Strange times... While I was quite productive recently I had a terrible start into this week. Maybe it's the weather change (we more or less dropped from sunny ~35 C down top rainy ~20 C), or that (nearly) everyone but me is on vacation at work, a boring project or maybe it's that I can't attend this years DebConf. Whatever it is, I don't feel that well and am quite grumpy (Hard to believe for those who know me, but at least I feel grumpy ;) So, reading I spotted this topic in Debian Project News. from a user who actually joined a discussion on Debian's development list can actually make my day :)

I spent the past three weeks away from basically any kind of usual contact. I took a three week vacation in Argentina (Buenos Aires, Entre R os, Tucum n, Salta, Jujuy, C rdoba), got my first snow experience and enjoyed a real lot... But got completely disconnected from all of my usual activities... and responsabilities :- Anyway, yesterday afternoon I landed in New York. Arrived to Columbia around 2PM, and spent most of the day zombying around with the Debian crew. And today it starts feeling like the real job is starting. As always, there is a lot of excitement when DebConf starts. I have many items I want to work on, and most are even Debian related ;-) So, lets get work flowing!

The web offers a compelling platform for developing modern applications. How can free software benefit more from web technology, and at the same time promote more software freedom on the web? What would the world be like if FLOSS web applications were as plentiful and successful as traditional FLOSS applications are today? Web architecture The web, as a collection of interlinked hypertext documents available on the Internet, has been well established for over a decade. However, the web as an application architecture is only just hitting its stride. With modern tools and frameworks, it s relatively straightforward to build rich applications with browser-oriented frontends and HTTP-accessible backends. This architecture has its limitations, of course: browser compatibility nightmares, limited offline capabilities, network latency, performance challenges, server-side scalability, complicated multimedia story, and so on. Most of these are slowly but surely being addressed or ameliorated as web technology improves. However, for a large class of applications, these limitations are easily outweighed by the advantages: cross-platform support, instantaneous upgrades, global availability, etc. The web enables developers to reach the largest audience of users with the most compelling functionality, and simplifies users lives by giving them immediate access to their digital lives from anywhere. Some web advocates would go so far as to say that if an application can be built for the web, it should be built for the web because it will be more successful. It s no surprise that new web applications are being developed at a staggering rate, and I expect this trend to continue. So what? This trend represents a significant threat, and a corresponding opportunity, to free software. Relatively few web applications are free software, and relatively few free software applications are built for the web. Therefore, the momentum which is leading developers and users to the web is also leading them (further) away from free software. Traditionally, pragmatists have adopted free software applications because they offered immediate gratification: it s much faster and easier to install a free software application than to buy a proprietary one. The SaaS model of web applications offers the same (and better) immediacy, so free software has lost some of its appeal among pragmatists, who instead turn to proprietary web applications. Why install and run a heavyweight client application when you can just click a link? Many web applications perhaps even a majority are built using free software, but are not themselves free. A new generation of developers share an appreciation for free software tools and frameworks, but see little value in sharing their own software. To these developers, free software is something you use, not something you make. Free software cannot afford to ignore the web. Instead, we should embrace the web more completely, more powerfully, and more effectively than proprietary systems do. What would that look like? In my view, a FLOSS client platform which fully embraced the web would:

• treat web applications as first-class citizens. The web would not be just another application, represented by a browser, but more like a native application runtime. Web applications could feel much more native while still preserving the advantages of a web-style user experience. There would be no web browser: that s a tool for legacy systems to run web applications within a compatibility environment.
• provide a seamless experience for developers to build web applications. It would be as fast and easy to develop a trivial client/server web application as it is to write Hello, world! in PyGTK using Quickly. For bonus points, it would be easy to develop and run web applications locally, and then deploy directly to a PaaS or IaaS cloud.
• empower the user to manage their applications and data regardless of where they are hosted. Traditional operating systems act as a connecting fabric for local applications, providing a shared namespace, file store and IPC mechanisms, but web applications are lacking this. The web s security model requires that applications are thoroughly sandboxed from each other, but a mediating operating system could connect them in meaningful ways, just as web browsers store cookies and passwords for various websites while protecting them from each other.

Imagine a world where free web applications are as plentiful and malleable as free native applications are today. Developers would be able to branch, test and submit patches to them. What about Chrome OS? Chrome OS is a step in the right direction, but doesn t yet realize this vision. It s a traditional operating system which is stripped down and focused on running one application (a web browser) very, very well. In some ways, it elevates web applications to first-class status, though its paradigm is still fundamentally that of a web browser. It is not designed for development, but for consuming the web. Developers who want to create and deploy web applications must use a more traditional operating system to do so. It does not put the end user in control. On the contrary, the user is almost entirely dependent on SaaS applications for all of their needs. Although it is constructed using free software, it does not seem to deliver the principles or benefits of software freedom to the web itself. How? Just as free software was bootstrapped on proprietary UNIX, the present-day web is fertile ground for the development of free web applications. The web is based on open standards. There are already excellent web development tools, web application frameworks and server software which are FLOSS. Leading-edge web browsers like Firefox and Chrome/Chromium, where much web innovation is happening today, are already open source. This is a huge head start toward a free web. I think what s missing is a client platform which catalyzes the development and use of FLOSS web applications.

Why use a Chroot environment? A large part of the use of chroot environments is for the purpose of security, it used to be the only way of isolating a user from a section of the files on a server. In many of the cases where a chroot used to be used for security it is now common practice to use a virtual server. Also another thing to note is that SE Linux provides greater access restrictions to most daemons than a chroot environment would so in many case using SE Linux with a sensible policy is a better option than using a chroot environment to restrict a daemon. So it seems to me that the security benefits that can be obtained by using a chroot environment have been dramatically decreased over the last 5+ years. One significant benefit of a chroot environment is that of running multiple different versions of software on one system. If for example you have several daemons that won t run correctly on the same distribution and if you don t want to have separate virtual machines (either because you don t run a virtualisation technology or because the resources/expense of having multiple virtual servers is unacceptable) then running multiple chroot environments is a reasonable option. The Simplest Solution The simplest case is when all the chroot environments are equally trusted, that means among many other things that they all have the latest security patches applied. Then you can run them all with the same labels, so every file in the chroot environment will have the same label as it s counterpart in the real root this will mean that for example a user from the real root could run /chroot/bin/passwd and possibly get results you don t desire. But it s generally regarded that the correct thing to do is to have a chroot environment on a filesystem that s mounted nosuid which will deal with most instances of such problems. One thing to note however is that the nosuid mount option also prevents SE Linux domain transitions, so it s not such a good option when you use SE Linux as domain transitions are often used to reduce the privileges assigned to the process. There are two programs for labeling files in SE Linux, restorecon is the most commonly used one but there is also setfiles which although being the same executable (restorecon is a symlink to setfiles) has some different command-line options. The following command on a default configuration of a Debian/Lenny system will label a chroot environment under /chroot with the same labels as the main environment: setfiles -r /chroot /etc/selinux/default/contexts/files/file_contexts /chroot I am considering adding an option to support chroot environments to restorecon, if I do that then I will probably back-port it to Lenny, but that won t happen for a while. For a simple chroot once the filesystem is labelled it s ready to go, then you can start daemons in the chroot environment in the usual way. Less trusted Chroot environments A reasonably common case is where the chroot environment is not as trusted. One example is when you run an image of an old server in a chroot environment. A good way of dealing with this is to selectively label parts of the filesystem as required. The following shell code instructs semanage to add file contexts entries for a chroot environment that is used for the purpose of running Apache. Note that I have given specific labels to device nodes null and urandom and the socket file log in the /dev directory of the chroot environment (these are the only things that are really required under /dev), and I have also put in a rule to specify that no other files or devices under /dev should be labelled. If /dev is bind mounted to /chroot/dev then it s important to not relabel all the devices to avoid messing up the real root environment and it s impractical to put in a specific rule for every possible device node. Note that the following is for a RHEL4 chroot environment, other distributions will vary a little some of the file names. semanage -i << END
fcontext -a -t root_t -f -d /chroot
fcontext -a -t bin_t /chroot/bin.*
fcontext -a -t usr_t /chroot/usr.*
fcontext -a -t usr_t /chroot/opt.*
fcontext -a -f -d /chroot/dev
fcontext -a -f -s -t devlog_t /chroot/dev/log
fcontext -a -f -c -t null_device_t /chroot/dev/null
fcontext -a -f -c -t urandom_device_t /chroot/dev/urandom
fcontext -a -t "<<none>>" "/chroot/dev/.*"
fcontext -a -t "<<none>>" "/chroot/proc.*"
fcontext -a -t lib_t /chroot/lib.*
fcontext -a -t lib_t /chroot/usr/lib.*
fcontext -a -t bin_t /chroot/usr/bin.*
fcontext -a -t httpd_exec_t -d /chroot/usr/bin/httpd
fcontext -a -t var_t /chroot/var.*
fcontext -a -t var_lib_t /chroot/var/lib.*
fcontext -a -t httpd_var_lib_t /chroot/var/lib/php.*
fcontext -a -t var_log_t /chroot/var/log.*
fcontext -a -t var_log_t -f /chroot/var/log/horde.log.*
fcontext -a -t httpd_log_t /chroot/var/log/httpd.*
fcontext -a -t var_run_t /chroot/var/run.*
fcontext -a -t httpd_var_run_t -f /chroot/var/run/httpd.pid
fcontext -a -t httpd_sys_content_t /chroot/var/www.*
END
You could create a shell script to run the above commands multiple times for multiple separate Apache chroot environments. If there is a need to isolate the various Apache instances from each other (as opposed to just protecting the rest of the system from a rogue Apache process) then you could start each copy of Apache with a different MCS sensitivity label which will provide adequate isolation for most purposes as long as no sensitivity label dominates the low level of any of the others. If you do that then the semanage commands require the -r option to specify the range. You could have one chroot environment under /chroot-0 with the sensitivity label of s0:c0 for it s files and another under /chroot-1 with the sensitivity label of s0:c1 for it s files. To start one environment you would use a command such as the following: runcon -l s0:c0 setsid chroot /chroot-0 /usr/sbin/httpd

Yesterday, I've arrived in New York City for the annual Debconf. Well, that is, today's the first day of Debcamp, and obviously not that many people have arrived yet. Since I arrived a day early, I'd also booked a hotel room for one night. But that's okay, it allowed me to sleep off my jetlag not that I had much of it, but anyway. Today, then, I signed in to the dormroom. Turned out I was the first non-organizer to do so, and that there wasn't even anyone in the hacklab yet. Well, that's what you get for being so early, I guess. Not quite sure yet what to make of the weather. When the plane touched down yesterday, the captain announced over the PA that the outside temperature was 99 degrees Fahrenheit (some 37 degrees Celcius), which is hot, especially when added to the rather high humidity. You walk outside for five minutes, and you're sweating like a pig. Today started off on the same foot, but then about an hour ago or so it started raining, and it hasn't stopped yet; and it doesn't feel like what I would call a regular summer thunderstorm, either. Bit weird. But then, who cares about rain at a computer conference, right? Right.

Just noticed that the default bookmarks in Ubuntu include one entry pointing back to Debian. It even says that Ubuntu is based on Debian. It s a small thing but it made my day. It s nice to see this kind of acknowledgement. Click on the screenshot to see the picture in full size (and yes, most favicons suck with a dark background). For those wondering, the screenshot is taken on a default install of Ubuntu 10.04 Netbook Edition. 3 comments Support my work

My patches to convert the 3.0 (git) source format to use git bundles have landed in dpkg's git repository and will be in dpkg 1.15.8. I think this second attempt at 3.0 (git) has worked out much better than the first. (Though the first was a pretty good success overall, since it also led all the other 3.0 formats eventually. ;) Perhaps the intervening years of git experience helped. The code is much simpler, with none of the ad-hoc hacks from the first version. The resulting git bundles can be manually cloned using git-bundle(1) where dpkg-source is not available. There are two handy new features that can be controlled by debian/source/options. git-ref can be used to limit the branches/tags/etc that are included in the source package. And git-depth can cause a shallow clone of specified depth to be created and bundled.

dpkg-source: info: using options from debhelper/debian/source/options: --git-ref=gitsrc --git-ref=master --git-depth=10
dpkg-source: info: using source format  3.0 (git)'
dpkg-source: info: creating shallow clone with depth 10
dpkg-source: info: bundling: gitsrc master

A demo source package is here.

joey@gnu:~/tmp/t>dget http://kitenet.net/~joey/tmp/debhelper_7.9.4.dsc
...
dpkg-source: info: extracting debhelper in debhelper-7.9.4
dpkg-source: info: cloning debhelper_7.9.4.git
dpkg-source: info: setting up shallow clone
joey@gnu:~/tmp/t>ls -l
total 392
drwxr-xr-x 10 joey joey   4096 Jul 25 13:58 debhelper-7.9.4/
-rw-r--r--  1 joey joey   1779 Jul 25 13:58 debhelper_7.9.4.dsc
-rw-r--r--  1 joey joey 388859 Jul 25 13:58 debhelper_7.9.4.git
-rw-r--r--  1 joey joey    738 Jul 25 13:58 debhelper_7.9.4.gitshallow
joey@gnu:~/tmp/t>cd debhelper-7.9.4 
joey@gnu:~/tmp/t/debhelper-7.9.4>git branch -a
* gitsrc
  remotes/origin/HEAD -> origin/gitsrc
  remotes/origin/gitsrc
  remotes/origin/master

Notice that the branch I was in when I built the package is preserved, and the 19 revisions included in the shallow clone (10 per branch) take up very little space of course. This particular git source package turned out 30k larger than the tar.gz. I am considering adding two other features:

• Using VCS-Git fields to automatically set up origin when a git source package is unpacked.
• Temporarily auto-committing uncommitted changes when building (currently the build fails when there are uncommitted changes).

I hope the next step will be for git source packages to be accepted in the Debian archive.

Well, I made it to New York, along with my brother. Yesterday we walked down most of Manhatten Island - we've been staying in the youth hostel on 103rd street, and made our way on foot as far as Battery Park. Along the way, we visited McDonalds (twice) and Starbucks (was that two or three times?), both featuring free wifi and air conditioning. We went up the Rockefeller Tower as well, and got a few photos out of that. It's really quite warm here. It's shorts and sandals weather (just like last year in Spain), and I'm tired of walking in sandals. Interesting differences from the UK: the New York Times crossword is quite different from what we call crosswords. I think Monday's one is meant to be easiest, so perhaps starting with Saturday's was not a good plan. There are water fountains dotted around the city, which is awesome. This morning I went running around Central Park. Except it's tougher than it looks - I'm not sure whether it was the humidity, or the inclines, or not eating anything before setting out... I ended up walking most of the second half, and it took half an hour more than I thought it would. I ran counter(anti-)clockwise - I think it would be better to go clockwise, because there's a hill in the corner with a steep side that I'd prefer to run down rather than up.

ffmpeg I ve updated my SE Linux repository for Squeeze to include a modified version of the ffmpeg packages without MMX support for the i386 architecture. When MMX support is enabled it uses assembler code which requires text relocations (see Ulrich Drepper s documentation for the explanation of this [1]). This makes it possible to run programs such as mplayer under SE Linux without granting excessive access something which we really desire because mplayer will usually be dealing with untrusted data. In my past tests with such changes to ffmpeg on my EeePC701 have resulted in no difference to my ability to watch movies from my collection, the ones that could be played without quality loss on a system with such a slow CPU could still be viewed correctly with the patched ffmpeg. $ mplayer
mplayer: error while loading shared libraries: /usr/lib/i686/cmov/libswscale.so.0: cannot restore segment prot after reloc: Permission denied The AMD64 architecture has no need for such patches, presumably due to having plenty of registers. I don t know whether other architectures need such patches, they might the symptom is having mplayer abort with an error such as the above when running in Enforcing Mode. The below apt sources.list line can be used to add my SE Linux repository: deb http://www.coker.com.au squeeze selinux dpkg In my repository for i386 and AMD64 architectures I have included a build of dpkg that fixes bug #587949. This bug causes some sym-links and directories to be given the wrong label by dpkg when a package is installed. Usually this doesn t impact the operation of the system and I was unable to think of a situation where it could be a security hole, but it can deny access in situations where it should be granted. I would appreciate some help in getting the patch in a form that can be accepted by the main dpkg developers, the patch I sent in the bug report probably isn t ideal even though it works quite well someone who knows absolutely nothing about SE Linux but is a good C coder with some knowledge of dpkg could beat it into shape. In my repository I don t currently provide any support for architectures other than i386 and AMD64. I could be persuaded to do so if there is a demand. How many people are using Debian SE Linux on other architectures? Of course there s nothing stopping someone from downloading the source from my AMD64 repository and building it for another architecture, I would be happy to refer people to an APT repository that someone established for the purpose of porting my SE Linux packages to another architecture. Policy selinux-policy-default version 20100524-2 is now in Testing. It s got a lot of little fixes and among other things allows sepolgen-ifgen to work without error which allows using the -R option of audit2allow see my post about audit2allow and creating the policy for milters for defails [2]. I have uploaded selinux-policy-default version 20100524-3 to Unstable. It has a bunch of little fixes that are mostly related to desktop use. You can now run KDE4 on Unstable in enforcing mode, login via kdm and expect that everything will work probably some things won t work, but some of my desktop systems work well with it. I have to admit that not all of my desktop systems run my latest SE Linux code, I simply can t have all my systems run unstable and risk outages. Let me know if you find any problems with desktop use of the latest SE Linux code, it s the focus of my current work. But if you find problems with chrome (from Google) or the Debian package chromium-browser then don t report them to me. They each use their own version of ffmpeg in the shared object /usr/lib/chromium-browser/libffmpegsumo.so which has text relocations and I don t have time to rebuild chromium-browser without text relocations I ll make sure it does the right thing when they get it working with the standard ffmpeg libraries. That said the text relocation problem doesn t seem to impact the use of Chromium, Youtube doesn t work even when the browser is run in permissive mode. GNOME is a lower priority than KDE for me at this time. But the only area where problems are likely to occur is with gdm and everything associated with logging in. Once your X session starts up GNOME and KDE look pretty similar in terms of access control. I would appreciate it if someone could test gdm and let me know how it goes. I ll do it eventually if no-one else does, but I ve got some other things to fix first.

• [1] http://people.redhat.com/drepper/selinux-mem.html
• [2] http://etbe.coker.com.au/2010/07/25/audit2allow-r-milter/

FrOSCon 5 - 21./22. August 2010 is approaching rapidly. I m a bit envious at some of the tracks (I mean, really, geocaching (ok, I did the surrounging caches over the last years but still), learning python by means of game programming, etc. really sounds interesting and I know people who could benefit from a non-kids version of that as well) but this year s FrOSCon is nothing for me to curse about either: I managed to get both a booth for The MirOS Project (MirBSD, mksh and other subprojects) as well as one for Waldemar s FreeWRT (although wbx@ if he comes won t join there since he forked his own fork since its conception). Booth staff are, currently: tg@ and bsiegert@ (Developer), gecko2@ (Staff) for MirOS, tg@ and XTaran abe@ (Developer), kimnotyze (Hacker) for FreeWRT. (XTaran will probably be helping Debian/Grml too.) This year, it ll be my job (after 2 years of aptituz) to keep the Altbier-Fraktion watered, I m thinking one crate of Schl sser Alt and one crate of Hannen Alt? Have a look at the Program and don t tell me you won t come! It will rock! (Except there won t be Formorer s Chilli, but that s no reason, there s enough other stuff in manageable distance.) Besides interesting booths and talks, FrOSCon is still looking for helpers who will not only get free entrance but also catering during operation.

The last few months me and the other Debian Edu developers have been working hard to get the Debian/Squeeze based version of Debian Edu/Skolelinux into shape. This future version will use Kerberos for authentication, and services are slowly migrated to single signon, getting rid of password questions one at the time. It will also feature a roaming workstation profile with local home directory, for laptops that are only some times on the Skolelinux network, and for this profile a shortcut is created in Gnome and KDE to gain access to the users home directory on the file server. This shortcut uses SMB at the moment, and yesterday I had time to test if SMB mounting had started working in KDE after we added the cifs-utils package. I was pleasantly surprised how well it worked. Thanks to the recent changes to our samba configuration to get it to use Kerberos for authentication, there were no question about user password when mounting the SMB volume. A simple click on the shortcut in the KDE menu, and a window with the home directory popped up. :) One step closer to a single signon solution out of the box in Debian Edu. We already had PAM, LDAP, IMAP and SMTP in place, and now also Samba. Next step is Cups and hopefully also NFS. We had planned a alpha0 release of Debian Edu for today, but thanks to the autobuilder administrators for some architectures being slow to sign packages, we are still missing the fixed LTSP package we need for the release. It was uploaded three days ago with urgency=high, and if it had entered testing yesterday we would have been able to test it in time for a alpha0 release today. As the binaries for ia64 and powerpc still not uploaded to the Debian archive, we need to delay the alpha release another day. If you want to help out with implementing Kerberos for Debian Edu, please contact us on debian-edu@lists.debian.org.

Recipe for RCBC - Release Critical Bug squashing Contest: It has been a while since my last post in the RCBW tradition. Luckily, the tradition is in very good health of its own, thanks to many others that have picked up the habit of SPAM-ing planet with good news for Debian, encouraging others to do the same. With all that RC-obsessed people around and with the Squeeze release forthcoming, can DebConf10 be devoid of geeky RC-squashing activities? Of course not! Thanks to the orga team we expect the conference to contain a 2-week long RC bug squashing pride with tutorials, BoFs, a permanent bug squashing party, ... and a contest! I won't indulge much on the contest as the wiki page contains all rules and gory details. Obviously, all usual rules and best practices of bug squashing parties will apply; coordination will happen on #debian-bugs. Get involved, it starts today, and it's open to everyone (DebConf10 attendees as well as Debian enthusiasts abroad, regular RC squashers as well as casual bystanders, etc). All this wouldn't have been possible without the help of many people that love Debian, so many thanks to:

• the sponsors of RCBC:
  • Marvell, for offering a GuruPlug
    (of course, the winner of this device is expected to help with Debian support for it *g*)
  • HP, for offering t-shirts
  • Pearson, for offering books
• micah - who dragged me into this (it hasn't been hard)
• gregoa and mehdi - the almighty judges - who have been transitively dragged into this (it hasn't been hard either)

PS a corresponding announcement is in the debconf-announce pipeline already

Since the earliest days there has been a command named audit2allow that takes audit messages of operations that SE Linux denied and produces policy that will permit those operations. A lesser known option for this program is the -R option to use the interfaces from the Reference Policy (the newer version of the policy that was introduced a few years ago). I have updated my SE Linux repository for Lenny [1] with new packages of policy and python-sepolgen that fix some bugs that stopped this from being usable. To use the -R option you have to install the selinux-policy-dev package and then run the command sepolgen-ifgen to generate the list of interfaces (for Squeeze I will probably make the postinst script of selinux-policy-dev do this). Doing this on Lenny requires selinux-policy-default version 0.0.20080702-20 or better and doing this on Debian/Unstable now requires selinux-policy-default version 0.2.20100524-2 (which is now in Testing) or better. Would it be useful if I maintained my own repository of SE Linux packages from Debian/Unstable that can be used with Debian/Testing? You can use preferences to get a few packages from Unstable with the majority from Testing, but that s inconvenient and anyone who wants to test the latest SE Linux stuff would need to include all SE Linux related packages to avoid missing an important update. If I was to use my own repository I would only include packages that provide a significant difference and let the trivial changes migrate through Testing in the normal way. The new Lenny policy includes a back-port of the new Milter policy from Unstable, this makes it a lot easier to write policy for milters. Here is an example of the basic policy for two milters, it allows the milters (with domains foo_milter_t and bar_milter_t) to start, to receive connections from mail servers, and to create PID files and Unix domain sockets. policy_module(localmilter,1.0.0)

milter_template(foo)
files_pid_filetrans(foo_milter_t, foo_milter_data_t, sock_file file )

milter_template(bar)
files_pid_filetrans(bar_milter_t, bar_milter_data_t, sock_file file )
allow bar_milter_t self:process signull;
type bar_milter_tmp_t;
files_tmp_file(bar_milter_tmp_t)
files_tmp_filetrans(bar_milter_t, bar_milter_tmp_t, file)
manage_files_pattern(bar_milter_t, tmp_t, bar_milter_tmp_t) After generating that policy I ran a test system in permissive mode and sent a test message. I ran audit2allow on the resulting AVC messages from /var/log/audit/audit.log and got the following output: #============= bar_milter_t ==============
allow bar_milter_t bin_t:dir search;
allow bar_milter_t bin_t:file getattr;
allow bar_milter_t home_root_t:dir search;
allow bar_milter_t ld_so_cache_t:file read getattr ;
allow bar_milter_t lib_t:file execute;
allow bar_milter_t mysqld_port_t:tcp_socket name_connect;
allow bar_milter_t net_conf_t:file read getattr ioctl ;
allow bar_milter_t self:process signal;
allow bar_milter_t self:tcp_socket read write create connect setopt ;
allow bar_milter_t unlabeled_t:association recvfrom sendto ;
allow bar_milter_t unlabeled_t:packet recv send ;
allow bar_milter_t urandom_device_t:chr_file read;
allow bar_milter_t usr_t:file read getattr ioctl ;
allow bar_milter_t usr_t:lnk_file read;
#============= foo_milter_t ==============
allow foo_milter_t ld_so_cache_t:file read getattr ;
allow foo_milter_t lib_t:file execute;
allow foo_milter_t mysqld_port_t:tcp_socket name_connect;
allow foo_milter_t net_conf_t:file read getattr ;
allow foo_milter_t self:capability setuid setgid ;
allow foo_milter_t self:tcp_socket write setopt shutdown read create connect ;
allow foo_milter_t unlabeled_t:association recvfrom sendto ;
allow foo_milter_t unlabeled_t:packet recv send ; Running the audit2allow command with the -R option gives the following output, it includes the require section that is needed for generating policy modules:
require
type sshd_t;
type ld_so_cache_t;
type bar_milter_t;
type foo_milter_t;
class process signal;
class tcp_socket setopt read create write connect shutdown ;
class capability setuid setgid ;
class fd use;
class file read getattr ;

#============= bar_milter_t ==============
allow bar_milter_t ld_so_cache_t:file read getattr ;
allow bar_milter_t self:process signal;
allow bar_milter_t self:tcp_socket read write create connect setopt ;
corecmd_getattr_sbin_files(bar_milter_t)
corecmd_search_sbin(bar_milter_t)
corenet_sendrecv_unlabeled_packets(bar_milter_t)
corenet_tcp_connect_mysqld_port(bar_milter_t)
dev_read_urand(bar_milter_t)
files_read_usr_files(bar_milter_t)
files_read_usr_symlinks(bar_milter_t)
files_search_home(bar_milter_t)
kernel_sendrecv_unlabeled_association(bar_milter_t)
libs_exec_lib_files(bar_milter_t)
sysnet_read_config(bar_milter_t)
#============= foo_milter_t ==============
allow foo_milter_t ld_so_cache_t:file read getattr ;
allow foo_milter_t self:capability setuid setgid ;
allow foo_milter_t self:tcp_socket write setopt shutdown read create connect ;
corenet_sendrecv_unlabeled_packets(foo_milter_t)
corenet_tcp_connect_mysqld_port(foo_milter_t)
kernel_sendrecv_unlabeled_association(foo_milter_t)
libs_exec_lib_files(foo_milter_t)
sysnet_read_config(foo_milter_t) To get this working I removed the require lines for foo_milter_t and bar_milter_t as it s not permitted to both define a type and require it in the same module. Then I replaced the set of tcp_socket operations write setopt shutdown read create connect with create_socket_perms as it s easiest to allow all the operations in that set and doesn t give any security risks. Finally I replaced the mysql lines such as corenet_tcp_connect_mysqld_port(foo_milter_t) with sections such as the following:
mysql_tcp_connect(foo_milter_t)
optional_policy(
mysql_stream_connect(foo_milter_t)
) This gives it all the access it needs and additionally the optional policy will allow Unix domain socket connections for the case where the mysqld is running on localhost.

• [1] http://etbe.coker.com.au/2008/07/31/installing-se-linux-on-lenny/

Hi Debcamper s and Debconfer s. I am currently coordinating volunteers and can use your help! Here is a list of our current and most pressing volunteer needs. If you are interested in volunteering and know what you would like to do, drop me a line with details. If you are interested in volunteering and are up for anything, drop me a line. If you want to volunteer but can only spare a couple of hours, drop me a line! You can reach me at biella(at)nyu.edu We are most in need of finding help for the front desk and for assisting with the talks (starting/ending on time and fielding questions). This year if you are a coordinator for a track you will be in charge of doing this, so we only need volunteers for non-track talks. Volunteers get a free, volunteer tee-shirt and a huge huge thanks from the orga team who simply cannot do this without you!

Hi Debcamper s and Debconfer s. I am currently coordinating volunteers and can use your help! Here is a list of our current and most pressing volunteer needs. If you are interested in volunteering and know what you would like to do, drop me a line with details. If you are interested in volunteering and are up for anything, drop me a line. If you want to volunteer but can only spare a couple of hours, drop me a line! You can reach me at biella(at)nyu.edu We are most in need of finding help for the front desk and for assisting with the talks (starting/ending on time and fielding questions). This year if you are a coordinator for a track you will be in charge of doing this, so we only need volunteers for non-track talks. Volunteers get a free, volunteer tee-shirt and a huge huge thanks from the orga team who simply cannot do this without you!

Raphael's Flattr FOSS is a good idea: Make it really easy for users to pay tips for free software and maybe users who otherwise wouldn't express their appreciation will. I've added Flattr buttons for a few of my Free Software packages. Am interested to see how it works out.

---

Regarding Flattr itself, I have always wanted a way to easily micropay artists, coders, etc online. Especially musicians like Mosaik! The way it splits your monthly payment amoung everyone you've Flattr'd that month is smart; it takes money out of the picture when deciding whether to click on a Flattr button. I think it would be more honest, though, if rather than taking 10% of everything (which would be just absurd and indefensible if this were used on a large scale, and whiffs faintly of pyramid scheme even now), Flattr took one share of your monthly payment (as if you automatically Flattr'd them each month). That would provide even more incentive to Flattr lots of other things. And if lots of people were Flattring lots of things, Flattr would still make plenty of money.

No, not the bzr switch rather the book : http://www.amazon.com/Switch-Change-Things-When-Hard/dp/0385528752 Read it, its solid.

Dpkg got rid of Perl Let s start with the interesting part and the great news: dpkg 1.15.8 (to be uploaded soon) will no longer need perl! After my changes to rewrite update-alternatives in C, Guillem recently pushed the rewrite of dpkg-divert/mksplit in C. Please test it out (binary package for i386 or .dsc). This is rather exciting news for those who would like to use dpkg in embedded contexts. And it s great to see this completed in time for Squeeze. In Squeeze+1, we might go one step further and merge cdebconf, the C replacement for debconf. I got rid of some recurring administrative tasks I have been administrating the Alioth server since its inception (see the announce I sent in 2003) but I m no longer enjoying the day-to-day administrative work that it represents. That s why I just retired from the team. We recently recruited Tollef Fog Heen so the number of admins is still the same (that said, Alioth could benefit from some more help, if you re a DD and interested, drop a mail to admin@alioth.debian.org or come to #alioth). Same goes for the collab-maint project. I have dealt with hundreds of requests to add new contributors to the project since it s the central repository where all Debian developers have write access and where they put the VCS for their packages that do not belong to a more specialized team. The new administrator that will approve the requests is Xavier Oswald and he s doing the work under the umbrella of the New Maintainer s Front Desk. The future I will continue to spend the same amount of time on Debian, the time freed will quickly be reallocated to other Debian and free software related projects. In fact, I even anticipated a bit by launching Flattr FOSS last week but that s a relatively simple project. The other projects that will never all fit in the freed time: I want to spend more time working on dpkg. I do plan to blog more often too, but I m sure you ll notice that yourself soon. I would like to see my Debian book translated into English (another post coming on the topic sometimes soon). In my dreams, I could even start yet another software project, I have some ideas that I really would like to see implemented but I don t see how that could fit in this year s planning unless I can convince someone else to implement them! Maybe I should blog about them. 5 comments Support my work

Like one or two years ago, I got myself a free Dropbox account. I use it occasionally to exchange files with some friends. It does an excellent job at that. Basically, it works like any network folder. Except it is not within a local network, but over the internet.Dropbox serves me as an occasional replacement for both email and USB pen drive. Instead of sending a modified file by email or bringing around a dozen of photos on a USB stick, I just put them into the shared folder. This also very useful for files such as flyers, templates. They may easily grow to big to be sensibly sent by email.For all my use, a regular free Dropbox account is more than enough. As in, I have less than 1 GB in use, and I could easily free some of that space. You start at 2 GB, and can currently get up to 10 GB free (+250 MB for each referrer; if you use the link above you'll already start at 2.25 GB). But for my use, this is already a lot.Note that there are a couple of alternatives around. For Linux (only) there is Ubuntu One, and there is Zumo Drive and Box.net just to name a few. I havn't tried them, given that Dropbox works for me well enough.

This Week In Debian I've been contacted by Jonathan Nadeau of Frostbite Systems, a company selling computer hardware with pre-installed GNU/Linux distros, including Debian (of course!). (Usual disclaimer applies: I haven't tried their products, I've just skimmed through their website ...) Both for promotion and as a service to the communities, Jonathan has started various podcasts, such as This Week in Fedora. Jonathan has contacted me to check whether Debian is interested in having a This Week in Debian podcast, which will be discussing weekly Debian-related topics, interviewing at each episode someone from the community. So, folks, are you interested in seeing that happen?
Personally I like the idea, as I'm myself an eager podcast listener and I've always missed something Debian-specific. To make it a reality however we need to plan and record some episode in advance, to ensure the podcast will have enough "buffer" to start. That's why I've created the ThisWeekInDebian wiki page, where interested people should drop a line, proposing a topic and volunteering to speak about it. Any Debian-related topic is a good candidate: a team, an initiative, a general discussion about a relevant project aspect, etc. You don't even need any particular upfront preparation, as it'll be interview-like. So, what are you waiting for? Drop a line to the wiki page. Jonathan will attend DebConf10 so, in case you are attending, that can be a nice occasion to record some episode in person (otherwise recordings usually happen over the net).