I have previously written about the execmod permission check in SE Linux [1] and in a post about SE Linux on the desktop I linked to some bug reports about it [2] (which probably won’t be fixed in Debian). One thing I didn’t mention is the proof of the implication of this. When running a program in the unconfined_t domain on a SE Linux system (the domain for login sessions on a default configuration), if you set the boolean allow_execmod then the following four tests from paxtest will be listed as vulnerable: Executable bss (mprotect)
Executable data (mprotect)
Executable shared library bss (mprotect)
Executable shared library data (mprotect) This means that if you have a single shared object which uses text relocations and therefore needs the execmod permission then the range of possible vectors for attack against bugs in the application has just increased by four. This doesn’t necessarily require that the library in question is actually being used either! If a program is linked against many shared objects that it might use, then even if it is not going to ever use the library in question it will still need execmod access to start and thus give extra possibilities to the attacker. For reference when comparing a Debian system that doesn’t run SE Linux (or has SE Linux in permissive mode) to a SE Linux system with execmod enabled the following tests fail (are reported as vulnerable): Executable anonymous mapping (mprotect)
Executable heap (mprotect)
Executable stack (mprotect)
Writable text segments If you set the booleans allow_execstack and allow_execheap then you lose those protections. But if you use the default settings of all three booleans then a program running in the unconfined_t domain will be protected against 8 different memory based attacks. Based on discussions with other programmers I get the impression that fixing all the execmod issues on i386 is not going to be possible. The desire for a 15% performance boost (the expected result of using an extra register) is greater than the desire for secure systems among the people who matter most (the developers). Of course we could solve some of these issues by using statically linked programs and have statically linked versions of the libraries in question which can use the extra register without any issues. This does of course mean that updates to the libraries (including security updates) will require rebuilding the statically linked applications in question - if a rebuild was missed then this could be reduce the security of the system. To totally resolve that issue we need to have i386 machines (the cause of the problem due to their lack of registers) go away. Fortunately in the mainstream server, desktop, and laptop markets that is already pretty much done. I’m still running a bunch of P3 servers (and I know many other people who have similar servers), but they are not used for tasks that involve running programs that are partially written in assembly code (mplayer etc). One problem is that there are still new machines being released with the i386 ISA as the only instruction set. For example the AMD Geode CPU [2] is used by the One Laptop Per Child (OLPC) project [3] and the new Intel Atom line of CPUs [4] apparently only supports the AMD64 ISA on the “desktop” models and the versions used in ultra-mobile PCs are i386 only. I think that these issues are particularly difficult in regard to the OLPC. It’s usually not difficult to run “yum upgrade” or “apt-get dist-upgrade” on an EeePC or similar ultra-mobile PC. But getting an OLPC machine upgraded in some of the remote places where they may be deployed might be more difficult. Past experience has shown that viruses and trojans can get to machines that are supposed to be on isolated networks, so it seems that malware can get access to machines that can not communicate with servers that contain security patches… One mitigating factor however is that the OLPC OS is based on Fedora, and Fedora seems to be taking the strongest efforts to improve security of any mainstream distribution, a choice between 15% performance and security seems to be a no-brainer for the Fedora developers.

• [1] http://etbe.coker.com.au/2007/02/10/execmod/


• [2] http://en.wikipedia.org/wiki/AMD_Geode


• [3] http://en.wikipedia.org/wiki/One_Laptop_per_Child


• [4] http://en.wikipedia.org/wiki/Intel_Atom

Share This

I posted a couple of weeks back to say that I'd got the Debconf plague again this year. Unfortunately, it looks like I picked up something worse than just the normal cold/'flu. I've been on penicillin for a week to try and clear up a throat infection, but it's not gone yet. Time for blood tests to see if I've got anything worse. I've been too ill to go to work several times in the last couple of weeks, feeling totally exhausted and feverish. Here's hoping that things start clearing up soon... Again, if I've not responded to you about Debian stuff lately then please pester/remind me as necessary and I'll try to get back to you.

My primary e-mail domain deuxchevaux.org was offline for one and a half week due to my (former) domain provider Korypet went bankrupt and probably hadn’t paid the registrar’s invoice for deuxchevaux.org although I had paid Korypet’s invoice. (The domain wasn’t expired. Its expiration date was somewhen in 2009.) Korypet itself just told its customers (and told it only on request) that they a) will shut down their business because it doesn’t pay off and that b) their service won’t be as good as usual since their head is currently in hospital. I should have noticed that there is something fishy and some details were missing at lastest when they told customers (also only on request) that they have to shut down some services earlier than announced because one of their providers has terminated their agreement with Korypet at short notice. I also should have expected that they couldn’t keep their promise to continue domains and DNS until May 2009 as they couldn’t keep other promised grace periods. I’m quite sad about how Korypet went down and how bad blood they caused — not only for me — since they offered not only good services for money but also had really good (and personal) support. But I guess that this quality at very low prices was also one of the reasons why they couldn’t keep up their business for longer. I had one of their UML based, low-end virtual “VD” servers for about six years, and used it as secondary DNS server and IRC client host. I also often thought about getting a second one at some other geographical location (they offered virtual servers in three German cities). That was the reason why I started to move my domains to them a while ago. They even could fully answer me domain registration questions for which the eDNS and the Hetzner staff only had partial and therefore confusing answers. Since it was the easiest way, I tried to transfer the domains I had registered with Korypet to the B2C division of their registrar Key Systems, to DomainDiscount24. The web interface isn’t as bad as the name “DomainDiscount24” suggests, but they seem to have communication problems if – as in this case – more than one of their business divisions are involved. It took at least two phone calls until they did the all the necessary things to get the domains transferred from Korypet’s business customer account to my newly created end customer account although they have a special form for former Korypet customers. Domains I registered after Korypet stopped accepting new domains (well, they just didn’t answer on my domain registration requests anymore) I have registered via eDNS which was a recommendation form someone on the DaLUG mailing list. My conclusion after these hassles: No more domain registration resellers, only directly interacting with registrars. Never register all domains at the same company. Have more than two DNS servers at different hosters. Don’t have domain registrations and DNS servers at the same company. So I now register my domains either at DomainDiscount24 or at eDNS. And .ch domains of course directly at SWITCH. (If only all domain registrations would be so simple and uncomplicated as with SWITCH!) And my DNS servers are currently hosted at x encon in Hannover (Yes, it’s a Xen DomU :-) and Hetzner in Erlangen. And a third one in Switzerland is already planned.

I wonder what would have happened if Obama had put lipstick on a pitbull would there be any less of this circus put up by the Republican monkeys? Are we back in Kindergarten? Mom! Mom! He hit me! . Is the next thing we ll see tears on stage? Or some sort of fake emotional outbreak? Anything goes in America, I say Both, Obama and McCain have used the lipstick analogy in the past (see previously linked article, and this AP writeup), so why are the Republican monkeys trying to nail him on sexism? They are (trying to) play the gender card (thanks to Erinn Clark for the link). Sexism surely is a word to grab attention, especially in the Excited States of America. By shifting attention to sexism, the Republican monkeys are not only stealing Obama s show and dragging the short-attention-span media (and populace) away from any Palin-related scandals, they are also covering up that they don t have anything else to say. Finally, sexism is an emotional topic, unlike the other political and policy crap the entertainment-hungry television crowd has to put up with, so hooray for excitement! I am disgusted by this American election circus. And I wish we d get about as much coverage of American news in these times as international news gets airtime on American TV. Even though I hope Obama wins for no other reason than that he s not in the same political camp as George W. International Terrorist and War Criminal Bush, I couldn t really care less and don t have any reason to believe that things will improve when the Democrats move back into the White House. And neither do lobbyists care who s sitting at the top. Idiots exist on every level and all over the globe. The rich will still pull the strings. The capitalist avalanche (euphemistically called the strive for democracy ) doesn t slow down. Other countries political monkeys have tasted totalitarianism and lost their senses, and no US government will get them back on track. And the media, who controls it all anyway, is just cashing in on the whole spectacle, which is why I have to continue to be subjected to it. Which brings us back to the rich I wouldn t be surprised to find the likes of Haliburton in the financial support list of the Republican monkeys. PS: I know and respect many American citizens, and I know most of them think like me. Nevertheless, I feel it necessary to point out that none of the above is an attack on those of you with a clue. I feel sympathy at the same time as I feel the rage expressed in the above, but this rage is solely with the political monkeys, the media, and merciless capitalists. None of those are US-specific, it just happens that you seem to have the most pronounced combinations. NP: Mogwai: Come On Die Young

To solve performance problems I've now started to switch my SMTP servers from using the "forkserver" version of qpsmtpd to using the "prefork" version. Under testing qpsmtpd-prefork performed significantly better than the qpsmtpd-forkserver for handling incoming SMTP connections. The loadavg of one machine has dropped from a constant 2.xx to 0.4x! I'd love to see what the asynchronous server would behave like, but that would require re-writing all my plugins to work in an asynchronous manner which would be a significant undertaking. (It would be nice if the qpsmtpd package available to Debian would allow you to choose between the two version of the server - I will file a wishlist bug.) ObQuote: Dune

As some might know, I've been working at the university for a few weeks now. I'm very happy how it all worked out, because of the people there and the subjects to work on. It's just great to think through some mind-bending index structure to improve reverse-k-nearest-neighbor queries. And the professor (who is very well known for his work on R*-Trees, the X-Tree, and the DBSCAN and OPTICS algorithms) really manages to aggregate excellent people.(rkNN is the problem of finding those points for which a Nearest Neighbor Search [Wikipedia] would return the given point. There are many use cases for example in location based services.)A lot of my work involves a framework which has been published recently on the SSDBM 2008 conference: ELKI - Environment for DeveLoping KDD-Applications Supported by Index-StructuresThe goal of ELKI is to become what WEKA is for machine learning. And it's well on it's way for that.ELKI aims at the data mining researcher, it's not designed to squeeze out the last bit of performance. Instead it allows you to compare different algorithms, try different index structures (including various spatial and metrical trees) and offers all kinds of functionality you can reuse. If you are planning to do some real world applications, it likely is still useful for prototyping.In the last weeks I've already put quite some effort in ELKI, so expect the next version to be released with significant changes and new functionality. In fact some working functionality was just left out of the release because we hadn't cleaned up the code yet.Currently, getting started with ELKI can be a bit tricky. It's not hard to use, but you just need to find out where to start. The next release will therefore include a "dummy algorithm" that mostly serves as being a template for implementing custom algorithms (it can also be used for benchmarking an index structure, though).

Maybe because email is eating less of my time, I've started using instant messaging. My jabber address is the same as my email address, joey@kitenet.net. Since identi.ca integrates so nicely with jabber, I may use that too.

I previously described the goals for SE Linux development in Lenny and assigned numbers to the levels of support [1]. I have just uploaded a new policy to unstable which I hope to get in Lenny that will solve all the major issues for level 1 of support (default configuration with the unconfined_t domain for all user sessions - much like the old “targeted” policy). The policy in question is in my Lenny SE Linux repository [2] (for those who don’t want to wait for it to get into Unstable or Lenny).

• [1] http://etbe.coker.com.au/2008/08/04/lenny-se-linux-on-the-desktop/


• [2] http://doc.coker.com.au/computers/installing-se-linux-on-lenny/

Share This

The word is out! Carles, Jonathan, Sabri and I will be throwing a hopefully great 30th anniversary party next weekend. It will start at 12:00 on Saturday and finish at some point during the next day. We have planned fun games during our 30thlon , prepared infinite hours of all kinds of music (including Chimo Bayo, NO LESS!), bought a supermarket worth of drinks. Do not miss!

Uno, que no pare ninguno!

Today, I wanted to finish something what looked like easy task from beginning. To bing IPv6 connectivity to my home using tunnel from Sixxs. As I have an OpenWRT, I expected it should not be harder than setting up same thing on my Debian notebook. There exists several howtos on the net, we can take the one on Sixxs wiki as a good starting point. Just follow the instructions and you should get it working right? Unfortunately not. Aiccu connects, IPv6 addresses are assigned, subnet is correctly distributed over network using radvd, but IPv6 connectivity does not work. Going deeper into this issue, I found out that some packets go out, but nothing comes back. When comparing results with Aiccu set up on my Debian notebook, I noticed that packets from OpenWRT router are few bytes larger, but I didn't though it could be a reason. Unfortunately it was -- OpenWRT contains wrongly compiled Aiccu, which does not strip ethernet headers from outgoing packets and gateway then throws them out. This is a well known bug, but unfortunately nobody fixed it for White Russian. Anyway I'm not going to reinstall whole system to Kamikaze just to make the thing work, so I compiled the Aiccu package on my own and now the tunnel works fine. If you are interested, you can get the package here.

So, I am pleased to announce that my course on hackers, which has already started, will be hosting a class blog, STDIN. Starting next class when we address phone phreaking, we will have one entry summarizing in some details each class readings and discussions. There is one student in charge for every class and then anyone else can post as they wish. I am also making an effort to post various definitions and examples of hackers, hacking, hacks and compile a master list at the end. I am not sure it will produce anything interesting except a list of definitions, but sometimes you see new associations and meanings when with such a comparative potpourri.

So, I am pleased to announce that my course on hackers, which has already started, will be hosting a class blog, STDIN. Starting next class when we address phone phreaking, we will have one entry summarizing in some details each class readings and discussions. There is one student in charge for every class and then anyone else can post as they wish. I am also making an effort to post various definitions and examples of hackers, hacking, hacks and compile a master list at the end. I am not sure it will produce anything interesting except a list of definitions, but sometimes you see new associations and meanings when with such a comparative potpourri.

Customer service... and vodafone. Something fundamentally missing here. Vodafone's website is slow - 50% of the time you can't even login. 15-20 simple page clicks. Ringing customer service - you get a IVR system that is intensely frustrating. It can't handle simple things like "Your website sucks" (it asks if you want to inquire about iphone 3g's). 10 minutes later and it actually offers a menu. Finally, some way to get through to a human. Having stopped doing paper bills, you have to sign up to this website; several thousand words of legal terms and conditions later - 99% unrelated to paying bills - and you can't configure it to email you, unless it also SMS's you. WTF. Customer service don't know why this is required. And the website doesn't tell you its required, it just refuses to accept the form unless it's ticked. Seriously, someone setup a viable, flexible, mobile provider in australia, with good international roaming - give me a ring.

It’s been a while since I last acquired new gadgets but I think I’ve made up for lost time with my last weeks purchases. You may remember that I’ve had my eye on the Openmoko phones since early 2007, but in between shifting across the world and starting a new job I never got around to purchasing one of the first versions. The second version, the “Freerunner”, was released in June this year and I placed an order with Pulster, a local distributor, shortly after. The phones have been in hot demand, so I only received my phone last week, a wait of of almost 2 months, and it turned up missing one of the cables that was meant to come with it. Still some distribution kinks to be worked out. Distribution kinks are the least of Openmoko’s worries at the moment though. As advertised, the phone is definitely not ready for primetime distribution yet. I’ve tried three different software images on it: the original “stable” 2007.2 image, the current “devel” 2008.8 image and the latest completely rebuilt SHR release which is the most promising yet. With the SHR image I’ve been able to send and receive calls and text messages, although the interface is somewhat arcane. I’m most interested in the GPS which looks to be working reasonably well at this stage. After almost a week with the phone I’m glad I purchased it, and I’m having fun hacking on it, but there is a huge way to go before I’ll be able to use it as my primary phone. So that’s gadget #1. The second gadget is a new Digital SLR camera. I’ve been thinking about getting back into photography for a while (I last took photos seriously in high school) and when I saw how affordable digital SLRs had become I couldn’t resist. There isn’t much between Canon and Nikon when comparing mid-range SLRs these days, so after about a week of deliberation I decided on the Canon 450D, primarily because most of my workmates also have Canon SLRs! I only got the camera on Friday, and spent half the weekend playing with the GPS on the phone (I want to set them up so I can geo tag all my photos), so I haven’t had quite as much time to play with it yet. I expect to spend plenty of quality time with it on our holiday in Malta next week. First impressions are favourable, although I’m fast discovering camera viewfinders were not really designed for people who wear glasses. I may have to consider wearing contacts again. Once we get back from Malta I’d like to find a local (or online) photography club with some good weekly assignments to fire my creativity and motivate me to get the most out of my new toy.

I told you I was re-reading Paul Graham s Hackers and Painters essay in order to update one of my lectures. I feel I like Ruby for I too have the same coding style as Paul s:

I found that I liked to program sitting in front of a computer, not a piece of paper. Worse still, instead of patiently writing out a complete program and assuring myself it was correct, I tended to just spew out code that was hopelessly broken, and gradually beat it into shape. Debugging, I was taught, was a kind of final pass where you caught typos and oversights. The way I worked, it seemed like programming consisted of debugging.

Ruby sort of frees me of figuring out everything beforehand. Of course, Ruby is not the only language with that in it It s just the one I like the most Anyway This is not a language-versus-language rant Rather this is about another article I just read by Carol S. Dweck The article focus on teaching kids that challenges can be taken as opportunities to improve. Failure at a challenge, in this sense, has less to do with intelligence than with effort. And I just mentioned Paul s essay because I think what Carol is really talking about is that hacking can be taught ... or rather that we should teach kids to be hackers. Here I mean hacker in the broad sense of the word, as in Paul s essay, or in the Jargon File.

7. One who enjoys the intellectual challenge of creatively overcoming or circumventing limitations.

Maybe if knowledge researchers, teachers and psychologists embrace and extend what we already understand as hacking, and begin applying it at schools, we can all improve as a society. Who knows Hacker-society might very well be our future society! ;-) What do you think about it?

New Firefox is complaining about untrusted certificates in even more painful way and the time when CAcert certificates will be widely accepted seems to be far away, so I had to do something with bug tracker certificate. Otherwise I would receive too much of mails about broken certificate (which has been always valid, just signed by CAcert, which is usually not between trusted certificate authorities). As a cheapest way to deal with this issue I found seems to be StartSSL. The problem is that their root certificate is not everywhere, but at least Firefox contains it. Anyway it is just an attempt to make things work better, if you have any problems with new certificate, just drop me an email.

In an hour the online part of this combined embedded+fai meeting in Badajoz in Extremadura, Spain, will sadly be over, but the sadness will hopefully be compensated by good food (yes, the food at the last dinner was great) and more fun! To me it were three intensive days (plus some two half days of intense travelling) which were really productive. This post is a summary of what I did here, to document how useful these meetings are. I'm only one person out of 18, who did some Debian work here, much more stuff was done, most of it I probably didnt even notice, as 14 people where working on embedded stuff, which I mostly ignored... ;-) That said, I think it was still very nice to have this meeting together, a.) because I'm quite interested in embedded stuff and b.) because the embedded crowd is a fun one to hang around with!

Right now I'm quite tired so that I dont fully remember what I have done on the first day :) It included uploading the DebConf7 mpeg videos which will now be used by Miguel Gea to create DVDs from those, so that he gets familar with the toolchain, so that he then can do the DebConf8 DVDs once those videos are (fully) ready. That will still take some time though, but hopefully not too long.

Unlike DebConf8 I also brought my fancy new fonera2 with me, in the hope to give it to someone to work on emdebian support for it. This is quite a longer road, as currently uclibc is not part of Debian, but thats only one step in this puzzle. Much to my joy Per Andersson took the opportunity to play with it and now took it home with him to document how to run Debian on it. I'm looking forward to see progress on this in the future ;-) Update: uclibc support is only needed for running Debian from the 4mb flash it has. But since it also has an usbport one can attach some storage there and run a full Debian system, just like on the nslug, which also has 32mb of RAM.

Unfortunatly I basically forgot about the FSG-3 I also took with me (which was for good reasons, one the second and third day I mostly did FAI work), but then I remembered 90min before the end, which was really too late. Narf. But Riku had a short look at it and told me one thing I didn't knew before: (at least) arm(el) kernels need to have the cpu id set in the kernel and the debian kernels don't have that, as they are build for more than one cpu type, so one has to prepend an arm assembler code instruction before running the kernel... I'm curious to do this soon :-)

But I have more hardware news to tell: C sar G mez Mart n (thanks for organizing this meeting, too!!!1) gave me back my OLPC laptop which I borrowed to him quite some time ago, so he could use it for a talk he gave at a university in Extremadura, so now I finally could give Andres Salomon new debian image for the XO a try. It was really nice to finally see a nice Debian gnome desktop on the device :-)

Today the FAI group, that was Sebastian, Michael, Thomas and me, also took a break to visit the Alcazaba de Badajoz (built around 1100, so roughly 900 years ago) which is an amazing building (thats why I linked to the spanish wikipedia entry as it has nicer pictures), from where you can see most of the city. I've been to Badajoz at least three times now and I'm really glad I finally did that, it's only 5min away from the office where the meeting was held and I highly recommend it to anyone going here.

Oh, and last and definitly not least I did a lot of work on FAI too. Besides discussing stuff which will hit planet after I posted this (hah! Michael already posted it, though without proper credit, so I will do a repost) I mostly reviewed changes and patches and discussed bugs, I didn't develop many patches myself (well, except one for the changelog..) but I've read every change at least twice, once as a commit msg and once in a full review. Plus many patches I read more often... all in all I think FAI is now in an great shape for lenny (which was the only thing we worked on during the weekend, we discussed some future plans, but work was only done for lenny), except that we want to another upload (with only documentation changes) after the upcoming one (which has quite some documentation changes already, but also some RC+important and some trivial bugfixes).

As you might have guessed, I started this entry on saturday and am finishing it now. According to the topic of the #extremadura2008 channel, which we created to coordinate between the groups, we also fixed 7 RC bugs (or 8? one should really document the bug numbers and not the number of bugs..) affecting lenny and 3 more which are only relevant to sid. Which is not as many as I would have liked to be fixed, but then, it wasn't a ("traditional") bug squashing party either. Which makes me wonder, are there any planned in the coming weeks?

So all in all I think this meeting was really very productive. Plus, I also enjoyed a special half an hour of real holidays: on saturday we had to leave lunch without having a chance to have a coffee afterwards, so I stumbled into a random cafe on the way to the venue. Turned out it was a very nice one, where due to its nice interiour I managed to reflect on life, 42 and all the rest almost immediatly. A totally unexpected but needed break. I wont say more here, because the thoughts and memories are really mostly relevant for me, but I'm really happy I found that space. DebConf8 and this meeting both were really fun, but I really didnt have a minute to reflect things. 30 minutes to do that is definitly not enough, but it was a good start. Now I just need to find another opportunity to continue with it. I hope this will happen before the next Extremadura meeting ;-)

Sound Juicer "Stab Stab Stab! This Is More Than A Message" 2.23.3 has been released. Tarballs are available on burtonini.com, or from the GNOME FTP servers.

• Don't crash when exiting
• Don't distribute full GFDL with docs
• Correctly parse CDDA URLs (#550131, thanks Matthew Martin)

A few speakers at DebConf8 used gobby during their talks to collate ideas without breaking the flow of the session.
I've just come back from the Emdebian meeting in Extremadura (of which more later) where we also used Gobby - FAI used it too. Once the network setup was working, it was simply a case of clicking Create Session in gobby on my laptop and everyone else clicking Join Session, entering the IP of my laptop (only accessible locally) and choosing a colour.
Gobby is real-time, currently plain-text only but clearly indicates how sections have been edited and has an integrated IRC box for each session. At the end of the meeting, every gobby user has a copy of every document they opened in every session they joined. updated to the moment they quit the session.
Based on using gobby in events like this, I'd strongly recommend that someone at each worksession-type meeting starts a gobby session and maintains that session for the duration of the meeting.
Gobby even does syntax highlighting - depending on how many people join and the colours they choose, this might become difficult so it can be turned off too.
There are only a few minor issues:

1. The colour bar warning box isn't particularly intuitive - you need to click on what looks like a dimmed progress bar to select a unique colour for yourself.


2. I initially thought that Gobby had no authentication - in a local meeting, anyone who can connect to the specified IP address is able to edit the document. Since then, I've noticed it does support password authentication and there is mention of fully encrypted connections so it may be possible to use it over public networks.


3. According to Wikipedia, there is a gobby server that allows non-GNU/Linux clients to run gobby and join any gobby session - I didn't explore this and the Debian package doesn't mention anything about a server option or mixed-OS support.
   
   • Update - the server is called Sobby and is in Debian.
   
   


4. The right hand side of the window is a bit wasted - maybe some kind of sidebar would be handy, especially docking the userlist into the window so that edits can be identified more quickly.