Thanks to the great work from, Sebastien Noel, the OSS4 package has made a great improvement ! An initial package has been commited to the SVN repository. It is not yet complete, but should work, provided you remove yourself the alsa modules (alsa force-unload, as root). I won't argue here about the sorry state of sound under linux, but you can read the links I already provided in the ITP for more details on this topic. Next to come: latest polishing, and then upload: yipee (...)

Lucy left for England yesterday (OK, now it’s two days ago — last Friday). That means that I have unusual amount of free time at my hands, and yet even more things that could be done with it. But I suppose it’s time to update this little blog. It’s probably pointless to enumerate what happened, or what changed. Everything is fine and smooth over here — the wrinkles get worked out over time (with Lucy, without Lucy). Hobbies still take time and I still haven’t given up. My latest determination is to get myself a bassoon for next Christmas. (Now, that will be a year since we got Lucy a Marigaux 901, used, in great condition for a great price, lo and behold, on Austrian ebay. World is so weird sometimes…) And in the land of [LVM], I have finally started the process to merge code to improve LVM’s behaviour in presence of failed storage hardware (physical volumes gone missing). In the land of Adept, well… first things first. FOSSCamp I have visited Prague for the latest Ubuntu- (well, Canonical-) organised event, the FOSSCamp. I have met Johnatan (KUbuntu), Seli (KWin), Lidya (Amarok), Robert (Konsole), Jos (Strigi) and Inge (KOffice). See also Johnatan’s Blog (including a real blurry picture). So back to Adept — I had some hacking time over there in Prague, and I have almost brought Installer and Updater back to life for Adept 3. I unfortunately didn’t have as much time for it since then — but my current free time situation does open up some possibilities. First and foremost, I should really make a text interface to the underlying libraries for myself, maybe with fancy colourful UI, hopefully one that is comfortably close enough to apt-get and still offers advantages. Hmmmm… Intermezzo 1 Now zoom out and zoom in somewhere else, enough of coding matters. Our research group at the University had a (tool) paper accepted for ATVA 2008, meaning that I am not unlikely to visit Seoul, South Korea in October. Another piece of distant world to visit. FOSDEM Now, that reminds me… Since the last time, I have also been in Belgium — to visit FOSDEM — meeting Alasdair (of LVM) and Bart and Pino of Krita and Okular, respectively… although unfortunately, I didn’t spend nearly enough time with Pino… At least we have spend a day walking around Ghent with Bart (and Lucy, who visited Belgium with me, also having friends of her own there). Moreover, I have spent a lot of mostly productive time with Alasdair, discussing LVM2. And Belgium is nice and pretty, although I didn’t really get around to taste any beer. Maybe next time. And Antwerps were nice, too. Photos? Someday. LinuxTag And after that, I have visited Berlin again, for LinuxTag as usual — plus the accompanying LVM discussions, with Milan, Kabi and Mikul (Blek) of the Czech part of the team, and Heinz, John and of course Alasdair for the rest of the world… Also as usual, we walked around, had dinners, discussed non-work stuff, etc… a good event all in all. At LinuxTag, I have briefly seen Lidya again, as well as Ossi (whom I nearly didn’t recognise…) and Aaron who (for a change) didn’t recognise me (but to be fair, I didn’t quite stop by to chat and he’s been busy…) and Sebas, cordial as ever (and always a pleasure to meet)… reminds me of Paris two years ago, too. Intermezzo 2 Less than a month ago, I have finished my first semester of master’s study — two or three more to go (I have completed bachelor’s the semester before). Yes, I am a bachelor of computer science, or something like that, anyway, now. Or so I hope. I did not attend the whatever ceremony and I don’t really have the diploma (or maybe I do, but gods know where it is…). A short note on Debian with best intentions I am now sponsoring Trent Buck’s ?darcs packages, contributing a little on the go (making me wish that alpha buildd would make a little more progress…). With Enrico, we have uploaded new versions of wibble and libept, both of which I think make both of us fairly happy. (Although we again managed to hit a way strange compiler issue (only manifested on arm… what have I done that the gods punish me so?), as documented in Debian bug 487406…) I have packaged dzen2 and taken over haskell-mode (I am losing track of my own packages again — I really need to set up reliable watch files so I don’t miss out too many releases… apparently neither has new upstream versions, so I can sleep peacefully for a little longer). Intermezzo 3 I am not going to DebConf nor Akademy this year. That makes me a little sad, but it’s all my own fault (and laziness). Next time folks, next time. I haven’t seen K vin in aeons and he probably removed me from his memory by now… No matter, I’ll try a little harder next year, promise (oh, how many have I made to date?). Finale Nothing grandiose, just best wishes to everyone, I have to land in bed now it seems, as I am ever so sleepy. (Just So Stories, anyone?) There I go.

Today seems to be Firefox/Iceweasel 3 Bashing Day on Planet Debian, so let me join the fun :) I agree with most other people that the default Firefox/Iceweasel 3 config is not ideal, so here's what I did to fix it. Some of these items improve performance, some remove annoyances, some remove privacy issues, some remove security issues. Not everything here may be desirable for people other than me. General

• Disable the bookmarks toolbar via "View / Toolbars / Bookmarks Toolbar", nobody needs that and we save some screen space. Remove all pre-defined bookmarks while we're at it.
• Select "View / Toolbars / Customize".
  • Add the "New Tab" button/icon right after the "Home" button. This is probably the most-used button (for me at least) and it's not available per default...
  • Click "Use Small Icons", there's no reason to waste screen space.
  • Remove the Google search bar (useless).
  • Now move all icons and the URL bar into the menu bar (I'm not kidding). After that you can disable the nagivation toolbar via "View / Toolbars / Navigation Toolbar" and save even more screen space.

Preferences Select "Edit / Preferences". Main:

• Select "When Iceweasel starts: Show a blank page".
• Set "Home Page" to whatever you see fit.

Tabs:

• Enable "Always show the tab bar".

Content:

• At the right-hand side of "Enable JavaScript" click "Advanced" and uncheck all checkboxes. JavaScript stuff shouldn't need to do any of those operations.
• Uncheck "Enable Java". Nobody needs this crap and it's a huge security risk.

Privacy:

• Disable "Keep my history for xyz days" completely. Huge privacy risks.
• Disable "Remember what I enter in forms and the search bar". Huge security and privacy risks, almost no gain.
• Disable "Remember what I've downloaded". Huge privacy risks.
• Uncheck "Accept third-party cookies".
• Choose "Keep until: I close Iceweasel".
• Click "Show Cookies" and remove all of them.
• Enable "Always clear my private data when I close Iceweasel". Click "Settings" and check all items. You want to purge everything when closing Iceweasel.

Security:

• On the right-hand side of "Warn me when sites try to install add-ons" click "Exceptions" and remove all exceptions.
• Disable "Tell me if the site I'm visiting is a suspected attack site". Useless crap, possibly a privacy issue.
• Disable "Tell me if the site I'm visiting is a suspected forgery". Useless crap, possibly a privacy issue.
• Disable "Remember passwords for sites". This is a huge security risk, never ever enable it!

Advanced:

• "General" tab:
  • Enable "Warn me when web sites try to redirect or reload the page".
  • Disable "Check my spelling as I type". Useless, annoying crap, which probably even impacts performance.
• "Update" tab:
  • Disable "Automatically check for updates to: Installed Add-ons".
  • Disable "Automatically check for updates to: Search Engines".
  • Select "When updates to Iceweasel are found: Ask me what I want to do".
about:config Open a new tab, enter "about:config" as URL and hit ENTER. Click the annoying "I'll be careful, I promise!" button. Uncheck "Show this warning next time" while we're at it.
• Set browser.urlbar.matchOnlyTyped = true to disable the new, annoying "AwesomeBar" URL bar feature (which is also a huge privacy risk).
• Browser tabs are way too huge for my taste (thus only very few fit on the screen). Fix it with browser.tabs.tabMinWidth = 60 and browser.tabs.tabMaxWidth = 60 (needs a browser restart). You can even use less than 60 if you don't need any text and an icon per tab is enough for you.
• Disable the annoying, flashing auto-search stuff when you select "Tools / Add-ons / Get Add-ons": Set extentions.getAddons.showPane = false.
• Set bidi.support = 0. You'll probably never need it, so reduce the number of potential bugs and security issues by disabling it.
• Self-signed certificate handling is annoying, so fix it with: browser.ssl_override_behavior = 2 and browser.xul.error_pages.expert_bad_cert = true (thanks Pierre Habouzit).
• Set browser.tabs.closeButtons = 3 in order to prevent accidental closing of tabs (no more Close buttons on each tab, only one global Close button on the right). Yes, CTRL+Shift+T helps in case it still happens.
• Set network.prefetch-next = false to prevent random prefetching of webpages which means wasting CPU cycles and bandwidth, as well as subtle privacy and security issues.
Plugins None. Don't even think about installing crap like the closed-source Flash player if stability or security are important to you. If you absolutely must watch YouTube videos, I recommend youtube-dl. Extensions Use as few as possible. Every extention may have security problems or bugs, and can negatively affect performance etc. Pretty much the only one I use is NoScript to selectively enable JavaScript for some trusted websites (and disable it for all other sites).

I've take some time this morning to work on xcb-util packaging. I've mainly urge that work because Sebastian Dr ge, the sweet cairo maintainer, agreed to enable the cairo XCB backend (#474353), which requires xcb-util. The first upload I've made was built from the latest upstream release which is old (i.e. more than one year old). So I've put a git repository in place this morning and packaged the latest git upstream version, with some good patches from Arnaud (upstream+patches branch), that the upstream XCB developers are still reviewing since several weeks: that is the cost to pay for good code quality Thanks to Sebastian, the new xcb-util targeted for unstable was just arrived in incoming that he already uploaded a new version of the Debian cairo package with XCB backend enabled. Well, that's a very good day for me since it means that building awesome 3 is no more a PITA (hi MadCoder!) since every dependency is available in the Debian archive.

I finally got around to dropping four old computers off to recycling. Triton, a community college nearby, had a recycling event where students volunteered, and so I finally got around to dropping two generations of old computers off. Old computers, I hear you ask, well how old? Real old. The older two were from an age where the bios didn't yet boot off cdroms -- circa 1995. We had bought those in Kingston just off the Queen's campus. These were respectively a pentium 90 and a pentium 100, which still have traces on the web as miles.econ.queensu.ca (e.g. in a number of Debian changelogs) and rosebud.sps.queensu.ca which was of course Lisa's office machine and for a while the only internet address showing SPS. The next two were purchased around 1999 in Toronto on College St just north of U of T's main St George campus. Those, an AMD k6-2 300 and a Celeron overclocked to 450 MHz (woot :) lived happily in the basement of our Toronto home, forming the first lan I built. If I recall they were initially connected using a crossed ethernet cable and a second nic to the ISP. Oh boy. At least those latter two still boot off Knoppix. And do they ever feel slow. To think now just how many Debian packages I must have built on at least three of these over the years... And each machine must have gotten at least five decent years of usage out of them. One of the second generation computers eventually morphed into the kids play computer but even retired from that a while ago. In any event, it was good to have them recycled, and also good to have been able to do so without paying a fee as is increasingly common. So cheers to Triton. I may be back in a few years as there are still a few computers spread across the house.

I don’t know if Peter tries KDE 4.1 beta1 (4.0.80) but I tend to disagree with some comments.

• you can’t configure size and appearance of the panel. This is a long-standing problem, but I thought it was fixed.

False. See the plasma icon on panel ? click on it and you’ll have what you want:

• In general, there don’t appear to be all that many configuration options available to replicate various behaviors that I have become accustomed to.

Could be nice to be more verbose.

• Rendering problems in the system tray; icons appear on top of each other.

True, but it’s better with each release and not really a showstopper.

• Various kicker widgets don’t appear to be available for KDE 4

Which one do you want ?

• Most applications don’t copy their old settings, but it appears that some do?

Indeed. KDE3 uses .kde as home directory and KDE4 uses .kde4. It is intended to not break your KDE3 until we test upgrade path.

• KMail doesn’t interact well with encrypted IMAP accounts. I didn’t try much beyond that, because I have no accounts that are not affected by that.
• Clicking on an RSS link in Konqueror doesn’t link to Akregator anymore. Probably, various MIME type associations are missing.

I don’t know I continue to use Kontact from KDE3. Modestas and Sune have switched to kde4pim and they found it better than expected.

• I couldn’t get the environment to remember to open terminal windows maximized. Very annoying.

Hmm It works for me. Konsole saves maximized/normal state.

• I couldn’t add any application icons to the panel. I’m not sure where on is supposed to store one’s favorites now.

Make sure you unlock widgets with plasma icon on the top-right corner. Drag and drop from K-Menu to panel. Sebas made a nice rough guide to plasma. Take a look !!!

• So when KDE 4 is actually usable, Debian will be ready. But not for lenny; that would be suicide in my opinion.

KDE4 is more than usable. It contains some glitches but we are far from sucide

When you're 5, you're living with your parents. If not, you're probably in an orphanage, waiting for adoptive parents. When you're 10, you're living with your parents. If you're not, something is very wrong. When you're 15, you're living with your parents—although you'd probably rather live elsewhere. When you're 20, you're most likely still living with your parents; but if you don't, that's nothing to be ashamed of. When you're 25, you've either moved out, are doing so, or are thinking about it. When you're 30 and you still live with your parents, you're pathetic. At least that's the way I look at it. As of today, I'm officially pathetic. Won't be for long, though—it's just taking slightly longer than initially expected to make the appartment habitable. Stuff left to do:

• Attach some plaster to one wall, closing the holes in it
• Paint that wall, and one other which had to be treated for water damage first
• Finish up the kitchen: attach doors, connect electricity, glue everything together, attach baseboards
• Close water pipe shafts again
• Actually move in

Except for the "connect electricity" bit and the final step, that should all be doable in about a day, if I hurry. It's about time.

My cousin Greg Coker has created an eBay auction for Football cards with the proceeds going to a charity that protects animal welfare (I can’t remember the name - I’ll update this post later). He also has a bunch of other eBay auctions of football cards going which are not for charity. The charity auction is held in association with SEN (Sports Entertainment Network - a sports talk-back AM radio station) [1]. This afternoon Greg was interviewed on SEN about football cards in general. He gave a good talk, he could probably do some professional radio work if he was interested. Greg’s cards are from the VFL (Victorian Football League) before it became the AFL (Australian Football League) [2]. The cards used to be sold in “milk bars” (small stores that sold a variety of junk food and some essential food items including milk - most such stores are closed now as they have been replaced by petrol stations and supermarkets) and each pack of ~5 cards had some crewing gum included (which Greg often discarded because he didn’t like it - he should have given it to me, I was not so fussy). The back side of the cards had a jigsaw picture which I have never seen anyone complete (I expect that Greg has assembled at least one jigsaw as he has some sets). Probably the way the cards were collected, traded, etc is very similar to sports based cards from other countries (such as baseball cards in the US). On the animal front, I’ve had a mother cat and four kittens move into the shed in my back-yard. The mother cat has no collar and is not known by anyone in the area so she appears to have been dumped by her owner when she got pregnant. There are four kittens, one is ginger, one is black, and two are mottled part black and part ginger. They are all healthy and friendly and the kittens are all really cute. The kittens have become used to being patted and handled by humans so it will be easy to make them household pets. If an owner is not found for them then they will probably all end up being put to sleep (unfortunately I can’t keep them so I’ll have to deliver them to the local council). If anyone in Melbourne, Australia wants some free cats then I would be happy to deliver them. I’ll supply as many cats as desired. I can’t give away the mother until the kittens have been given away, so if you want the mother cat (dark coloured) then you may have to wait for a while. Judging by the date that I first noticed them (when they were walking around, had their eyes open, and ate solid food) the kittens would have to be at least 7 weeks old. It’s recommended that kittens not be given away before they are 8 weeks old and given that it will probably take a week to organise anything I expect that anyone who reads I don’t think that there is any risk of giving them away too early. Please let me know by email or a comment if you are in the vicinity of Melbourne, Australia and want a new pet (or several new pets).

• [1] http://www.sen.com.au/


• [2] http://www.afl.com.au/

Share This

Update
After contacting Sebastian Dr ge, I've found that the problem with GVfs isn't in the deb-gview code, it is a permission problem within GVfs - the current deb-gview CVS code works with remote URIs when run under sudo which isn't ideal but at least indicates the nature of the problem. Once I have confirmation and/or gvfs is fixed, I'll skip deb-gview 0.1.6 and upload 0.2.0.

** (deb-gview:31002): WARNING **: file-read:http://ftp.debian.org/debian/pool/main/g/gpe-tetris/gpe-tetris_0.6.4-1_i386.deb:The specified location is not supported

Hmm. This is with current CVS of deb-gview, already substantially modified to work with GIO and GVfs as libgnomevfs is deprecated. I wanted to look at the port because quicklist and gpe-filemanager will need similar ports.

$ dpkg -l 'gvfs*'
ii gvfs 0.2.1-1 userspace virtual filesystem - server
ii gvfs-backends 0.2.1-1 userspace virtual filesystem - backends

I have an RC bug in deb-gview that I need to fix and I wanted to do the two jobs in one but it's looking now as if I'll need two uploads, 0.1.6 with a trivial fix to unstable just to fix the existing bug and 0.2.0 to experimental with a lot more changes but partially broken functionality. It's a shame because I've got everything else working using GIO - it is only the GVfs part that is giving errors.

Anyone else using GIO and GVfs with http:// in Sid?

The status page speaks for itself: most of GNOME 2.22 is now available in sid. A few packages are being staged in experimental to avoid breaking too much stuff, and a few of the remaining missing pieces are waiting in NEW. Special thanks to Sebastian Dr ge who's done an incredible work with more than 90 uploads over the past week!

I use the enhanced commentify script from vim.org to easily comment and decomment parts of code. It knows about comment delimiters in a ton of languages, and it’s generally nice. Lately, I’ve been a bit annoyed about commenting several lines with different indent levels. In particular, given for example this snippet:

  def foo():
      if duck.is_hungry():
          grab_food()
          feed_duck()

If one instructs the script to comment the three last lines, the result is:

  def foo():
      # if duck.is_hungry():
          # grab_food()
          # feed_duck()

When what I would like is:

  def foo():
      # if duck.is_hungry():
      #     grab_food()
      #     feed_duck()

There is one variable one can set to achieve this behavior: EnhCommentifyUseBlockIndent. However, it only works when commenting from visual mode. From normal mode (what I normally use — that is, going to e.g. line 2 above, and pressing 3,c), it doesn’t work, because from normal mode the commenting function does not receive the block, it just gets called three times, once per line. To solve this, the solution I found was to create a custom command that accepts a range, and calls the function exactly once, for the whole block. In particular, this is all my enhanced commentify configuration from ~/.vimrc:

  let EnhCommentifyPretty = "yes"
  let EnhCommentifyUserBindings = "yes"
  let EnhCommentifyRespectIndent = "yes"
  let EnhCommentifyUseBlockIndent = "yes"
  " The MyEnhancedCommentify bit is needed because the normal nmap just
  " calls EnhancedCommentify() <count> times, thus UseBlockIndent can't
  " work.
  nmap <Leader>c :MyEnhancedCommentify<CR>
  vmap <Leader>c <Plug>VisualTraditional
  command! -range MyEnhancedCommentify 
      \ call EnhancedCommentify('', 'guess', <line1>, <line2>)

Yesterday, collectd 4.3.0-1 has been uploaded to Debian unstable. The most important changes since 3.x are (in chronological order):

• the much improved plugin infrastructure offers a lot more flexibility
• the much improved networking code offers a lot more flexibility
• the new bindings to Perl allow plugins to be written in the scripting language Perl
• the new unixsock and exec plugins allow external programs to communicate with the daemon and submit data
• integration with Nagios has been implemented
• support for flexible intervals has been added
• support to read values from SNMP enabled devices has been added
• basic support for monitoring has been added
• many new plugins

See the changelog for details. About collectd:
collectd is a small daemon which collects system information periodically and provides mechanisms to monitor and store the values in a variety of ways. It is written in C for performance. Since the daemon doesn't need to startup every time it wants to update the values it's very fast and easy on the system and allows very fine-grained statistics.

Is Squid not returning some data you need on a SE Linux system? The default configuration of the SE Linux policy for Squid only allows it to connect to a small number of ports which are used for web servers. For example ports http (80) and https (443) are labelled as http_port_t which permits serves such as Apache to bind to them and Squid to connect to them. But sometimes services run on non-standard ports and periodically new services are devised which use the HTTP protocol and thus you have Squid and Apache using new ports. semanage port -a -t http_port_t -p tcp 11371 One example of such a port is hkp (11371) - the latest protocol for sending and receiving GPG/OpenPGP keys. Running the above command relabelled the TCP port 11371 in question as http_port_t and thus allowed everything to work. setsebool -P squid_connect_any 1
An alternate option would be to run the above command to allow Squid to connect to any port. I will suggest that the upstream policy be changed to make the default labelling of TCP port 11371 be http_port_t, but the same operations can be used for other ports. Some people may claim that this makes things difficult for sys-admins. But the fact is that a well known port is a significant resource that you don’t want to permit any random user to access. Not only do the SE Linux port access controls prevent malice, but they also prevent system programs from accidentally using the wrong ports. A common example of accidental mis-use is the port 631 used for the IPP (Internet Printing Protocol - CUPS). When system programs need to use TCP source ports below 1024 they start at 1023 and work their way down, having such programs get down to 631 is not uncommon (there are some error conditions which result in ports being reserved for some minutes after use). In terms of malicious operations, it seems that the ports used by database servers such as MySQL and PostgreSQL would ideally be inaccessible to a Squid proxy, and services such as network backup should be inaccessible to everything other than the backup software.

Share This

Two nights ago I was having dinner with a colleague who recounted a truly horrible experience he had with the modern-day American health care “system.” While in Montana over the summer, he got bit by a bat and well, as a result, he and his entire family had to get rabies shots. These shots are hard to get and priceeeeeeeeeeeeeeeeeeey. The final bill was $ 20,000 and his NYU based health insurance, United Health Care is claiming they are not responsible!### Like getting bit by a bat and the possibility of rabies are not bad enough. Isn’t the point of health insurance to take care of the unexpected?? Someone also pointed me to The Daily Kos’ wrangle with BCBS of California and well, they picked the wrong guy to mess with given there are so many many many many eyeballs tuned to his blog, everyday (just check out the number of comments). I wonder if the public relations director will contact him as they did with me after I blogged about my trials and tribulations. I certainly don’t have the audience and readers he does, so I am always surprised they ever contacted me in the first place. The Daily Kos also provided a link for a site that I was thinking of creating if my problems with BCBS were not solved (glad to see someone else has) called Sick of Blue Cross. I personally like the name I came up with a little better Blue Cross No Shield but the important thing is that a site like that exists and it is very good site, design and content wise. There should be a site created for every health insurance company and they should federate and pool resources to gain more visiblity. While I am not hopeful that the health insurance industry will change within, I think mounting and steady consumer pressure can do a lot to force the industry to change their awful ways. And while I think the bad publicity is a key part to putting pressure on the health insurance to change, I actually think that the power of the consumers also can come from elsewhere, and this elsewhere is overwhelming the administrative channels within and outside of the health insurance. The gist is if they send us a lot of (useless) paperwork, send them A LOT of paperwork back. On the Daily Kos, a lot of people noted that things got moving when they complained to the Department of Banking and Insurance. While my own complaint to that department did not produce any immediate fruit, it did get the ball moving for the appeal process, which eventually panned out for me. That is, I learned a lot and started to get decent customer service. Doors opened. Now, it took me weeks to find out that I could complain to the Department of Banking and Insurance and I am sure many find themselves in that situation of walking in a no man’s land of confusion and frustration. If more and more people know that you can file a complaint to these Departments (and why are doctor’s offices not relaying this information??!!), they and the health insurance companies will get inundated with that which they love to inflict on us, paperwork. This may slow things down for you but at a certain point, state governments will get the message that something is deeply wrong. So, people MUST use these channels and overwhelm these agencies with complaints, faxes, emails as this is a powerful and very material message that something is deeply wrong and broken and must be fixed. Also, send faxes and letters to various departments in your health insurance company (appeals, customer service, medical director’s office, public relations office…) get people’s email’s and send them emails. Inundate them with a barrage of administrative paperwork. If they are not being helpful, send a fax or two a day concerning your case until you get clear answers. While individual faxes won’t make much of a difference, imagine if there are 300 a day coming in or 3000…. This can work with the numbers are there and I have a feeling that the numbers Are There. So spread the word for housebreaking your health insurance and push the paperwork back on them.

Added: Sainsbury's Bank's Online Saver, SEB Vilniaus Bankas (LT), Snoras (LT) Noted problems with Alliance and Leicester commercial banking.

I'm not a serious fan of professional sports, but over the years, I've enjoyed watching a wide variety of sporting events at different times and for different reasons. It can be fun when a relatively local team is doing well, and even more fun when they're doing well with style. For the last week or so, I've been paying attention to Major League Baseball for the first time in several years. Last night, from a hotel room on my current business trip, I watched the Colorado Rockies baseball team take the National League championship, thereby winning the right to compete in this year's World Series. It's pretty amazing that they've now won 21 of their last 22 games, including seven straight in the playoffs. But there are two other things that captured my attention last night prompting me to comment here. The first is that this really has been a team effort. With due respect to the various players on the team, none of them seem to be superstars... instead, they come across as a group of very good players who are just doing their jobs really well. And second, they really do seem to be having fun and aren't taking themselves too seriously. I don't know what's going to happen next. They may win, they may lose. But those two observations last night cheered me up after a fairly stressful day, and left me encouraged that doing what you love as well as you can, and finding others to work together with who care as much about the cause at hand as you do can still lead to extraordinary results. That's pretty cool.

Disclaimer: I am 100% newbie on SELinux, so any inaccuracies, mistakes or fallacies are almost sure due to this fact.

After reading Russell's latest post on SELinux, and reading the 5 minutes tutorial on SELinux I decided I should try SELinux on my laptop, too.

Now I have it enabled/enforcing/permissive/refpolicy-targeted.

First issue, hal didn't start in my GNOME session, although the hal module appears to be loaded:

bounty:/emul/ia32-linux/usr/lib/dri# semodule -l grep hal
hal 1.4.0


It seemed that gdomap indirectly required execstack. I cleared the execstack bit (or whatever it is) on libcallback.so.0.0.0 and libavcall.so.0.0.0 and gdomap started.

OTOH, oolite failed to start since it required execmem:

0 eddy@bounty ~ $ oolite
trampoline: cannot make memory executable
Aborted

And after allowing execmem it worked:
# setsebool allow_execmem=1

0 eddy@bounty ~ $ oolite
2007-10-09 01:42:04.686 oolite[26717] initialising SDL
open /dev/sequencer: No such file or directory
2007-10-09 01:42:04.789 oolite[26717] init: numSticks=0
2007-10-09 01:42:04.789 oolite[26717] CREATING MODE LIST
2007-10-09 01:42:04.789 oolite[26717] Added res 1024 x 768
...

I also seem to have some other denied messages, but I hope I'll understand this soon enough to make it work.

I would like to know if is possible to allow execmem only for oolite, and since I suspect it is, how can I accomplish this?

So, now my question is, where is the fine manual on setting SELinux? I digged the whole evening to get oolite to start.

One of several things I never got around to blog about is my experience with MythTV (which, in case you don't know, turns your pc into a tivo, given a suitable tv decoder card and the mythtv software). To make up for the lack of a more detailed post, let's just recap: I had set it up a little over two years ago, on what was then a 'possibly temporary' Kubuntu box. Well the box is still there and still running Kubuntu, four releases later, and MythTV only got easier as Ubuntu now includes the decoder drivers. So far no worries. TV schedule information had always been provided via the 'free as in beer if you answer a question or two' zap2it subsidiary of the for-profit Tribune publishing company (i.e. the folks who own the Chicago Tribune, Cubs baseball team, WGN TV station around here and what have you, and are in the process of being sold to Sam Zeil). As had been noted in other places, that 'free' service is no more, and a seemingly cooperatively-run 'small fee' service has been set up by a few volunteers at schedulesdirect. So I just switched, and for the benefit of anybody sitting on the fence about this, the switch is trivial:

1. If need be, add 'feisty-proposed' to apt's sources.list file to get the new MythTV 0.20.2 release directly from Ubuntu.
2. Install MythTV 0.20.2 which takes as little as wajig update; wajig dist-upgrade
3. Follow the instructions in this email, in particular point 4) about re-creating lineup info
4. sit back and enjoy

Including the signup at schedulesdirect, the whole thing took maybe ten minutes. Not bad. Now I only have to find some spare time so that the backlog of unwatched episodes of the Daily Show does not grow much beyond six months... Oh, and last but not least, I'll have to pony up the fifteen bucks for the subscription once my trial is up next Sunday.

• Froscon rocks!
• explored some more software in more detail, including op, dconf, dstat, unoconf, dwscan, ikiwiki, openQRM, Pentabarf, sl
• it was great to meet so many people (some of them for the first time in RL), including Alexander ‘formorer’ Wirt, Timo ‘Spida’ Boettcher, Marc ‘HE’ Brockschmidt, Bernd Zeimetz, Thomas ‘MrFai’ Lange, Sebastian Harl, Elmar Hoffmann, Martin Zobel-Helas, Luk Claes, Christoph ‘myon’ Berg, Klaus Knopper, Sven Guckes, Dag Wieers and many more…
• using ‘vlock -a -n’ with Debian package >=2.0-2 rocks when using libthinkfinger and authentication via ’swipe finger’ (thanks, formorer :-))
• having Debian release managers (hi Zobel and Luk :-)) by hand rocks
• the book shop at Froscon (Lehmanns) provided one of the best selection of books I’ve seen on an Open-Source event so far (fsck, 3 more books for my library)
• organization of the event was very good
• sadly the press plant made a fscking error when shipping the froscon edition of grml-CDs, so 1000 grml-CDs failed to arrive in time
• thanks to Pierre Schmitz and the Archlinux team for providing us linux-user DVDs containing grml 1.0 and grml64 0.1!

This little Lego robot runs (well, drives) with Debian ;-)