NethSecurity 8.8.0 Beta2 ready for testing!

mark_nl · July 9, 2026, 5:56pm

Could you share the commit Beta2 is based on? (or even better tag it?)

Because the ns-storage package is stubborn in my effort to port Nethsecurity to arm64 I scrutinized this package. Now I take the opportunity to report issues that look odd to me.

As mentioned before the ns.ha has the same bug as found in ns-storgage. The call to get path to the dhcp-leasefile in get_dhcp_leasefile has one argument to much
(second " dhcp"):

github.com/NethServer/nethsecurity

packages/ns-api/files/ns.ha

b9634a2a9


      
          """
          
          def get_device_from_ip(uci, ipaddr):
              for n in utils.get_all_by_type(uci, 'network', 'interface'):
                  if uci.get('network', n, 'ipaddr', default=None) == ipaddr:
                      # Return a tuple with the (interface, device)
                      return (n, uci.get('network', n, 'device', default=None))
              return (None, None)
          
          def get_dhcp_leasefile(uci):
              return uci.get('dhcp', 'ns_dnsmasq', 'dhcp', 'leasefile', default='/tmp/dhcp.leases')
          
          def get_main_vrrp_interface(uci):
              for section in utils.get_all_by_type(uci, 'keepalived', 'ipaddress'):
                  if uci.get('keepalived', section, 'name', default=None) != 'lan_ha':
                      continue
          
                  ns_link = uci.get('keepalived', section, 'ns_link', default='')
                  if ns_link.startswith('network/'):
                      return ns_link.split('/', 1)[1]

This below does not determine whether the os_device is found; even if grep exits non zero as the mount point /boot is not found; piping that result through uniq and awk exits zero as long uniq and awk are found in the (subprocess) path.
Please note it would be very beneficiary for the arm port effort if Nethsecurity looks for the partition mounted on /rom instead of /boot to determine the block device on which re OS lives.

github.com/NethServer/nethsecurity

packages/ns-api/files/ns.storage

b9634a2a9


      
              except:
                  pass
          
              return {"devices": devices}
          
          
          def get_configuration():
              u = EUci()
              os_device = ''
              try:
                  proc = subprocess.run("mount | grep /boot | uniq | awk '{print $1}'", shell=True, check=True, capture_output=True, text=True)
                  os_device = proc.stdout.strip()[:-1]
              except:
                  return utils.generic_error("os_device_not_found")
          
              ret = {"name": None, "size": None, "path": None, "model": None, "vendor": None}
              try:
                  info = get_storage_info(u)
                  p = subprocess.run(["/usr/bin/lsblk", "--json", "-b", "--output-all"], check=True, capture_output=True, text=True)
                  data = json.loads(p.stdout)
                  cur = None

It is not possible to setup the permanent storage on a second nvme (or a SD-card) because their partition naming schemes are different form traditional block devices. The partition numbers have a p prefix. Here the offending line that assumes the newly created partition is called {device}1 on nvme’s, emmc 's and SD-cards it is {device}p1.

github.com/NethServer/nethsecurity

packages/ns-storage/files/ns-storage-setup-disk

b9634a2a9


      
          device=$1
          
          [ -z "$device" ] && eerror "Device '$device' not found"
          [ ! -e "/sys/class/block/$(basename "$device")" ] && eerror "Device '$device' is not a block device"
          mount | grep -q "$device" && eerror "Device '$device' is already mounted"
          
          # cleanup partitions
          dd if=/dev/zero of="$device" bs=512 count=1 conv=notrunc 2>/dev/null
          # create a single ext4 partition
          parted -s -a optimal "$device" mklabel gpt -- mkpart primary  1 -1 >/dev/null
          mkfs.ext4 -q -F -L ns_data "$device"1 >/dev/null
          echo '{"device": "'${device}1'"}'

Please note it would be very beneficiary for the arm port effort if Nethsecurity did not make assumptions on the partition naming scheme, possible like this:

While testing my solution for the partition naming scheme on X86_64 I removed and (re)created the permanent storage on different devices such as the nvme the OS lives on, a second nvme and a usb-drive.
Even though all is working well, I observed at some point the wrong partition was shown in the UI. I have not figured out why but have an strong hunch: If the permanent storage is removed the partition keeps the label ns_data. So while testing I ended up with 3 partitions labelled ns_data

root@NethSec:~# lsblk -o name,mountpoint,label,size,uuid
NAME          MOUNTPOINT LABEL         SIZE UUID
loop0         /overlay   rootfs_data 226.8M b6bcca32-4019-4154-94d8-2db91d6912b2
sda                                   59.5G
└─sda1                   ns_data      59.5G ecdc7c62-d821-4004-b458-cac8ed4002ce
nvme0n1                              465.8G
├─nvme0n1p1   /boot      kernel         16M 1234-ABCD
├─nvme0n1p2   /rom                     300M
├─nvme0n1p128                          239K
└─nvme0n1p3   /mnt/data  ns_data     465.4G 051b1224-5101-43df-8a56-9b25accd3c3a
nvme1n1                              931.5G
└─nvme1n1p1              ns_data     931.5G cd71df60-e662-4d25-b561-3baa735a07c7

Note nvme0n1p3 is mounted on /mnt/data not nvme1n1p1