Search Results: "spa"

22 October 2006

Martin Michlmayr: Testing GCC 4.2 on ARM

On Friday, a branch for GCC 4.2 finally got created, which means that we will hopefully see a release in a few months. The branch should have been created ages ago but the number of regressions just wouldn't go under 100 until recently. During that time, basically since I completed my tests with GCC 4.1, I've been busy testing snapshots of 4.2. I've mainly been testing on em64t (amd64), powerpc and ia64, but I also did some runs on alpha, mips, mipsel, s390 and sparc. Recently, I started testing it on ARM. Being an embedded architecture, ARM isn't terribly fast compared to some other architectures. However, Intel's IOP line is quite interesting and is used in a number of NAS devices. They typically include SATA and often have expandable memory. The device some ARM people are currently working with is the Thecus N2100. A port of debian-installer is underway but more on that later. Since my N2100 is not permanently connected to the Internet, Riku Voipio kindly gave me access to his to do some GCC tests. I started several weeks ago using gcc-snapshot 20060922-1 and it has been compiling happily since. I sort packages by their age, starting with old packages, so while there has been quite a bit of progress since I started, lately it has been going quite slowly. With about 2000 packages compiled in 3.5 weeks, I reckon that GCC 4.2 will be released before I've compiled the full archive. I've therefore been thinking of using distcc to speed the process up. The idea is to run the build process natively on the ARM box but use distcc to perform the actual compilation on another box, namely on a fast machine that has an ARM cross compiler. Unfortunately, I don't have access to such a setup right now. However, I strongly believe that this is a good alternative to test GCC on slower systems and in fact Bill Allombert is currently testing whether it could be used for the m68k port. Finally, Intel's new IOP 34x CPUs are also interesting for this kind of work given that they feature a cache and go up to 1.2 GHz with two cores. P.S. If someone is interested in fixing bugs, I have tagged package bugs related to GCC 4.2.

Andrew Pollock: [debian] Mirror coordination progress

I've finally caught up on all the backlog of email to mirrors@debian.org, and I've been added to the webwml group, so now I need to go through all of the outstanding mirror submission bug reports, and figure out which ones are still valid for acting on. There were probably less than 20 legitimate emails in the 12 months of backlog, and one metric crapload of spam.

Andrew Pollock: [debian] Going to Spain

Cool, I'm heading to Spain for the QA meeting in Extremadura in December. Not quite so cool is that I'll be flying out two days after getting back from a holiday in Australia. I suspect I'm going to be totally shagged by the time I get back. $DEITY only knows what timezone my body will be in. Better get my QA pants back on again.

Clint Adams: I can make love disappear

Down by the river, there are people loudly playing soccer, oblivious to the overpowering stench wafting from the trees. Others stand on the pedestrian bridge, gawking at the smog-shrouded peak of Mount Peeweehockey to the south, or the climbing spires of Sturmdrangsturm to the north. On the left bank, there is naught but cobbles and stenchless trees. I walked along the quay for a time, and ducked into a cove wherein I saw a tavern called the Monkey's Door. Were I to give a complete account of what was therein, I would incur the wrath of the Monkey Girl, so I will refrain from so imparting. While supping on a m lange of blood and sour cream, I noticed an old skinhead with a backpack and a gym bag, both bursting at the seams. He was drinking hard sparkling cider and chain-smoking Camel Blues, while reading the smallest copy of Eldest that I have ever seen in my life. That is to say, it was the same thickness as the standard hardcover, but only a few inches long and wide. My favorite skinhead used to do a cover of Romeo and Juliet in a faux Filipina accent. Her cover was of the Indigo Girls cover, since she preferred it to the original. I guess if you're going to be a skinhead, your judgment has to be a bit suspect. Still, her rendition was hilarious. Hopefully she's still smoking sage, and not Camel Blues.

Adam Rosi-Kessel: Channel Cafe: Respectable Espresso

One of my longstanding frustrations living in Boston is the lack of artisanale espresso sources. Starbucks is, of course, ubiquitous (I think there are four within a block of where I work), and at least espresso drinks there aren’t bad, but there is little-to-no artistry involved. They aren’t aiming for perfection, they’re aiming for absolute consistency, mass appeal, and caffeine. Ever since Starbucks started opening in strip malls and grocery stores like Safeway, I’ve doubted whether they even care about maintaining an image of serving an elite population. This article presents some good background on the art of espresso, but apparently the only place it’s happening in Greater Boston is on the other side of the Charles River, which might as well be Prince Edward Island. (See also this article about Murky Coffee, my and Steve’s favorite coffee place in DC). I’d love to support Emack and Bolio’s, my neighborhood coffee shop, but the coffee and espresso there are inconsistent at best. I don’t get the feeling that the baristas there get a lot of training. Or that they even consider themselves to be baristas (according to Wikipedia: “one who has acquired some level of expertise in the preparation of espresso-based coffee drinks,” or “a professional who is highly skilled in coffee preparation, with a comprehensive understanding of coffee, coffee blends, espresso, quality, coffee varieties, roast degree, espresso equipment, maintenance, latte art, etc.”). Hey, while I’m talking about Starbucks, I should mention that Google Maps is wrong. There is no Starbucks at 1510 Centre Street in Roslindale, Massachusetts. It’s nearly a mile away from the real Starbucks at 1810 Centre Street, that has the same phone number. Wouldn’t you think Google could have figured that out? Can someone tell them? Anyway, I recently discovered the Channel Cafe (deserving a PageRank boost), just a brisk 8 minute walk from my office down Summer Street across the Fort Point Channel, actually has quite respectable espresso and espresso drinks. I first went there for lunch several months ago and the place was mostly empty — more recently, there seems to be a line up the steps every day. (The cafe is in the basement of art gallery space and is owned by one of the Fort Point artists.) Aside from excellent espresso, they have a great menu, especially for vegetarians, with entrees such as baked tofu with pan steamed vegetables, peanut dipping sauce, jasmine rice, mandarin and oranges, and basil and ricotta ravioli with fresh tomatoes, zucchini, sweat pea and mint coulis, and parmesan cheese. All for under $10, which is a bargain in the greater financial district. I’m afraid the line up the stairs may soon be out the door… It’s a good sign for the burgeoning Seaport District, though.
(…more espresso art…)

21 October 2006

Ben Hutchings: Finally I'm going to shut up about these DVDs

As posted to debian-devel-announce and debconf-announce (and partially written by Holger): On behalf of the DebConf6 video team I'm proud to announce the DebConf6 DVDs! They include all formal sessions from Debian Day and DebConf, plus the group photos, the video team BoF, and some documentary videos made by Gabriella Coleman. They are divided into (there is a small overlap between these). The DVD images are now available for download along with the source videos, as are the software and menu design used for them. You can also order DVDs to be shipped to you in a nice box. Many thanks to the sponsors, organisers and other people who made DebConf6 a fun and productive event to be remembered. See you at DebConf7 in Edinbourgh - or maybe DebConf8 in your town! Finally, I apologise for the delay in producing these discs. We ran into a number of technical problems along the way but it's primarily a result of discouragement and procrastination on my part. However I believe that the VideoLink software is now sufficiently reliable and that next year's DVDs need not be so dependent on me.

Per Olofsson: cheap mp3 players

I have bought a dirt cheap SanDisk mp3 player (< 40). It has 1GB of memory, but no ogg vorbis support. So I have to use mp3. Also, I want to conserve space so I can have many songs and radio shows. And I'm not fanatic about audio quality, I just want it to sound OK and without artifacts.

I found this command line for LAME:
lame --vbr-new -V5
It's fast, uses VBR, and generates on average circa 128 kbits/sec of data. The quality seems to be quite good. This is the exact same command line options as was used in this public listening test.

Together with the ripit package and some configuration, I just have to type ripit to rip a CD. Neat!

20 October 2006

Martin F. Krafft: Freeing the primary IP address

I have a machine in Singapore and have been asked to switch it to another IP address (don't ask...). Due to numerous reasons, I do not want to reboot the machine, so I am faced with the task of switching the primary IP address of a remote host via SSH. Fun. In the following remote identifies the remote machine, local the workstation from where the SSH session originates. 1.2.3.150 is the old IP that I have to free, and 1.2.3.200 is the new IP. 1.2.3.129 is the router IP and since it's a /25 network, 1.2.3.128 is the network address. I'll be using the ip command from the iproute package exclusively. ifconfig must DIE! The first step of this endeavour is making sure that traffic to your new IP is not going to be caught by the packet filter. This is simple enough: 
remote# ip addr add 1.2.3.200/25 dev eth0
local# nc 1.2.3.200 22
SSH-2.0-OpenSSH_4.3p2 Debian-3~bpo.1
We have thus added a secondary address and verified that it can communicate, at least receive packets on port 22. However, since it is a secondary address, it depends on the primary address and will be removed if you remove the primary from the interface. We thus need to get tricky: 
remote# ip addr del 1.2.3.200/25 dev eth0
remote# ip addr add 1.2.3.200/32 dev eth0
Note how we're adding the address with a /32 netmask instead. This makes it independent of the current primary address. Now the fun begins. Close the SSH session and log in to the new IP: 
remote# exit
local# ssh root@1.2.3.200
And remove the primary IP; yes, you heard me: 
remote# ip route
1.2.3.128/25 dev eth0  proto kernel  scope link  src 1.2.3.150
default via 1.2.3.129 dev eth0
remote# ip addr del 1.2.3.150/25 dev eth0
remote# ip route
default via 1.2.3.129 dev eth0
Gotta love Linux: it saved the default route because it was still reachable from the 1.2.3.200/32 address, and only removed the link-local route. We could stop right here for there is no real reason why this machine should have a link-local route or even know about the network to which it is attached; but we won't... instead, we'll add the new address again (a second time), now with a proper netmask: 
remote# ip addr add 1.2.3.200/25 brd 1.2.3.255 dev eth0
remote# ip addr del 1.2.3.200/32 dev eth0
remote# ip route
1.2.3.128/25 dev eth0  proto kernel  scope link  src 1.2.3.200
default via 1.2.3.129 dev eth0
After modifying /etc/network/interfaces, the deed is done. The next time I do this I might consider a safety net of the form: 
remote# echo 'ifdown --force eth0; ifup eth0'   at now + 10 minutes
But that would only have been half as fun. Of course it goes without saying that the above comes without warranties, if you try it out, you do so at your own risk. :) NP: Neurosis / The Eye of every Storm Update: It's been proposed to just run: 
remote# ip addr del 1.2.3.150/25 dev eth0; \
  ip addr add 1.2.3.200/25 dev eth0; \
  ip route add default via 1.2.3.128
This may well work, especially if run within a screen session (I've had times when the shell did not execute subsequent commands after being cut off from the controlling tty). However, this method does not guard against typoes. Or did you spot the typo in the above set of commands? The method I provided above seems resilient to typos as no command ever affects the current connection.

Russell Coker: new hybrid Camry


Toyota in the US has released a hybrid Camry which seems to be the larger Prius that many people have wanted. Since it's release the Prius has been greatly desired by people who like technology and the environment. The only down-side to the Prius is that it is a small car and doesn't have as much room for baggage or passengers as you might desire.

The new Camry Hybrid has the Continuously Variable Transmission (CVT) that gives the Prius it's smooth ride, the keyless start (optional), DVD navigation via a large screen, six airbags, and tire pressure monitoring.

The above review states that the test car shuddered when the engine started and made odd mechanical noises. It's not indicated in the article but I suspect that the car may have been an early production test model rather than the type of car you will get if you actually buy one. The Prius I drove did not shudder or make any odd noises (in fact hardly any noise that I could hear). Maybe if I drove a Prius in a country area I would hear some noises, but in the city (which the Prius is designed for) the Prius didn't make any
engine sounds I could here. I expect that the hybrid Camry will perform as well as the Prius in this regard.

The review describes the hybrid Camry as giving 35mpg with a driving pattern that was not the most fuel efficient, that is roughly 6.7 liters per 100Km which is more than the quoted rate for some small cars. The four-door Smart cars are advertised as using 5.8L/100Km and Diesel allows even better efficiency. But if you want the space of a Camry then 7.1L/100Km is fairly good, especially considering that you could reduce that by driving more slowly. Also we have to consider that the primary aim of the Prius design (and presumably the design of the hybrid Camry) is to protect the environment by reducing the poisonous emissions, this may reduce the fuel efficiency slightly (the aim of reducing emissions is not always compatable with the aim of reducing fuel use).

There are apparently 3.785 liters to a US gallon. A US mile has 1760 yards and a yard is apparently 0.9144m, so a US mile would be 1760*0.9144 = 1609 meters or 1.609Km.

3.785*100/1.609/X

To convert MPG (the US measurement of fuel use when based on a US mile and a US gallon) to L/100KM (the Australian way of measuring fuel use) you use the above formula (where X is the MPG rating). I included this information here because I couldn't find it anywhere else.

I was going to post this before but was side-tracked by the flash issue.

Also I've included a beard picture for day 12 (yesterday).

Martin F. Krafft: Loop-mounting partitions from a disk image

Every now and then, I have a disk image (as produced by cat, pv, or dd) and I need to access separate partitions. Unfortunately, the patch allowing partitions on loop devices to be accessed via their own device nodes does not appear to be in the latest (Debian) 2.6.18 kernels the loop module does not have a max_part parameter, according to modinfo. So this time I sat down to come up with a recipe on how to access the partitions, and after some arithmetic and much swearing at disk manufacturers, and especially the designers of the msdos partition table type, I think I have found the solution, and the urge to document it for posterity. It's all about the -o parameter to losetup, which specifies how many bytes into the disk a given partition starts. Getting this number isn't straight forward. Well, it is, if you know how, which is why I am writing this. Let's take a look at a partition table, with sectors as units: 
$ /sbin/fdisk -lu disk.img
You must set cylinders.
You can do this from the extra functions menu.
Disk disk.img: 0 MB, 0 bytes
255 heads, 63 sectors/track, 0 cylinders, total 0 sectors
Units = sectors of 1 * 512 = 512 bytes
      Device Boot      Start         End      Blocks   Id  System
disk.imgp1   *          63       96389       48163+  83  Linux
disk.imgp2           96390     2056319      979965   82  Linux swap / Solaris
disk.imgp3         2056320    78140159    38041920    5  Extended
disk.imgp5         2056383     3052349      497983+  83  Linux
disk.imgp6         3052413    10859939     3903763+  83  Linux
disk.imgp7        10860003    68372639    28756318+  83  Linux
disk.imgp8        68372703    76180229     3903763+  83  Linux
disk.imgp9        76180293    78140159      979933+  83  Linux
The first few lines is fdisk complaining not being able to extract the number of cylinders, since it has to operate on a file which does not provide an ioctl interface. The first important data are the units, which are stated to be 512 bytes per sector. We take note of this value as the factor for use in the next operation. Let's say we want to access the 7th partition, which is 10860003 sectors into the disk, according to the fdisk output. We know that each sector is 512 bytes, so: 
10860003 * 512 = 5560321536
Passing this number to losetup produces the desired result: 
# losetup /dev/loop0 disk.img -o $((10860003 * 512))
# file -s /dev/loop0
/dev/loop0: Linux rev 1.0 ext3 filesystem data
# mount /dev/loop0 /mnt
[...]
# umount /mnt
# losetup -d /dev/loop0
If the partition really holds a normal filesystem, you can also let mount set up the loop device, and manage it automatically: 
# mount -o loop,offset=$((10860003 * 512)) disk.img /mnt
[...]
# umount /mnt
And since there's aparently no means to automate the whole process for an entire disk, I hacked up plosetup. Enjoy: 
# plosetup lapse.hda .
I: partition 1 of lapse.hda will become ./lapse.hda_p1 (/dev/loop0)...
I: plosetup: skipping partition 2 of type 82...
I: plosetup: skipping partition 3 of type 5...
I: partition 5 of lapse.hda will become ./lapse.hda_p5 (/dev/loop1)...
I: partition 6 of lapse.hda will become ./lapse.hda_p6 (/dev/loop2)...
I: partition 7 of lapse.hda will become ./lapse.hda_p7 (/dev/loop3)...
I: partition 8 of lapse.hda will become ./lapse.hda_p8 (/dev/loop4)...
I: partition 9 of lapse.hda will become ./lapse.hda_p9 (/dev/loop5)...
# ls -l
total 0
lrwxrwxrwx 1 root root 10 2006-10-20 13:25 lapse.hda_p1 -> /dev/loop0
lrwxrwxrwx 1 root root 10 2006-10-20 13:25 lapse.hda_p5 -> /dev/loop1
lrwxrwxrwx 1 root root 10 2006-10-20 13:25 lapse.hda_p6 -> /dev/loop2
lrwxrwxrwx 1 root root 10 2006-10-20 13:25 lapse.hda_p7 -> /dev/loop3
lrwxrwxrwx 1 root root 10 2006-10-20 13:25 lapse.hda_p8 -> /dev/loop4
lrwxrwxrwx 1 root root 10 2006-10-20 13:25 lapse.hda_p9 -> /dev/loop5
# plosetup -c .
# ls -l
total 0
(this post is dedicated to Penny for no other reason than the tunes I am listening to right now) NP: Fly My Pretties / The Return of Fly My Pretties Update: Be careful about the $((...)) style arithmetic. dash manages to overflow at 32bit. zsh and bash seem to get it right. If in doubt, use perl or a calculator.

Sam Hocevar: Dead LCD pixels

Dead LCD pixels Dear lazyweb, after 12 hours of displaying this animated GIF, the dead LCD pixel on my laptop disappeared. Probably worth a try.

19 October 2006

Andrew Pollock: [tech] Asterisk and MythTV integration

After much more work than was necessary, I managed to get Asterisk to blat on the TV the caller ID information of an incoming call. Next I need to see if I can pause the TV, and resume it when the call ends. The MythTV side just needed to be configured to listen on the UDP notify port, the XML templates and whatnot were already there for it (I think installed by MythPhone), so all I had to do was get Asterisk to run this script when a call came in: 
#!/usr/bin/perl
use Asterisk::AGI;
use IO::Socket;
# Set this to the broadcast address for your network
$netbroadcast = "172.16.0.255";
$AGI = new Asterisk::AGI;
my %input = $AGI->ReadParse();
my $num = $input 'callerid' ;
my $name = $input 'calleridname' ;
($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime();
$date = sprintf("%02d/%02d/%4d %d:%02d:%02d",$mday,$mon+1,$year+1900,$hour,$min,$sec);
$sock = IO::Socket::INET->new(PeerPort  => 6948,
                              PeerAddr  => $netbroadcast,
                              Proto     => udp,
                              Broadcast => 1 ) or die "Can't bind : $@\n";
print $sock <<EOT;
<?xml version="1.0"?>
<mythnotify version="1"><container name="notify_cid_info"><textarea name="notify_cid_line"><value>Unused</value></textarea><textarea name="notify_cid_name"><value>NAME: $name</value></textarea><textarea name="notify_cid_num"><value>NUM : $num</value></textarea><textarea name="notify_cid_dt"><value>$date</value></textarea></container></mythnotify>
EOT
close $sock;
exit(0);
That was accomplished by just adding an AGI(mythcid.agi) application call to one my existing extensions that handled incoming calls. Future enhancements will involve displaying who the caller wants to speak to after they've selected the appropriate response from the menu we give most callers. The Asterisk::AGI Perl module was a bit hard to track down. I've made a 2 second (dh-make-perl) Debian package of it, available here. If I get sufficiently motivated, I'll consider cleaning it up and uploading it to Debian.

Martin-&#201;ric Racine: Linutop in Arvutimaailm and Eesti Ekspress

Yours truly appears this week in computer magazine Arvutimaailm [Estonian] and in the technology insert of newspaper Eesti Ekspress [Estonian], in feature articles about the Linutop. Both articles are signed by Elver Loho of the IT-Neeger team.

Kai Hendry: Where was I?


School children learning about Free software I feel a little stupid for my last post about my unstable machine. It was the hardware to blame and my hard drive finally crashed during a Linux conference in Mendoza, Argentina. Typical. At the conference there wasn´t much new for me and I regret that I didn´t get organised enough to give a talk about the Web and WHATWG stuff. Though I did manage to meet good people and talk about some topics that are of interest to me. As usual the fabulous friendly CafeLUG geeks from Buenos Aires were there, led by the wonderful DD Marcela. I also met an inspiring guy from Cordoba who founded a successful software company that works with free software. His brother gave a great talk about it at the conference. I really love to see Free software power people to start a business. Oh and about my thinkpad X40 hard drive replacement. With the help of another new friend Fredrico from Mendoza, we called up IBM in Buenos Aires and arranged a new hard drive and a battery within 5 days! I didn´t know if my machine was under warranty still, phew. Unfortunately IBM called the next day saying they didn´t have any stock and the wait from the US is about 2 weeks. Since I have no idea where I will be in two weeks (ok, probably Sao Paulo, Brazil) I cancelled that request and now I have found a free Windoze (hopefully not trojaned) terminal just over the Andes, in Santiago Chile. Tough life!

Kai Hendry: Where was I?


School children learning about Free software I feel a little stupid for my last post about my unstable machine. It was the hardware to blame and my hard drive finally crashed during a Linux conference in Mendoza, Argentina. Typical. At the conference there wasn’t much new for me and I regret that I didn’t get organised enough to give a talk about the Web and WHATWG stuff. Though I did manage to meet good people and talk about some topics that are of interest to me. As usual the fabulous friendly CafeLUG geeks from Buenos Aires were there, led by the wonderful DD Marcela. I also met an inspiring guy from Cordoba who founded a successful software company that works with free software. His brother gave a great talk about it at the conference. I really love to see Free software power people to start a business. Oh and about my thinkpad X40 hard drive replacement. With the help of another new friend from Mendoza, we called up IBM in Buenos Aires and arranged a new hard drive and a battery within 5 days! I didn’t know if my machine was under warranty still, phew. Unfortunately IBM called the next day saying they didn’t have any stock and the wait from the US is about 2 weeks. Since I have no idea where I will be in two weeks (ok, probably Sao Paulo, Brazil) I cancelled that request and now I have found a free Windoze (hopefully not trojaned) terminal just over the Andes, in Santiago Chile. Tough life!

18 October 2006

Ben Hutchings: Ich lerne die deutsche Sprache

For some years I've been meaning to learn more German than I remember from my GCSE and the little I've managed to absorb from [info]tea_cantata and others speaking it around me. I am repeatedly embarrassed by my inability to join in conversation when we visit Nattie's relatives in Germany. In fact I've made some attempts to learn from books and tapes, but with little effect. Nattie finally persuaded me to sign up for an evening AS (half an A-Level) German course starting this term. It's tough going with only one lesson (2.5 hours) per week though I believe I'm making some progress. I don't have much of a problem with grammar, and my pronunciation seems to be as good as anyone in the class, but I continue to find myself frustrated in being unable to think of the words to express what I mean to say. I think my vocabulary may be relatively poor, but this is compounded by my difficulty in working around the lack of a word for the concept I mean to express. This also applies to English, but I have a large enough vocabulary that this is much more rarely a problem. In addition, some of the topics of conversation or question are so broad that I would have trouble formulating an intelligent comment in English, let alone one in German. Maybe I should just say something dumb that I don't really believe purely as linguistic practice, but I don't feel comfortable doing that.

Uwe Hermann: Freiheit statt Angst - Demo against the current Surveillance and Data Retention madness, October 20, Bielefeld, Germany



 This demo is initiated and backed by a number of organizations in Germany, among others the Arbeitskreis Vorratsdatenspeicherung, Chaos Computer Club e.V., FoeBuD e.V., STOP1984, Attac AG Wissensallmende, Indymedia Germany, and the German Pirate Party. Place: Bielefeld, Germany (exact meeting place)
Time: 15:00 o'clock on Friday, October 20, 2006
Motto: Freiheit statt Angst (Freedom instead of fear) Goals and Demands Materials: Banners, flyers, mottos for transparents and more are available in the wiki of the site. Donations are possible and welcome, too. Demo participants can visit the Big Brother Awards 2006 right after the demo (for free). If you value your privacy and democracy in this country, now is the time to speak up and let the whole world (and especially the German politicians) know! This surveillance-madness has to stop!

Bastian Blank: procfs behaviour changed

Yes Junichi, you are correct, the behaviour of /proc/1/ cwd,root changed in 2.6.18. The relevant commit is 778c1144771f0064b6f51bee865cceb0d996f2f9. The behaviour is now really weird. readlink returns /, but in reality it points to somewhere else. Also it breaks the chroot detection.

17 October 2006

Russell Coker: invasive vs inconvenient security

The recent news from the UK gives us an example of invasive security. Preventing passengers carrying on any hand luggage (even wallets) and frisking all of them is the type of treatment you expect for criminals and visitors to maximum security prisons. It's not what you expect for people who are involved in routine (or what used to be routine) travel.

The security measures offered by SE Linux are sometimes described as invasive. I don't believe that this is an accurate description. I admit that sometimes minor tweaks are required (such as setting the correct context of a file). But for most users (corporate users and typical home users) the distribution takes care of all this for them. A default Fedora install should just work for the typical home user and a default Red Hat Enterprise Linux install should just work for the corporate user.

The main reason that it's so easy to use is that the default domain for user sessions and for daemons that are not specifically configured in the security policy is unconfined_t. This means that programs for which there is no policy and programs run from a user session do not have SE Linux access controls. The default configuration of SE Linux only restricts programs that are known to be at risk.

The most common case of SE Linux access controls causing inconvenience is the policy for Apache (the daemon with the most configuration options). There are a set of configuration options (known as booleans) that can be used to determine what aspects of Apache will be confined, generally it only takes a few minutes to determine and specify the correct settings to support the desired operation.

Next time you are being frisked at a UK or US airport and are facing the prospect of a long flight with books and all other forms of entertainment banned keep in mind that airlines have invasive security and should be avoided if possible. SE Linux offers security that is at most a minor inconvenience (usually not even noticed) and should be embraced.

Russell Coker: a newbie question about SE Linux and anti-spam mea...

An anti-spam measure that is used by a very small number of people is that of verifying the sender address by connecting to the sending mail server. For example when I send mail from russell@coker.com.au the receiving machine will connect to my mail server and see whether it accepts mail addressed to russell@coker.com.au and will reject my mail if that isn't the case.

The problem with this is that if I try to send mail to someone who has their mail server listed as a SPAM source then their efforts to verify my email address will fail and then my message to them will bounce with a confusing error message. This means that if one of the two mail servers involved in the communication is listed in a DNSBL or RHSBL service then all communication will be impossible. There will not be an option for one person to say "please phone me on this number if you can't send me an email".

This happened recently when someone from Italy asked me a question about SE Linux. So I will answer here (maybe they read my blog). In any case the answer might be of general interest:

Firstly I have to note that I have a B.Sc degree and no post-graduate qualifications, so it is not accurate to address me as Dr. Coker.

The question is: Let's imagine a user acquire root rights. Especially on Fedora Core, which modify su command to map it to sysadm_r role, couldn't he/she simply disable SELinux, delete logs, and so on?

If a user obtains ultimate privileges then they can do all things including deleting logs etc.

One thing to note is that there is no need for any process other than kernel threads to have ultimate privs, it would be useful in some situations to make log files append-only for all processes and the SE Linux policy language supports this.

The nearest any release policy comes to implementing such things is the separation between sysadm_r and secadm_r in the MLS policy in recent versions of Fedora.

Also note that it is possible to configure a SE Linux policy that does not permit any process to request that a new policy be loaded, the policy files be changed on disk, or the use of programs such as debugfs. Using SE Linux to enforce a policy that can not be bypassed by anything less than booting from installation media is quite easy to achieve.

One idea that I had was to have GPG implemented in the system BIOS and have GPG checks performed on the kernel before it's loaded (to verify that the kernel had not been modified). The kernel could be passed a decryption key for the root filesystem by the BIOS, and SE Linux would be enabled as soon as the root filesystem was mounted. Thus nothing less than disassembling the BIOS would allow a hostile person to access the data on the disk. This is all possible with technology that has been common for many years. I almost convincced a BIOS author to implement this in about 2002.

Next.

Previous.