Search Results: "pm"

15 December 2006

Ian Murdock: Reunited Package Manager

Max Spevack: “The Fedora Project is leading the creation of a new community around RPM. One in which the leaders can come from Fedora, from Red Hat, from Novell, from Mandriva, or from anywhere.”

13 December 2006

Uwe Hermann: Free Ryzom Campaign now supported by the FSF [Update]

The Free Ryzom Campaign that I have mentioned earlier is now officially supported by the Free Software Foundation with a donation pledge of $60.000 (which now makes a total of ca. 134.000 Euros together with the contributions by many other people).
The Free Ryzom campaign was established to purchase the online game and universe known as Ryzom, property of the now bankrupt Nevrax company, and release the entire game as free software. As stated by Peter T. Brown, Executive Director of the Free Software Foundation, the FSF considers the Free Ryzom campaign "a high priority project for the free software movement". The aim of the campaign is to publish the source code to the entire game under the terms of the
widely-used GPL, as well as publishing all of the artwork and other content under similar free licenses. The Free Ryzom campaign represents a unique opportunity for the free software movement and the emerging free gaming field. A fully free MMORPG (massively multiplayer online roleplaying game) engine and client/server architecture would allow the development of a myriad of universes, each one evolving its own philosophy and unique content - but sharing in general technical improvements. If successful, this campaign would allow any user to create their own universe and produce their own content based on the Ryzom/Nevrax architecture.
The new goal is now to reach 200.000 Euros in order to increase chances to convince the judge to choose the Free Ryzom project as the new owner of the code and game data.
Pledges must be made within the next few days, since the deadline for the final bid is expected sometime before Wednesday, December 19th, depending on when the judges make their decision.
Good luck to the project! Update 2006-12-14: Fix the numbers (Euro vs. Dollar messup). Thanks Ward Vandewege!

Amaya Rodrigo: Sexism at FLOSS Conferences

07 Dec 2006, at the Open Source Developers Conference in Melbourne, at a lightning talk session, quoting Why there s few women in IT, at Richard Jones blog:

The conference last week was educational for the committee in a way that was completely unexpected:

Observation 1: During one of the lightning talks a presenter put some porn up on the big screen. He was peripherally discussing a Perl module called Acme::Playmate (which basically looks up Playmate info on the playboy playmate directory).

We (the committee) had never thought it would be necessary to have to explicitly say that it s not OK to put up porn. Or that we d have to actively discourage discussing a module that would clearly offend members of the audience.

Observation 2: I was amazed that Acme::Playmate exists in (and is blessed by) CPAN.

I spoke before the keynote the next day apologising to the attendees and our sponsors for what had happened.

Observation 3: Some attendees thought that we had overreacted by even saying anything.
At least one woman walked out the conference. The next morning, the organisers apologised to the attendees and their sponsors for the images.

You can read more, including the guy s name at Mary Gardiner's blog entry. Quoting:

I gave a 5 minute lightning talk at OSDC entitled Women in FOSS groups [...]. It was mostly an attempt to jam Adam Kennedy s lightning talk about Acme::Playmate, which featured lingerie shots of women (and maybe topless shots, I didn t want to watch it [...]). So mine featured pictures of women, fully clothed, with labels like Linux user and AI researcher.

I still wonder where the slides from the Debian ftp-masters s talk at Debconf 3 are available from, because of the technical content of the slides was good, only the way it was presented made this ftp-master team like a boys-only club where no women would ever belong. Because it made me want to walkout, but instead I stayed there and almost cried. Update: I found the slides.

Of course, this was 2003, it is all forgotten and forgiven, and Debian, including the speakers that gave this talk, has really changed since The Debian Women Project was started in Brazil, 2004. And I mean really changed. Even the ftp-masters scripts named after Elmo s Angels were renamed in the latest Dak release (look for What does each script do at The DebianEdu ftpmaster-Howto for the cuties names). I am no longer bitter about this. I am even happy it happened because it indeed motivated me to start the whole flamewar, as it even came up on Debian Weekly News - March 9th, 2004.

<peterS> Amaya: as Lincoln once said to Harriet Beecher Stowe: so you re the little woman who started this big war   (/me refers to the now famous -vote thread)

While I sometimes think Debian Women died from success, stories like this remind me why Debian Women is still needed and useful.

12 December 2006

Biella Coleman: The Moose is On the Loose and a little Usenet History

So I am back to le study of le hackers, trying to write a super-secret paper that I will present in January and then of course I am back with and to my beloved book (which for now has the following title: “Freedom’s Pleasures: Hacker Practice And The Limits of Liberalism” but I am sure it will morph, endlessly). As part of my transition I just finished re-reading one of my favorite articles on the history of Usenet: If I want it, it s OK: Usenet and the (outer) limits of free speech by B. Pfaffenberger (available here for download. When I released one of my dissertation chapters where I addressed the phenomenon of the Cabal, Bryan was nice enough to write me and point me to his article, which also examines the existence of Backbone Usenet Cabal. The artile, which provides just the right mix of history and commentary, analyzes how a free speech ethic came to be valued on Usenet and the ways in which technological and social factors co-mingled to facilitate and dampen the free flow of expression. You are provided with classic Usenet quotes like:
Usenet is like a herd of performing elephants with diarrhea–massive, diffi-
cult to redirect, awe-inspiring, entertaining, and a source of mind-boggling
amounts of excrement when you least expect it. (Spafford, 1993b)
You learn about the early attempts to control spam by the likes of “CancelMoose:”
In 1995, a secret, shadowy figure known as the CancelMoose
devised a spam-canceling program called a cancelbot.”
And then in the end, he provides his challeng to one of the dominant STS theories of the time, SCOT: “It should be noted that this picture is at odds with the predictions of the social construc-
tion of technology (SCOT) theory (Pinch & Bijker, 1987), in which the outcome of a period
of technical controversy is ascribed solely to social factors. Underlying SCOT s dogmatism
is a justifiable aversion to technological determinism, the doctrine that a technology s con-
tent leads irresistably to predictable social consequences a doctrine that is simply the re-
verse of SCOT s insistence on social causation. Two wrongs, as we were taught in kinder-
garten, do not make a right. What we see in the history of Usenet is a contingent outcome
that is shaped neither exclusively by social nor by technical factors, but rather is best under-
stood as a long process in which contesting groups attempt to mold and shape the technol-
ogy to suit their ends sometimes successfully, and sometimes not. They are as likely to be
blindsided by technological developments as they were to succeed in changing the system
to meet their ends. As this article attests, it is one thing to create new technologies with a
coherent social vision, and it is quite another to control the way it grows and develops.” I could not agree with him more. I think what he is highlighting is that if we dip into the historical record, we have instances in which technology can trump the social and vice-versa (and often instead it is a co-mixture), so in the end, understanding the impact of technologies is less about theories of technology and more of a historical question…

Evan Prodromou: 20 Frimaire CCXV

Do you want to know a word I don't like? Of course you do. Why would you be reading my blog if you weren't interested in my trivial impressions and conceits? The word I don't like is crowdsourcing. It's a snappy little business term for opening up your information-development processes -- like software, documentation, or other text -- and letting the hoi polloi do all your work for you. As opposed to outsourcing, you don't have to pay these suckers; they'll do the work for free! So say the crowdsourcing advocates. I don't like the term because from the crowdsourcing point of view the generous, altruistic action on the part of contributors becomes a clever exploitation on the part of the platform provider. People don't contribute to Open Source software, wikis, or other Open Content projects because they're dumb. They do it because they have skills, experience and information that they want to share with their neighbor. Of course, I think it would be pretty cool if companies used crowdsourcing for some of the tasks they've been outsourcing in previous years. Like, say, if the 1-800 telephone support number for a company didn't go to a call centre in Moncton but instead multiplexed out to other customers' home phones. Or if everyone who bought a shirt from the Gap had to also spend a few minutes at the sewing machine making purses. I hope this terms goes the way of other marketing and Web jargon. tags:

11 December 2006

Edd Dumbill: Afraid of the POX?

The other day I had was tinkering with that cute little poster child of Web 2.0, Flickr. Looking for a lightweight way to incorporate some photos into a web site, I headed to their feeds page to find some XML to use.Before you read on, don't forget that the XTech 2007 call for participation ends this week. The result was interesting. Flickr have a variety of outputs in RSS dialects, but you just can't get at the raw data using XML. The bookmarking service del.icio.us is another case in point. My friend Matt Biddulph recently had to resort to screenscraping in order to write his tag stemmer, until some kind soul pointed out there's a JSON feed.Both of these services support XML output, but only with the semantics crammed awkwardly into RSS or Atom. Neither have plain XML for public consumption (some is available behind a registration protected API), but do support serialization via other formats. We don't really have "XML on the Web". We have RSS on the web, plus a bunch of mostly JSON and YAML for those who didn't care for pointy brackets.Did we as supporters of XML get it wrong somehow? I think we did. The success of the XML project and the W3C as a unifying forum was seductive, and we felt more bound to the edicts of the W3C than we thought. Our justified love of open standards inadvertently promoted a straitjacketed approach to using XML. XML was felt to need a schema language.What we missed was that settling on schemas for data serialization represented much more of an up-front commitment than most developers could really make. The rise of agile programming techniques further emphasizes the hazards of prematurely freezing a design.Schemas never really came with great evolution or migration strategies.
And of course it didn't help that both DTDs and W3C XML Schema are pretty darn obscure. Somehow we never got the word out, despite the "standalone" XML declaration, that it's OK to spread schema-less XML around.We had of course the Simple XML movement, but it came to little. Other voices pointed the way forward. Walter Perry notably promoted an agenda that required little a priori agreement between communicators, but it gained little ground in common thought. Ironically it took James Clark to push the agenda of developer convenience, with the RELAX NG compact syntax giving us all permission not to think in angle brackets.Meanwhile, busy developers with work to do on the web have created non-XML syntaxes such as JSON and YAML. Though I deliberately closeted myself in XML for a long time, I have come to appreciate the utility of these syntaxes.One of the more intriguing developments is that the Semantic Web crowd, while still very much W3C oriented, have really proved themselves more flexible in their attitude than the XML world at large. RDF/XML is hardly the only acceptable way to approach the throne of Tim, and the man himself threw out XML syntax pretty early on with the development of the N3 scribble format. More recently, the work on GRDDL to scrape semantics from HTML has shown the semweb folks' amenability to outside initiatives such as microformats.Maybe it's not such a bad world, as making an XML mapping of YAML, JSON and friends isn't really very hard. I'd just like to get the message out to web application developers that Plain Old XML is fine by me. I live in hope yet that the rise of REST will hit this home.So while markup has most definitely won on the web, it's a shame XML hasn't yet achieved as much as it could. It's not too late for an injection of pragmatism and a little less constraint.

Joachim Breitner: DeCaf taking on form

A few month ago, I blogged a way to spread Free Software effectively, especially in developing countries: By deploying Free Software in internet caf s, where most people learn their way around computers. Most of them (and there are a lot, much more than in Europe) have a buisness plan that relies on software for free, but currently they achieve that through pirating Windows and software like Cybercafe Pro. Back than, I wrote this more or less theoretically, but it happend that I ended up having some time to actually start working on it.While Free Software, especially Debian, provides a very good base to build internet caf s from, one key component is more or less missing: Software to hand out these codes ( timecodes ) to the customer, to let them log in and surf for the time they bought. Very recently, Zybacafe was released, but I did not really like it, nor felt like maintaining a Pascal/Lazarus based Debian package. So I went ahead and implemented my own ideas.The Idea is to keep it very simple, very modularized and integrate deeply with normal unix ideas. So what we have now is a PostgreSQL database (one table so far), and all communication just goes via this table, so we don t have to design or implement complicated protocols. A python gtk application for the front desk generates the timecodes that are then, on paper, passed to the customer. The workstations greet the user with standard GDM, but our pam modules authenticates the timecode instead of a username/password pair. While using the system, a small floating window informs the user about the remaining time. If he does not log out voluntarily, a system daemon will kill all his processes eventually.The long term mission is to form that into a Custom Debian Distribution that will install the server hassle-less, and besides being pre-configured for the internet caf s needs, also immediately serves as an automated installation server for the workstations (think FAI), all useing stock Debian packages, as far as possible. Another pam module could, upon login, mount the homedirectory as a copy-on-write overlay of a template user s home directory, and through away the changes afterwards. The goal is to offer easier installation, less maintenance, better robustness and more flexibility than the current common non-free systems.But, of course, this project needs help. First of all: Users! If you have any use for time-limited logins (Internet caf , school surf terminaly, parents with otherwise not to bed going kids), you can be an earliy adaptor. Developers are very welcome as well, and due to the modular structure, cooperation should be quite smooth.The development happens on alioth, where we have the subversion repositry, as well as on the Debian wiki page. Alpha packages for these components can be found on the alioth group s webspace. We do not have a mailing list yet, but feel free to e-mail me. We will set up a mailing list once there is a need for it. Thank s to the KACE for supporting this.

10 December 2006

Daniel Baumann: Kernel Modules Packaging

Kernel Modules Almost all drivers for Linux are maintained within the Linux Kernel Project. But some drivers are maintained outside in seperate projects. We distinguish between two kind of drivers. Conglomeration Packages From the user point of view, out-of-tree modules are not ideal. Although it is very easy to build the binary module packages for a driver, they require to have their build dependencies installed. This would be acceptable on a development machine, but not on a client. Therefore, some module maintainers started to build the binary modules for every kernel image available in Debian, so users can just apt-get install those prebuild packages. From the archive point of view, this is a mess. While the distribution is under development, every new kernel release and every kernel ABI bump requires a rebuild of all out-of-tree modules, resulting in new binary packages and hence NEW queue spamming for the ftp-master team. While the distribution is in maintenance after beeing released as stable, point releases suffer from this too, making it a major pain in the ass for the security team. The solution: conglomeration packages. Conglomeration packages are empty packages depending on a given set of $ driver -source packages and only building the binary modules out of them. This way, the NEW queue spamming is limited to one single source package for each new kernel release or kernel ABI bump (actually three of them: linux-modules-extra-2.6 for main, linux-modules-contrib-2.6 for contrib, and linux-modules-nonfree-2.6 for non-free). Status in Etch The conglomeration package for the modules of main is maintained by the kernel team. For contrib and non-free, I needed to take care about them myself. Fortunately, they were accepted two days ago, so there is enough time left to let them properly migrate to testing. Module Maintainers please join I can only speak for contrib and non-free: If you are a module maintainer and the license terms of your module do allow binary redistribution and auto-building, you are heartily invited to join the conglomeration package. Please submit a wishlist bug report against the respective conglomeration package, or, feel free to contact me directly if you have any questions.

Ross Burton: Devil's Pie in Fedora

Sebastian Vahl just mailed me to say that he has packaged Devil's Pie for Fedora Core (5, 6, and development) in Extras. Thanks Sebastian!

Russell Coker: The Squirrel and the Grasshopper

There's a story going around the neo-con blogs titled "The Squirrel and the Grasshopper". It was forwarded to me by a business associate with the claim that it's "right on the money". It's strange that someone could be considered to be "right on the money" for Australia when essentially the same text is posted in the UK, New Zealand, and Sweden (from a 30 second google search - I'm sure that the neo-cons in other countries have posted it too).

The following are the neo-con ideas promoted by the story in question:
  1. To mis-represent a local main-stream political party that is known for representing workers (the ALP in the case of Australia) as being extremist and associated with Greenpeace (an organization that is out of favor at the moment and disliked by many people who vote for main-stream parties).
  2. To spread the "liberal press" lie that wing-nuts like to believe. Any analysis of the press will show that most multi-national media organizations are quite biased towards the right-wing groups.
  3. Making false claims about the legal system to drive support for recent fascistic legal changes. In the case of Australia this means allowing employers to lay off employees and immediately re-hire them at a lower rate, allowing employees to be laid off if factory equipment breaks down, and for almost any reason you can imagine. Driving the idea that the judges are incompetent and therefore imposing legislation to remove judicial discretion is an important step in removing civil rights.
  4. Claims that the government is communist and takes the property from the middle-classes and gives it to unworthy people. In fact the opposite is true (for Australia at least). Large companies and wealthy individuals are routinely given community property. The toll roads are the best example of this, the government closes public roads that can be used as an alternative to a toll road, and then politicians get paid off after they leave office. Far from taking money from people who work (as the neo-con propaganda claims) the government allows big corporations to do so with impunity. The Australian government (as many governments in first-world countries) has been becoming increasingly fascistic recently.
  5. The claim that asylum seekers are terrorists. If the government wanted to stop terrorism then they would cease involvement with those parts of the world. However only plebians (people like us) are likely to be hurt by terrorism so the government has little motivation to stop it - it's good for winning elections! By joining the invasion of Iraq the Australian government helped al Quaeda establish new training bases while also giving al Quaeda (and related organizations) a reason to target Australia. Also whenever a war is started people will be forced to leave their homes and seek asylum else-where. If you don't want asylum seekers seeking entry to your country then you don't want to mess up other countries and force people to flee.
  6. Support for the "war on drugs". That war has been at best a stale-mate and generally a loss for a century now. The approach that is being adopted experimentally of legal supply of hard drugs to addicts seems to have more promise. Incidentally the breaches in border security that are established for the purpose of drug smuggling are available for any illegal purpose that pays enough - if al Quaeda wanted to smuggle weapons into a first-world country they would probably get drug dealers to do it for them. I'll blog more on this topic in future.

There you have it, The Squirrel and the Grasshopper covered all of the neo-con propaganda bases apart from the pro-Christian angle.

For the benefit of anyone who is thinking of forwarding on a "parable" in future, the first thing you might want to do is a google search on it. Search for comments and also search for who is promoting it. If a message you are considering forwarding is being promoted by people who are obviously racist or who discriminate against people on the basis of religion then you might consider whether you want to associate yourself with them by forwarding the message.

9 December 2006

Daniel Burrows: Hardware manufacturers to avoid: Samsung

[UPDATE 2: the problem is of the form "Daniel is an idiot". See this post for details. DRM is still evil, though.]

I recently assembled a little Mini-ITX system, mainly for use as a file server/desktop replacement/music server. However, it has a DVD drive, and it has a hardware MPEG2 decoder. So today, feeling a bit lazy, I decided to try displaying a DVD on the box instead of using the DVD player. This is when I discovered that my computer's new DVD drive is defective.

hdc: command error: status=0x51 DriveReady SeekComplete Error
hdc: command error: error=0x54 AbortedCommand LastFailedSense=0x0
5
ide: failed opcode was: unknown
ATAPI device hdc:
Error: Illegal request -- (Sense key=0x05)
Read of scrambled sector without authentication -- (asc=0x6f, asc
q=0x03)
The failed "Read 10" packet command was:
"28 00 00 00 01 c0 00 00 02 00 00 00 00 00 00 00 "


Yes, you read that right.

So, I won't be buying any more Samsung hardware until they figure out that I am their customer, not the MPAA. I realize this is an utterly futile gesture, that Samsung won't even notice my lack of custom, that this will make not even a dent on the juggernaut of DRMed/TPMed/locked-down hardware/software systems that are coming in the future, and that the end result is that I quit using computers entirely and go raise chickens...but you know, right now I think I'm mad enough not to care.

PS: Even worse: based on some discussions I found online, I ran a quick check of the CD reading speed -- and it appears that the drive now refuses to read CDs any faster than 2-3X! This is absolutely the last dollar that Samsung is getting from me, and if the store's return policy allows it, this sucker is getting RMAed tomorrow.

[UPDATE: the store I bought the drive from in October has a 30-day return policy, so I'm stuck with the one I've got. Probably I won't bother with getting DVD functionality on my next optical drive, it's not worth the obnoxiousness.]

Daniel Burrows: Apologies to Samsung

I need to learn not to write blog posts after 9pm, given that my brain starts fogging up around 8:30pm.

Apparently the only reason I couldn't play DVDs is that I had forgotten to install the DVD decoder library. Doh. And apparently the reason the DVD wouldn't play yesterday is that the video program was trying to get the drive to decode the DVD for it -- which I can understand Samsung not wanting to do, since it would get them in legal hot water. (what ticked me off was that it looked like they were going beyond the minimum and keeping me from even reading the encrypted DVD data)

So, the problem is that Daniel is a doofus. I want to apologize again for being a little trigger-happy last night -- especially since this is syndicated, it sucks to have put incorrect information out there.

8 December 2006

Russell Coker: SE Linux on Debian in 5 minutes

Following from my 5 minute OSDC talk yesterday on 5 security improvements needed in Linux distributions I gave a 5 minute talk on installing SE Linux on Debian etch. To display the notes I formatted them such that they were in 24 line pages and used less at a virtual console to display them. The ultra-light laptop I was using has only 64M of RAM which isn't enough for a modern X environment and I couldn't be bothered getting something like Familiar going on it.

After base install you install the policy and the selinux-basics package:

# apt-get install selinux-basics selinux-policy-refpolicy-targeted
The following extra packages will be installed:
checkpolicy libsemanage1 mime-support policycoreutils python python-minimal
python-selinux python-semanage python-support python2.4 python2.4-minimal
selinux-utils
Suggested packages:
python-doc python-tk python-profiler python2.4-doc logcheck syslog-summary
The following NEW packages will be installed:
checkpolicy libsemanage1 mime-support policycoreutils python python-minimal
python-selinux python-semanage python-support python2.4 python2.4-minimal
selinux-basics selinux-policy-refpolicy-targeted selinux-utils
0 upgraded, 14 newly installed, 0 to remove and 0 not upgraded.
Need to get 6362kB of archives.
After unpacking 41.5MB of additional disk space will be used.
Do you want to continue [Y/n]?

The package install process also configures the policy for the machine. The next step is to label the filesystems, this took 26 seconds on my Celeron 500MHz laptop with 20,000 files on an old IDE disk. The time is in proportion to number of files, often bottlenecked on CPU. A more common install might have 5* as many files with a 5* faster CPU so 30 seconds is probably common for labelling. See the following:

# fixfiles relabel

Files in the /tmp directory may be labeled incorrectly, this command
can remove all files in /tmp. If you choose to remove files from /tmp,
a reboot will be required after completion.

Do you wish to clean out the /tmp directory [N]? y
Cleaning out /tmp
/sbin/setfiles: labeling files under /
matchpathcon_filespec_eval: hash table stats: 14599 elements, 14245/65536 buckets used, longest chain length 2
/sbin/setfiles: labeling files under /boot
matchpathcon_filespec_eval: hash table stats: 19 elements, 19/65536 buckets used, longest chain length 1
/sbin/setfiles: Done.

The next step is to edit /boot/grub/menu.list to enable SE Linux, auditing, and put it in enforcing mode:

title   Debian GNU/Linux, kernel 2.6.17-2-686
root (hd0,1)
kernel /vmlinuz-2.6.17-2-686 root=/dev/x selinux=1 audit=1 ro enforcing=1
initrd /initrd.img-2.6.17-2-686

Then reboot.

After rebooting view the context of your shell, note that the login shell will have a domain of unconfined_t when the targeted policy is used:
# id -Z
system_u:system_r:unconfined_t

Now let's view all processes that are confined:
# ps axZ  grep -v unconfined_t grep -v kernel_t grep -v initrc_t
LABEL PID TTY STAT TIME COMMAND
system_u:system_r:init_t 1 ? Ss 0:02 init [2]
system_u:system_r:udev_t 1999 ? S.s 0:01 udevd --daemon
system_u:system_r:syslogd_t 3306 ? Ss 0:00 /sbin/syslogd
system_u:system_r:klogd_t 3312 ? Ss 0:00 /sbin/klogd -x
system_u:system_r:apmd_t 3372 ? Ss 0:00 /usr/sbin/acpid -c /etc
system_u:system_r:gpm_t 3376 ? Ss 0:00 /usr/sbin/gpm -m /dev/i
system_u:system_r:crond_t 3402 ? Ss 0:00 /usr/sbin/cron
system_u:system_r:local_login_t 3423 tty1 Ss 0:00 /bin/login --
system_u:system_r:local_login_t 3424 tty2 Ss 0:00 /bin/login --
system_u:system_r:getty_t 3425 tty3 Ss+ 0:00 /sbin/getty 38400 tty3
system_u:system_r:getty_t 3426 tty4 Ss+ 0:00 /sbin/getty 38400 tty4
system_u:system_r:getty_t 3429 tty5 Ss+ 0:00 /sbin/getty 38400 tty5
system_u:system_r:getty_t 3430 tty6 Ss+ 0:00 /sbin/getty 38400 tty6
system_u:system_r:dhcpc_t 3672 ? S.s 0:00 dhclient3 -pf /var/run/
The initial install of policy inserts modules to match installed software, if you install new software then you need to add new modules with the semodule command:

# semodule -i /usr/share/selinux/refpolicy-targeted/apache.pp
security: 3 users, 7 roles, 824 types, 67 bools
security: 58 classes, 11813 rules
audit(1165532434.664:21): policy loaded auid=4294967295
# semodule -i /usr/share/selinux/refpolicy-targeted/bind.pp
security: 3 users, 7 roles, 836 types, 68 bools
security: 58 classes, 12240 rules
audit(1165532467.874:22): policy loaded auid=4294967295

Note that the security and audit messages come from the kernel via printk, it is displayed on console login but you need to view the system log if logged in via ssh or running an xterm. Now you have to relabel the files that are related to the new policy:

# restorecon -R -v /etc /usr/sbin /var/run /var/log
restorecon reset /etc/bind context system_u:object_r:etc_t->system_u:object_r:named_zone_t
restorecon reset /etc/bind/named.conf context system_u:object_r:etc_t->system_u:object_r:named_conf_t
[...]
restorecon reset /etc/apache2 context system_u:object_r:etc_t->system_u:object_r:httpd_config_t
restorecon reset /etc/apache2/httpd.conf context system_u:object_r:etc_runtime_t->system_u:object_r:httpd_config_t
[...]
restorecon reset /usr/sbin/named context system_u:object_r:sbin_t->system_u:object_r:named_exec_t
restorecon reset /usr/sbin/apache2 context system_u:object_r:sbin_t->system_u:object_r:httpd_exec_t
restorecon reset /usr/sbin/rndc context system_u:object_r:sbin_t->system_u:object_r:ndc_exec_t
restorecon reset /usr/sbin/named-checkconf context system_u:object_r:sbin_t->system_u:object_r:named_checkconf_exec_t
[...]
restorecon reset /var/run/bind context system_u:object_r:var_run_t->system_u:object_r:named_var_run_t
restorecon reset /var/run/bind/run context system_u:object_r:var_run_t->system_u:object_r:named_var_run_t
restorecon reset /var/run/bind/run/named.pid context system_u:object_r:initrc_var_run_t->system_u:object_r:named_var_run_t
restorecon reset /var/run/motd context system_u:object_r:initrc_var_run_t->system_u:object_r:var_run_t
restorecon reset /var/run/apache2 context system_u:object_r:var_run_t->system_u:object_r:httpd_var_run_t
restorecon reset /var/run/apache2/cgisock.3558 context system_u:object_r:var_run_t->system_u:object_r:httpd_var_run_t
restorecon reset /var/run/apache2.pid context system_u:object_r:initrc_var_run_t->system_u:object_r:httpd_var_run_t
restorecon reset /var/log/apache2 context system_u:object_r:var_log_t->system_u:object_r:httpd_log_t
restorecon reset /var/log/apache2/error.log context system_u:object_r:var_log_t->system_u:object_r:httpd_log_t
restorecon reset /var/log/apache2/access.log context system_u:object_r:var_log_t->system_u:object_r:httpd_log_t

The -v option to restorecon causes it to give verbose output concerning it's operations. Often you won't do it in real use, but it's good to illustrate the use.

Now you have to restart the daemons:

# killall -9 apache2
# /etc/init.d/apache2 start
Starting web server (apache2)....
# /etc/init.d/bind9 restart
Stopping domain name service...: bind.
Starting domain name service...: bind.

Apache and BIND now run in confined domains, see the following ps output:

system_u:system_r:httpd_t   3833 ?     Ss     0:00 /usr/sbin/apache2 -k start
system_u:system_r:httpd_t 3834 ? S 0:00 /usr/sbin/apache2 -k start
system_u:system_r:httpd_t 3839 ? Sl 0:00 /usr/sbin/apache2 -k start
system_u:system_r:httpd_t 3841 ? Sl 0:00 /usr/sbin/apache2 -k start
system_u:system_r:named_t 3917 ? Ssl 0:00 /usr/sbin/named -u bind

It's not particularly difficult. I covered the actual install of SE Linux in about 1.5 minutes. I had considered just ending my talk there on a note of "it's so easy I don't need 5 minutes to talk about it" but decided that it was best to cover something that you need to do once it's installed.

If you want to know more about SE Linux then ask on the mailing list (see http://www.nsa.gov/selinux for subscription details), or ask on #selinux on freenode.

Alexander Sack: noteworthy things from the firefox & linux front

mconnor (Mozilla Corp) and caillon (Red Hat) give hope that mozillas attitude finally starts to change (in the right direction): That’s all good news, but even better … “Red Hat and Novell are both going to commit some effort into maintaining the Firefox 1.5.0.x line past the current EOL date this spring” ... thank $GOD for that ;-)

Evan Prodromou: 17 Frimaire CCXV

One problem with keeping your journal in the French Revolutionary Calendar is that you have to keep looking up what the date is. It is nice to know that there are functions for converting Julian dates to French Revolutionary dates in PHP. Also a nice link on that page to the strange and mellow http://bottoms-dream.de/ , which isn't anywhere near as pornographic as it sounds. tags:

Blinky Redux I had Blinky Hockey again tonight -- the first time in a month that I've gone. (Blinky is the pickup hockey team my friends Meg and Patti started. It's for people who don't play hockey so good but want to learn. Like me.) Last time we had it, I flew out to California at 6AM the next day for 2 weeks, so I missed two practices in between. And then last time I had everyone over for Thanksgiving dinner, and I fell asleep putting the baby down. Doh. So it was good to go out this time around. I've been going to our local hockey rink, Ar na Mont-Royal, for free skating from 4-5PM a couple of times per week since we got home, and I think I'm getting a little steadier on the ice. I still haven't got the whole stop-on-a-dime thing or skate-forwards-backwards-forwards thing, but I'm able to get around without going face down. Which is good. Tonight we did some more sophisticated drills and had a good scrimmage at the end of practice. I didn't score but I had an awesome shot. It would have been cool if it were a score. Anyways, I think I'm going to have to keep practicing on my own. Going to the Ar na is great, but maybe I should fill our parking lot out back with water, like this R ves de Glace site suggests. That'd be cool. tags:

Calendar wishlist So, I'm always trying to learn to use my calendar application, whatever's easiest and most available. I have a Treo 650 and Evolution, and they work OK, but they don't work great. I have a lot of things that I wish calendar programs had.
  • Project management integration. This is probably the biggest one for me. I can't believe that we have two different kinds of programs for planning the exact same information: what you're going to do with your time. On top of that it's remarkable that so few of project planner programs talk to calendars (or vice versa).
  • Hierarchical TODO lists. I'd like to break up tasks into sub-tasks that depend on each other.
  • Effort estimates. I'd like to be able to make notes about how long I think a task is going to take, and when I'll get it done.
  • Repeating TODOs. Probably the most egregiously un-ergonomic thing about modern calendaring programs. Almost everything I have to do in my life I have to do on a repeating schedule. I have to take out the recycling once a week before Wednesday morning. I have to pay rent before the 1st. I understand it's a tricky problem, but that doesn't mean I don't want a program to do it.
  • Open invitations. I'd like to be able to send open event invitations to mailing lists and have people RSVP automatically (if they want). All the systems I've used require that I know the email address of each invitee ahead of time. And they rarely work across calendaring systems.
  • Skipped TODOs. Sometimes I give myself a task todo and I just don't get around to doing it. I'd like to be able to mark a task as not done, but no longer important. I don't want to forget it forever, just remember that it never got done.
  • Logging. It'd be nice if there were more and nicer interfaces to say what I did with my day after it's done. When did I finish that module? When was the last time Niko came over for dinner? It would be nice if my calendar helped me remember the past as well as plan the future.
  • Sharing by default. I want to set up calendar sharing once, have my local and remote calendar synched transparently, and never worry about it again. CalDAV seems neat, but I have got no idea how to get it working.
  • More shared calendars. I like using shared calendars; I wish more organizations published them. I'd like it if Bell Canada published a calendar that told me when to pay my phone bill, and I'd like it if MSLUG published a calendar of their meetings. I'd like it if I could mark my phone bill as paid, and RSVP for an MSLUG meeting, through my calendar interface.
  • ACLs. Different people need to see different parts of my calendar. It'd be nice to have finer-grained control than "public" and "private".
tags:

7 December 2006

Martin Zobel-Helas: Preparation for r5 started

I just sent the first preparation mail for r5, which will either happen end of December or 48h before the release of Etch, whatever comes first. It currently does not cover all packages, as there are still quite a couple (more then 20) packages that need to be accepted from p-u-new by ftpmaster. Stay tuned for more information during the next days.

Gunnar Wolf: SmbGate: Almost entirely not frustrating

I've been working a bit over a week on writing SmbGate, a simple and quite braindead Web app giving my users web access (read-only for now at least) their home shares in a Samba server from outside the Institute, which will be basically closed for vacations/moving to a new building for over a month. It went quite smoothly. Even using a quite ugly API (Filesys::SmbClient - It works, but in an ugly fashion), getting the basic app to work took me only two days, and I've been beautifying bits of it for around a week. I even got around to write a user manual, which -to my surprise and astonishement- has been followed by the users. Wow, I'm productive! I even think this can be useful to other people, so I'll put the code online soon - As soon as I get the workplace-specific things weeded out to a configuration file.
Of course, everything has its ups and downs. Yesterday, I found a bug. Today, a user reported the bug to me. And, of course, it seems to depend on MSIE's weirdness.
I really, really hate my users experiencing browser incompatibilities - That's why I installed W2k under qemu (which, when used with the non-free but downloable with no fee required kqemu kernel module is perfectly speed-comparable with the completely-non-free VMware - Go try qemu now!). I tested thoroughly the system from the guest W2k system to my development machine (which is, incidentally, the same physical box), and it worked perfectly. Of course, locally, I didn't care about setting it up in a SSL-protected area. For my users, of course, access to their files is SSL-protected. I tested the production system from Linux, using Firefox. Works like a charm.
So, why am I bitching? Because browsing the directories works correctly from MSIE, but downloading the files doesn't (it says, in such a Spanish that I don't really understand the error message, that the file does not exist or the site is unavailable). Of course, debugging a HTTP request over a SSL session is not feasible. I installed an instance of this system in my regular unencrypted HTTP server - But, surprise surprise, it now works fine under MSIE. Exactly the same URL, only with the https replaced by http
So... I am almost entirely non frustrated. I have hit a bug which does not like being debugged. Joy, joy. But, I promise, victory will be mine.

John Goerzen: Saving Power with CPU Frequency Scaling

Yesterday I wrote about the climate crisis. Today, let's start doing something about it.

Electricity, especially in the United States and China, turns out to be a pretty dirty energy source. Most of our electricity is generated using coal, which despite promises of "clean coal" to come, burns dirty. Not only does it contribute to global warming, but it also has been shown to have an adverse impact on health.

So let's start simple: reduce the amount of electricity our computers consume. Even for an individual person, this can add up to quite a bit of energy (and money) savings in a year. When you think about multiplying this over companies, server rooms, etc., it adds up fast. This works on desktops, servers, laptops, whatever.

The easiest way to save power is with CPU frequency scaling. This is a technology that lets you adjust how fast a running CPU runs, while it's running. When CPUs run at slower speeds, they consume less power. Most CPUs are set to their maximum speed all the time, even when the system isn't using them. Linux has support for keeping the CPU at maximum speed unless it is idle. By turning on this feature, we can save power at virtually no cost to performance. The Linux feature to handle CPU frequency scaling is called cpufreq.

Set up modules

Let's start by checking to see whether cpufreq support is already enabled in your kernel. These commands will need to be run as root.

# cd /sys/devices/system/cpu/cpu0
# ls -l


If you see an entry called cpufreq, you are good and can skip to the governor selection below.

If not, you'll need to load cpufreq support into your kernel. Let's get a list of available drivers:

# ls /lib/modules/ uname -r /kernel/arch/*/kernel/cpu/cpufreq

Now it's guess time. It doesn't really hurt if you guess wrong; you'll just get a harmless error message. One hint, though: try acpi-cpufreq last; it's the option of last resort.

On my system, I see:

acpi-cpufreq.ko     longrun.ko      powernow-k8.ko         speedstep-smi.ko
cpufreq-nforce2.ko  p4-clockmod.ko  speedstep-centrino.ko
gx-suspmod.ko       powernow-k6.ko  speedstep-ich.ko
longhaul.ko         powernow-k7.ko  speedstep-lib.ko


For each guess, you'll run modprobe with the driver name. I have an Athlon64, which is a K8 machine, so I run:

#modprobe powernow-k8

Note that you leave off the ".ko" bit. If you don't get any error message, it worked.

Once you find a working module, edit /etc/modules and add the module name there (again without the ".ko") so it will be loaded for you on boot.

Governor Selection

Next, we need to load the driver that tells the kernel what governor to use. The governor is the thing that monitors the system and adjusts the speed accordingly.

I'm going to suggest the ondemand governor. This governor keeps the system's speed at maximum unless it is pretty sure that the system is idle. So this will be the one that will let you save power with the least performance impact.

Let's load the module now:

# modprobe cpufreq_ondemand

You should also edit /etc/modules and add a line that says simply cpufreq_ondemand to the end of the file so that the ondemand governor loads at next boot.

Turning It On

Now, back under /sys/devices/system/cpu/cpu0, you should see a cpufreq directory. cd into it.

To turn on the ondemand governor, run this:

# echo echo ondemand > scaling_governor

That's it, your governor is enabled. You can see what it's doing like this:

# cat cpuinfo_min_freq
800000
# cat cpuinfo_max_freq
2200000
# cat cpuinfo_cur_freq
800000


That shows that my CPU can go as low as 800MHz, as high as 2.2GHz, and that at the present moment, it's running at 800MHz presently.

Now, check your scaling governor settings:

# cat scaling_min_freq
800000
# cat scaling_max_freq
800000


This is showing that the system is constraining the governor to only ever operate on an 800MHz to 800MHz range. That's not what I want; I want it to scale over the entire range of the CPU. Since my cpuinfo_max_freq was 2200000, I want to write that out to scaling_max_freq as well:

echo 2200000 > scaling_max_freq

Making This The Default

The last step is to make this happen on each boot. Open up your /etc/sysfs.conf file. If you don't have one, you will want to run a command such as apt-get install sysfsutils (or the appropriate one for your distribution).

Add a line like this:

devices/system/cpu/cpu0/cpufreq/scaling_governor = ondemand
devices/system/cpu/cpu0/cpufreq/scaling_max_freq = 2200000


Remember to replace the 2200000 with your own cpu_max_freq value.

IMPORTANT NOTE: If you have a dual-core CPU, or more than one CPU, you'll need to add a line for each CPU. For instance:

devices/system/cpu/cpu1/cpufreq/scaling_governor = ondemand
devices/system/cpu/cpu1/cpufreq/scaling_max_freq = 2200000


You can see what all CPU devices you have with ls /sys/devices/system/cpu.

Now, save this file, and you'll have CPU frequency scaling saving you money, and helping the environment, every time you boot. And with the ondemand governor, chances are you'll never notice any performance loss.

This article showed you how to save power using CPU frequency scaling on Linux. I have no idea if it's possible to do the same on Windows, Mac, or the various BSDs, but it would be great if someone would leave comments with links to resources for doing that if so.

Updated: added scaling_max_freq info

6 December 2006

MJ Ray: Gowers Review

At first glance, the Gowers report could be very good, especially the EUCD (European Copyright Directive, also known as European-DMCA, or "that TPM/DRM crap") changes for 'orphan works' and the fence-sitting on punishment adjustments, but could also be bad with increased numbers of state copyright enforcers and increased use of the confused "IP" jargon (then again, UK Patent Office handles Copyright at the moment, which is confused anyway).
History
Discussion

Daniel Burrows: Things I miss about being an Undergrad.

So, it's been about 4.5 years since I got my ScB, 1.5 years since I got my MSc, and 1 year since I started working at Satori. Seems like an ideal time to look back on the halcyon simplicity of college, right? Here are a few things that I really wish I had appreciated more in 2000.

(1) Getting enough sleep.

I was just about the only well-rested student I knew in college. When other people (who stayed up past midnight regularly) would complain that they seemed to spend lots of time working withotu getting anything done, I occasionally suggested that they try getting more sleep. Hah.

So, in grad school I developed some bad, bad habits -- staying up past midnight, sleeping in erratically, etc. (I like to blame my girlfriend, who refused to get up before 9-10am when she was a student ;-) ) I started to sort of get a handle on that, and then I got a full-time job.

The problem here is this: you know how they say that to figure out how much sleep you need, you should sleep until you wake up naturally and feel rested? If I go to bed at 9PM, I wake up naturally at 7-8AM or so. That's -- count it -- 10-11 HOURS OF SLEEP. As a student, I had the luxury of sleeping 11 hours straight (since I had no social life). As a working drone with an hour-plus commute, that would leave me with 3-4 hours to fit in all my non-work activities (like, say, eating; personal hygeine; etc). The fact that I tend to get heartburn if I lie down within 2-3 hours of a meal, and that I usually have to cook my meal before I can eat it ... well, this just isn't gonna work.

So, to get enough time to actually live a bit outside work, I end up curtailing my sleep schedule to "only" about 7-8 hours. I know that's enough for some people. I wish I was one of them. The result for me, though, is that I go through most days feeling dazed, tired, sleepy, and with an on-and-off headache. I can generally hold it together well enough to get through the work day (although yesterday I collapsed on the couch halfway through), but once I get home I lack the energy to do anything but feed myself and idly browse the Web. Trying to do anything intellectually challenging (hence interesting), like say learn Cantonese or category theory, is right out. (I can just about say I want to eat, and I got as far as power categories before getting horribly tired and confused)


(2) Breaks.

One great feature of college is that you get time off of it. In addition to some random vacations during the semester, you usually break for several whole weeks between semesters, and then break again in the summer. Even if you have a summer job, this is a great way to recharge the batteries.

In the working world, I get exactly 1 day off per month -- if I want a decent-sized break, I have to go several months with no days off at all (except the paid holiday day every other month or so that the company gives us in its beneficience).


(3) The cafeteria.

College students like to make fun of cafeteria food. They don't know how good they have it. You get three hot meals a day, plus you don't have to do ANY cooking or cleaning up? Sign me up!

When I get home at 6:30 PM and I'm starving, the first thing I have to do is get out the raw ingredients for my dinner and toss them in a pot, then gnaw on some cheese or something to take away the hunger pains until they're done. By 7:30, I might have some food in me, hopefully. I'm thinking about switching to a frozen-food diet (ew), although that doesn't help clean the dishes.


(4) There's no commute in college.

To get to work, I have to walk 10 minutes, ride the bus for about 30-40 minutes, then walk another 20 minutes or so. In the evening I have to do the reverse. That's 2-3 hours of my life sucked up by just getting to work and back. If my brain wasn't too fried to study any of the interesting books I've optimistically purchased (see (1) and (2)), it might be bearable...but when I just want to get some food and rest, it really sucks. And it sucks especially when I have no good alternative (living in Seattle is EXPENSIVE, and it would give Kate an even worse commute in the other direction).

(5) Having the time and energy to study topics or write software just for the heck of it.

This really incorporates all of the above. It seems like all these factors conspire to suck my time up, then suck up the energy I have in the little time left to me. Meh. For instance, right now (at 9PM) I am getting very sleepy and should get to bed, yet I've done nothing since I finished eating (at 7:30PM) but skim Lambda the Ultimate and a few linked articles sites (slowly) and write this blog post. Blah.




Lest I give the impression that I completely hate work, let me add that there is one very, very important thing that I enjoy about it relative to my student, free-software-hacking days.

(1) NOT BEING FLAT BROKE.

I believe this one is self-explanatory; and so far it still makes up for the rest (I wonder how long this will continue). It's too bad I can't get paid to just sit around doing whatever I feel like and then giving it away, but then it's also too bad I can't wave a magic wand to get a pony and a few dozen acres to keep it on.

Next.

Previous.