Search Results: "ron"

2 April 2007

Benjamin Mako Hill: Victory!

Last November, I used a Venn diagram to complain about (and explain) the fact that there while there were several RFID blocking wallets for sale, they were all made of leather. Many people, who like me prefered to eschew leather wallets, left comments, blogged, and emailed me in strong agreement. Mike Aiello, the proprietor of DFIRWEAR, found my blog. He emailed me not longer after my post to tell me that he had started looking into vegan materials to make a wallet that would fit my needs! Today, a vegan RFID-blocking wallet made it onto his site and is now available to be ordered! It's very exciting to see that what started out as a mild and humorous expression of dissatisfaction could quickly culminate in the creation of a new product. Mika and I each just ordered one. If you care about your privacy, you should too!

Russell Coker: buy free software developers dinner

In response to my post about buying dinner for developers (as an alternative to "professional networking sessions") Kris notes that his company has been doing it for years. He goes a little further than I did in my post and advocates buying dinner for developers as a way of thanking them for their work.

I agree that buying dinner for people is a good way of thanking them for their work. I didn't suggest it in my post though because I didn't expect that there would be much interest in such things. I'm glad that Kris has proved me wrong. I'm not sure whether Kris was talking about personally buying dinner or getting his company to do so. In either case it's a really good thing, and I encourage others to do the same!

1 April 2007

Biella Coleman: The Joy of Weather, Writing, Music, and Software

Spring has arrived in many parts of North America. But in Edmonton, North America’s largest and most northernly city, spring has sort-of-come-but-not-really as it recedes fairly quickly. There will be a day of explosive warmth (you know, a balmy 45-55 F) and of course locals strip down to near nakedness, wearing shorts and, the more flamboyant will don an 80’s inspired cut-off tee. Hot. This sartorial statement says WE are SO ready for the long winter to leave … for good. Despite the collective sentiment, which is probably shared by 99.999999% of Edmonton’s inhabitants, the winter cold, snow, and breeze are indifferent to our deepest pleas and they come right back, making us sport at least a few layers of winter clothes. Within this dance between winter breeze and spring warmth, I have spent most of my time staring at my computer doing everything possible to transform half-baked ideas, hunches, sentiments, and theories into coherent words, sentences, paragraphs, and chapters for my book. I am working on it full-force and am enjoying it more than I have in a year though from time to time I get fed-up, lost, sick of it, and my writing soul descends back, deep into one of Dante’s infernal rings, where I fester with my frustration, convinced that I should have become an organic flower farmer/acupuncturist that I almost became (well not really, but I have always fancied that combination as an ideal and fulfilling career path). Slowly I usually make my way back up, brush off the cobwebs of despair, and proceed anew. Within this highly secluded life of monastic-like repetition, thankfully, I have been enjoying some new things this spring. Once a week I head over to an University of Alberta off-site library facility to pour over archive material for a new project, which I am not going to talk about here (it is super-duper-top-secret) but it has been interesting working at an archive, especially one that is housed in an old Ikea. Since I am one of those right-brained people, I like to listen to music while I work, and lately I have also become pretty obsessed with house & electronic music, mainly thanks to a local DJ, David Stone whose weekly radio show on CJSR, BPM, is simply the bomb. He claims to bring the latest and greatest of electronic dance music from around the world and I think he is totally right. If you like this type of music, do catch his weekly show on Sat nights at 6 PM (MST). I sometimes get a little sad when I listen to some good music or see some stellar performance because it reminds me that what I may one day have to offer to the wider world an academic book and article here and there simply cannot bring the type of joy that musical performance and other creative expressions can bring. While you can listen to songs and over again, a book, if it is really superb, may attract a second or third reading. An academic book or article may at times light an inner light of joy, but let’s face it, it is usually a pretty cerebral light oh’ joy, leaving untouched those part of the brain, soul, heart, where more visceral, mysterious, yet fully self-enveloping feelings of joy reign high (but I am trying my hardest to stick a funny section or two in every chapter to leave a trace of laughter because if I can’t manage that with an ethnography on hackers, I will have failed miserably). Every track David Stone plays is something I want to listen to over and over again and thanks to mplayer stream dump function, I can. And funny enough, is that in the last month software believe it or not has brought me much joy as of late. I have been using free software since 1997 and I used to get A LOT more annoyed no make that a downright frustrated with programs (or lack of programs) than I do now. In fact, now, I am simply stunned whenever I upgrade to a version of a program. For example, Word Press 2.0 is like so much nicer in terms of usability and functionality than 1.5. The same goes for Open Office, the Gimp, and even Firefox, which has some bugs, but is so much better than its predecessors. I once described free software using the well-worn clich as “the gift that keeps on giving. And I think that this is becoming more and more true. And like wine, with the passing of time, these gifts usually get better and better. And like a unexpected present that arrives on your doorstep, these software packages induce some joy, because it is actually pretty neat to see these programs develop and grow into something stronger and more useful; so thanks to those who spend their time hacking away at making and improving this software and thanks to those (you know who you are) who helped with my recent WP upgrade!

Martin F. Krafft: Unsubscribing newspapers

I used to subscribe to the paper edition of the Frankfurter Allgemeine Zeitung (FAZ), but found myself discarding more papers than I could read, so sometime in 2005, I switched the subscription to their excellent Sunday paper (FAS) only and subscribed to their RSS feed for the daily juice. About a year ago, I subscribed to the Financial Times Europe (FTE), which I came to like a lot for the journalism, the objectivity, and the brevity of the entire paper, while it never withheld an important story from me. I always noticed that stories from the Sunday paper would randomly appear online throughout the week, but this morning, as I sat down for coffee and Sunday paper consumption, I was disappointed when quite a lot of the stories had already been RSS-fed to me before the Sunday paper was published. The usual number of spelling errors in the FAZ online feed had been corrected in the paper version, making me wonder why they perform quality control only for the paper edition. Given the overlap between FTE and FAZ, the spelling errors, and this spoiled Sunday morning, I thus unsubscribed from the RSS-feed in favour of the FAS and FTE paper editions. That's rather contrary to the general trend and I am aware of the "dead-tree" argument, but I recycle all my papers, neatly stacked, and I do not believe that real-paper newspapers are among the prime environmental concerns we need to deal with. In the end, I simply prefer the paper editions and am happy to contribute otherwise to environmental preservation. NP: Erik Norlander / Music Machine

Nico Golde: Creating RSS feed for a website you want

Today I found Feed43 which is a site offering the creation of RSS feeds for sites without one.

It is not that flexible that it could follow links and get their content like I did it with the Heise feed but you are able to parse all the information you want in a very easy way. You just specify the text on the site and put tags like % everywhere you want to extract information and then you just create a template for the output where you insert these tags.

I used Feed43 to create a feed of the Debian QA site for Orphaned packages with wrong maintainer site since I like
to do uploads for them if I am somehow bored but I don't want to go to the website every time.

The result is: http://feed43.com/orphaned-packages.xml

And what is really cool, you are even able to edit this feed using: http://feed43.com/feed.html?name=orphaned-packages

Ok there is a small advertisement in every article like "-- Delivered by [1]Feed43 service" but I can live with it.

Erich Schubert: Running multiple Mono/.NET applications

I just filed Intend-to-package bug number #416996:
* Package name    : stereo
  Version         : 2.0 beta
* URL             : http://www.mono-project.com/Stereo
* License         : LGPL
  Programming Lang: C#
  Description     : Mono (.NET) extension for running
                    multiple applications
Stereo is an extension to the Mono (.NET/C#) platform for running multiple applications at the same time. As you probably know, C# is a language using a bytecode, called CIL: Common Intermediate Language. Using code in an intermediate language has benefits for platform and operating system independence (Java is the most prominent example of this approach), however it also means an overhead when running the applications. Various approaches have been tried to remedy these effects, such as JIT (just in time) compilers translating the bytecode to native code when needed. Applications running based on such bytecodes tend to use more memory than regular applications (for example, they need to keep the compiled code in writeable memory, whereas regular applications can use shared read-only memory for this), and you probably have heard many people complain about the memory usage of Java and .Net applications. Some people even claim the Linux .NET platform is called "Mono" because you can run at most one such application at the same time. That how "stereo" was born: an extensions to run two (or more) applications in the same mono environment, thus reducing the memory overhead significantly, and making it useful for more people. Future versions should even be able to run Python (using IronPython) and eventually Java applications in the stereo runtime. It is also planned to add support for multiple user operation. So eventually, it will be able to replace your whole system. The project will then also change it's name to Multics, to reflect it's unique multi-user capabilities. At least if we get enough funding by Dunc-Tank, who is currently sponsoring all our development efforts.

31 March 2007

Benjamin Mako Hill: Progress

There is cool semi-recent news on the Free Cultural Works Definition front. The board of directors of the Wikimedia Foundation passed a resolution stating that all projects (including Wikipedia, Wikimedia Commons, and Wikibooks):
...are expected to host only content which is under a Free Content License, or which is otherwise free as recognized by the Definition of Free Cultural Works.
There is still room for several exceptions but this must be minimal and the use of such works, "with limited exception, should be to illustrate historically significant events, to include identifying protected works such as logos, or to complement (within narrow limits) articles about copyrighted contemporary works." For WMF and it's member projects, this was a useful step because it documents and strengthens an important position in favor of explicit goals that I feel is important to successful freedom movements. But it's not a major change for them. The resolution merely codifies what has already become accepted practice within Wikimedia projects. But this is a major change -- and a major victory -- for freedomdefined.org and the definition. Wikimedia projects, including Wikipedia, are the single most visible and important centers for the production and dissemination of free culture today. They're also the most successful and a model many want to emulate. Explicit buy in from WMF is a major victory indeed.

30 March 2007

Patrick Winnertz: cipux as admintool for DebianEdu - a second test

Mh… I tested today again cipux, a admintool which one of the two tools which will replace our(Debian-edu) old admintool wlus . Since I dislike cipux a bit I regulary test it (the last time 1 week ago) and most of the errors I announced last week are fixed. But here the new report: The CipUX team fixed many issues I mentioned the last time… but there are still very hugh errors for productive software :S During the installation an the run of cipux_setup -s I recognised an error in the script: it uses wrong options for an other subinstallation script of cipux. The cookie handling is mostly fixed but in some scripts I still got this nice picture.. Apparently there are still hugh errors in the cookie handling. Furthermore it was not possible to edit the user data (e.g. full name, …. ) in the useradmin, it allows only to add users, resetting the passwords and deleting them. I think this is not enough for an admintool as we need it in debian-edu as a replacement for webmin/wlus. While searching for editing the users data I clicked on “Userselfadmin” and … got a error 404.. this script does not exist. So here is also no possibility to change the user details. I noticed something strange… there are many groups for users, e.g: assistant, teacher, tutor, … but I don’t find an group for students, quite strange. I asked upstream but until one week I got no answer. :S Because I was a bit frustrated I want to have a look on one of the other features of cipux.. the internetadmin. It should be possible to forbid a user or a complete group the internet access…this is the theorie. When I clicked on the internetadmin-button I got the cookie error mentioned above. Mh… so it is not possible to forbid your pupils to go into the internet. :S Another important feature we need for DebianEdu. Okay… the other things works. ;-) As a conclusion: Upstream works hard on fixing the errors I found last time, but there are still hugh errors which can be found by testing the software a bit. Atm I would suggest them to work on it and don’t upload to Debian-Edu since I think many features they have in theory doesn’t work properly and are not well tested.

Patrick Winnertz: cipux as admintool for DebianEdu - a second test

Mh… I tested today again cipux, a admintool which one of the two tools which will replace our(Debian-edu) old admintool wlus . I started last week to test it and most of the errors I announced last week are fixed. But here the new report: The CipUX team fixed many issues I mentioned the last time… but there are still very hugh errors for productive software :S During the installation an the run of cipux_setup -s I recognised an error in the script: it uses wrong options for an other subinstallation script of cipux. The cookie handling is mostly fixed but in some scripts I still got this nice picture.. Apparently there are still hugh errors in the cookie handling. Furthermore it was not possible to edit the user data (e.g. full name, …. ) in the useradmin, it allows only to add users, resetting the passwords and deleting them. I think this is not enough for an admintool as we need it in debian-edu as a replacement for webmin/wlus. While searching for editing the users data I clicked on “Userselfadmin” and … got a error 404.. this script does not exist. So here is also no possibility to change the user details. I noticed something strange… there are many groups for users, e.g: assistant, teacher, tutor, … but I don’t find an group for students, quite strange. I asked upstream but until one week I got no answer. :S Because I was a bit frustrated I want to have a look on one of the other features of cipux.. the internetadmin. It should be possible to forbid a user or a complete group the internet access…this is the theorie. When I clicked on the internetadmin-button I got the cookie error mentioned above. Mh… so it is not possible to forbid your pupils to go into the internet. :S Another important feature we need for DebianEdu. Okay… the other things works. ;-) As a conclusion: Upstream works hard on fixing the errors I found last time, but there are still hugh errors which can be found by testing the software a bit. Atm I would suggest them to work on it and don’t upload to Debian-Edu since I think many features they have in theory doesn’t work properly and are not well tested.

MJ Ray: My DPL Vote, but While There's Moonlight and Music and Love and Romance...

A lot of people seem to post their votes onto planet these days. More so than 2 or 3 years ago. I'm still not going to post the full details, but here's my usual summary, based on the debate and the platforms.
Above None Of The Above
  • Sam Hocevar - I share his view of the problems, although I don't agree with all the suggested actions. A bit quirky, but seems nice enough.
  • Aigars Mahinovs - I think he could be an accountable and fair DPL. Has ideas - not all good ideas and I don't like the aim of releasing less often - but I can't see him driving on if he's getting flamed to a well-done crisp. A leader more than a ruler.
  • Gustavo Franco - nice guy, but maybe I just think that because I've had more direct contact with him than other candidates recently. I agree with most of his views of the problems, except Ubuntu and the tattoo. Maybe too inexperienced for this time.
  • Raphael Hertzog - I think the team model is a good idea for the size of the project now and it learns from past attempts.
Borderline
  • Wouter Verhelst - I'd be voting mainly based on what I've seen of him. I don't want to vote for someone standing with a low-detail platform, as that's just scary. Even when people break promises, it's hard enough to remove them. The debate did give a bit more detail. I fear the adoption of ESR-style "authority follows responsibility" - that's just impractical for parts of the debian infrastructure.
  • Simon Richter - Generally OK, but I'm worried by the cutting it fine with the platform, not posting any rebuttals and being late for the debate because one battery went flat.
Below NOTA
  • Steve McIntyre - This won't surprise anyone: it's because of the manner in which the Debian UK Society retail business was started; but also the trial misadvertised as mediation of the d-i conflict. I shudder to think what social conformance tests he wants in NM.
  • Anthony Towns - last year I didn't vote for this politician (while correct in one way, most DDs have never even seen me in a mediation situation and he didn't have the courage to cc me on that email) because I thought that email suggested he'd be a terrible DPL. This year, he's demonstrated how terrible and the platform and debate suggests he hasn't even noticed: he thinks he's been a successful leader, despite the recall vote. One or two interesting ideas, but not enough to overcome that. His rebuttal seems to utterly miss Sam Hocevar's point about how being not-evil (Corporate Social Responsibility, as seen in the private sector) is different from actively being good (Concern for Community, as seen in the third sector): is that being dense or devious?
So, how wrong am I this year? Is there more trouble ahead?

29 March 2007

Matthew Garrett

Relating to my previous post, it's pretty clear that some people think of the Ubuntu code of conduct as (effectively) political correctness gone mad, and that anyone who thinks it's a good idea is clearly a wuss. nou suggested that this isn't inherently a bad thing, and that the range of different opportunities in Linux means that whether or not one distribution aims to be "fluffy" isn't really a problem.

I'd possibly go slightly further than that. We have basically three classes of people:
  1. People who won't work on "fluffy" projects
  2. People who won't work on "hostile" projects
  3. People who will work on pretty much any project, independent of the atmosphere
So, think of it as an optimisation tactic - projects benefit from having skilled people working on them. Do you gain more skilled people from being "fluffy" or "hostile"? Ubuntu's betting on the former, and my gut feeling is that that's the right answer. I don't have any reason to believe that the number of people in category 1 is terribly large, while I think category 2 is potentially much bigger.

Right now, I've got no evidence to back that up at all. But that's ok. In the long run, we'll probably get a better idea. If you think that Ubuntu's wrong to have chosen those criteria, then that's also ok. You're not obliged to be involved. Perhaps I'll be wrong, and the "hostile" projects will end up out-innovating the "fluffy" ones. But criticising the "fluffy" projects because they've dared to try something different? No, I don't think that's reasonable.

Romain Francoise: Lessons learned: #612

If you admin a heavily loaded SpamAssassin server...
  1. Use SQL for Bayes and AWL data. This allows your spamd processes to store their tokens simultaneously, instead of fighting over the lock for the Berkeley DB files. I use MySQL, postgres works too.
  2. If you use network tests, install a local caching nameserver. Even if your nameserver is on the LAN right next to the mail server, it'll be worth it.
  3. If you use OCR, make sure that the caching mechanism works. This is especially important in corporate environments where people use images as signatures. For extra points, store the image hashes in SQL too.
Also, the old prefork (--round-robin) algorithm works much better in my case than the new Apache-like scaling algorithm. YMMV.

Benjamin Mako Hill: Dollar Books

One of my favorite weekend activities is spending a Saturday afternoon going through the dollar book carts outside many New York and Boston area used book stores. It's not only because the books are cheap -- although I like that. The dollar book section is the great equalizer of bookstores. A neglected Dickens or Shakespeare can rub out against a discarded Mary-Cate and Ashley teeny-bopper quasi-romance novel. In the best cases, random shelving creates perfect (if unintuitive and ironic) pairs like Run Run Run about Abbie Hoffman and Fun Fun Fun about other youngsters -- a pair I found adjacent in a dollar book section last week.
/copyrighteous/images/run_fun_run.jpg
But you also get to meet books you will never meet in the bookstore sections you normally frequent. The dollar book section at the Strand has introduced me to a whole class of books with intriguing non-fiction sounding titles that I had pulled excitedly off the shelf only to find out that they were, in fact, novels. There are also the books with titles so good you suspect the book will be downhill from that point. The Complete Idiot's Guide To Being a Model (not, as one might expect, Becoming a model) and this guide to the British pierage are great examples.
/copyrighteous/images/british_piers.jpg

Matthew Garrett

I'm not really sure which I find more disappointing - this, this or this.

The Ubuntu Code of Conduct is something that's designed to ensure two things. Firstly, and perhaps most obviously, that discussions don't end up bogged down in personal abuse with no useful conclusions being drawn. Secondly, and perhaps more subtly, to ensure that potential contributors aren't put off by an atmosphere of perceived hostility.

The second point has been most commonly raised with respect to women in computing (perhaps most notably by the FLOSSPOLS findings), but it's not limited to that. One of the reasons I'm not involved with Debian nowadays is the atmosphere on the mailing lists[1]. If you're about to make something that you expect to be a controversial point, realising that the likely result is going to be a certain number of responses implying that holding that opinion is stupid is a pretty strong incentive to avoid posting in the first place. Suppressing the expression of thoughts isn't beneficial, even if you're not doing so deliberately.

Now, the obvious response to this is to accuse the CoC of enforcing some sort of Tellytubby land where people are nice to each other and it's all a mutual love-in. Which isn't, in fact, the case. Disagreeing with people is fine, but disagreeing in a factual and precise manner is significantly more useful than disagreeing in a manner that gives the strong impression that it would have been more helpful if the original poster had died rather than sending the mail in the first place. You're not even obliged to behave in a friendly way towards people - just avoid behaving in a clearly unfriendly way. A good rule of thumb is probably that if you think it would potentially result in a complaint to your boss if you did it in a moderately large company, then doing it on an Ubuntu mailing list is a bad plan.

So, the original point. The joke itself implies that there's no way to know why women behave the way they do, even to the point where a (presumably) omniscient god has no idea. Unsurprisingly, telling a large body of potential contributors that their behaviour is irrational[2] isn't a great way making them feel like their contributions are welcomed. But, oh no! It's actually ok - we're supposed to replace "women" with "newbs", because suggesting that basically your entire pool of potential contributors that their behaviour is irrational is much less bad.

Cough.

We then get to Caroline's post, an expression of frustration about an aspect of life. It contains the word "Fuck", which doesn't seem unreasonable in context. There's then a complaint from someone claiming that it's offensive, which means we have to consider a few things. Firstly, is the author of the complaint actually offended, or just attempting to claim that there's hypocrisy involved? Given the context, I'd suspect the latter. Arguably this isn't really the point, though - the issue isn't whether a given person is offended, it's whether it'll offend someone who would otherwise potentially make a valuable member of the community. Right now, I'd suspect that we (as a community) don't really object to it strongly. Google suggests that swearing isn't unheard of on the lists. While swearing in the context of a personal attack is pretty clearly a violation of the CoC[3], people don't seem to be objecting to it in general.

So, is it unacceptable to swear within the Ubuntu community? Right now, I'd say that (in appropriate contexts) it's not a problem. If a moderate number of people claim that the current degree of swearing dissuades them from being involved, then it may become a problem. Accusing someone of hypocrisy for swearing (not clearly a CoC issue, especially in context) after they claimed that a sexist joke might be, well, offensive? Yeah, I'd say that that one's pretty clearly unacceptable. Telling people that it's pretty funny and that they're wrong to be offended? History suggests that it's not a good plan. If you think someone's wrong to be offended, then a good first step is trying to figure out why rather than just dismissing them.

Of course, there's also the entirely secondary issue of what the roles of planet sites in the community are. Personally, I like to think of them as opportunities to see what people are really like rather than being reflections of people's behaviours on project mailing lists[4]. From that point of view, I think that the bounds of acceptable behaviour should be a little more liberal. If people disagree, that's not a problem and things can change - but expecting people to change their behaviour before there's any sort of general opinion that it's unacceptable isn't ok.

Which leaves open the question of whether posting sexist jokes to mailing lists is on the acceptable side of the CoC[5] or not. I'd be surprised if the ubuntu-uk community genuinely thought so, but if they do then there are pretty clearly issues that we need to solve. As far as I'm concerned, justifying that sort of behaviour has no place in Ubuntu.

[1] Yes, I'm aware that there's a certain degree of irony there
[2] For the record, yes, I do believe that women often behave in irrational ways. So do men.
[3] I find it surprisingly hard not to write that as COCK. Too much Jerkcity
[4] Which is, to an extent, why this journal isn't on Planet Ubuntu - there'd be potential for things I said to be mistaken for some sort of official Ubuntu position, which would end up limiting what I could say, which would kind of ruin the point
[5] Must... resist... temptation...

Enrico Zini: remoteform-weird-error

TurboGears RemoteForm tip In case your RemoteForm misteriously behaves like a normal HTTP form, refreshing the page on submit, and the only hint that there's something wrong is this bit in the Iceweasel's error console:
Errore: uncaught exception: [Exception... "Component returned failure
code: 0x80070057 (NS_ERROR_ILLEGAL_VALUE) [nsIXMLHttpRequest.open]"
nsresult: "0x80070057 (NS_ERROR_ILLEGAL_VALUE)"  location: "JS frame ::
javascript: eval(__firebugTemp__); :: anonymous :: line 1"  data: no]
the problem can just be a missing action= attribute to the form. I found out after:
  1. reading the TurboGears remoteform wiki: "For some reason, the RemoteForm is acting like a regular html form, serving up a new page instead of performing the replacements we're looking for. I'll update this page as soon as I figure out why this is happening."
  2. finding this page on Google and meditating for a while while staring at it. I don't speak German, but often enough I manage to solve problems after meditating over Google results in all sorts of languages unknown or unreadable to me. I will call this practice Webomancy.

Russell Coker: questions regarding SE Linux

I just received a question about SE Linux via email. As I don't want to post private messages containing material that's globally useful I'll answer through my blog:

> other than strict and targeted policies......other policies like
> RBAC, MCS, Type Enforcement are also there....how are these policies
> implemented

The two main policies are the strict policy and the targeted policy. The strict policy is the earliest and was originally known as the sample policy (but was given the name "strict" after targeted was developed).

The strict policy aims to give minimal privileges to all daemons. The targeted policy aims to restrict the programs that are most vulnerable (network facing daemons) and not restrict other programs (for ease of use). There is currently work in progress on combining those policies so the person who compiles the policy can determine which features of strict they desire.

RBAC means Role Based Access Control. The strict policy assigns users to roles and the role then limits the set of domains that can be entered. For example the user_r role does not permit the sysadm_t domain so a user who is only permitted to enter the user_r role can not perform sys-admin tasks. Like many terms RBAC is used in different manners, some people consider that it means direct control by role (EG role user_r can not write to /dev/hda), while SE Linux has a more indirect use of roles (role user_r can not run programs in domain sysadm_t or any other domain that allows writing to type fixed_disk_device_t - the type for /dev/hda). You may consider that the strict policy supports RBAC depending on which definition of the term you use.

Generally the targeted policy is not considered to support RBAC, although if you consider a role to merely be a container for a set of accesses that are permitted then a SE Linux domain could be considered a in the RBAC sense. I don't think of targeted policy as being a RBAC implementation because all user sessions run in the domain unconfined_t which has no restriction. I think that to be considered RBAC a system must confine user logins.

Type enforcement is the primary access control mechanism for SE Linux. Every object that a process may access (including other processes) has a type assigned to it. The type of a process is known as a domain. The system has a policy database which for every combination of domain, type, and object class (which is one of dir, file, blk_file, etc - all the different types of object that a process may access) specifies whether the action is permitted or denied (default deny) and whether it is audited (default is to audit all denied operations and not audit permitted operations).

MCS is a confidentiality protection mechanism where each file has a set of categories assigned to it. The set may be empty, may contain all 1024 categories, or any sub-set. Each process has a set of categories that determines which files it may access. File access is granted if Unix permissions allow it, if the domain-type model allows it, and if MCS allows it (on an MCS system). I have just had an article on MCS published in Linux Journal.

MCS is an optional feature for people compiling Linux from source or for distribution vendors. For Red Hat Enterprise Linux, Fedora, and Debian the decision was made to include it, so the strict and targeted policies for those distributions include MCS.

There is another policy known as MLS. This is a policy build that comprises the strict policy plus Multi-Level Security. Multi-Level Security aims to give the highest confidentiality protection and comply with the LSPP (Labeled Security Protection Profile - roughly comparable to B1) Common Criteria certification. It would be possible to build a targeted policy with MLS but that wouldn't make sense - why have the highest protection of confidentiality with anything less than the highest protection of integrity?

As for how the policies are implemented, I'm not about to write a tutorial on policy writing for a blog post, I'm sure that someone will post a link to a Tresys or Fedora web page in the comments. ;)

> there r some packages of linux in which some changes has been made
> to support linux......for eg:- coreutils, findutils

That is correct. Every program that launches a process on behalf of a user at a different privilege user (EG /bin/login, sshd and crond) and every program that creates files for processes running in different domains (EG logrotate creating new log files for multiple daemons) needs to be modified to support SE Linux. Also ls and ps were modified to show SE Linux contexts as well as the obvious programs in coreutils.

> 'Z' is the new thing that have been added to most of the
> utilities......wherever I search I get the changes made only in few
> utilities like ps, mv, cp, ls
>
> Can u help me by giving all the changes made in each of the utilities.....

Unfortunately I can't. This has been identified as an issue and there is currently work in progress to determine the best way of managing this.

Gerfried Fuchs: Rhonda blogs

I think it's time to start blogging more often about this topic, and fill this section a bit more. I mean, Mermaids was a long time ago... And debconf in Mexico with my first try on skirts, getting rid of my beard and dying my hairs red is history in the meantime, too. So, what has happened in between... Well, there was of course the Regenbogenparade which I attended and which was nice. I even ordered a special t-shirt from a shop in Australia that I totally love. In summer I met up in Bratislava with a longtime friend from a MUD I played way back, and enjoyed running around in a skirt there, too. Gladly it was a sunny day. It was though... people back here in Vienna looked more awkward at me than in Bratislava. At least that was my impression... Had been to Extremadura for the i18n meeting which was quite nice. It was quite productive, even though I have to admit that I haven't done much on that front since. Even in Spain people didn't look that strange at my skirt as over here in Austria... At our company's Christmas party I got into a talk with a work colleague about the topic and she informed me that a former working colleague of us is starting with hormone treatment after the year change and if I'd fancy a meeting with him. I was quite happy about that offer so we arranged a meeting on December 23rd. It was a bit strange at first to address him as he, and we didn't know how to start talking because said working colleague was late, but after a while we talked about various things and even were finished with the more interesting topics when she finally appeared. We arranged to visit the next Trans-X meeting after the year change.
I left them for leaving home, but I wasn't able to catch my bus on time—the subway had serious problems. Well, I thought I might spend the night in the Flex so I called another working colleague who usually hangs out there about what was going on that evening, and interestingly he told me it was Gay Heaven night. I stopped believing in coincidence long ago... Anyway, was a nice evening all in all, they had a Christmas rabbit handing out "I love you" stamps with pink ink-pads. :) The Trans-X meeting wasn't too bad. It was some discussions about various topics. After a while my first shyness dropped a bit and I started to join in the discussion at some points. After the first started to leave I had some more direct talks with two of the women from there, one of them had mostly the same trip home as me so we talked on in the subway. A week later they had set a transgender weekend—no wonder, it was the weekend of the Rosenball. They were meeting in a cafe on Friday and I joined them, a bit less shy now that I at least knew some of the faces. Maria was quite ill and was sitting in her jacket within the cafe, shivering like hell... But all in all it was a nice meeting too, got to know some more nice people. I was a bit lazy from there on, didn't join another meeting... But another working colleague did invite me to the carnival party of his sister. I thought I could try a bit more than before, in the disguise of the carnival party, so I used a bra my former wife left behind, filled it with some socks, and put up some eye makeup (quite discreet, I hate overdone makeup already on natural females...) The light there wasn't the best, so they just saw my tall body at first. It took them a while to even notice the skirt, and only after I put off my long-sleeve they haven't noticed my breast. But well, I don't really blame them, my working colleague has announced me as a he, and given the low lights it's not too bad. Though, after the host noticed my breasts he asked if he could touch them and I even received a quite nice kiss from him. :D I stumbled upon the Gaia TG Guild on Gaia Online—a quite interesting web-based community. In general Gaia is filled with mostly kids, many of them immature, not able to spell and considering that even cool, but there are some quite special guilds that are lots of fun. But still, when I stumbled upon the TG Guild I was in awe of that such a thing could exist there. What I read made me feel totally happy and more confident on the path I'm having ahead of me. Last week I finally had been to an Trans-X meeting again, and Maria showed some quite interesting reportages about transsexual people—including one that was on TV just the day before about a 14 year old girl who is already on hormone treatment and has the absolute support from her family since she was 4 and confronted them with cutting "it" off when they don't allow her to wear skirts when going out, too. All the best to you, Kim! I so envy your strength... I'm sorry about the length of this entry—but I'm sick of people who tell me that I'm only playing it, or that I would hide... And I also see it as a chance to document my path for myself. I promise—the next entries will be more often and thus shorter.

Miriam Ruiz: Free Software and Composer s Copyright Societies

We’re trying hard to include Frets on Fire in Debian. FoF is a really great game where you have to try to play a simulated guitar through your computer keyboard. The code is already GPL, and the developers are really nice and collaborative. The game consists of some code in python, some game data, graphics and so, and some songs, including a tutorial. The problem comes when we try to get the songs into Debian too. It seems that, for being able for someone to be something in the musical scene in Finland, they must sign an abusive contract with Teosto (Finish Composer’s Copyright Society, which AFAIK is a private organization), giving them exclusive rights on whatever songs you make, so you won’t be able to license any song at all without using a license that has been approved by them. More discussion here. This is wierd. Composer’s Copyright Societies should be there to help composers and artists, not to enslave them. For what I heard it’s not the only country in which that happens. Especially in Europe, the EU is extremelly protectionist to those matters, whether they do right or wrong, or whether they even go against the author’s will. Gosh, it’s the authors who should have the right to choose, not the mafias choose for them. In Spain I think it’s more or less the same, the SGAE seems to have the same attitude towards artists than Teosto. When will they realize they’re being anachronistic and unfair?

28 March 2007

Marc 'Zugschlus' Haber: using grml to prepare LVM surgery

One of my dedicated servers was in bad need of major LVM surgery today. Since the rescue system delivered with the server by the housing provider suffers from lack of LVM support, I needed to pull a creative stunt with grub and grml to accomplish this. The dedicated server rented from strato is the Box I tested in a different article. Installing the LVM-based Debian system via the LVM-less rescue system involved first installing without LVM in the partition which was originally supposed to be swap, booting the just installed system and using this temporary system to finally bootstrap the target. I had originally planned to go this way again in case rescue should become necessary. Today, I checked first whether the provider supplied rescue system had improved in the mean time (which it hadn’t), and I didn’t feel like installing a new temporary system. Instead, I decided to go through a different route, using grml. grml is extremely versatile regarding boot. All you need is to get the grml kernel to boot and point it towards the grml initrd, and the initrd automatically searches the available drives for the compressed file system image, mounts it and continues the boot process. This was the point where I hooked myself into grml. I put an ext3fs on the swap partition and copied the contents of a grml CD to that partition. After thinking a while about how to get ISOLINUX to boot this grml, I remembered that the disk already has grub installed, and decided to use grub to boot grml. This was possible because the provider offers a serial console for the machine. If no serial console had been available, things would have been a lot harder since there would be no feedback and one would have to talk to grub via offline editing of menu.lst. Thanks to the serial console, things were a lot faster. Booting grml via grub is actually easy. After finding out which partition grml is on (find /linux26) and setting this partition as root, all you need is “kernel /linux26 ramdisk_size=100000 init=/etc/init lang=us BOOT_IMAGE=grml console=ttyS0,57600n8”, “initrd /minirt26.gz” and finally “boot”. The “57600” given on the kernel command line was actually the hardest part: Strato operates the serial console at unusual 57600 bps, and grml’s serial console feature starts mgetty with hard-coded 9600 bps. The rather frustrating symptom was that you can watch grml booting, with “Finished execution of main grml startup” as the last sign of life. Knowing that there is a login prompt waiting for you at the wrong baud rate. After talking to Mika from the grml team for some minutes, we decided to take two “roads” to solve the issue. Mika hacked grml’s startup process to parse the baud rate to be used for mgetty from the kernel command line. Since I couldn’t wait for Mika’s fix, I used a grml.sh script to put a fixed mgetty.config over the file contained in grml. After fixing some stupid mistakes on my part, I finally received my grml login prompt and could start with the LVM surgery. Grml is a perfect tool for such tasks since it is extremely flexible and not selective in which medium and partition types it can boot from. It has saved me a lot of grief today and has helped me in solving a difficult problem. Oh, btw, pvmove --alloc anywhere can move a logical volume inside a pysical volume without the need of a temporary physical volume, and it is thus possible to “manually” defragment a physical volume in order to allow more clean resizing of logical values. While it is debateable whether this does really make sense, it satisfies my sense of order to have an LVM setup unfragmented.

Roland Mas: Camsync, now with pmount support

My little pictures-downloading tool just got a new feature: instead of relying on an automounter, it can now invoke pmount itself. That makes it easier to setup. It also allows you to unplug the camera as soon as the program is done running; no more waiting for the automounter to unmount it after a timeout. The Synchronisation scripts for digital cameras page has been updated accordingly.

Next.

Previous.