The day before yesterday I learned that a fellow Debian Developer was visiting Porto Alegre Federal University to do some work on Parallel Computing: Vincent Danjean. People from local user group organized a last minute get-together at Cavanhas (that served as last meeting of the year) and we had the most pleasant time. Guaraldo registered the moment with his cellphone camera: Vincent is flying back to France today or tomorrow. Hope he had a great time in Porto Alegre and have a safe trip back home.

The day before yesterday I learned that a fellow Debian Developer was visiting Porto Alegre Federal University to do some work on Parallel Computing: Vincent Danjean. People from local user group organized a last minute get-together at Cavanhas (that served as last meeting of the year) and we had the most pleasant time. Guaraldo registered the moment with his cellphone camera: Vincent is flying back to France today or tomorrow. Hope he had a great time in Porto Alegre and have a safe trip back home.

I guess you can say that A Christmas Carol by Charles Dickens has been a success. It was published in 1843 and has never been out of print since then. It s spawned all manner of plays, films, adaptations, and spoofs. It s been adapted at least twice by Disney, once featuring Mickey Mouse and another time featuring Jim Carey. We re almost inundated with the story I m not sure how many ways I ve seen it. Yet I had never read the original story by Dickens until just now. And I must say, what a treat it was. Despite knowing the plot in advance, it was a very good read. The 19th century London setting was done well. It wasn t some idealized London as is often portrayed in film adaptations. It had depth, as did the characters. Dickens Scrooge had a troubled childhood, the son of poor and apparently abusive parents. He turned to business, with which he was successful. Along the way, he lost sight of family, and really of his humanity in general, striving to be a richer and more successful businessman at the cost of all else. How apropos this story is for us in the 21st century. Our large banks define success in terms of profits made for their shareholders, while adding more gotchas to the terms of the credit cards held by their customers. Our governments play geopolitical games over weapons, oil, and gas, while unwilling to sacrifice anything to prevent a climate disaster. Our politicians, even in the season of Christmas, turn a blind eye and a cold heart to the suffering of those that can t afford health care for naught but political reasons, rather than trying their hardest to make a plan that will help them reality as soon as possible. And what of us, the citizens of the 21st century? We consume ever flashier cars, houses, computers, and cellphones with data plans, while poverty intensifies across the globe in this economic downturn. Well, count me among those many inspired and reminded by Dickens to be a more empathetic person, to remember how good even many of the poor in the West have it compared to other parts of the world, and to try to do more for others. And that, perhaps, is part of the genius of Dickens. He inspired a complete change of how people looked at Christmas in his time. And his work is no less relevant today; perhaps it hits even closer to home these days. He invites us to carefully consider the question: what does it mean to achieve success in life? And he deftly illustrates that wealth is wrong answer. Here s hoping that many others will also learn a small bit about life from Dickens. How to find it: A Christmas Carol is available for free from Project Gutenberg for reading online, printing, or reading on an ebook reader such as the Kindle. Be careful when buying printed editions. Many have been abridged or improved for a modern audience , and thus lose a lot of the quality of the original. I found at least one edition that looks true to the original; I m sure there are others. [This review also posted to Goodreads]

(English translation below. Indian Debian community, please spread the word!) ! , , KDE, GNOME . . (Debian Installer) Lenny , . , , . , , , . ! ; . : akumar@ . ( ) ;-) !TranslationFellow Debian users (who know Hindi)! Maybe you aren't aware yet, but several parts of Debian have been localized and are available in several Indian languages, and KDE and GNOME and several programs are available natively in those languages. This has been possible only due to dedicated volunteers spending time in translating the programs. I have been translating the strings in the Debian Installer to Hindi, since Lenny, and will continue with the translations. But like others, I am short on both time, and my knowledge of technical Hindi words and phrases is limited. So, I'd request fellow users to chip in with some translations to the Debian Installer strings, if they have the time. That way, not only will you earn fame and glory, you'll also earn the gratitude of the Hindi Debian user community.You don't need to be an expert in the language and grammar to help out with the translations. All you need is some working Hindi knowledge and a bit of time.For more information, email me at akumar followed by debian.orgThank you!

I've been using virtual machines (KVM, these days) as isolated environments to do things like build packages as root. Unfortunately, some of these activities require decent-sized chunks of random data (pulled from /dev/random). But /dev/random pulls from the kernel's entropy pool, which in turn is replenished from "hardware" events. But a virtual machine has no actual hardware, and if it is only doing isolated package builds, there is very little activity to feed the kernel's entropy pool. So the builds and test suites that rely on this randomness all hang for a long long time. :( My current way to get around this is to replace /dev/random with the /dev/urandom device, which does not block if the entropy pool is depleted:

mknod /dev/newrandom c 1 9
chmod --reference=/dev/random /dev/newrandom
mv -f /dev/newrandom /dev/random

This has the consequence that the "randomness" these commands use doesn't have as much "real" entropy, though some operating systems (like FreeBSD) have a non-blocking /dev/random by default (and it's also questionable what "real" entropy means for a virtual machine in the first place). I'm also using cowbuilder within these VMs to do package builds. But cowbuilder has its own /dev tree, with its own device nodes, so this needs to be fixed too. So after you have successfully done cowbuilder --create, you need to modify the random device within the cowbuilder chroot:

mknod /var/cache/pbuilder/base.cow/dev/newrandom c 1 9
chmod --reference=/var/cache/pbuilder/base.cow/dev/random /var/cache/pbuilder/base.cow/dev/newrandom
mv -f /var/cache/pbuilder/base.cow/dev/newrandom /var/cache/pbuilder/base.cow/dev/random

Hopefully this will be useful for other people using cowbuilder (or other build strategies) on isolated virtual machines. If you've worked around this problem in other ways (or if there's a security concern about this approach), i'd be happy to hear about the details.

There are few things I really hate. One of them is regressions. Regressions are bad because they usually take away things we are used to rely on, and leave us with the idea that perhaps the technical improvements didn t really improve our lifes as a user, despite putting less burden on the developers. Software is made for users, after all. As part of my work on WebKitGTK+, I always keep an eye on regressions, both from previous WebKitGTK+ releases, and those imposed on embedding applications on their migration away from Gecko, and try to focus some of my efforts into lowering their numbers, whenever I can. In recent times I have worked on removing a few very user-visible regressions in Epiphany, which I see as the most demanding WebKitGTK+ user in GNOME, such as save page not working, missing
favicon support, failing to
perform server-pushed downloads (such as GMail attachments), and not being able to view source. An example of a regression from a previous version of WebKit also exists: in 1.1.17 we started advertising more than we should as supported by the HTML5 media player, causing download to be almost completely broken. All of these are working if you are using WebKit and Epiphany from trunk/master, so should be on the next development versions of WebKitGTK+ and Epiphany. Other people have also fixed many other regressions; a few examples: Xan has reimplemented the Epiphany customization of the context menu, Frederic Peters provided a work-around for mailto: links while we don t have SoupURILoader yet, and Joanmarie Diggs keeps rocking on the accessibility front! If you find regressions, keep them coming! If you have a patch, even better! =) Next week WebKitGTK+ team gets together to work furiously on improving WebKitGTK+ in a hackfest sponsored by Collabora, and Igalia, and hosted/organized by Igalia. While there I should also get my hands on one of these. Can t wait! =)

Over Thanksgiving this year, we took a train trip to visit Terah s family in Indiana. Here s the story of the trip. The Train to Indiana Our last train trip (to Chicago) was in May, before Oliver was born. Jacob always has enjoyed the train, but this time wow. We told Jacob about the trip the day before we were to leave. Several times in the day, he d get a sly smile, and ask, What are we going to do? Terah or I would spell out the day s activities, and when we d get close to the part where I d wake him up at night and we d go to the train station, he d have a big smile. The big hour (2AM) arrived and Jacob woke up while Terah was putting his shoes on. I was there a moment later. Normally Jacob is terribly grumpy after waking up, even more so if somebody else woke him up. That day, I saw a very groggy-looking boy. I asked him, Jacob, are you ready to go to the train station? He answered, YEAH! while rubbing his eyes. Dad, let s go! We had Amtrak s family bedroom for the first time this trip, and it worked out great. Jacob actually slept, despite his extreme excitement. He d been talking about eating in the diner car for quite some time, and was really excited when breakfast time rolled around. We sat down, and he pressed his nose up against the window right away. He counted the freight trains the he saw, pointed out train tracks and crossing guard lights , noticed barns and trucks, and gave us frequent updates on how fast we were going. His voice was high-pitched from excitement, and sometimes we d have a running commentary we could barely interrupt, and other times he d sit there silently just soaking it all in. But he didn t eat. He didn t want to turn his head away from the window for a second to take a bite. I kept reminding him to take a bite, and finally, fearing he d be really hungry as soon as we went back to our room, fed him a few bites for the first time in ages. I don t believe he realized that happened. He just opened his mouth by reflex and once I had to tell him to close his mouth around the fork that was in it. It was much the same story for lunch, and for dinner on the train though less so for dinner since it was dark outside. At dinner, a man sitting across the aisle from us said, If you weren t getting your meal free [since we're in the sleeper], I d buy it for you. Your boys are amazingly well-behaved! I thanked him politely Jacob and Oliver both were doing well but didn t really think it was that unusual. Oliver and Jacob were both big hits on the train. They got smiles from so many people on board and in the stations. Several of the dining car staff seemed to linger at our table longer than elsewhere, looking at them (and especially Oliver). Oliver slept well on the train: And here are a couple of typical Jacob photos: In Indiana I ve got to start this out with one of the family gatherings at Terah s aunt s house. They have a large kids area in their basement, and a swingset with a slide outside. Jacob loved all of this, and spent hours playing with me. Sometimes if I d go upstairs with the adults, I d hear Jacob s voice from the basement a few minutes later: DAAAAAD!!!! Shall you come back downstairs? DAAAD! And, of course, it s hard to resist a 3-year-old that wants to play with me, so I inevitably would. We played air hockey Jacob shrieked with delight whenever anybody scored a goal in any way. At one point, he stood up, looked around, and said, Hmmm. Where are all the trains? Apparently he expected every home to be stocked with toy trains, and this one wasn t. A few seconds later, he was all excited. He ran over to a toy semi, and said, I will use the semi train! Outside the short slide had a ladder going up to it. I held Jacob s hands while he climbed up the first few times, but I knew he could do it himself. I started helping him less and less, and eventually refused to help him at all. He was rather frustrated with that for a moment, but a couple times later, climbed up and said, Dad, I got up here all by myself! A few times later, it looked like he was having trouble, so I tried to help, and got shooed away with, No, dad! I can do it. The best moment of the weekend came during the drive back to Terah s mom s house where we were staying. Terah was driving, and I heard Jacob say, Shall you come closer? Not sure how to do that from the front seat of the car, I reached my hand back there and he held it. He held one or the other of my hands for 20 minutes until he fell asleep in the car. It s funny what feeling needed by a 3-year-old makes a person feel, but that was surely a happy day. Jacob got to see all of his Indiana grandparents on this trip, and loved playing with them. He especially liked using a perfect red train (his words!) he drug home from the nursery at church on Sunday, and a child-sized tent in the basement. I m not sure how many times I heard Gampa Mike! Shall we go to the basement? that weekend. One point he wanted me to come down to see it and play with him, so I did. Then he decided we all needed to be down there, and told me I ll go pick up mom. I ll be right back. Stay downstairs, dad. Fearing that Terah wouldn t know what to do when Jacob attempted to pick her up , I tried to discreetly follow at a distance. That was no match for a 3-year-old. He looked back at me from the top of the stairs, pointed an accusing finger at me, lowered his voice, and said, Dad. Stay. Terah and I spent a day in South Bend and stayed at the Oliver Inn while Jacob and Oliver got some time to themselves with their grandparents. We had dinner at the beautiful Tippecanoe Place, just next door. The Trip Home We had a few hours in downtown Chicago on our way home. We went and ate at a small Indian restaurant. Jacob kept alternating between three things: This food is very spicy! I like spicy food. I need another drink! A little while later, Terah decided we should have some dessert. So she and Oliver stayed in the waiting area while Jacob and I went asporing (exploring) to find something. We walked a block or two to the nearest Dunkin Donuts, then to a Starbucks, and then back. Jacob carried the sack of donuts, guarding them so carefully that I was afraid he might smash them. (They were cream-filled so that wouldn t have been good.) He had a lot of fun exploring Chicago Union Station, and also enjoyed walking in Chicago (though not quite as much; it was all a little too loud for him.) In the train station, he loved the escalators. Up and down we went, whenever we wouldn t get in people s way. I had to eventually drag him away from them as I was getting a little self-conscious at all the people standing around watching us repeatedly go up and down the escalators. Jacob has found a 3-year-old way to express his feelings: he ll pretend to be a kitty, and say the kitty is sad or something like it. All day he had been saying the kitty is hungry. He hadn t had a big breakfast, but he had plenty of opportunity to eat at lunch, and a snack. We were a bit confused, but I think we finally figured it out on the train back to Kansas. We didn t have time to eat breakfast in the diner on the train from South Bend to Chicago, so Jacob missed out on the dining car then, and I think he was disappointed or confused about that. Once we had dinner in the dining car, he was happier. Since we ve been back home, he s been talking about our next train trip. He says which suitcases we ll take, that we ll eat in the diner, that it will be a night train we take, and generally is still very excited about it. It was a fun trip.

So a few years ago I got stuck with no health insurance as I had a fellowship that had for its history accepted professors (with health insurance) not fresh off the boat PhDs as was the case with me. Since I was at a Large State school it was nearly impossible for me to get insurance and finally I ended up paying 400 a month and getting a whole lot of headache. In many ways my ordeal was a fluke following a change of policy and this fellowship now provides insurance to its postdocs. Increasingly, however, it seems like a number of postdoctoral fellowships shirk from their duties and don t provide a drop of health insurance. Given the academic job market, many academics don t have any choice but to accept these positions and if they don t come with insurance, well then these folks are shelling out thousands upon thousands of dollars for basic, really lousy, coverage. Given that universities for the most part have decent, even in some cases kick ass insurance, with a large pool of people, shutting postdocs out of their pool is.. gross and just plain wrong. One of my fellow friends, currently on the market and currently screwed by her last postdoc wrote up a short document (aka Academic Labor Hall of Shame) and I thought I would post it here as it gets to the heart of the issues and starts shaming some of these shameful universities. If you know of other postdoctoral positions that don t offer insurance, please please leave a comment. We will include it in the hall of shame. Academic Labor Hall of Shame Universities like to promote themselves as bastions of enlightenment, but their treatment of temporary and hidden employees is often anything but enlightened. Or progressive. Or fair. 1. Postdoctoral fellows and researchers: There is a growing trend towards classing postdocs as not employees . I learned this recently when I was laid off from postdoctoral position at the University of Pennsylvania. I planned to extend my health insurance through COBRA, which is currently federally subsidized for workers who lost their jobs during the financial crisis. I was shocked when Penn initially claimed that I was not eligible for the subsidy (made available through the American Recovery and Reinvestment Act of 2009, the so-called stimulus act ). Their reason was that postdocs were not classed by Penn as employees. I appealed this with the Office of General Counsel and after a few weeks was told that I was indeed eligible, as Penn had found an inconsistency in [their] policy for certain categories of post docs between tax treatment and the availability of COBRA/ARRA . This means that while I am in fact eligible for this subsidy, postdocs paid through many other classes of grants are still not. If you want to see an example of this process of sorting some postdocs into not employee status, here is another one:
Postdocs on training grants or on individual fellowships (roughly 25% of VUMC postdocs) receive a stipend and are specifically excluded from the employee classification. They do not pay FICA and do not receive employee benefits. Their health insurance is provided and purchased separately. [by whom?] Even if Vanderbilt does in this case make provisions for these postdocs to receive health insurance, there is abundant evidence that some postdocs are outright excluded, as in this example at Stanford:
Stanford makes no provision for fellows to purchase health insurance, and the Institute will not provide medical insurance or other benefits. External fellows must bring their own medical coverage with them or purchase an individual plan during their stay in California. This is also quite apparent when you look into the outfits that profit from selling health insurance to postdocs (because their universities don t provide them any):
http://www.garnett-powers.com/npa/ Also, take a look at the policy they and you ll note that it stinks: it excludes such luxuries as preventive care, birth control, and chemotherapy. I m not making this up:
http://www.garnett-powers.com/npa/summary.pdf

So a few years ago I got stuck with no health insurance as I had a fellowship that had for its history accepted professors (with health insurance) not fresh off the boat PhDs as was the case with me. Since I was at a Large State school it was nearly impossible for me to get insurance and finally I ended up paying 400 a month and getting a whole lot of headache. In many ways my ordeal was a fluke following a change of policy and this fellowship now provides insurance to its postdocs. Increasingly, however, it seems like a number of postdoctoral fellowships shirk from their duties and don t provide a drop of health insurance. Given the academic job market, many academics don t have any choice but to accept these positions and if they don t come with insurance, well then these folks are shelling out thousands upon thousands of dollars for basic, really lousy, coverage. Given that universities for the most part have decent, even in some cases kick ass insurance, with a large pool of people, shutting postdocs out of their pool is.. gross and just plain wrong. One of my fellow friends, currently on the market and currently screwed by her last postdoc wrote up a short document (aka Academic Labor Hall of Shame) and I thought I would post it here as it gets to the heart of the issues and starts shaming some of these shameful universities. If you know of other postdoctoral positions that don t offer insurance, please please leave a comment. We will include it in the hall of shame. Academic Labor Hall of Shame Universities like to promote themselves as bastions of enlightenment, but their treatment of temporary and hidden employees is often anything but enlightened. Or progressive. Or fair. 1. Postdoctoral fellows and researchers: There is a growing trend towards classing postdocs as not employees . I learned this recently when I was laid off from postdoctoral position at the University of Pennsylvania. I planned to extend my health insurance through COBRA, which is currently federally subsidized for workers who lost their jobs during the financial crisis. I was shocked when Penn initially claimed that I was not eligible for the subsidy (made available through the American Recovery and Reinvestment Act of 2009, the so-called stimulus act ). Their reason was that postdocs were not classed by Penn as employees. I appealed this with the Office of General Counsel and after a few weeks was told that I was indeed eligible, as Penn had found an inconsistency in [their] policy for certain categories of post docs between tax treatment and the availability of COBRA/ARRA . This means that while I am in fact eligible for this subsidy, postdocs paid through many other classes of grants are still not. If you want to see an example of this process of sorting some postdocs into not employee status, here is another one:
Postdocs on training grants or on individual fellowships (roughly 25% of VUMC postdocs) receive a stipend and are specifically excluded from the employee classification. They do not pay FICA and do not receive employee benefits. Their health insurance is provided and purchased separately. [by whom?] Even if Vanderbilt does in this case make provisions for these postdocs to receive health insurance, there is abundant evidence that some postdocs are outright excluded, as in this example at Stanford:
Stanford makes no provision for fellows to purchase health insurance, and the Institute will not provide medical insurance or other benefits. External fellows must bring their own medical coverage with them or purchase an individual plan during their stay in California. This is also quite apparent when you look into the outfits that profit from selling health insurance to postdocs (because their universities don t provide them any):
http://www.garnett-powers.com/npa/ Also, take a look at the policy they and you ll note that it stinks: it excludes such luxuries as preventive care, birth control, and chemotherapy. I m not making this up:
http://www.garnett-powers.com/npa/summary.pdf

A couple of weeks ago, Lucas Nussbaum wrote about his experience at the Ubuntu Developer Summit. Two things stuck out at me:

• "Ubuntu has clearly gone a very long way since 2004. Everything looks very well organized and polished, and gives the impression of a big machine that nothing can stop."

In the summer of 2004, my laptop (an iBook G4) ran Debian GNU/Linux on PowerPC. I tried out Ubuntu that autumn, and was very impressed. It's been five years since then. My desktop still runs Debian, and I'm proud to be a "two-distro" community member. At the same time, this juggernaut nature raises concern. When Ubuntu releases ship with significant flaws, I quietly sigh and wonder, Are we doing good service to the people coming to GNU/Linux for the first time and seeing Ubuntu? This bugginess has bit me a few times (even for upgrades between one release and the next), and it pushed a friend of mine to switch a lot of his computing to DragonflyBSD. Lucas points out that Ubuntu's done a fantastic job of becoming visible. A look at Google Trends shows that people search for "Ubuntu" about as much as they search for "Linux" at all. Richard Stallman complains when people refer to GNU/Linux as just "Linux." But today, the most popular name for an operating system based on GNU is probably "Ubuntu." For Stallman, having his hard work associated with someone else's "Linux" project must be frustrating. As a Debian contributor, it would be easy to succumb to the same feeling with regard to Ubuntu. Lucas is well aware of that. He asks,

• "Will Debian manage to stay relevant, or are we just going to be the technically-pure distro without many users that serves as a package supermarket for Ubuntu?"

Debian does have users! I was feeling a bit disheartened about my maintenance work on alpine lately, when out of the blue I received an email from a fellow at MIT asking me if I would accept some help with maintenance from him. Just seeing the note was a relief; it's very nice to be reminded that I have users to take care of. Debian is not as popular as Ubuntu on the desktop (or laptop), it's true. But technically sharp people do frequently still choose it. For example, the FreeNAS project recently announced a switch from FreeBSD to Debian (and a new name as coreNAS). But we could end up a "package supermarket". To stave this off, we must do good releases and make sure people know about them. Doing all that work takes us all time. We must recruit new contributors, help them find things to work on, and make sure they feel welcome. And sometimes-sloppy maintainers like me ought to fix our packages, and get help from others where necessary. I promise to work toward that.

As I ran out of time whilst writing the "introducing ujail" post on monday I would like to further elaborate on the idea, giving you some examples of possible use cases and then having a look at FAQs regarding ujail. Additionally I have created a second proof of concept that should be a lot faster, see below for more details.

Use cases of ujail

Monday's post was rather technical, so let's have a look at possible use cases today.

The main reason for both having the idea of ujail and starting working on it is my web server. I am running quite a few (S)CGI scripts there and, even though running them as different users, on a per-vhost basis, I have the impression of the whole thing being a bit insecure.

Okay, PHP does provide its famous open_basedir feature, but I am also running some Python applications which I simply cannot restrict easily. My first ideas involved adding something similar to open_basedir to Python, followed by the idea of replacing some C library functions, like fopen and friends on startup time.

Whilst the adding open_basedir to Python would have involved changing a lot of Python's internals I soon discarded the library patching idea as those could be worked around by injected code directly invoking syscalls. It didn't take long for me to notice that I have to dig deeper. The idea of ujail was born and after coming up with the proof of concept this seems to be a viable solution.

Now ujail is not only about protecting a web server from its web applications, but could do a lot more, for example:

• Creating a sandbox for untrusted code (socket&file i/o emulation)
  
• Implementing some sort of personal firewall (socket-call only emulation)
• Testing applications that perform low-level system operations (read: package managers and friends, filesystem emulation)

I am sure you can come up with even more use-cases. What should be noted is that emulating a system call does not mean that one necessarily needs to emulate the whole filesystem. What can be done, for example, is patching through access to common files (libraries, executables, etc.) whilst maintaining a virtual filesystem for data that will eventually be modified. A copy-on-write approach is possible too, for example. There are multiple methods with which the multiple filesystem could be implemented, the most common would probably be using a state directory.

FAQs

There have been some questions about ujail in comments to my first post which I would like to answer. Also, I have been thinking about things that are different about ujail compared to other virtualization techniques. Feel free to add additional questions either in a comment or drop me an email: debian at sp dot or dot at.

1. Could you change the license of ujail to ... ?
   
   Not likely to happen. The proof of concept's license is GPLv3 and the actual code's license will be too. However, ujail is a userspace application that does not need any modifications to the kernel so there should be no problems with porting ujail from GNU/Linux to any other system.
   
   
2. Does ujail work on operating systems other than GNU/Linux?
   
   Not yet. If it's technically possible to implement the technique on other operating systems I would be happy to accept patches.
   
   
3. Do I need to patch my kernel for ujail to work?
   
   No, ujail is running in userspace. The only thing it needs is Linux with support for PTRACE_SYSEMU.
   
   
4. How is this approach different from using LD_PRELOAD?
   
   With LD_PRELOAD one can replace library functions, but malicious code could still directly invoke syscalls, working around this protection completely. Also, statically linked binaries cannot be restricted with LD_PRELOAD.
   
   
5. How is this approach different from user-mode-linux?
   
   User-mode-linux (UML) works by emulating a full kernel in userspace and allows you to virtualize a whole Linux instance (including a new init process, etc). ujail is about providing a way of restricting a single process (and its childs) inside a running system in terms of access to syscalls and the partial emulation of those.
   
   
6. How is this approach different from linux-vserver?
   
   Linux-vserver is a kernel patch and runs in kernel space, as opposed to ujail, which works in userspace.
   Also, linux-vserver works similarly to user-mode-linux, providing a fully virtualized Linux instance.
   
   
7. Does the account running ujail need any special privileges?
   
   No, the only restrictions that apply are those of ptrace.
   
   
8. Where is the code?
   
   Right now ujail is in a planning phase, and only the proof of concept code has been written and published. The actual ujail code is yet to be written and the code will be hosted on launchpad.net.
   
   

Proof of concept, part 2

An anonymous person (who were you stranger?) added a comment to my first post, suggesting "Also, why patch the process rather than just modifying its state and trapping into the kernel?". I have had a look at this approach earlier, but it didn't work out. However, I decided to give it yet another try and created a second proof of concept. That code does not require patching any code, but only modifies the instruction pointer (eip) and the first register (eax). This should be a lot faster than patching the code.

Technically the new main loop works by calling PTRACE_SYSEMU and waiting for a notification. It then saves the instruction pointer and switches to PTRACE_SYSCALL. As before it waits for the emulated syscall to exit and at this point sets eax from orig_eax and decreases the value of the instruction pointer by the size of the "int $0x80" instruction. Another call to PTRACE_SYSCALL resumes the process. The next event is the process actually entering the real syscall and yet another one leaving the syscall again. These are resumed by PTRACE_SYSCALL and PTRACE_SYSEMU respectively. So, comparing this with the first approach we are only modifying two registers now, instead of writing to the TEXT area of the running process.

Thanks should go to the anonymous commenter for making me give this approach another try.

Questions? Criticism? More ideas? Want to contribute?

Coming to an end I would yet again like to let you know that I am open for questions, criticism, more ideas and contributions in general. So if you are interested in this topic come join the discussion by either dropping me an email, writing a comment to this post or replying to this post on your own blog.

The following User stylesheet snippet can be used to highlight particular search results (such as your own domain, if you want to quickly find it in Google search results):

@-moz-document url-prefix(http://www.google.com/search)
 
a[href^='http://www.vitavonni.de/']   background-color: yellow;  
 

You might also want to add a copy for your localized Google domain:

@-moz-document url-prefix(http://www.google.de/search)
 
a[href^='http://www.vitavonni.de/']   background-color: yellow;  
 

Or you could go the heavyweight way:

a[href*=vitavonni.de]   background-color: yellow !important;  

to even highlight any link to your domain.This modification obviously only applies to your browser; it's meant to help you finding links to your own site more easily.

Lately I have been thinking about methods to provide a stripped down, secured environment for running untrusted code on GNU/Linux. With this post I would like to present you with the first results of my research.

ujail - brief introduction

I have chosen ujail as the name for the technique I am proposing. ujail stands for micro jail in userspace and, in itself, describes the concept briefly. The main idea is to have a userspace process monitor system calls of one of its childs and emulate some calls, if needed. This is done using ptrace and namely both PTRACE_SYSEMU and PTRACE_SYSCALL.
The ujail process should not be able to monitor syscalls, like strace does, but also intercept and emulate them.

This sounds a lot like user mode linux (uml), but the method is different. Whilst uml comes with a complete kernel, emulates all system calls and this way provides a virtualized system, ujail is intended to only emulate some systemcalls, without emulating the kernel.

Revisiting PTRACE_SYSCALL & PTRACE_SYSEMU

To better explain how the ujail technique works I would like to have a quick look at PTRACE_SYSCALL and PTRACE_SYSEMU again.

PTRACE_SYSCALL allows a userspace process to be notified whenever a traced process enters or leaves a system call. This means that two notifications are normally sent: one before system call entry and one afterwards. Even though one is able to change the parameters of system calls this method does not allow system calls to be fully emulated (think virtual filesystem here).

PTRACE_SYSEMU on the other hand provides one notification on syscall entry and expects the receiver of the notification to emulate the syscall. This method alone sounds great, but this also means that memory allocation needs to be emulated too, which is quite complex in userspace.

A hybrid of PTRACE_SYSCALL & PTRACE_SYSEMU

Now on to the concept behind ujail. The method I am describing works by calling PTRACE_SYSEMU for a specific process and this way taking over emulation of all system calls. However, some system calls are complex to emulate in userspace, and so a hybrid of both PTRACE_SYSEMU and PTRACE_SYSCALL is needed. In short this works by checking whether the syscall needs to be emulated when the PTRACE_SYSEMU event is received.
Now one way is emulating the syscall, filling the processes' registers and resuming execution of the process. This is simple and straight-forward.

The second way is forwarding the system call to the kernel. The problem here is that calling the syscall in the monitoring process will make the new resources available to that very process, and not the process to be jailed. This is where the hybrid method kicks in.

The proof of concept code creates a backup of the next instruction to be executed along with a copy of the instruction pointer at this point and patches it with the opcodes for "int $0x80", causing the syscall to be made again. After that it resumes execution with PTRACE_SYSCALL and waits again. The first event to be received now is the program leaving the emulated system call, which can be ignored. Resuming yet again will give use two PTRACE_SYSCALL events, one for syscall entry and one for syscall exit.

The first event is not really interesting, but at the second event the opcode backup is restored and the eip set from the saved value. Now the kernel has handled the syscall and the result is ready for the child process. A final call of PTRACE_SYSEMU resumes execution of the child and waits for the next syscall.

Proof of concept

The proof of concept code can be downloaded from its bazaar branch at launchpad.net. It is intended to be used on i386 systems only and works with simple programs, but is known not to work with anything using fork, vfork and most likely will not work for binaries using threading.

Finally, I would like to thank Pradeep Padala for his "Playing with ptrace" articles [0][1], which were fun to read and worked as a great introduction of ptrace for me.

Now there is only one thing left to say: if you are interested in this method, see loopholes or problems or want to contribute, please go ahead and contact me:

debian at sp dot or dot at

The first thing I searched for in Google, back in 1999, was probably "linux", followed by my name. The last thing I searched for in Google, on a snowy day in 2009, was "vdash". With the decade over, and Google rolling out all manner of tracking cookies and javascript, it's time to move on. Just keeping on top of the torrent of privacy-affecting changes Google is making, and trying to parse the real meaning in the chirpy googlespeak announcements has become more work than the value their search engine adds. (This was the last straw.) At least for now, I'll be using Duck Duck Go for search. It's small, quirky, has features the big competition lacks, and works well enough for my mostly moderate and occasionally intense needs. Sorta like Google in 1999.

Here's a code fragment to track outgoing links with Google Analytics. As usual, use it at your own risk. I can not give you support for Google products, for obvious reasons.To use it, you <me>need at least understand where to put it (call it in a try-catch in onLoad) and how to adjust the variable name of your page tracker (I'm not using the default).

function trackLinks() 
  var as=document.getElementsByTagName("a");
  var ig=["mydomain.tld","google-analytics.com"];
  for(var i=0; i<as.length; i++)  
    var ignore=false;
    var oc=as[i].getAttribute("onclick");
    if(oc!=null) 
      oc=String(oc);
      if(oc.indexOf('urchinTracker')>=0
        oc.indexOf('_trackPageview')>=0
        oc.indexOf('javascript:')>=0)
        continue;
     
    if(as[i].href.indexOf("mailto:")<0) 
      for(var j=0;j<ig.length;j++) 
        if (as[i].href.indexOf(ig[j])>=0)
          ignore=true;
       
     
    if(!ignore) 
      as[i].onclick = function() 
        var o=this.href.replace(/:\/*/,"/");
        pt._trackPageview('/out/'+o)+";"
        + ((oc!=null)?oc+";":"");
       ;
     
   
 

This code tries to attach an onload handler to any outgoing link, ignoring internal links or links that use JavaScript. If such a link is clicked, it generates a virtual page access with an "/out/" URL that can be analyzed in Google Analytics.A side benefit (apart from knowing which links are interesting to your visitors) is that you should get more accurate "time on page" statistics for your pages.

After I had been living with mostly the same electronic toys over the last few years (ok, I got the netbook earlier this year, but that's about it... and it might even count as a serious work tool given how much I came to use it) all the toys I've agonized over buying suddenly appeared on the doorstep within these two weeks... First part was the QNAP TS-419P which I bought after reading about QNAP on Martin Michlmayr's blog. The decision was quick when I realized that at least part of the Debian related information was not hidden in some obscure web forums but was there on the QNAP wiki itself, indicating quite some level of support from the manufacturer. Beyond that, tbm does an awsome job supporting QNAP users like myself through his excellent QNAP / Kirkwood pages and also, since Debian installer support for the 419 is not quite finished, by email. Kudos to him! So, once I get past some remaining obstacles (for some reason, the initrd refused to mount a raid1 root device when I tried it at first; working on that, but it's not that easy to debug without console access...) our old storage / Internet router (very old! Pentium II 350MHz with 128M RAM and its probably third internal disk, which became ridicolous to use when I bought a (big) external USB disk and realized it only has USB 1...) can be retired. Should be good for the environment, too, I should hope, in terms of power consumption even considering that I now run 3 more disks.

Remember Vitacilina? A small aggregation library I wrote last year to be intended to replace Planet on Planeta Linux? Well, it never quite replaced it but it achieved some level of stability since I was using it for a number of tasks at work. So, during this long holiday weekend, I received a notification that the Request To Package bug I had filled against the Work-Needing and Prospective Packages in Debian has already been taken care of and the library had been uploaded. Of course, I could have made this myself a long time ago, but at the time it was simpler and faster just to hope someone else would do it at some point. So, Dario did it. He packaged it and uploaded version 0.1 under the umbrella of the Debian Perl Group. Hurray! But then I realized that Alexandr Ciornii had implemented some nice changes to Vitacilina back in September that I never got to include or release as a CPAN distribution. And so I just did. I've uploaded 0.2 to CPAN and you can fetch it with cpanf Vitacilina or wait for the Debian Perl folks to update it

I got a new computer at home a week ago and finally got around to assemble all the parts. Which wasn t as easy as expected, especially fitting the CPU cooler was a hard fight. Specs For the curious, here are the specs:

CPU

AMD Phenom II X4 965 (4 3.4 GHz)

Mainboard

MSI 790GX-G65

Graphics

ATI Radeon HD 3300 (on-board)

RAM

8 GB, DDR3

Hard drives

2x SATA 1.5 TB (by Western Digital)

Ubuntu installation For testing and having a first look, I installed Ubuntu karmic koala (amd64). Installation went like a breeze, everything was detected and worked out of the box. Well, kind of graphics performance was dreadful. Which was kind of expected. Debian installation I originally thought about using Debian only inside virtual machines or change roots. Still, Ubuntu does not really feel like the real thing . So I went to install Debian, aiming at a sid/unstable installation. The first boot using the official squeeze snapshot netinst image (Binary-1 20091128-11:21) went fine. Up to the first prompt: No input was possible. Probably a problem with the USB keyboard I had connected (Logitech wireless). Out of curiosity I tried the graphical installer, which did not even get so far. It was stuck in an endless loop trying to start an X11 server. So I dug for a PS/2 connected keyboard and had more luck. I got to the point where the installer searches for the CD-ROM drive. As I did not want to dismantle my old system yet, I used an external USB DVD/RW drive. This was not detected by the installer so I was unable to continue installation. I guess, the NIC driver was also on the disc so no ethernet either. Today I installed the DVD burner into the tower and had more luck. It still amazes me how easy it is to create my default storage setup using d-i (LVM on RAID). However, the installer failed to reread the partitions after I created two on each drive, interestingly telling me about /dev/sda2 being busy. Perhaps a left-over swap partition from the Ubuntu install? Anyway, after running fdisk manually and writing the same partition table again, I was able to continue. The remaining d-i steps went fine, with just a nuisance: I was asked for the console font setting twice. And I had no idea what it was asking of me, AFAIK UTF-8 should be fine for all possible uses. I selected # Latin1 and Latin5 western Europe and Turkic languages. Not that I will see the console unless Xorg fails to run After having the base system running, I rebooted without selecting any more software, partly because I knew that the resync on md1 will need restarting after booting into the new system. The new system booted fine and I called aptitude to install build-essential, Xorg and both KDE and Gnome desktops. This pulled in MySQL via akonadi-server (ouch!) and I was asked for a MySQL root password. Seriously, I don t care, this is a desktop system. I tend to forget the password anyway and the last time, root was able to reset it. So I just hit Enter, leaving no password set. This lead to the installation asking me two more times for the password, which really sucks given that the server is only used by Akonadi for whatever reason and the last time I looked, it creates its own MySQL configuration. Albeit my old system is 8 years old, the new system still seemed slower. Which of course is due to disk latencies, given that /dev/md1 was being synchronized in the background. Anyway, I was eager to test the desktop experience and started gdm. X came up fine, but again I had no mouse and no keyboard (USB mouse, keyboard connected as well as PS/2 keyboard). I also was unable to switch to a VT, so I logged in remotely and rebooted the new system. After the reboot, hal obviously picked up the input devices and X11 worked fine now. At this point, I stopped as the sunday almost passed already. Summary: Debian installation still needs some improvements I think. Maybe our distribution is just too stable, after all my last install is 3 years back due to a disk crash Relevant Debian bugs

• #558679: My installation report with some logs included.
• #558681: Nagging about MySQL root password.
• #558686: Failure to reload partition table.
• #545933: No USB keyboard support
• #315553: Installation from optical drive on usb fails (but this is for kernel 2.4)
• #558691: No keyboard and mouse after fresh installation of xserver-xorg.