Re: Using festival in Orca (opens a shell)

--TblTQzxnieG5tvbl
Content-Type: text/plain; protected-headers=v1; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Date: Fri, 23 Jan 2026 07:09:07 +0100
From: Carles Pina i Estany <[email protected]>
To: [email protected]
Subject: Re: Using festival in Orca (opens a shell)


Hi,

On 18 Jan 2026 at 11:42:34, Samuel Thibault wrote:
> Hello,
>=20
> Carles Pina i Estany, le dim. 18 janv. 2026 07:54:47 +0100, a ecrit:
> > carles@pinux:~$ telnet localhost 1314
> > Trying ::1...
> > Connection failed: S=E2=80=99ha refusat la connexi=C3=B3
> > Trying 127.0.0.1...
> > Connected to localhost.
> > Escape character is '^]'.
> > (system "whoami > /tmp/festival-whoami2.txt")
> > LP
> > nil
> > ft_StUfF_keyOK
>=20
> Ah, festival people didn't restrict what you can do with it?

nope.

On the other hand, they restrict (but I haven't checked anything else)
connecting from outside localhost/127.0.0.1. So, just a plain "festival
--server" and connecting from antoher device in the local network:

carles@pinux:[systemd-socket-activation]~/git/debian/festival/debian$ festi=
val --server
server    Fri Jan 23 06:56:52 2026 : Festival server started on port 1314
client(1) Fri Jan 23 06:57:02 2026 : rejected from 192.168.1.101 not in acc=
ess list

it reaches festival but it rejects connections

> I guess they assumed it wouldn't be run as a system service, but still,
> exposing as a tcp port means any user on the system can access this.
>=20
> The systemd unit recently introduced at least shrinks down the
> permissions to the dynamic user permissions, so it actually reduces
> the concern to "somebody that has localhost tcp access has access as
> anonymous user", which is way better than "somebody that has localhost
> tcp access has access as whatever user who happened to start festival."

Well, this is thanks to the "festival --server" rejecting connections
=66rom outside localhost.

If I enable the socket activation and *after* "festival --server" runs:
festival is reachable from outside localhost. But it drops the
connections. I see the clients reaching it via:

carles@pinux:~$ sudo journalctl -u festival -f

I'll check how to make festival binding only to localhost (I think that
some options could be passed to "festival --server" but I don't know if
this is possible...)

--=20
Carles Pina i Estany
https://carles.pina.cat | [email protected] | [email protected]

--TblTQzxnieG5tvbl
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEth6/Zob9uGYomaJ+qAKIT2ClX4EFAmlzEIMACgkQqAKIT2Cl
X4Ey6g/+LSxvbf3Fsjpyi/LnrcDoZ1kQq2Vw8V3esoW3tXtIIqJ/5y3W+MkStgfI
vQtVFaBVhEsJ7f1Fh7vh5Zw2BaN0fg5snCJtz76CmdmWSVSG1Xqh1MFbLMEuwxtt
DNlLmp1bPQc6z04sNNMzX6oX0IvW/U+BViHsX8QK6Vdp7BCDTji5naxrYk2iQbC4
jDrknIylwLBV2PTuO9TyTxTx4K+fFbGp0r3kDlJL2m+lAReSj1FzPsW5oPgep9Ai
JjrxQl3tICOZey9Kk5KShi8wYStMjbhiR16PwzAwuIUu/xa5R6fM1p+roSAsEZ5/
v5ml8LgYn5amssj/Hv+SBmceoev6CsyVCyaCg4oAWInWHt6uUW4CUdJ5zt7gSxyu
eDsoV+49G8SSW7AMO6jlbYj8VE6fD5OK1KEcSGQBi4X6hcd9x7jnz9t9x0xWObdG
0+IhcNRtCvgaxjinArP/igXAh2BJ2BhO2TWg4RlV19ovOHUNsDA5qK5P2tvRHeTP
sT8sNwyDf6IHjTEYznz3u2LklRYAm/YFcWynd2xbQrVj2OjaGBfVPIewd57hf1G7
TRLiA0B+CuaZ+QPcyN9haXXTKI/fMf3CVBrFJydf2YXBdTlRGtpbb24bhn6jFlKB
IbWvs8lqQUs+tjnsdrMqRGT/HCyjFXz1rSfxYfj6E320Hm+Ctpo=
=5Aup
-----END PGP SIGNATURE-----

--TblTQzxnieG5tvbl--