GPE packaging (at least for my own packages in GPE) has been added to svn.debian.org (alternative browser front end - my preference) and available via svn://svn.debian.org/pkg-gpe/.

Some packages have been converted to dpkg source format 3.0, although only for purposes of using the upstream .orig.tar.bz2 directly without repacking and for the purposes of testing svn-buildpackage 0.7.1 support.

Over Thanksgiving this year, we took a train trip to visit Terah s family in Indiana. Here s the story of the trip. The Train to Indiana Our last train trip (to Chicago) was in May, before Oliver was born. Jacob always has enjoyed the train, but this time wow. We told Jacob about the trip the day before we were to leave. Several times in the day, he d get a sly smile, and ask, What are we going to do? Terah or I would spell out the day s activities, and when we d get close to the part where I d wake him up at night and we d go to the train station, he d have a big smile. The big hour (2AM) arrived and Jacob woke up while Terah was putting his shoes on. I was there a moment later. Normally Jacob is terribly grumpy after waking up, even more so if somebody else woke him up. That day, I saw a very groggy-looking boy. I asked him, Jacob, are you ready to go to the train station? He answered, YEAH! while rubbing his eyes. Dad, let s go! We had Amtrak s family bedroom for the first time this trip, and it worked out great. Jacob actually slept, despite his extreme excitement. He d been talking about eating in the diner car for quite some time, and was really excited when breakfast time rolled around. We sat down, and he pressed his nose up against the window right away. He counted the freight trains the he saw, pointed out train tracks and crossing guard lights , noticed barns and trucks, and gave us frequent updates on how fast we were going. His voice was high-pitched from excitement, and sometimes we d have a running commentary we could barely interrupt, and other times he d sit there silently just soaking it all in. But he didn t eat. He didn t want to turn his head away from the window for a second to take a bite. I kept reminding him to take a bite, and finally, fearing he d be really hungry as soon as we went back to our room, fed him a few bites for the first time in ages. I don t believe he realized that happened. He just opened his mouth by reflex and once I had to tell him to close his mouth around the fork that was in it. It was much the same story for lunch, and for dinner on the train though less so for dinner since it was dark outside. At dinner, a man sitting across the aisle from us said, If you weren t getting your meal free [since we're in the sleeper], I d buy it for you. Your boys are amazingly well-behaved! I thanked him politely Jacob and Oliver both were doing well but didn t really think it was that unusual. Oliver and Jacob were both big hits on the train. They got smiles from so many people on board and in the stations. Several of the dining car staff seemed to linger at our table longer than elsewhere, looking at them (and especially Oliver). Oliver slept well on the train: And here are a couple of typical Jacob photos: In Indiana I ve got to start this out with one of the family gatherings at Terah s aunt s house. They have a large kids area in their basement, and a swingset with a slide outside. Jacob loved all of this, and spent hours playing with me. Sometimes if I d go upstairs with the adults, I d hear Jacob s voice from the basement a few minutes later: DAAAAAD!!!! Shall you come back downstairs? DAAAD! And, of course, it s hard to resist a 3-year-old that wants to play with me, so I inevitably would. We played air hockey Jacob shrieked with delight whenever anybody scored a goal in any way. At one point, he stood up, looked around, and said, Hmmm. Where are all the trains? Apparently he expected every home to be stocked with toy trains, and this one wasn t. A few seconds later, he was all excited. He ran over to a toy semi, and said, I will use the semi train! Outside the short slide had a ladder going up to it. I held Jacob s hands while he climbed up the first few times, but I knew he could do it himself. I started helping him less and less, and eventually refused to help him at all. He was rather frustrated with that for a moment, but a couple times later, climbed up and said, Dad, I got up here all by myself! A few times later, it looked like he was having trouble, so I tried to help, and got shooed away with, No, dad! I can do it. The best moment of the weekend came during the drive back to Terah s mom s house where we were staying. Terah was driving, and I heard Jacob say, Shall you come closer? Not sure how to do that from the front seat of the car, I reached my hand back there and he held it. He held one or the other of my hands for 20 minutes until he fell asleep in the car. It s funny what feeling needed by a 3-year-old makes a person feel, but that was surely a happy day. Jacob got to see all of his Indiana grandparents on this trip, and loved playing with them. He especially liked using a perfect red train (his words!) he drug home from the nursery at church on Sunday, and a child-sized tent in the basement. I m not sure how many times I heard Gampa Mike! Shall we go to the basement? that weekend. One point he wanted me to come down to see it and play with him, so I did. Then he decided we all needed to be down there, and told me I ll go pick up mom. I ll be right back. Stay downstairs, dad. Fearing that Terah wouldn t know what to do when Jacob attempted to pick her up , I tried to discreetly follow at a distance. That was no match for a 3-year-old. He looked back at me from the top of the stairs, pointed an accusing finger at me, lowered his voice, and said, Dad. Stay. Terah and I spent a day in South Bend and stayed at the Oliver Inn while Jacob and Oliver got some time to themselves with their grandparents. We had dinner at the beautiful Tippecanoe Place, just next door. The Trip Home We had a few hours in downtown Chicago on our way home. We went and ate at a small Indian restaurant. Jacob kept alternating between three things: This food is very spicy! I like spicy food. I need another drink! A little while later, Terah decided we should have some dessert. So she and Oliver stayed in the waiting area while Jacob and I went asporing (exploring) to find something. We walked a block or two to the nearest Dunkin Donuts, then to a Starbucks, and then back. Jacob carried the sack of donuts, guarding them so carefully that I was afraid he might smash them. (They were cream-filled so that wouldn t have been good.) He had a lot of fun exploring Chicago Union Station, and also enjoyed walking in Chicago (though not quite as much; it was all a little too loud for him.) In the train station, he loved the escalators. Up and down we went, whenever we wouldn t get in people s way. I had to eventually drag him away from them as I was getting a little self-conscious at all the people standing around watching us repeatedly go up and down the escalators. Jacob has found a 3-year-old way to express his feelings: he ll pretend to be a kitty, and say the kitty is sad or something like it. All day he had been saying the kitty is hungry. He hadn t had a big breakfast, but he had plenty of opportunity to eat at lunch, and a snack. We were a bit confused, but I think we finally figured it out on the train back to Kansas. We didn t have time to eat breakfast in the diner on the train from South Bend to Chicago, so Jacob missed out on the dining car then, and I think he was disappointed or confused about that. Once we had dinner in the dining car, he was happier. Since we ve been back home, he s been talking about our next train trip. He says which suitcases we ll take, that we ll eat in the diner, that it will be a night train we take, and generally is still very excited about it. It was a fun trip.

So a few years ago I got stuck with no health insurance as I had a fellowship that had for its history accepted professors (with health insurance) not fresh off the boat PhDs as was the case with me. Since I was at a Large State school it was nearly impossible for me to get insurance and finally I ended up paying 400 a month and getting a whole lot of headache. In many ways my ordeal was a fluke following a change of policy and this fellowship now provides insurance to its postdocs. Increasingly, however, it seems like a number of postdoctoral fellowships shirk from their duties and don t provide a drop of health insurance. Given the academic job market, many academics don t have any choice but to accept these positions and if they don t come with insurance, well then these folks are shelling out thousands upon thousands of dollars for basic, really lousy, coverage. Given that universities for the most part have decent, even in some cases kick ass insurance, with a large pool of people, shutting postdocs out of their pool is.. gross and just plain wrong. One of my fellow friends, currently on the market and currently screwed by her last postdoc wrote up a short document (aka Academic Labor Hall of Shame) and I thought I would post it here as it gets to the heart of the issues and starts shaming some of these shameful universities. If you know of other postdoctoral positions that don t offer insurance, please please leave a comment. We will include it in the hall of shame. Academic Labor Hall of Shame Universities like to promote themselves as bastions of enlightenment, but their treatment of temporary and hidden employees is often anything but enlightened. Or progressive. Or fair. 1. Postdoctoral fellows and researchers: There is a growing trend towards classing postdocs as not employees . I learned this recently when I was laid off from postdoctoral position at the University of Pennsylvania. I planned to extend my health insurance through COBRA, which is currently federally subsidized for workers who lost their jobs during the financial crisis. I was shocked when Penn initially claimed that I was not eligible for the subsidy (made available through the American Recovery and Reinvestment Act of 2009, the so-called stimulus act ). Their reason was that postdocs were not classed by Penn as employees. I appealed this with the Office of General Counsel and after a few weeks was told that I was indeed eligible, as Penn had found an inconsistency in [their] policy for certain categories of post docs between tax treatment and the availability of COBRA/ARRA . This means that while I am in fact eligible for this subsidy, postdocs paid through many other classes of grants are still not. If you want to see an example of this process of sorting some postdocs into not employee status, here is another one:
Postdocs on training grants or on individual fellowships (roughly 25% of VUMC postdocs) receive a stipend and are specifically excluded from the employee classification. They do not pay FICA and do not receive employee benefits. Their health insurance is provided and purchased separately. [by whom?] Even if Vanderbilt does in this case make provisions for these postdocs to receive health insurance, there is abundant evidence that some postdocs are outright excluded, as in this example at Stanford:
Stanford makes no provision for fellows to purchase health insurance, and the Institute will not provide medical insurance or other benefits. External fellows must bring their own medical coverage with them or purchase an individual plan during their stay in California. This is also quite apparent when you look into the outfits that profit from selling health insurance to postdocs (because their universities don t provide them any):
http://www.garnett-powers.com/npa/ Also, take a look at the policy they and you ll note that it stinks: it excludes such luxuries as preventive care, birth control, and chemotherapy. I m not making this up:
http://www.garnett-powers.com/npa/summary.pdf

So a few years ago I got stuck with no health insurance as I had a fellowship that had for its history accepted professors (with health insurance) not fresh off the boat PhDs as was the case with me. Since I was at a Large State school it was nearly impossible for me to get insurance and finally I ended up paying 400 a month and getting a whole lot of headache. In many ways my ordeal was a fluke following a change of policy and this fellowship now provides insurance to its postdocs. Increasingly, however, it seems like a number of postdoctoral fellowships shirk from their duties and don t provide a drop of health insurance. Given the academic job market, many academics don t have any choice but to accept these positions and if they don t come with insurance, well then these folks are shelling out thousands upon thousands of dollars for basic, really lousy, coverage. Given that universities for the most part have decent, even in some cases kick ass insurance, with a large pool of people, shutting postdocs out of their pool is.. gross and just plain wrong. One of my fellow friends, currently on the market and currently screwed by her last postdoc wrote up a short document (aka Academic Labor Hall of Shame) and I thought I would post it here as it gets to the heart of the issues and starts shaming some of these shameful universities. If you know of other postdoctoral positions that don t offer insurance, please please leave a comment. We will include it in the hall of shame. Academic Labor Hall of Shame Universities like to promote themselves as bastions of enlightenment, but their treatment of temporary and hidden employees is often anything but enlightened. Or progressive. Or fair. 1. Postdoctoral fellows and researchers: There is a growing trend towards classing postdocs as not employees . I learned this recently when I was laid off from postdoctoral position at the University of Pennsylvania. I planned to extend my health insurance through COBRA, which is currently federally subsidized for workers who lost their jobs during the financial crisis. I was shocked when Penn initially claimed that I was not eligible for the subsidy (made available through the American Recovery and Reinvestment Act of 2009, the so-called stimulus act ). Their reason was that postdocs were not classed by Penn as employees. I appealed this with the Office of General Counsel and after a few weeks was told that I was indeed eligible, as Penn had found an inconsistency in [their] policy for certain categories of post docs between tax treatment and the availability of COBRA/ARRA . This means that while I am in fact eligible for this subsidy, postdocs paid through many other classes of grants are still not. If you want to see an example of this process of sorting some postdocs into not employee status, here is another one:
Postdocs on training grants or on individual fellowships (roughly 25% of VUMC postdocs) receive a stipend and are specifically excluded from the employee classification. They do not pay FICA and do not receive employee benefits. Their health insurance is provided and purchased separately. [by whom?] Even if Vanderbilt does in this case make provisions for these postdocs to receive health insurance, there is abundant evidence that some postdocs are outright excluded, as in this example at Stanford:
Stanford makes no provision for fellows to purchase health insurance, and the Institute will not provide medical insurance or other benefits. External fellows must bring their own medical coverage with them or purchase an individual plan during their stay in California. This is also quite apparent when you look into the outfits that profit from selling health insurance to postdocs (because their universities don t provide them any):
http://www.garnett-powers.com/npa/ Also, take a look at the policy they and you ll note that it stinks: it excludes such luxuries as preventive care, birth control, and chemotherapy. I m not making this up:
http://www.garnett-powers.com/npa/summary.pdf

Today is a nice milestone. For the first time my server is "in the cloud", and yet I have full control over the kernel it is running. While it should be possible to do this with Xen, I never found a host who would. So for the three years since I got rid of colocated physical hardware, I was constantly nagging my Xen hosters to update their kernels, often to fix security issues. And I sometimes struggled with things like udev that needed a newer kernel. Most importantly it just didn't feel right for "my" server to not run my kernel. Even though in this modern day, "my" server is just a fever dream of bigger computer. I'm infected with the Sovereign Computing meme. KVM probably makes this easier than does Xen. What Steve has set up at kvm-hosting.org is a great example and template for providing a small group with great hosting at a very fair price, with full control, and an excellent interface. It's the little things, like being able to view the my neighboring guests' virtial machines in top, that I really like.

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND            
 2841 joey      20   0 1637m 1.0g 3152 S    7 13.2  48:27.20 kvm                
 6606 steve     20   0 1365m 1.0g 3540 S    2 13.2   9:29.52 kvm                
 2888 cernio    20   0 1269m 284m 3152 R    1  3.6   4:08.57 kvm   
 2800 ore2      20   0  754m 521m 3152 S    0  6.6   4:35.68 kvm     

This all feels sorta science fictional when I step back and look at it.

---

notes for kernel setup on kvm-hosting.org I want to be able to install regular Debian kernel packages. In these packages, the virtio drivers are modules, and need to be manually added to an initrd. So first edit /etc/initramfs-tools/modules and add the below to it, then run update-initramfs -k all -u to rebuild the initrd. BTW, some of these modules may not really be necessary.

virtio_blk
virtio_console
virtio_pci
virtio_net
virtio_balloon
virtio-rng

Then edit /etc/kernel-img.conf to configure the kernels to add a symlink to the latest version in /boot. This way, kvm-shell can be configured to boot the latest kernel automatically.

do_symlinks = yes
link_in_boot = yes

And here is a hook that rsyncs /boot, sending kernels and initrds to kvm-hosting, so its interface will let me boot them. This was put in /etc/initramfs-tools/hooks/kvm-hosting-rsync and made executable.

#!/bin/sh
# Use --copy-links so the symlinks to the current
# kernel and initrd are selectable in kvm-shell.
# 
# Use --delete because I like living dangerously. :)
rsync --copy-links --delete -vazr /boot/ kernels.kvm-hosting.net::joey-kernels/

A couple of weeks ago, Lucas Nussbaum wrote about his experience at the Ubuntu Developer Summit. Two things stuck out at me:

• "Ubuntu has clearly gone a very long way since 2004. Everything looks very well organized and polished, and gives the impression of a big machine that nothing can stop."

In the summer of 2004, my laptop (an iBook G4) ran Debian GNU/Linux on PowerPC. I tried out Ubuntu that autumn, and was very impressed. It's been five years since then. My desktop still runs Debian, and I'm proud to be a "two-distro" community member. At the same time, this juggernaut nature raises concern. When Ubuntu releases ship with significant flaws, I quietly sigh and wonder, Are we doing good service to the people coming to GNU/Linux for the first time and seeing Ubuntu? This bugginess has bit me a few times (even for upgrades between one release and the next), and it pushed a friend of mine to switch a lot of his computing to DragonflyBSD. Lucas points out that Ubuntu's done a fantastic job of becoming visible. A look at Google Trends shows that people search for "Ubuntu" about as much as they search for "Linux" at all. Richard Stallman complains when people refer to GNU/Linux as just "Linux." But today, the most popular name for an operating system based on GNU is probably "Ubuntu." For Stallman, having his hard work associated with someone else's "Linux" project must be frustrating. As a Debian contributor, it would be easy to succumb to the same feeling with regard to Ubuntu. Lucas is well aware of that. He asks,

• "Will Debian manage to stay relevant, or are we just going to be the technically-pure distro without many users that serves as a package supermarket for Ubuntu?"

Debian does have users! I was feeling a bit disheartened about my maintenance work on alpine lately, when out of the blue I received an email from a fellow at MIT asking me if I would accept some help with maintenance from him. Just seeing the note was a relief; it's very nice to be reminded that I have users to take care of. Debian is not as popular as Ubuntu on the desktop (or laptop), it's true. But technically sharp people do frequently still choose it. For example, the FreeNAS project recently announced a switch from FreeBSD to Debian (and a new name as coreNAS). But we could end up a "package supermarket". To stave this off, we must do good releases and make sure people know about them. Doing all that work takes us all time. We must recruit new contributors, help them find things to work on, and make sure they feel welcome. And sometimes-sloppy maintainers like me ought to fix our packages, and get help from others where necessary. I promise to work toward that.

As I ran out of time whilst writing the "introducing ujail" post on monday I would like to further elaborate on the idea, giving you some examples of possible use cases and then having a look at FAQs regarding ujail. Additionally I have created a second proof of concept that should be a lot faster, see below for more details.

Use cases of ujail

Monday's post was rather technical, so let's have a look at possible use cases today.

The main reason for both having the idea of ujail and starting working on it is my web server. I am running quite a few (S)CGI scripts there and, even though running them as different users, on a per-vhost basis, I have the impression of the whole thing being a bit insecure.

Okay, PHP does provide its famous open_basedir feature, but I am also running some Python applications which I simply cannot restrict easily. My first ideas involved adding something similar to open_basedir to Python, followed by the idea of replacing some C library functions, like fopen and friends on startup time.

Whilst the adding open_basedir to Python would have involved changing a lot of Python's internals I soon discarded the library patching idea as those could be worked around by injected code directly invoking syscalls. It didn't take long for me to notice that I have to dig deeper. The idea of ujail was born and after coming up with the proof of concept this seems to be a viable solution.

Now ujail is not only about protecting a web server from its web applications, but could do a lot more, for example:

• Creating a sandbox for untrusted code (socket&file i/o emulation)
  
• Implementing some sort of personal firewall (socket-call only emulation)
• Testing applications that perform low-level system operations (read: package managers and friends, filesystem emulation)

I am sure you can come up with even more use-cases. What should be noted is that emulating a system call does not mean that one necessarily needs to emulate the whole filesystem. What can be done, for example, is patching through access to common files (libraries, executables, etc.) whilst maintaining a virtual filesystem for data that will eventually be modified. A copy-on-write approach is possible too, for example. There are multiple methods with which the multiple filesystem could be implemented, the most common would probably be using a state directory.

FAQs

There have been some questions about ujail in comments to my first post which I would like to answer. Also, I have been thinking about things that are different about ujail compared to other virtualization techniques. Feel free to add additional questions either in a comment or drop me an email: debian at sp dot or dot at.

1. Could you change the license of ujail to ... ?
   
   Not likely to happen. The proof of concept's license is GPLv3 and the actual code's license will be too. However, ujail is a userspace application that does not need any modifications to the kernel so there should be no problems with porting ujail from GNU/Linux to any other system.
   
   
2. Does ujail work on operating systems other than GNU/Linux?
   
   Not yet. If it's technically possible to implement the technique on other operating systems I would be happy to accept patches.
   
   
3. Do I need to patch my kernel for ujail to work?
   
   No, ujail is running in userspace. The only thing it needs is Linux with support for PTRACE_SYSEMU.
   
   
4. How is this approach different from using LD_PRELOAD?
   
   With LD_PRELOAD one can replace library functions, but malicious code could still directly invoke syscalls, working around this protection completely. Also, statically linked binaries cannot be restricted with LD_PRELOAD.
   
   
5. How is this approach different from user-mode-linux?
   
   User-mode-linux (UML) works by emulating a full kernel in userspace and allows you to virtualize a whole Linux instance (including a new init process, etc). ujail is about providing a way of restricting a single process (and its childs) inside a running system in terms of access to syscalls and the partial emulation of those.
   
   
6. How is this approach different from linux-vserver?
   
   Linux-vserver is a kernel patch and runs in kernel space, as opposed to ujail, which works in userspace.
   Also, linux-vserver works similarly to user-mode-linux, providing a fully virtualized Linux instance.
   
   
7. Does the account running ujail need any special privileges?
   
   No, the only restrictions that apply are those of ptrace.
   
   
8. Where is the code?
   
   Right now ujail is in a planning phase, and only the proof of concept code has been written and published. The actual ujail code is yet to be written and the code will be hosted on launchpad.net.
   
   

Proof of concept, part 2

An anonymous person (who were you stranger?) added a comment to my first post, suggesting "Also, why patch the process rather than just modifying its state and trapping into the kernel?". I have had a look at this approach earlier, but it didn't work out. However, I decided to give it yet another try and created a second proof of concept. That code does not require patching any code, but only modifies the instruction pointer (eip) and the first register (eax). This should be a lot faster than patching the code.

Technically the new main loop works by calling PTRACE_SYSEMU and waiting for a notification. It then saves the instruction pointer and switches to PTRACE_SYSCALL. As before it waits for the emulated syscall to exit and at this point sets eax from orig_eax and decreases the value of the instruction pointer by the size of the "int $0x80" instruction. Another call to PTRACE_SYSCALL resumes the process. The next event is the process actually entering the real syscall and yet another one leaving the syscall again. These are resumed by PTRACE_SYSCALL and PTRACE_SYSEMU respectively. So, comparing this with the first approach we are only modifying two registers now, instead of writing to the TEXT area of the running process.

Thanks should go to the anonymous commenter for making me give this approach another try.

Questions? Criticism? More ideas? Want to contribute?

Coming to an end I would yet again like to let you know that I am open for questions, criticism, more ideas and contributions in general. So if you are interested in this topic come join the discussion by either dropping me an email, writing a comment to this post or replying to this post on your own blog.

Barnes and Noble's new nook ebook reader is now shipping to people. Mine[1] is due to turn up tomorrow, but the instruction manual is available for download already. Quoting from it:

Notwithstanding anything to the contrary in this Agreement, certain components of the
Software are licensed subject to the General Public License Version 2.0, a copy of which is attached
as Exhibit A (the GPL License ). You may not use these components except in compliance with
the GPL License. In addition, you may have additional rights with respect to such components
under the GPL License, including, without limitation, the right to obtain the source code for such
components from us. You may obtain a copy of such source code by contacting us through the
contact information provided on the Web Site. We will provide such source code in accordance
with the GPL License.

Which is all very promising[2], except contacting them via either phone or email reveals that nobody has the faintest idea what I'm talking about. I can certainly imagine that they have other concerns right now (delaying your initial shipments by up to two weeks depending on how early people ordered suggests some kind of utter failure somewhere in the chain), but it's depressing that approximately nobody appears to be able to get this right.

Updated:

After further conversations with tech support, I was told that I'll be mailed a CD of source within two weeks.

[1] I had a Sony, which unfortunately had a bit of an accident. On the other hand, it was running 2.4, so maybe it was a lucky escape of some sort?
[2] Well, apart from the traditional confusion of the GPL as something that claims to restrict use

For a Java project, I wanted to give the Eclipse profiler a try. It didn't work, because it was missing a library (open the "Error log" view to see such things)The corresponding library - libstdc++-5, and old C++ library - is no longer available in Debian unstable, so you need to grab the package from lenny. It will install fine on unstable.Things may or may not be different on other architectures.[Update: But TPTP is far from stable for me. It freezes Eclipse pretty much all the time.]

Dear lazyweb: I am in a dreadful situation! I need to secure e-mail communication between five types of users:

• Outlook 2003 users who receive their mail by POP3 from Exchange,
• Thunderbird users downloading mail with POP3,
• Apple Mail users downloading mail with POP3,
• Webmail users (Squirrelmail and Roundcube),
• and a bunch of Unix folks using proper clients.

To make matters worse: there is no common provider or server infrastructure, so the solution must work across providers and mailboxes.

Requirements

• Human error should be anticipated and prevented.
• Mail between all parties must be encrypted (and signed) automatically. If encryption is not possible, the mail must not be sent. This includes the situation where not all mail recipients keys are known;
• Ideally, one can define rules (using wildcards or regular expressions) to enforce certain policies.
• Mail to other parties may be signed, and it would be good to be able to turn this on and off by default;
• The MIME standard should be employed so that the mail body is not altered, and attachments can be seamlessly encrypted too. Existing MIME parts should be encapsulated as children of a new multipart tree;
• Incoming mail should be automatically and seamlessly decrypted/verified, and the user must be alerted if the verification fails.

Ideally, the solution will be open-source. However, if proprietary software performs better, then we will gladly use that where required.

Previous attempts So far, we ve tried (and were let down by)

• GpgOL, which has very irky and brittle integration with Outlook and can only do inline signing/encryption.
• S/MIME, which seems supported by all involved clients, but Outlook does not really allow you to specify policies. Encryption seems to be opportunistic at best, which is not enough.
• GPGrelay, which is promising because transparent, but apparently messes with MIME, and I am unsure whether it can fit between Outlook and Exchange. I have yet to run real tests though. If you are a GPGrelay user, or you d like to try it (it s Windows-only), please get in touch.
• WinGEAM, but that apparently no longer exists, and neither is the underlying GEAM.

Help! Does anyone have proper suggestions over what to use? In fact, if you are interested in devising a solution, or even deploying it, there s money to pay you for those services. Write in if you are interested.

Lately I have been thinking about methods to provide a stripped down, secured environment for running untrusted code on GNU/Linux. With this post I would like to present you with the first results of my research.

ujail - brief introduction

I have chosen ujail as the name for the technique I am proposing. ujail stands for micro jail in userspace and, in itself, describes the concept briefly. The main idea is to have a userspace process monitor system calls of one of its childs and emulate some calls, if needed. This is done using ptrace and namely both PTRACE_SYSEMU and PTRACE_SYSCALL.
The ujail process should not be able to monitor syscalls, like strace does, but also intercept and emulate them.

This sounds a lot like user mode linux (uml), but the method is different. Whilst uml comes with a complete kernel, emulates all system calls and this way provides a virtualized system, ujail is intended to only emulate some systemcalls, without emulating the kernel.

Revisiting PTRACE_SYSCALL & PTRACE_SYSEMU

To better explain how the ujail technique works I would like to have a quick look at PTRACE_SYSCALL and PTRACE_SYSEMU again.

PTRACE_SYSCALL allows a userspace process to be notified whenever a traced process enters or leaves a system call. This means that two notifications are normally sent: one before system call entry and one afterwards. Even though one is able to change the parameters of system calls this method does not allow system calls to be fully emulated (think virtual filesystem here).

PTRACE_SYSEMU on the other hand provides one notification on syscall entry and expects the receiver of the notification to emulate the syscall. This method alone sounds great, but this also means that memory allocation needs to be emulated too, which is quite complex in userspace.

A hybrid of PTRACE_SYSCALL & PTRACE_SYSEMU

Now on to the concept behind ujail. The method I am describing works by calling PTRACE_SYSEMU for a specific process and this way taking over emulation of all system calls. However, some system calls are complex to emulate in userspace, and so a hybrid of both PTRACE_SYSEMU and PTRACE_SYSCALL is needed. In short this works by checking whether the syscall needs to be emulated when the PTRACE_SYSEMU event is received.
Now one way is emulating the syscall, filling the processes' registers and resuming execution of the process. This is simple and straight-forward.

The second way is forwarding the system call to the kernel. The problem here is that calling the syscall in the monitoring process will make the new resources available to that very process, and not the process to be jailed. This is where the hybrid method kicks in.

The proof of concept code creates a backup of the next instruction to be executed along with a copy of the instruction pointer at this point and patches it with the opcodes for "int $0x80", causing the syscall to be made again. After that it resumes execution with PTRACE_SYSCALL and waits again. The first event to be received now is the program leaving the emulated system call, which can be ignored. Resuming yet again will give use two PTRACE_SYSCALL events, one for syscall entry and one for syscall exit.

The first event is not really interesting, but at the second event the opcode backup is restored and the eip set from the saved value. Now the kernel has handled the syscall and the result is ready for the child process. A final call of PTRACE_SYSEMU resumes execution of the child and waits for the next syscall.

Proof of concept

The proof of concept code can be downloaded from its bazaar branch at launchpad.net. It is intended to be used on i386 systems only and works with simple programs, but is known not to work with anything using fork, vfork and most likely will not work for binaries using threading.

Finally, I would like to thank Pradeep Padala for his "Playing with ptrace" articles [0][1], which were fun to read and worked as a great introduction of ptrace for me.

Now there is only one thing left to say: if you are interested in this method, see loopholes or problems or want to contribute, please go ahead and contact me:

debian at sp dot or dot at

I've got a new, fast, server and I've migrated my homepage to Drupal6. This has given me a chance to experiment with i18n updates.

I've got a section for translations and I can write blog entries for this section using drivel. The new i18n blog is a separate feed, not syndicated on planet, intended for anyone who wants to know about the translation status of any of my packages - whether upstream or Debian. POT files will be uploaded for each package and each message (should have) links to the VCS where the current PO files can be found.

I could post continual messages to the debian-i18n mailing list but this way I can put specific content (like messages about which parts of the project I'm changing) as well as updates on which translations are lagging etc. I hope it'll be easier for translators to find the relevant data instead of having to search through the debian-i18n mailing list archive.

I'm not sure about comment handling within the i18n section at this stage. I think I'd prefer to get input via normal email and bug reports.

This, more general, i18n blog category will remain on my main blog and syndicated with planet. I'll use this for posts that aren't specific to one particular project.

The twiki package has been removed from Debian. The package was not really maintained, and twiki s maintenance still required some attention, as there were quite a lot security issues. So the removal is logical. I had tried and help maintain it in good shape, but couldn t do much recently, as we ve moved a little bit away from its inegration in PicoForge, having other matters to care for in Helios and Coclico these days. Maybe foswiki (the more open fork of twiki) will enter Debian some day. The ITP is there, and there are unofficial packages to be tested, for those that would need to transition from the previous installations of twiki on Debian. More details in the fowsiki ITP. Anyway, thanks for all the good work to all those who spent time working on TWiki s packages in Debian. As for me, maybe some day, I ll be interested in contributing some time to Foswiki, should we deploy it alongside FusionForge some day.

• Due to some problems in the testing migration scripts, the testing suite is currently broken. This means some packages are currently not installable (such as KDE) or others are gone (such as MySQL). This is reported as the bug #559346. The issue is being worked on but it will take some time. If you see you problems when installing packages from testing, please be patient, or fetch the package from unstable.
• Some X.Org drivers (packages xserver-xorg-input-* and xserver-xorg-video-*) that were meant to be uploaded to experimental landed in unstable instead (see sbuild s bug #559659). If you see packages with a Depends: on xorg stuff from experimental, do not update and wait until xorg-server 1.7 moves to unstable.
• Backports of KDE 4.1 made for Lenny were available at http://kde4.debian.net. That repository was planned to go out of service in the end of this year, due to technical problems they are already gone.
• Volunteers for a Debian booth at the 26c3 (Chaos Communication Congress) in Berlin wanted. If you want to help, there is more info at http://wiki.debian.org/DebianEventsDe/2009/26C3
• There will be a BSP in M nchengladbach (Germany) the weekend 22-24 January, 2010. More info in this wikipage.

I'd like to make pyroman IPv6 capable. That is actually the one big thing before calling it a version "1.0".I must admit that I havn't been very active on Pyroman (or Debian in general) the last years. This goes even so far as that "pyroman" was considered "abandoned" by Fedora or so. It is not; I use it on all my servers. It's still in use at the network I developed it for (after all there is not that much benefit for a workstation setup, where a 10 line iptables script will do the job just perfectly.).Anyway, I'd like to get IPv6 support into pyroman, but there is one big issue here: I don't have any machine using IPv6, so I havn't used ip6tables myself yet, so I don't know about all the magic involved ...So if you use IPv6, it would be very cool if someone would jump in to get full IPv6 support into pyroman. Madduck had already done some preliminary stuff, but I didn't get around to have a look at the integration or completeness yet.The '--no-act' and '--print' modes of pyroman should even allow development without any IPv6 support or root permissions in the system.Other things remaining on my pyroman wishlist:

• Fully automatic iptables firewall visualization
• Keeping traffic counters over firewall reloads
• Configuration UI
• A fancy 'arsonist' icon and a web page design

Recently I've been spidering the internet, merrily downloading content for the past few days. The intention behind the spidering is to record, in a database, the following pieces of information for each image it stumbles across:

• The page that contained the link to this image. (i.e. the image parent)
• The image URL.
• The MD5sum of the image itself.
• The dimensions of the image.

I was motivated by seeing an image upon a website and thinking "Hang on I've seen that before - but where?". Thus far I've got details of about 30,000 images and I can now find duplicates or answer the question "Does this image appear on the internet and if so where?". Obviously this is going to be foiled trivially via rotations, cropping, or even resizing. But I'm going to let the spider run for the next few days at least to see what interesting things the data can be used for. In other news I'm a little behind schedule but I'm going to be moving from Xen to KVM over the next week or ten days. My current plan is to setup the new host on Monday, move myself there that same day. Once that's been demonstrated to work I can move the other users over one by one, probably one a day. That will allow a little bit of freedom for people to choose their downtime window, and will ensure that its not an all-or-nothing thing. The new management system is pretty good, but I have the advantage here in that I've worked upon about four systems for driving KVM hosting. The system allows people to enable/disable VNC access, use the serial console, and either use one of a number of pre-cooked kernels or upload their own. (Hmmm security you say?) ObFilm: Chasing Amy

To count means that you/it/whatever counts matters. If one counts the number of females in many tech/media conference, the number of women is dreadfully low, giving off the meaning and feeling they don t always count, even if they are very well received. There is a new project spearheaded by the efforts of Annina R st that will help us count women at conferences. The project is cleverly called Be Counted and it allows you to input information about gender representation in conferences. Here is a little more about the project and I urge you to check it out and contribute:

The project aims to collect a stream of user-contributed data on gender diversity in technology environments in the form of Gender Ratio Reports (GRRs). The longterm aim of the project is to not just collect but also provide tools for retrieving and visualizing the data in order to encourage others to collectively analyze the patterns behind the numbers.

To count means that you/it/whatever counts matters. If one counts the number of females in many tech/media conference, the number of women is dreadfully low, giving off the meaning and feeling they don t always count, even if they are very well received. There is a new project spearheaded by the efforts of Annina R st that will help us count women at conferences. The project is cleverly called Be Counted and it allows you to input information about gender representation in conferences. Here is a little more about the project and I urge you to check it out and contribute:

The project aims to collect a stream of user-contributed data on gender diversity in technology environments in the form of Gender Ratio Reports (GRRs). The longterm aim of the project is to not just collect but also provide tools for retrieving and visualizing the data in order to encourage others to collectively analyze the patterns behind the numbers.

Yesterday I went to the local support service center for Acer at El Salvador, I realize that I bought my Acer One on Dic 21 2008, so the warranty is still valid , my first concern was my HDD, since at the time the netbook fails I did have a copy of my GPG Key on a non encrypted file system, also all my data was on the HDD and I did not want to leave my computer with my data on the hands of a $RANDOM tech support. It took me like 15 minutes to convince the representative to remove my HDD before I leave the netbook, but they agree, and they even agree on let me see when they remove the HDD before give it to me, for me this looks like a nice tech support, I actually thought that they will refuse to follow this extrange request, and I even thought that they will be refuse to admit the computer, since the original OS was no longer installed. The netbook should be up and running this Thursday yay!