exe
PID:68 ; winedevice.exe
PID:104 ; plugplay.exe
PID:112 ; explorer.exe
PID:136 ; svchost.exe
PID:164 ; winedevice.exe
PID:252 ; rpcss.exe
PID:288 ; conhost.exe

Term / Kill

	proceses_list, _ := process.Processes()
 
	for _, p := range proceses_list {
		processName, _ := p.Name()
 
		if processName == "sleep" {
			p.Kill()
		}
		if processName == "cmd.exe" {
			p.Kill()
		}
	}

FIXME

2026/05/20 23:17 · Jean-Baptiste
, ,

Go lang - les fichiers

Exemple lecture fichier texte 

package main
 
import (
        "bufio"
        "fmt"
        "os"
)
 
func main() {
 
        file, err := os.Open("input.txt")
        if err != nil {
                panic(err)
        }
        defer func() {
                if err := file.Close(); err != nil {
                        panic(err)
                }
        }()
        scanner := bufio.NewScanner(file)
 
        // Iterate over each line
        for scanner.Scan() {
                line := scanner.Text()
                fmt.Println(line)
        }
 
}

Exemple d'écriture texte 

func write_file(filename string, data string) {
	file, err := os.Create(filename)
	if err != nil {
		panic(err)
	}
	defer func() {
		if err := file.Close(); err != nil {
			panic(err)
		}
	}()
	_, err = file.WriteString(data)
	if err != nil {
		panic(err)
	}
 
}

Exemple de copie de fichier

Voir : https://opensource.com/article/18/6/copying-files-go 

func copyFile(src, dest string) {
	input, err := ioutil.ReadFile(src)
	if err != nil {
		panic(err)
	}
 
	err = ioutil.WriteFile(dest, input, 0644)
	if err != nil {
		fmt.Println("Error creating", dest)
		panic(err)
	}
}

Fichier droits POSIX octal mode

Voir aussi : 

	file, err := os.Lstat("/tmp/plop")
	if err != nil {
		panic(err)
	}
	mode := file.Mode()
	fmt.Printf("%s\n", mode)
	fmt.Printf("%o\n", mode)

Exemple lecture fichier CSV 

package main
 
import (
        "encoding/csv"
        "fmt"
        "log"
        "os"
        "regexp"
)
 
func IsMatchingRegex(s string, regex string) bool {
        return regexp.MustCompile(regex).MatchString(s)
}
 
func main() {
        file, err := os.Open("data.csv")
        if err != nil {
                log.Fatal(err)
        }
        defer file.Close()
 
        // Read all records from the CSV file
        reader := csv.NewReader(file)
        reader.Comma = ';'
        records, err := reader.ReadAll()
        if err != nil {
                log.Fatal(err)
        }
 
 
        for _, record := range records[1:] {
                if IsMatchingRegex(record[0], "^#") {
                        continue
                }
 
                fmt.Println(record[0])
                fmt.Println(record[1])
        }
}

Exemple de calcul de hash d'un fichier 

package main
 
import (
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"io"
	"os"
)
 
func hashFile(filePath string) (string, error) {
	file, err := os.Open(filePath)
	if err != nil {
		return "", fmt.Errorf("failed to open file: %w", err)
	}
	defer file.Close()
 
	hasher := sha256.New()
	if _, err := io.Copy(hasher, file); err != nil {
		return "", fmt.Errorf("failed to hash file: %w", err)
	}
 
	return hex.EncodeToString(hasher.Sum(nil)), nil
}
 
func main() {
	hash, err := hashFile("/tmp/plop")
	if err != nil {
		panic(err)
	}
 
	fmt.Println(hash)
}
2026/05/14 20:40 · Jean-Baptiste
, , ,

Go lang - regex

// Source - https://stackoverflow.com/a/41551456
// Posted by Mr_Pink, modified by community. See post 'Timeline' for change history
// Retrieved 2026-05-14, License - CC BY-SA 3.0
 
func IsMatchingRegex(s string, regex string) bool {
    return regexp.MustCompile(regex).MatchString(s)
}

FIXME

2026/05/14 20:11 · Jean-Baptiste
, ,

<< Billets récents | Anciens billets >>

blog.txt · Dernière modification : de 127.0.0.1
Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki