Sometimes I write things that are for myself, and later decide to release on the off-chance other people might be interested. I've hated procmail for a long time, but it is extremely flexible, and for the longest time I figured since I'd got things working the way I wanted there was little point changing. When it comes to procmail there are few alternatives:

• Exim filters.
• Maildrop.
• Email::Filter

Unfortunately both Exim and Email::Filter suffer from a lack of "pipe" support. To be more specific Exim filters and Email::Filter allow you to pipe an incoming message to an external program - but they regard that as the end of the delivery process. So, for example, you cannot receive a message (on STDIN), pipe it through crm114, then process that updated message. (i.e. The output of crm114). Maildrop does allow pipes, but suffers from other problems which makes me "not like it". My own approach is to have a simple mail-sieve command which is configured thusly:

set maildir=/home/steve/Maildir
set logfile=/home/.trash.d/mail-sieve.log
#
#  Null-senders
#
Return-Path: /<>/        save .Automated.bounces/
#
#  Spam filter
#
filter /usr/bin/crm -u /home/steve/.crm /usr/share/crm114/mailreaver.crm
#
#  Spam?
#
X-CRM114-Status: /SPAM/   save .CRM.Spam/
X-CRM114-Status: /Unsure/ save .CRM.Unsure/
#
#  People / Lists
#
From: /foo@example.com/  save .people.foo/
From: /bar@example.com/  save .people.bar/
..
..
#
#  Domains
#
To: /steve.org.uk$/               save .steve.org.uk/
To: /debian-administration.org$/  save .debian-administration.org.personal/
#
#  All done.
#
save .inbox.unfiled/

On the one hand this is simple, readable, and complete enough for myself. On the other hand if I were going to make it releasable I think I'd probably want to add both conditionals and the ability to match upon multiple header values. Getting there would probably involve something like this on the ~/.mail-filter side :

if ( ( From: /foo@example.com )  
     ( From: /bar@example.com ) )
 
   save .people.example.com/
   exit
 
# ps. remind me how much I hate parsers and lexers?

That starts to look very much like Exim's filter language, at which point I think "why should I bother". Pragmatically the simplest solution would be to add a "Filter" primitive to Email::Filter - and pretend I understood the nasty "Exit" settings. ObQuote: Andre, we don't use profanity or double negatives here at True Directions. - "But I'm a Cheerleader".

I have a few new (academic) publications out and most are on my website. Hope to get a copy of the Annual Review of Anthropology up there in the fall!

I have a few new (academic) publications out and most are on my website. Hope to get a copy of the Annual Review of Anthropology up there in the fall!

Why use a Chroot environment? A large part of the use of chroot environments is for the purpose of security, it used to be the only way of isolating a user from a section of the files on a server. In many of the cases where a chroot used to be used for security it is now common practice to use a virtual server. Also another thing to note is that SE Linux provides greater access restrictions to most daemons than a chroot environment would so in many case using SE Linux with a sensible policy is a better option than using a chroot environment to restrict a daemon. So it seems to me that the security benefits that can be obtained by using a chroot environment have been dramatically decreased over the last 5+ years. One significant benefit of a chroot environment is that of running multiple different versions of software on one system. If for example you have several daemons that won t run correctly on the same distribution and if you don t want to have separate virtual machines (either because you don t run a virtualisation technology or because the resources/expense of having multiple virtual servers is unacceptable) then running multiple chroot environments is a reasonable option. The Simplest Solution The simplest case is when all the chroot environments are equally trusted, that means among many other things that they all have the latest security patches applied. Then you can run them all with the same labels, so every file in the chroot environment will have the same label as it s counterpart in the real root this will mean that for example a user from the real root could run /chroot/bin/passwd and possibly get results you don t desire. But it s generally regarded that the correct thing to do is to have a chroot environment on a filesystem that s mounted nosuid which will deal with most instances of such problems. One thing to note however is that the nosuid mount option also prevents SE Linux domain transitions, so it s not such a good option when you use SE Linux as domain transitions are often used to reduce the privileges assigned to the process. There are two programs for labeling files in SE Linux, restorecon is the most commonly used one but there is also setfiles which although being the same executable (restorecon is a symlink to setfiles) has some different command-line options. The following command on a default configuration of a Debian/Lenny system will label a chroot environment under /chroot with the same labels as the main environment: setfiles -r /chroot /etc/selinux/default/contexts/files/file_contexts /chroot I am considering adding an option to support chroot environments to restorecon, if I do that then I will probably back-port it to Lenny, but that won t happen for a while. For a simple chroot once the filesystem is labelled it s ready to go, then you can start daemons in the chroot environment in the usual way. Less trusted Chroot environments A reasonably common case is where the chroot environment is not as trusted. One example is when you run an image of an old server in a chroot environment. A good way of dealing with this is to selectively label parts of the filesystem as required. The following shell code instructs semanage to add file contexts entries for a chroot environment that is used for the purpose of running Apache. Note that I have given specific labels to device nodes null and urandom and the socket file log in the /dev directory of the chroot environment (these are the only things that are really required under /dev), and I have also put in a rule to specify that no other files or devices under /dev should be labelled. If /dev is bind mounted to /chroot/dev then it s important to not relabel all the devices to avoid messing up the real root environment and it s impractical to put in a specific rule for every possible device node. Note that the following is for a RHEL4 chroot environment, other distributions will vary a little some of the file names. semanage -i << END
fcontext -a -t root_t -f -d /chroot
fcontext -a -t bin_t /chroot/bin.*
fcontext -a -t usr_t /chroot/usr.*
fcontext -a -t usr_t /chroot/opt.*
fcontext -a -f -d /chroot/dev
fcontext -a -f -s -t devlog_t /chroot/dev/log
fcontext -a -f -c -t null_device_t /chroot/dev/null
fcontext -a -f -c -t urandom_device_t /chroot/dev/urandom
fcontext -a -t "<<none>>" "/chroot/dev/.*"
fcontext -a -t "<<none>>" "/chroot/proc.*"
fcontext -a -t lib_t /chroot/lib.*
fcontext -a -t lib_t /chroot/usr/lib.*
fcontext -a -t bin_t /chroot/usr/bin.*
fcontext -a -t httpd_exec_t -d /chroot/usr/bin/httpd
fcontext -a -t var_t /chroot/var.*
fcontext -a -t var_lib_t /chroot/var/lib.*
fcontext -a -t httpd_var_lib_t /chroot/var/lib/php.*
fcontext -a -t var_log_t /chroot/var/log.*
fcontext -a -t var_log_t -f /chroot/var/log/horde.log.*
fcontext -a -t httpd_log_t /chroot/var/log/httpd.*
fcontext -a -t var_run_t /chroot/var/run.*
fcontext -a -t httpd_var_run_t -f /chroot/var/run/httpd.pid
fcontext -a -t httpd_sys_content_t /chroot/var/www.*
END
You could create a shell script to run the above commands multiple times for multiple separate Apache chroot environments. If there is a need to isolate the various Apache instances from each other (as opposed to just protecting the rest of the system from a rogue Apache process) then you could start each copy of Apache with a different MCS sensitivity label which will provide adequate isolation for most purposes as long as no sensitivity label dominates the low level of any of the others. If you do that then the semanage commands require the -r option to specify the range. You could have one chroot environment under /chroot-0 with the sensitivity label of s0:c0 for it s files and another under /chroot-1 with the sensitivity label of s0:c1 for it s files. To start one environment you would use a command such as the following: runcon -l s0:c0 setsid chroot /chroot-0 /usr/sbin/httpd

David Byrne gave an interesting TED talk about how changes to architecture drove changes to musical styles [1]. I think he does stretch the point a little. To a certain extent people develop the most complex instruments and the largest music halls that can be supported by the level of technology in their society people with a hunter-gatherer civilisation play drums because they can build them and can carry them. The NY Times has an interesting article about paternity leave in Sweden [2]. The Swedish government pays for a total of 13 months leave that can be split between parents for every child. Of those 13 months 2 months can only be taken by the father and that is likely to increase to a minimum of 4 months of paternity leave after the next election. Dan Meyer gave an interesting TEDX talk about how the current math curriculum in the US (as well as Australia and lots of other countries that do the same thing) is totally wrong [3]. His main point is that maths problems should be based on real-world use cases where not all needed data is immediately available and there is also useless data that must be discarded. He believes that the most important thing is developing mathematical problem solving skills basically the things that I did for fun when I was in primary school are skills that need to be taught to high-school students The Atlantic magazine has an amusing article by Daniel Byman and Christine Fair about the incompetent Islamic terrorists [4]. In Afghanistan half the suicide bombers kill only themselves and the US government has a lot of evidence of Taliban soldiers practicing bestiality and collecting porn. Islamic extremist groups are staffed by people who are bad soldiers and bad Muslims. Jon Masters wrote an interesting post titled What Would Jesus Buy about ethical purchasing decisions [5]. Jon references The Church of Stop Shopping which isn t a real religious organisation but a street theatre activist group. ZeroHedga has an insightful article comparing corporations and the US government to street gangs [6]. The conclusion is that when gangs take over a neighbourhood everyone has to join a gang for their own protection. Hillel Cooperman gave an interesting TED talk about being obsessed with Lego [7]. He compares Lego fans to Furries and makes a good case for this comparison. Marian Bantjes gave an interesting TED talk about her graphic art / graphic design work [8]. I ve never seen anything quite like this. Business Insider has an interesting article about oil cleanup, it seems that most people who worked on the Exxon Valdez disaster are now dead [9], s opposed to most people who worked in almost every other occupation at that time who are either still working or enjoying their retirement. The current gulf disaster is bigger, will require more workers for the cleanup, and can be expected to have a higher death toll. Some people claim that measures to reduce oil efficiency will impact the economy, how will millions of people who are chronically ill for the rest of their lives impact the economy? The NY Times has an interesting article on circle lenses [10], contact lenses designed to make the eyes look larger. It s illegal to sell contact lenses in the US without a prescription, but the latest trend is for women to buy them online in a variety of colors. The FDA should probably approve them, it would be better to have the quality controls you expect from a medical supply company instead of having people rely on Malaysian mail-order companies for the safety of their eyes. Don Marti has written an interesting article about the economic decline in the US, he suggests making pension funds invest in local jobs [11]. Companies are supposed to act on behalf of their stock-holders, but US companies often have the majority of their stock owned by the pension funds of workers but they act on behalf of a small number of rich people who own a minority of the stock. Don s article was inspired by Andy Grove s article in Bloomberg about the stagnation in technological development that has been caused by off-shoring the manufacturing [12]. Neil Brown has completed a test release of a new Linux software RAID feature for arrays with multiple redundancy that have bad sectors [13]. When a disk gets a bad sector the current behavior is to kick it out of the array, if you have two such errors on a 3 disk RAID-1 or a RAID-6 array then you lose all redundancy and are at risk of catastrophic failure even though in most cases both disks will still mostly work. With this patch some regions of the disk may be excluded but it can provide redundancy for other stripes. Thanks Neil for your great work here, and all your previous work over the last 10+ years! The RSPCA has a new campaign titled Close the Puppy Factories [14]. Dogs are kept in very poor conditions and forced to churn out puppies for their entire lives to supply pet stores. The RSPCA recommends that people buy puppies from registered dog breeders (not registered dog breeding companies ) and ask to see the dog s parents. They also recommend not buying from classified adverts or pet stores. Animal shelters have to euthenise huge numbers of unwanted animals, you can buy a pet dog or cat from an animal shelter for a small fee that covers the expenses related to housing and spaying it and save that animal from being euthenised! Maureen Dowd criticises the Catholic Church properly in an article for the New York Times [15]. The Catholic Church officially regards ordaining a woman and raping a child to be equally bad offenses. Frank Rich wrote an interesting column for the New York Times about Mel Gibson [16]. He describes the destruction of Mel Gibson s reputation as a symptom of changes in the culture in the US and also links it to the fall of Ted Haggard (who supported Gibson s most notorious movie The Passion of the Christ).

• [1] http://www.ted.com/talks/david_byrne_how_architecture_helped_music_evolve.html
• [2] http://www.nytimes.com/2010/06/10/world/europe/10iht-sweden.html
• [3] http://www.ted.com/talks/dan_meyer_math_curriculum_makeover.html
• [4] http://www.theatlantic.com/magazine/archive/2010/05/the-case-for-calling-them-nitwits/8130/
• [5] http://www.jonmasters.org/blog/2010/06/27/what-would-jesus-buy/
• [6] http://www.zerohedge.com/article/guest-post-corporate-entities-modern-day-street-gangs
• [7] http://www.ted.com/talks/hillel_cooperman_legos_for_grownups.html
• [8] http://www.ted.com/talks/marian_bantjes_intricate_beauty_by_design.html
• [9] http://www.businessinsider.com/warning-to-gulf-cleanup-workers-almost-every-crew-member-from-the-1989-exxon-valdez-disaster-is-now-dead-2010-6
• [10] http://www.nytimes.com/2010/07/04/fashion/04lenses.html
• [11] http://zgp.org/~dmarti/business/grove-on-jobs/
• [12] http://www.bloomberg.com/news/2010-07-01/how-to-make-an-american-job-before-it-s-too-late-andy-grove.html
• [13] http://lwn.net/Articles/391208/
• [14] http://www.closepuppyfactories.org/
• [15] http://www.nytimes.com/2010/07/18/opinion/18dowd.html
• [16] http://www.nytimes.com/2010/07/18/opinion/18rich.html

ffmpeg I ve updated my SE Linux repository for Squeeze to include a modified version of the ffmpeg packages without MMX support for the i386 architecture. When MMX support is enabled it uses assembler code which requires text relocations (see Ulrich Drepper s documentation for the explanation of this [1]). This makes it possible to run programs such as mplayer under SE Linux without granting excessive access something which we really desire because mplayer will usually be dealing with untrusted data. In my past tests with such changes to ffmpeg on my EeePC701 have resulted in no difference to my ability to watch movies from my collection, the ones that could be played without quality loss on a system with such a slow CPU could still be viewed correctly with the patched ffmpeg. $ mplayer
mplayer: error while loading shared libraries: /usr/lib/i686/cmov/libswscale.so.0: cannot restore segment prot after reloc: Permission denied The AMD64 architecture has no need for such patches, presumably due to having plenty of registers. I don t know whether other architectures need such patches, they might the symptom is having mplayer abort with an error such as the above when running in Enforcing Mode. The below apt sources.list line can be used to add my SE Linux repository: deb http://www.coker.com.au squeeze selinux dpkg In my repository for i386 and AMD64 architectures I have included a build of dpkg that fixes bug #587949. This bug causes some sym-links and directories to be given the wrong label by dpkg when a package is installed. Usually this doesn t impact the operation of the system and I was unable to think of a situation where it could be a security hole, but it can deny access in situations where it should be granted. I would appreciate some help in getting the patch in a form that can be accepted by the main dpkg developers, the patch I sent in the bug report probably isn t ideal even though it works quite well someone who knows absolutely nothing about SE Linux but is a good C coder with some knowledge of dpkg could beat it into shape. In my repository I don t currently provide any support for architectures other than i386 and AMD64. I could be persuaded to do so if there is a demand. How many people are using Debian SE Linux on other architectures? Of course there s nothing stopping someone from downloading the source from my AMD64 repository and building it for another architecture, I would be happy to refer people to an APT repository that someone established for the purpose of porting my SE Linux packages to another architecture. Policy selinux-policy-default version 20100524-2 is now in Testing. It s got a lot of little fixes and among other things allows sepolgen-ifgen to work without error which allows using the -R option of audit2allow see my post about audit2allow and creating the policy for milters for defails [2]. I have uploaded selinux-policy-default version 20100524-3 to Unstable. It has a bunch of little fixes that are mostly related to desktop use. You can now run KDE4 on Unstable in enforcing mode, login via kdm and expect that everything will work probably some things won t work, but some of my desktop systems work well with it. I have to admit that not all of my desktop systems run my latest SE Linux code, I simply can t have all my systems run unstable and risk outages. Let me know if you find any problems with desktop use of the latest SE Linux code, it s the focus of my current work. But if you find problems with chrome (from Google) or the Debian package chromium-browser then don t report them to me. They each use their own version of ffmpeg in the shared object /usr/lib/chromium-browser/libffmpegsumo.so which has text relocations and I don t have time to rebuild chromium-browser without text relocations I ll make sure it does the right thing when they get it working with the standard ffmpeg libraries. That said the text relocation problem doesn t seem to impact the use of Chromium, Youtube doesn t work even when the browser is run in permissive mode. GNOME is a lower priority than KDE for me at this time. But the only area where problems are likely to occur is with gdm and everything associated with logging in. Once your X session starts up GNOME and KDE look pretty similar in terms of access control. I would appreciate it if someone could test gdm and let me know how it goes. I ll do it eventually if no-one else does, but I ve got some other things to fix first.

• [1] http://people.redhat.com/drepper/selinux-mem.html
• [2] http://etbe.coker.com.au/2010/07/25/audit2allow-r-milter/

FrOSCon 5 - 21./22. August 2010 is approaching rapidly. I m a bit envious at some of the tracks (I mean, really, geocaching (ok, I did the surrounging caches over the last years but still), learning python by means of game programming, etc. really sounds interesting and I know people who could benefit from a non-kids version of that as well) but this year s FrOSCon is nothing for me to curse about either: I managed to get both a booth for The MirOS Project (MirBSD, mksh and other subprojects) as well as one for Waldemar s FreeWRT (although wbx@ if he comes won t join there since he forked his own fork since its conception). Booth staff are, currently: tg@ and bsiegert@ (Developer), gecko2@ (Staff) for MirOS, tg@ and XTaran abe@ (Developer), kimnotyze (Hacker) for FreeWRT. (XTaran will probably be helping Debian/Grml too.) This year, it ll be my job (after 2 years of aptituz) to keep the Altbier-Fraktion watered, I m thinking one crate of Schl sser Alt and one crate of Hannen Alt? Have a look at the Program and don t tell me you won t come! It will rock! (Except there won t be Formorer s Chilli, but that s no reason, there s enough other stuff in manageable distance.) Besides interesting booths and talks, FrOSCon is still looking for helpers who will not only get free entrance but also catering during operation.

Hi Debcamper s and Debconfer s. I am currently coordinating volunteers and can use your help! Here is a list of our current and most pressing volunteer needs. If you are interested in volunteering and know what you would like to do, drop me a line with details. If you are interested in volunteering and are up for anything, drop me a line. If you want to volunteer but can only spare a couple of hours, drop me a line! You can reach me at biella(at)nyu.edu We are most in need of finding help for the front desk and for assisting with the talks (starting/ending on time and fielding questions). This year if you are a coordinator for a track you will be in charge of doing this, so we only need volunteers for non-track talks. Volunteers get a free, volunteer tee-shirt and a huge huge thanks from the orga team who simply cannot do this without you!

Hi Debcamper s and Debconfer s. I am currently coordinating volunteers and can use your help! Here is a list of our current and most pressing volunteer needs. If you are interested in volunteering and know what you would like to do, drop me a line with details. If you are interested in volunteering and are up for anything, drop me a line. If you want to volunteer but can only spare a couple of hours, drop me a line! You can reach me at biella(at)nyu.edu We are most in need of finding help for the front desk and for assisting with the talks (starting/ending on time and fielding questions). This year if you are a coordinator for a track you will be in charge of doing this, so we only need volunteers for non-track talks. Volunteers get a free, volunteer tee-shirt and a huge huge thanks from the orga team who simply cannot do this without you!

The unofficial rc bug tracker currently knows about the following bugs:

In Total:	446
Affecting Squeeze:	348
Squeeze only:	62
Remaining to be fixed in Squeeze:	286

Of these 286 bugs, the following tags are set:

Pending in Squeeze:	18
Patched in Squeeze:	48
Duplicates in Squeeze:	36
Contrib or non-free in Squeeze:	12
Claimed in Squeeze:	2
Delayed in Squeeze:	7
Can fixed in a security Update:	23
Otherwise fixed in Squeeze:	36

Ignoring all the above (multiple tags possible), 152 bugs need to be fixed by Debian Contributers to get Debian 6.0 Squeeze released. However, with the view of the Release Managers, 250 need to be dealt with for the release to happen. Please see my older post for an explanation of the different numbers.

Like one or two years ago, I got myself a free Dropbox account. I use it occasionally to exchange files with some friends. It does an excellent job at that. Basically, it works like any network folder. Except it is not within a local network, but over the internet.Dropbox serves me as an occasional replacement for both email and USB pen drive. Instead of sending a modified file by email or bringing around a dozen of photos on a USB stick, I just put them into the shared folder. This also very useful for files such as flyers, templates. They may easily grow to big to be sensibly sent by email.For all my use, a regular free Dropbox account is more than enough. As in, I have less than 1 GB in use, and I could easily free some of that space. You start at 2 GB, and can currently get up to 10 GB free (+250 MB for each referrer; if you use the link above you'll already start at 2.25 GB). But for my use, this is already a lot.Note that there are a couple of alternatives around. For Linux (only) there is Ubuntu One, and there is Zumo Drive and Box.net just to name a few. I havn't tried them, given that Dropbox works for me well enough.

I saw an article on Wired today: The Lost Tribes of RadioShack. It is well worth the read even if you re not into electronics. A key quote:

[H]is shop is a lone outpost; in a single generation, the American who built, repaired, and tinkered with technology has evolved into an entirely new species: the American who prefers to slip that technology out of his pocket and show off its killer apps. Once, we were makers. Now most of us are users.

I remember as a kid eagerly awaiting each year s new RadioShack catalog. I d read them pretty much cover to cover for fun. And who wouldn t? The catalogs had fun things like radios, telephone gadgets, calculators, tape recorders, electronic lab kits , books, components, LEDs I loved the catalogs and loved the store. My parents bought me a electronic kit (if memory serves 20 years later, it s the deluxe 160-project electronic kit from page 156 of the 1988 catalog, though it may have been purchased a different year). I had endless fun with that thing. It had resistors, diode, capacitors, oscillator, speaker, LED, relay, etc plenty to make a bunch of kid-friendly projects. Just looking at the catalog makes me excited even today. On the next page from the kit I had is a $5 crystal radio kit which needs no power source Solderless. With earphone, instructions, theory. On page 28 there was a revolving red light, and some microcassette recorders on p. 36 (I had one of those for awhile). I had enthusiasm for building and figuring out things for a long time. My dad let me take apart an old lawn mower for fun once I m sure he knew ahead of time it would never be back together. One of his friends from work built homemade contraptions out of things like an old vacuum cleaner (attach a cardboard tube to the exhaust and you get a great tennis ball shooter). And there was always all sorts of fun junk to discover up in the barn. I eventually shifted to a different sort of making things : programming. It has kept me busy for quite a number of years. But the Wired article has a point. RadioShack is struggling. Many people have no interest in making or fixing things anymore. The best-selling smartphone in the world comes sealed in a metal case where not even the battery can be replaced, the software is dictated by a company in California, and good luck trying to program for it without signing your life away first. A far cry from the first computer I used, a TRS-80 Color Computer II, bought, yes, at RadioShack. Turn it on, and in a few seconds you get a BASIC prompt. Can t really use it without programming. Being able to read its manual was an early motivation for me to work at learning to read. It is sad that so many devices can t be worked on anymore, and that so many people don t care. It is difficult for me to give Jacob (and later, Oliver) the sort of experience I had as a child. Companies would love to sell us $50 DVD sets, $300 educational game systems, $40 educational games, and any number of $30 plastic toys (some of which we have and the boys enjoy). I d rather give him a $10 bag of resistors, capacitors, wire, battery holders, LEDs, and a book, and see what he can come up with (when he s a bit older, of course). And, in fact, he and I built his first computer together. We installed the ultimate in operating systems for tinkering: Linux. This all brings me back to RadioShack. I ve been working on ham radio lately, with an eye to that being a project for Jacob (age 3.5), Oliver (just turned 1), and me to enjoy in the future. I needed some cable, and had been told by many people to visit the RadioShack in Derby, KS. It s like the one mentioned in the Wired article: huge, selling everything from washing machines to bulk cable, except this one specializes in amateur radio. I asked Jacob if he would like to come with me to a radio store. Dad, I would LOVE that! He brought his little semi-broken walkie-talkies with him to use during the hour drive there. At one point, he was concerned that a radio store is like a library and he might have to leave them on a shelf. I assured him he could keep them. We got to the RadioShack and he loved it. He couldn t even really contain his excitement. He ran back and forth along the bright green stripe running down the middle of the carpet. He excitedly watched them measure out 60ft of RG-8 coax for me. He pushed buttons on the demo clothes dryer, looked at all the antennas, and just had a great time. And he s been interested in my radio, too. When I was talking to somebody on it the other day, he said, I think he is at the radio store. He is having fun there. Right now, everybody I talk to on the radio is at the radio store to him. Jacob loves the fact that the backlight on my FT-857D can change colors, and often comes into the office just so I can put it into setup mode and let him spin the big wheel to change the colors. He enjoys opening boxes of components, and came out to help (and run around) while I suspended a dipole from some trees last Friday. I had told Jacob when we got to the store that This radio store is called RadioShack. He obviously took that to heart, because now if he hears me talking about a radio store , he will say, Dad, actually it is radio SHACK. So I say thank you to the Derby RadioShack for keeping the magic of making things with your dad alive for another generation.

Well, I suppose I should be happy that mksh is actually used

• [tg] Correct shf buffer I/O routines to avoid a memory corruption bug discovered by Waldemar Brodkorb and other bad effects
• [tg] Fix NULL pointer dereference during iteration loop when checking for alias recursion; discovered by Michal Hlavinka

That s OpenADK (Waldemar s fork of FreeWRT, which is Waldemar s fork of OpenWrt), and Red Hat Enterprise Linux, respectively. Popcon in Debian and its derivates is also pleasant. I could use some help bugfixing this though:

	(sleep 3; exit 12) &
	bgprocpid=$!
	sleep 6
	# background process is done by now
	wait $bgprocpid
	# POSIX mandates that, since $! was asked
	# for, wait is to reply its errorlevel

Somehow, JF_KNOWN is never set and I can t debug this with gdb(1). (There s also a dashism in some *buntu start scripts that does pretty much the same except it uses wait %1 there. In fact it doesn t even seem to use $! no idea whether we can support that at all in a POSIX shell which dash clearly isn t without keeping track of background processes forever.)

As part of the 11th Debian Conference in New York City, USA, there will be OpenPGP (pgp/gpg) keysignings. If you intend to participate in the DebConf10 keysignings, please send your ascii armored public key as explained no later than Tuesday 20th of July, 2010 at 23:59 UTC. If your mail to anibal@debian.org cannot get through, send it to anibal at v7w dot com but first try the debian.org email address, please. More (and up-to-date) information is available so keep watching that page. An bal Monsalve Salazar and the DebConf team

We've got a fairly layered set of software that runs beneath our file systems: RAID1 followed by cryptsetup, followed by lvm. It works remarkably well. However, when it's time to do something like enlarge a partition or disk, it gets complicated. We have a server (hubert) that was running two 1 TB disks in a RAID1. We typically create two partitions: one small boot partition and one large partition the uses the rest of the available disk (with 2 TB disks we've added a third partition for grub). Last month I replaced one of the disks with a 2 TB disk, partitioned the new disk with similar a partition scheme (except that the "rest of the disk" partition was twice the size as the original one), and then added the new partitions to the RAID (mdadm /dev/md0 --add /dev/sda1; mdadm /dev/md1 --add /dev/sda2). Yesterday, I replaced the 2nd 2 TB disks, and again added the new partitions. The result was a fairly painless transition from 1 to 2 TB disks with minimal downtime. The problem - though - is that we're not using all the disk space available, since md1, the RAID array that uses the "rest of the disk" partition, is only about 1 TB when it should be just under 2 TB. That problem was easy enough to solve by growing the RAID device with:

mdadm -G /dev/md1 -z max

It took a while, but eventually, running:

cat /proc/mdstat

And

cat /proc/partitions

Reported the right sizes for md1. After RAID, comes cryptsetup (/dev/md1 is the source device for md1_crypt). So, the next command was:

cryptsetup resize md1_crypt

In the output of:

cat /proc/partitions

I saw the change reflected in the dm-0 device. Since md1_crypt is used as the physical volume for a volume group, the next step was to resize the physical volume:

pvresize /dev/dm-0

This change was reflected with:

pvs

Now, the command:

vgs

Displayed a full 931 GB available that wasn't there before. Next up: resizing the logical volume:

lvresize --size 1700GB vg_hubert0/blanco_members

And, last but not least, was the file system:

 resize2fs /dev/mapper/vg_hubert0-blanco_members

See also dkg's article on resizing crypt partitions.

I spent the last two days at the BSP in Munich thanks to everyone for inviting & feeding me, & especially to Stefan for hosting me again!

Unfortunately the weather was not good enough for an excursion to a Biergarten but the local chefs at the LiMux office delighted us with self-made spaghetti salmone & self-rolled sushi, & we spent quite some time behind our laptops.

The main results can be seen on the wiki page; my personal conclusion is that the list of remaining RC bugs contains mostly "hard stuff" (e.g. architecture-, hardware-, or desktop-specific bugs). Probably some packages will need to be kicked out of squeeze & some bugs might get a squeeze-ignore tag ... To put it positively: I have a gut feeling that the freeze is getting closer :)

This is a followup on my previous work on merging all the computer related LDAP objects in Debian Edu. As a step to try to see if it possible to merge the DNS and DHCP LDAP objects, I have had a look at how the packages pdns-backend-ldap and dhcp3-server-ldap in Debian use the LDAP server. The two implementations are quite different in how they use LDAP. To get this information, I started slapd with debugging enabled and dumped the debug output to a file to get the LDAP searches performed on a Debian Edu main-server. Here is a summary. powerdns Clues on how to set up PowerDNS to use a LDAP backend is available on the web. PowerDNS have two modes of operation using LDAP as its backend. One "strict" mode where the forward and reverse DNS lookups are done using the same LDAP objects, and a "tree" mode where the forward and reverse entries are in two different subtrees in LDAP with a structure based on the DNS names, as in tjener.intern and 2.2.0.10.in-addr.arpa. In tree mode, the server is set up to use a LDAP subtree as its base, and uses a "base" scoped search for the DNS name by adding "dc=tjener,dc=intern," to the base with a filter for "(associateddomain=tjener.intern)" for the forward entry and "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry. For forward entries, it is looking for attributes named dnsttl, arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord, srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord, ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord, spfrecord and modifytimestamp. For reverse entries it is looking for the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord, naptrrecord and modifytimestamp. The equivalent ldapsearch commands could look like this:

ldapsearch -h ldap \
  -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
  -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
  cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
  rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
  nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
  rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
ldapsearch -h ldap \
  -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
  -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
  dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
  hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
  srvrecord naptrrecord modifytimestamp

In Debian Edu/Lenny, the PowerDNS tree mode is used with ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two example LDAP objects used there. In addition to these objects, the parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no also exist.

dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
objectclass: top
objectclass: dnsdomain
objectclass: domainrelatedobject
dc: tjener
arecord: 10.0.2.2
associateddomain: tjener.intern
dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
objectclass: top
objectclass: dnsdomain2
objectclass: domainrelatedobject
dc: 2
ptrrecord: tjener.intern
associateddomain: 2.2.0.10.in-addr.arpa

In strict mode, the server behaves differently. When looking for forward DNS entries, it is doing a "subtree" scoped search with the same base as in the tree mode for a object with filter "(associateddomain=tjener.intern)" and requests the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord, naptrrecord and modifytimestamp. For reverse entires it also do a subtree scoped search but this time the filter is "(arecord=10.0.2.2)" and the requested attributes are associateddomain, dnsttl and modifytimestamp. In short, in strict mode the objects with ptrrecord go away, and the arecord attribute in the forward object is used instead. The forward and reverse searches can be simulated using ldapsearch like this:

ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
  '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
  cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
  rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
  nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
  rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
  '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp

In addition to the forward and reverse searches , there is also a search for SOA records, which behave similar to the forward and reverse lookups. A thing to note with the PowerDNS behaviour is that it do not specify any objectclass names, and instead look for the attributes it need to generate a DNS reply. This make it able to work with any objectclass that provide the needed attributes. The attributes are normally provided in the cosine (RFC 1274) and dnsdomain2 schemas. The latter is used for reverse entries like ptrrecord and recent DNS additions like aaaarecord and srvrecord. In Debian Edu, we have created DNS objects using the object classes dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS attributes) and domainrelatedobject (for associatedDomain). The use of structural object classes make it impossible to combine these classes with the object classes used by DHCP. There are other schemas that could be used too, for example the dnszone structural object class used by Gosa and bind-sdb for the DNS attributes combined with the domainrelatedobject object class, but in this case some unused attributes would have to be included as well (zonename and relativedomainname). My proposal for Debian Edu would be to switch PowerDNS to strict mode and not use any of the existing objectclasses (dnsdomain, dnsdomain2 and dnszone) when one want to combine the DNS information with DHCP information, and instead create a auxiliary object class defined something like this (using the attributes defined for dnsdomain and dnsdomain2 or dnszone):

objectclass ( some-oid NAME 'dnsDomainAux'
    SUP top
    AUXILIARY
    MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
          DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
          TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
          NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
          A6Record $ DNAMERecord
    ))

This will allow any object to become a DNS entry when combined with the domainrelatedobject object class, and allow any entity to include all the attributes PowerDNS wants. I've sent an email to the PowerDNS developers asking for their view on this schema and if they are interested in providing such schema with PowerDNS, and I hope my message will be accepted into their mailing list soon. ISC dhcp The DHCP server searches for specific objectclass and requests all the object attributes, and then uses the attributes it want. This make it harder to figure out exactly what attributes are used, but thanks to the working example in Debian Edu I can at least get an idea what is needed without having to read the source code. In the DHCP server configuration, the LDAP base to use and the search filter to use to locate the correct dhcpServer entity is stored. These are the relevant entries from /etc/dhcp3/dhcpd.conf:

ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
ldap-dhcp-server-cn "dhcp";

The DHCP server uses this information to nest all the DHCP configuration it need. The cn "dhcp" is located using the given LDAP base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))". The search result is this entry:

dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
cn: dhcp
objectClass: top
objectClass: dhcpServer
dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no

The content of the dhcpServiceDN attribute is next used to locate the subtree with DHCP configuration. The DHCP configuration subtree base is located using a base scope search with base "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" and filter "(&(objectClass=dhcpService)( (dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))". The search result is this entry:

dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
cn: DHCP Config
objectClass: top
objectClass: dhcpService
objectClass: dhcpOptions
dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
dhcpStatements: ddns-update-style none
dhcpStatements: authoritative
dhcpOption: smtp-server code 69 = array of ip-address
dhcpOption: www-server code 72 = array of ip-address
dhcpOption: wpad-url code 252 = text

Next, the entire subtree is processed, one level at the time. When all the DHCP configuration is loaded, it is ready to receive requests. The subtree in Debian Edu contain objects with object classes top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions, top/dhcpSubnet, top/dhcpGroup and top/dhcpHost. These provide options and information about netmasks, dynamic range etc. Leaving out the details here because it is not relevant for the focus of my investigation, which is to see if it is possible to merge dns and dhcp related computer objects. When a DHCP request come in, LDAP is searched for the MAC address of the client (00:00:00:00:00:00 in this example), using a subtree scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet 00:00:00:00:00:00))" as the filter. This is what a host object look like:

dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
cn: hostname
objectClass: top
objectClass: dhcpHost
dhcpHWAddress: ethernet 00:00:00:00:00:00
dhcpStatements: fixed-address hostname

There is less flexiblity in the way LDAP searches are done here. The object classes need to have fixed names, and the configuration need to be stored in a fairly specific LDAP structure. On the positive side, the invidiual dhcpHost entires can be anywhere without the DN pointed to by the dhcpServer entries. The latter should make it possible to group all host entries in a subtree next to the configuration entries, and this subtree can also be shared with the DNS server if the schema proposed above is combined with the dhcpHost structural object class. Conclusion The PowerDNS implementation seem to be very flexible when it come to which LDAP schemas to use. While its "tree" mode is rigid when it come to the the LDAP structure, the "strict" mode is very flexible, allowing DNS objects to be stored anywhere under the base cn specified in the configuration. The DHCP implementation on the other hand is very inflexible, both regarding which LDAP schemas to use and which LDAP structure to use. I guess one could implement ones own schema, as long as the objectclasses and attributes have the names used, but this do not really help when the DHCP subtree need to have a fairly fixed structure. Based on the observed behaviour, I suspect a LDAP structure like this might work for Debian Edu:

ou=services
  cn=machine-info (dhcpService) - dhcpServiceDN points here
    cn=dhcp (dhcpServer)
    cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
      cn=10.0.2.0 (dhcpSubnet)
        cn=group1 (dhcpGroup/dhcpOptions)
    cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
      cn=192.168.0.0 (dhcpSubnet)
        cn=group1 (dhcpGroup/dhcpOptions)
    ou=machines - PowerDNS base points here
      cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)

This is not tested yet. If the DHCP server require the dhcpHost entries to be in the dhcpGroup subtrees, the entries can be stored there instead of a common machines subtree, and the PowerDNS base would have to be moved one level up to the machine-info subtree. The combined object under the machines subtree would look something like this:

dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
dc: hostname
objectClass: top
objectClass: dhcpHost
objectclass: domainrelatedobject
objectclass: dnsDomainAux
associateddomain: hostname.intern
arecord: 10.11.12.13
dhcpHWAddress: ethernet 00:00:00:00:00:00
dhcpStatements: fixed-address hostname.intern

One could even add the LTSP configuration associated with a given machine, as long as the required attributes are available in a auxiliary object class.

The daemon feature of Emacs is great. But when should the daemon be started? At one time I used an '@reboot' line in my crontab. But when you want to use things like Tramp mode (for editing files on remote servers transparently), you very quickly wish that emacs could talk to your ssh-agent. So if you accept that you will be running a desktop environment (not always true), you can add the daemon to your equivalent of "System >> Preferences >> Startup Programs". But then you find that Flymake (when used with cperl-mode) is not picking up any of your uninstalled, work-in-progress Perl modules. Wouldn't it be great if you could set $PERL5LIB to fix this? And doesn't M-x copyright require you to set "$ORGANIZATION"? Ever since Debian bug #411639 was fixed at the end of 2007, we have the option of "~/.xsessionrc" for setting environment variables that will cover everything in your desktop session, including things launched from panels and startup scripts. So now that's what I do. But I've yet to figure out a good equivalent for console-only systems. Maybe I don't need one?

Yesterday some confusion arised on my side when I saw a new facebook advertising campaign in my facebook account (yes, I am a member of facebook, although I'm aware of the privacy concerns). Basically it was saying that I should try the friends finder and that some of my friends (showing and naming me three of them) would have used it already.

Some background:
The friends finder feature of facebook is a feature that asks for the password of your e-mail account. It will then crawl through your emails to find contacts that might already be on facebook but not connected to you (in a facebook sense).

My first feeling was: Oh my god. How can it be that friends (and family) of mine are so naive? Especially since there were people included which I consider to be quiet clever. But honestly: Who would be so naive to give an unknown company direct unsupervised (you can't tell what they really do) access to your mail account? Would you give it to your friend? Your husband? Your father? I guess the answer will be "No" in the most cases and these people are most likely people you trust. Well, I know, you could state similar things for Googlemail who crawl your mails to show you personalized advertising. And in fact you are right. But if one decides to use gmail for your email hosting you have to trust them anyway. Like you have to trust anybody else you retain to host your mails (who could do the same but just don't tell you). But in this case its a third party, Facebook.

But if you now think that this becomes a rant against my friends: You are wrong. Over the day I found out that it basically shows up all my friends in a rotation. Every time I open the start page it randomly picks three people from my friend list and shows them to me, telling the same lie to me all over again.

So what do we have here? Facebook tries to advertise the most dubious feature they have in the most aggressive way one could imagine. By pretending wrong facts. Wouldn't that even be an element of crime in Germany ("Irref hrung" 5 UWG or maybe also 4 UWG, "unsachliche Beeinflussung")?

Facebook, you can do better.

Update: Stefano raised a good point. I didn't actually make clear that it has been verified that those people actually did not use the "feature":

1. I asked some of them. They said, they didn't use it and were in fact surprised that I asked.
2. Others told me they saw that ad stating that I used the feature. I definitely did not use this "feature".
3. Probably weak: IMHO its highly unlikely that all of my friends used that feature and at the point I've written this it had already shown my whole friend list.

The unofficial rc bug tracker currently knows about the following bugs:

In Total:	476
Affecting Squeeze:	377
Squeeze only:	71
Remaining to be fixed in Squeeze:	306

Of these 306 bugs, the following tags are set:

Pending in Squeeze:	16
Patched in Squeeze:	46
Duplicates in Squeeze:	37
Contrib or non-free in Squeeze:	13
Claimed in Squeeze:	3
Delayed in Squeeze:	7
Can fixed in a security Update:	29
Otherwise fixed in Squeeze:	27

Ignoring all the above (multiple tags possible), 171 bugs need to be fixed by Debian Contributers to get Debian 6.0 Squeeze released. However, with the view of the Release Managers, 279 need to be dealt with for the release to happen. Please see my older post for an explanation of the different numbers.