Repository navigation
daemon: fail2ban bans no longer die on EROFS; TUI y copies through tmux/native/OSC 52 - #287
Merged
Merged
Conversation
…ux/native/OSC 52
The "permissions error" on ban from the TUI (vienna, 2026-10-07) was the
systemd sandbox, not privilege: the root daemon's fail2ban backend writes
/etc/fail2ban/{jail,filter}.d/threatcrush.conf before its first ban, and
ProtectSystem=full mounts /etc read-only, so every ban (manual and automatic)
failed with EROFS. The unit now lists -/etc/fail2ban in ReadWritePaths (the
'-' keeps boxes without fail2ban starting), and explainBlockFailure names the
read-only path and the reinstall instead of passing raw EROFS through.
`y` wrote only an OSC 52 sequence, which iTerm2 drops unless clipboard access
is enabled and tmux drops (DCS-wrapped) without allow-passthrough. Copy now
tries a native helper when a display exists, tmux load-buffer -w, raw and
wrapped OSC 52, and always saves ~/.threatcrush/last-copy.txt; the status bar
says which routes took.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ThreatCrush Security Scan18 finding(s) HIGH/CRITICAL: 1 | MEDIUM: 9 | LOW: 8
Snippets are redacted; ThreatCrush never prints matched credential material. |
ralyodio
added a commit
that referenced
this pull request
Oct 7, 2026
`fail2ban-client reload threatcrush` only reloads a jail the server already runs; for the jail threatcrushd has just written it answers NOK, so with the EROFS fixed (#287) the first ban on a fail2ban box still failed. Fall back to a plain `reload`, which starts new jails and keeps existing bans. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Anthony: "threatcrush ban broken again with permissions error. and y (yank) for copy error doesn't work — in tui".
Ban: root cause
Reproduced on vienna (where the TUI was running):
threatcrush block→EROFS: read-only file system, open '/etc/fail2ban/filter.d/threatcrush.conf' (backend: fail2ban). The daemon runs as root with CAP_NET_ADMIN; the problem isProtectSystem=full, which makes /etc read-only, and the fail2ban backend writes its jail + filter there before the first ban. So on any fail2ban box every ban failed, including auto-defence. dev2 (nftables) was unaffected; TUI ban there works.ReadWritePaths=… -/etc/fail2ban(-= skip if absent, no 226/NAMESPACE)explainBlockFailure: EROFS → names the path +install-service && systemctl restarty / copy
Was OSC 52 only. iTerm2 drops it unless "Applications in terminal may access clipboard" is on; tmux drops the DCS-wrapped form without
allow-passthrough. Newtui/clipboard.ts: native helper (pbcopy locally, wl-copy, xclip, xsel) →tmux load-buffer -w→ raw + wrapped OSC 52 → always~/.threatcrush/last-copy.txt; status bar says which routes took.Tests
-/etc/fail2ban, every path absoluteyon dev2 inside tmux → tmux buffer + file had the error text🤖 Generated with Claude Code