Search Results: "ana"

2 August 2010

Matt Zimmerman: DebConf 10: Day 2

Today was the first day of DebConf proper, where all of the sessions were aimed at project participants. Bits from the DPL (Stefano Zacchiroli) Stefano delivered an excellent address to the Debian project. As Project Leader, he offered a perspective on how far Debian has come, raised some of the key questions facing Debian today, and challenged the project to move forward and improve in several important ways. He asked the audience: Is Debian better than other distributions? Is Debian still relevant? Why/how? Having asked this question on identi.ca and Twitter recently, he presented a summary. There was a fairly standard list of technical concerns, but also: He pointed out some areas which we would like to see improve, including: All in all, I thought this was an accurate, timely and inspirational message for the project, and the talk is worth watching for any current or prospective contributor to Debian. Debian Policy BoF (Russ Albery) Russ facilitated a discussion about the Debian policy document itself and the process for managing it. He has recently put in a lot of time working on the backlog (down from 160+ to 120), but this is not sustainable for him, and help is needed. There was a wide-ranging discussion of possible improvements including: There was also some discussion in passing of the long-standing confusion (presumably among people new to the project) with regard to how policy is established. In Debian, best practices are first implemented in packages, then documented in policy (not the reverse). Sometimes, improvements are suggested at the policy level, when they need to start elsewhere. I m not very familiar with how the policy manual is maintained at present, but listening to the discussion, it sounded like it might help to extend the process to include the implementation stage. This would allow standards improvements to be tracked all the way through from concept, to implementation, to documentation. The Java Packaging Nightmare (Torsten Werner) Torsten described the current state of Java packaging in Debian and the general problems involved, including licensing issues, build system challenges (e.g. maven) and dependency management. His slides were information-dense, so I didn t take a lot of notes. His presentation inspired a lively discussion about why upstream developers of Java applications and libraries often do not engage with Debian. Suggested reasons included: Collaboration between Ubuntu and Debian (Jorge Castro) Jorge talked about the connections between Debian and Ubuntu, how people in the projects perceive each other, and how to foster good relationships between developers. He talked about past efforts to quantify collaboration between the projects, but the focus is now on building personal relationships. There were many good questions and comments afterward, and I m looking forward to the Debian derivatives BoF session tomorrow to get into more detail. Tonight is the traditional wine and cheese party. When this tradition started, I was one of just a handful of people in a room with some cheese and paper plates, but it s now a large social gathering with contributions of cheese and wine from around the world. I m looking forward to it.

Gunnar Wolf: We have released!

If you have seen me anywhere near my computer at DebConf, you probably have seen the face of a hurried, worried developer. Still, if you monitor my Debian-related activity, you will notice it is still quite low, even given my (much needed and very much enjoyed) vacations pre-DebConf. Yes, orga-team work is very time consuming, even if my role is far from central this year. And yes, DebCamp+DebConf are known for sucking time into social interaction, which is great but not so (formally) productive. And yes, I even took 1.5 days off to visit my family and a friend who live in the area... Still, I managed to release! \ / Release what? I have been working with Pooka for the last ~2 years on the Seminary on Collaborative Knowledge Construction. We assembled a group of ~10 speakers/authors, each of whom prepared a chapter for a book meant for publication. Pooka and me coordinated the work, which took a long time because it was also an interaction experiment (and because we both did it only in our free time). After the coordination work started fading, I took up the task of coming up with a way to translate it all into LaTeX (and fix a host of conversion bugs, and play with the available packages, and... Hey, I'm after all just a LaTeX newbie, and had to learn to tame the beast!), I stumbled upon that precious fact that makes so many projects release. I stumbled upon a deadline. We want to publish the book under the seal of IIEc-UNAM. Besides my workplace, it is a very well regarded university, and having its seal in our work is definitively a big plus. And the Publications Committee of my Institute is meeting this week - So I had to send our final manuscript by today. Having a deadline overlapping with DebConf sucks. But somehow, I managed to do the needed work to my complete satisfaction. The work is now in the Committee's hands, and I expect to have more news soon(ish). Oh, and where can you get our work? Well, if you register in our site, you will be able to read the whole contents. And once the book is approved and published, the whole work will be published online under a free (CC-BY-SA) license. BTW, that probably means I will have more time to fix my Debian bugs and pending stuff! \ /

Joachim Breitner: Protecting static content selectively by OpenID

When I created my on-line photo album, we had the year 2001 and there was nothing wrong with publishing ones photos in the Internet. It has been almost ten years now, and things have changed. Privacy is an issue, especially when it also affects your friends and family. The problem
So I needed to find some protection. These were my requirements:
  1. I only want to protect parts of the site, as there are some pictures that I intentionally share with the public. This selection should be possible down to the individual image.
  2. The solution should work without any dynamic server component besides the web server itself. This rules out any self-written CGI scripts as well.
  3. One password, given to all my friends etc., is not sufficient as it might leak to unintended audience.
  4. I do not want my visitors to have to register and remember yet another username and password just for my site. I also do not want to manage this user database.
  5. I do not want to have do large changes to the file structure of my photo album.
This rules out most common options, e.g. protection by a .htpasswd file. Requirements 3 and 4 point to a solution based on OpenID. With OpenID, my visitors can authenticate against a service they already use (Google, Yahoo, etc.), relieving me from the burden of maintaining a user database and them from having to remember a password. There is a mod_auth_openid module for the Apache webserver, and it is even distributed with Debian in the libapache2-mod-auth-openid package. So requirement 2 is fulfilled. The tricky part is: How do we achieve OpenID protection for some images, and not for others. The solution I first played around with selectively enabling or disabling mod_auth_openid based on <FileMatch> directives in the Apache configuration, but it was not elegant and would not scale well. I have more than 20.000 pictures to manage, and have already selected over 5000 pictures to be shown without protection. My solution is based on a partial copy of the whole directory tree that contains all public files. To save disk space, these are just symbolic links to the real file in the protected location. Some mod_rewrite magic then takes care of giving the user the impression that all files are in the same location. I set up a small example of my solution, which has this directory structure: 
.:
drwxr-xr-x 2 root root 4096  2. Aug 12:03 images
lrwxrwxrwx 1 root root   18  1. Aug 12:05 index.html -> private/index.html
lrwxrwxrwx 1 root root   18  1. Aug 12:05 login.html -> private/login.html
drwxr-xr-x 3 root root 4096  2. Aug 12:03 private
./images:
lrwxrwxrwx 1 root root 33  2. Aug 12:00 pleaselogin.png -> ../private/images/pleaselogin.png
lrwxrwxrwx 1 root root 28  2. Aug 12:03 public.png -> ../private/images/public.png
./private:
drwxr-xr-x 2 root root 4096  2. Aug 12:00 images
-rw-r--r-- 1 root root  267  2. Aug 12:03 index.html
-rw-r--r-- 1 root root   94  2. Aug 12:01 loggedin.html
-rw-r--r-- 1 root root 2091  2. Aug 12:03 login.html
-rw-r--r-- 1 root root   10 18. Nov 2009  protected.html
./private/images:
-rw-r--r-- 1 root root 4074  2. Aug 11:58 pleaselogin.png
-rw-r--r-- 1 root root 2670  2. Aug 11:58 private.png
-rw-r--r-- 1 root root 2043  2. Aug 11:58 public.png
As you can see, real files only reside in private/, outside of that, only symbolic links exist. The apache configuration protects the private directory and blends it into the main directory: 
   <directory /var/www/nomeata.de/openid-test>
        RewriteEngine On
        # Abuse the login page as an error image
        RewriteCond % QUERY_STRING  \.(png jpg)
        RewriteRule ^login.html$ /openid-test/images/pleaselogin.png
        # Ship private files, if they exist, unless public files exist
        RewriteCond  $1 !^private
        RewriteCond  /var/www/nomeata.de/openid-test/$1 !-f
        RewriteCond  /var/www/nomeata.de/openid-test/private/$1 -f
        RewriteRule  ^(.+)$ /openid-test/private/$1
   </directory>
   <directory /var/www/nomeata.de/openid-test/private>
        AuthOpenIDEnabled        On
        AuthOpenIDDBLocation     /var/lib/apache2/mod_auth_openid/mod_auth_openid.db
        AuthOpenIDLoginPage      /openid-test/login.html
        AuthOpenIDTrustRoot      http://nomeata.de
        AuthOpenIDCookiePath     /
        AuthOpenIDCookieLifespan 2592000
    </directory>
A special trick handles the login page for protected images: If the login page is requested and the referrer indicates that the user tried to access a .png or .jpg file, apache will instead ship an image containing an error message. For my photo album I have a small Perl script that, given a directory with a private/ directory therein and a list of rules in form of glob patterns, will symlink matching files and remove symlinks that are not allowed any more.
What s next? As you can see, this does not actually protect the content. It only requires the user to authenticate, then everything is visible. To select which OpenIDs are allowed to access which code, some bugs will have to be fixed in mod_auth_openid first. There was little activity there recently, I hope that the project is not dead.

Jaldhar Vyas: PreventaCamp Days 3 and 4

I missed yesterdays report but there was not a lot to say anyway. I've made further progress on the DHCP problem in the sense that I can make it go away if I use NAT in VMWare instead of Bridged networking. Tried compiling gcc 4.4.4 and ran out of disk space. I've been feeling guilty about not volunteering so that evening I assisted the organizers by eating some of their excess baked ziti. It's my civic duty. Today (Sunday) was Debian day. I spent some time in the hacklab trying to compile gcc again. This time I ran out of inodes. I did manage to get to two of the presentations. One was about the GSoC projects various students are doing. Perhaps next year Debian Minix will be a subject for GSoC? The other one was by Andy Oram about FLOSS Manuals. They are doing important work in Free Software documentation and have developed some interesting tech towards that end. One is CSS3 print profile support. This will be a relief for anyone who has had to deal with the bletcherous XSL. Another is booki a platform for collaborative writing and editing. I shall be following the progress of this project as I hope to make a big contribution to Debian documentation soon. Andy works for O'Reilly and after the talk we had some informative discussion about the publishing world. This "hallway track" is the great thing about gatherings like Debconf.

John Goerzen: The Best Place of Ever

Jacob and Oliver have enjoyed our recent train trip, and our stay, from Kansas to New York City for Debconf. All told, that s a 40-hour trip, including the layover in Chicago. When we got on the train, in the middle of the night as usual, Jacob couldn t stop chattering about how great , fun , and exciting it is. He told us about all the lots of great things on the train, the fact that we were on a night train , and generally couldn t stop chattering. For an hour. At 3:30AM. This was a typical sight from Jacob: IMG_4284 It wasn t as relaxing as usual for Terah and me. Oliver is at the grabbing everything in sight stage. Which worked fine when Jacob was at the age, but with Jacob also along it was a bit more difficult to manage. I suspect that our next trip, when Oliver is a few months older, will go easier. A highlight for both boys, as usual, is the dining car. Oliver loves anything related to eating solid food it s still novel to him and Jacob loves anything relating to trains. What could go wrong? (Parents will probably identify the capability for two hyper-excited young boys to have plenty of things go wrong at a table in a restaurant here fortunately we didn t have anything go terribly wrong.) Oliver turned out to find the things outside the window to require intense concentration intense enough to stick out his tongue while he worked it all out. IMG_4296 And Jacob, of course, wanted to get the wrapper off his straw by himself. Which he can do, but takes a minute. IMG_4305 They also enjoyed the lounge car. IMG_4292 We were in a sleeper room on both trains. That was nice, and when we needed to go explore , we could. Jacob s favorite part of the trip was when I folded down the upper bunk during the day for him to play. I pointed out that it was like a train treehouse. His face sure lit up. He loved that he had his own window up there to look out of. He climbed up the ladder, and after awhile of playing, said, Dad, would you like to play with me up here? Of course I would it always makes me happy when he asks if I want to play with him. As I was playing with him, I asked him if he was having fun in his train treehouse. He gave me a sweet smile, and said, Dad, this is the best place of ever! IMG_4321 In Chicago, Jacob and I went outside and walked around. He enjoyed walking across the bridges over the canal by Union Station. I checked some work email when we got back, tried but failed to reach some local hams with my handheld, and then we got on the train for New York. The boys loved it too, and Jacob was very ready to be in New York when we got there. We got out at Penn Station which was, I think, pretty much what my mind had imagined of an underground station robbed of its former glory (especially having been in that part of Chicago Union Station). We found the connection to the 2 train uptown, bought some MetroCards for the subway, and got on. Jacob was very interested in the subway. He sat very, very still I thought he was scared but on asking him some questions, realized that he was just very interested and engrossed in it all. I had been trying out my HF antenna for my amateur radio setup a few days ago, and by some coincidence, kept making contact with people that grew up in New York. A guy from Fargo, ND a native of Brooklyn told me to make sure to get pretzels from a hot sauce vendor, Pastrami on rye or corned beef on rye from a Jewish deli (because they have the best meat), pizza from guys wearing red and white shirts, and don t be afraid of rats on the subway tracks, and that our boys will love to feed leftover bits of pretzels to pigeons and squirrels. He got so excited about NYC that he went on and on, saying, Man, you re making me hungry now. During times I m not at sessions at Debconf, we ve found some time to do some things as a family. We went to Grand Central Terminal, just to see it it is indeed still Grand. I knew there was a Jewish deli there, so I thought hey try out his advice. It was closed, and when I realized it was Saturday, I realized why. Oops. We hopped on another train to Brooklyn and checked out the New York Transit Museum, which is great and has a lot of exhibits about the history of the city s subway and bus systems. It s housed in a former subway station, and they have a lot of old subway cars down there dating back to 1905 most of which are open to go inside of. It s been nice to meet people at Debconf that I have only known via email or IRC. The organizers of this conference have done a fabulous job. I have every expectation that this will turn out to be the best conference I ve been to in at least 12 years this is my first Debconf. It doesn t skimp on the technical details, people are friendly, and there is a sense of common purpose. But just as important, while there is a set schedule, there is an easy way to add other ad-hoc sessions to the conference schedule. People can get together a group interested in a topic, and schedule an event about it for the next day very easily. I m quite impressed by that, and am looking forward to the virtualization discussion that grew out of a question to the mailing list. It was also neat to meet people that sort of knew our family from my blog posts. I had no idea that there were all that many people that actually read these things ;-) The Debconf kick-off was great. As I was walking across the campus of Columbia towards it, it was a nice temperature, with some light rain, and I heard bagpipes in the distance. Beautiful. And when I left after the evening sessions, I still heard bagpipes. So I went to check it out, and ran into Gabriella Coleman, one of the Debconf organizers and the person that gave the talk I just left on the way, with the same idea. The Columbia campus is beautiful and historic, and it is an excellent venue for the conference. New York is a great city and I m sure we ll be back. It is great to walk out of the hotel in the morning, buy a fresh peach or two from the street vendor 20 feet away, and then go buy a roll or two ($0.75 each) from the bakery down the street. I have been so missing rolls like that since we got back from Germany in March. These weren t quite like the German bakeries, but the closest I ve had to it. It is interesting to note how differently people from different places look at things. Terah has told several people how we live 6 miles from a town with 500 people in it, and people that stop to think about it realize how different it is from New York. It was a surprise to me to hear that some New Yorkers think of Columbia as country . It is beautifully landscaped, and feels different than the rest of the city. The numbers I ve seen suggest that a typical fall weekday has more people on the Columbia campus than in the entire county where we live. And that county is twice the size of New York City. That s not to say that there s anything wrong with New Yorkers thinking of it as country, any more than there is of me thinking of a town with 15,000 people as a pretty big town. It s a different perspective, and I enjoy different perspectives which is another thing I like about Debconf. There are so many people from all over the world there that different perspectives are inevitable.

Matt Zimmerman: DebConf 10: Day 1

This week, I am attending DebConf 10 at Columbia University in New York. The first day of DebConf is known as Debian Day. While most of DebConf is for the benefit of people involved in Debian itself, Debian Day is aimed at a wider audience, and invites the public to learn about, and interact with, the Debian project. These are the talks I attended. Debian Day Opening Plenary (Gabriella Coleman, Hans-Christoph Steiner) Hans-Christoph discussed Debian and free software from a big picture perspective: why software freedom matters, challenging the producer/consumer dichotomy, how the Debian ecosystem hangs together, and so on. Steps to adopting F/OSS in government (Andy Oram) Andy discussed FLOSS adoption in governments, drawing on examples from Peru, the city of Munich, the state of Massachusetts. He covered the reasons why this is valuable, the relationship between government transparency and software freedom, and practical advice for successful adoption and deployment. Pedagogical Freedom (panel, Jonah Bossewitch et al) The panelists discussed the use of technology in education, especially free software, some of the parallels between free software and education, and what these communities could learn from each other. This is a promising topic, though the perspectives seemed to be mostly from the education realm. There is much to be learned on both sides. Google Summer of Code 2010 at Debian (Obey Arthur Liu) This talk covered the student projects for this year s Summer of Code. Most of the students were in attendance, and presented their own work. They ranged from more specialized projects like the Hurd installer, to core infrastructure improvements like multi-arch in APT. Beyond Sharing: Open Source Design (Mushon Zer-Aviv) Mushon gave an excellent talk on open design. This is a subject I ve thought quite a bit about, and Asheesh validated many of my conclusions from a different angle. I ve added a new post to my todo list to go into more detail on this subject. Some points from his talk which resonated with me: How Government can Foster Freedom in Technology (Hon. Gale Brewer) Councillor Brewer paid a visit to DebConf to tell us about the work she is doing on the city council to promote better government through technology. Brewer seems to be a strong advocate of open data, saying essentially that all government data should be public. She summarized a bill to mandate that New York City government data be public, shared in raw form using open standards, and kept up to date. It sounded like a very strong move which would encourage third party innovation around the data. She also discussed the need for greater access to computers and Internet connectivity, particularly in educational settings, and a desire to to have all public hearings and meetings shared online. Why is GNU/Linux Like a Player Piano? (Jon Anderson Hall, Esq.) Jon is a very engaging speaker. He drew parallels between the development of player pianos, reproducing pianos, reed organs, pipe organs and free software. He even tied in Hedi Lamarr s work which led to spread spectrum wireless technology. To be quite honest, I did not find that these analogies taught me much about either free software or player pianos, but nonetheless, I couldn t help but take an interest in what he was saying and how he presented it. DebConf Opening Plenary (Gabriella Coleman) Biella and company explained all the ins and outs of the event: where to go, what to do (and not do), and most importantly, whom to thank for all of it. Now in its 11th year, DebConf is an impressively well-run conference. I m looking forward to the rest of the week!

1 August 2010

Clint Adams: No time

Some things I intended to work on last week but did not:

Lucas Nussbaum: Help needed: analyzing and filing installation/removal/upgrade bugs

I ve been working on a piuparts-like tool call instest (yeah, crappy name) to test installation, removal and upgrade of packages. Compared to piuparts, it s simpler and tries to make it easier to file bugs. However, running it on sid still raises ~3000 failures. So I m seeking help to analyze those failures and file bugs. The tasks are: If you want to help, just contact me at Debconf!

Chris Lamb: screen-message prompt for Awesome

The following snippet adds a screen-message prompt to the Awesome window manager: 
mypromptbox = widget( 
  type = "textbox",
  name = "mypromptbox",
  align = "left"
 )
globalkeys = awful.util.table.join(
  -- [..]
  awful.key(  "Mod1"  , "F6", function ()
    awful.prompt.run(
        prompt = "Msg: "  ,
      mypromptbox,
      function (msg)
        awful.util.spawn_with_shell(
          'echo ' .. msg .. '   sm - -b Black -f White'
        )
      end
  ) end)
)
root.keys(globalkeys)
(The default colour scheme of black-on-white is painful.)

30 July 2010

Alexander Reichle-Schmehl: Release Critical Bug report for Week 30

The unofficial rc bug tracker currently knows about the following bugs:
In Total:433
Affecting Squeeze:328
Squeeze only:74
Remaining to be fixed in Squeeze:254
Of these 254 bugs, the following tags are set:
Pending in Squeeze:21
Patched in Squeeze:41
Duplicates in Squeeze:20
Contrib or non-free in Squeeze:12
Claimed in Squeeze:0
Delayed in Squeeze:7
Can fixed in a security Update:17
Otherwise fixed in Squeeze:25
Ignoring all the above (multiple tags possible), 150 bugs need to be fixed by Debian Contributers to get Debian 6.0 Squeeze released. However, with the view of the Release Managers, 238 need to be dealt with for the release to happen. Please see my older post for an explanation of the different numbers.

29 July 2010

Clint Adams: Efika MX

Processor       : ARMv7 Processor rev 5 (v7l)
BogoMIPS        : 799.53
Features        : swp half thumb fastmult vfp edsp thumbee neon vfpv3 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x2
CPU part        : 0xc08
CPU revision    : 5
Hardware        : Genesi Efika MX
Revision        : 51030
Serial          : 0000000000000000 
             total       used       free     shared    buffers     cached
Mem:        482740      44836     437904          0       4672      21104
-/+ buffers/cache:      19060     463680
Swap:            0          0          0
Bus 002 Device 002: ID 0b95:772a ASIX Electronics Corp. 
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 003: ID 13d3:3273 IMC Networks 802.11 n/g/b Wireless LAN USB Mini-Card
Bus 001 Device 002: ID 1a40:0101 TERMINUS TECHNOLOGY INC. USB-2.0 4-Port HUB
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Christian Perrier: First day at DebConf10

Yesterday late evening, Jean-Baptiste and I arrived in NYC after about a 16 hours trip. Amazingly, he mentioned to me that we entered a train in the station close to our home....and then never went outside until we exited the 1 line subway at 116th street on Broadway Ave.: It's indeed quite typical to notice that, these days, you can travel 1/4 of the planet, using 9 different trnsportation systems and never go outside. We made a quick appearance in the Hacklab yesterday, enough to say "hi" to a dozen of people around and mostlysee how things are organized. Then bed, which is probably the best way to avoid jetlag. This morning, I of course woke up quite early (Debian grandfathers, blah blah) and of course I went out running..:-) The initial plan was to do a short enough run in Central Park. However, I managed to get partly lost and, indeed, after entering the Park in the NW corner, I managed to read Columbus circle...in the SW corner after wandering around the large alleys. So, my only choice was then to come back through the westernmost part of the Park back to Columbia..and thus ended up with a 13km run (for running junkies, the pace was 5'31"/km (8'52"/mile for local runners). And now, I'm in the hacklab with JB (did I already say that I'm proud of this? Yes, dozens of times...OK...). And they're waiting for me to go to lunch....so, end of this blog post..:)

Olivier Berger: Weaving a Semantic Web Across OSS Repositories: Unleashing a New Potential for Academia and Practice published

A new paper of ours was just published. If you re curious about all that Semantic Web and Linked Data hype and how it would impact forges and other software development tools, and the link with Open Source development platforms, then, read this :
Weaving a Semantic Web Across OSS Repositories: Unleashing a New Potential for Academia and Practice
(DOI: 10.4018/jossp.2010040103)
Authors: Olivier Berger (Institut Telecom, France); Valentin Vlasceanu (Institut Telecom, France); Christian Bac (Institut Telecom, France); Quang Vu Dang (Institut Telecom, France); St phane Lauriere (Mandriva, France)
in International Journal of Open Source Software & Processes (IJOSSP) Volume: 2, Issue: 2 (2010), Pages: 29-40 pp.
Here s the abstract:
Several public repositories and archives of facts about libre software projects, maintained either by open source communities or by research communities, have been flourishing over the Web in recent years. These have enabled new analysis and support for new quality assurance tasks.
This paper presents some complementary existing tools, projects and models proposed both by OSS actors or research initiatives that are likely to lead to useful future developments in terms of study of the FLOSS phenomenon, and also to the very practitioners in the FLOSS development projects.
A goal of the research conducted within the HELIOS project is to address bugs traceability issues. In this regard, the authors investigate the potential of using Semantic Web technologies in navigating between many different bugtracker systems scattered all over the open source ecosystem.
By using Semantic Web techniques, it is possible to interconnect the databases containing data about open-source software projects development, which enables OSS partakers to identify resources, annotate them, and further interlink those using dedicated properties and collectively designing a distributed semantic graph.
Keywords : RDF, forge, archive, bug, semantic, semantic Web, ontology, database, repository of repositories,
interoperability, bugtracker, OSLC-CM, Debian. The journal is published as closed content on paid access, but you may ask us, should you need to read a draft version. This is an extended version of an earlier position paper presented at WOPDASD 2009. This work was conducted in the frame of the System@tic Paris-Region cluster (http://www.systematic-paris-region.org/), with funding of the Paris Region council.

28 July 2010

Aigars Mahinovs: Debconf 10 arrival and first days

I had planned long for this Debconf and with the experience from the previous times I did all I could to reach one goal minimise stress. I think I got it right this time. First of all I got my company (Accenture) pay for the whole thing, so I did not have to worry about sponsorship queue (but instead I must gather and deliver them back some knowledge gained from the conference should be easy). I also managed to get a direct flight there is a weekly flight Tashkent-Riga-New York on Sundays and I got a ticket for that both ways. This took many hours off the travel time and reduced the stress a ton. Then I also did all the prudent travelling things: mostly reading the New York page on Wikitravel. This told me (among other things) what metro line to take to get the best view of the city. And for luggage I took a backpack (for the laptop and walking around) and a roller (for the clothes). I learned a lot from the Up in the air movie, it really teaches one how to take stress out of travel. This went very well in the beginning I took a bus to the airport early, checked in, breezed trough security and then waited and waited. The boarding only started half an hour after we were scheduled to depart. But I can not complain, because the flight attendant called my name (among a few others) just before boarding and changed my ticket I was bumped up to business class :) . It has been many years since I ve flown a regular (non-budget) airline and now first time ever in the business class! We got regular class meals, but at least we got to sit in the big chairs with lots of leg room. It was great! I bought a paper book (from Charles Stross) to read during the flight, because that is the only thing you can do during take-off and landing and I had some stuff to listen to in my iPhone. I tried sleeping and I think I managed to kill a couple hours that way too. It sure helped combat jet lag later on. When I arrived, I had my immigration and customs forms filled out. Latvia is on the USA Visa Waiver program, so I just had to fill out a form online prior to the trip to get a permission to enter USA. I only had one printout of the Waiver confirmation page and my airline took that before giving me a boarding pass, so I had no paper copy to give to the guy at the USA border, but he did not even ask for it he only took the two forms I filled out, scanned my passport, took my fingerprints (all fingers) and a photo. Then he gave me back the customs for (stamped) and I could go get my luggage. After that it was just a matter of walking trough customs and giving the customs official the pre-filled and stamped customs form. I was not stopped further. The AirTrain was a bit confusing you just get on the AirTrain and go where you need to go, you actually pay at the place where AirTrain connects to metro, so when you are coming from the airport you are actually paying ($5) when you are exiting the AirTrain system. There are plenty of AirTrain people that will give you an AirTrain ticked for $5 cash right there or you can use a machine to get it (where you can also pay with a card). The machines also take AmEx, but you must know the PIN code, if your don t know the PIN of you AmEx card (like I don t know the PIN of my corporate AmEx) you can only buy MetroCards at news stands, but there you will not find the unlimited ride tickets only 5 or 10 ride tickets are available. Next I screwed up a bit and thus got a bit lost in the New York metro system. The Wikitravel recommends to take the AirTrain to Jamaica station and from there take J or Z line into the city for the best views. I went to Jamaica and got into the first metro train that came on to the platform. Unfortunately, that was the E line train and it does not cross with J or Z lines after that, so I was stuck. To complicate the situation E line is under repair, so after a few stops the trains diverted to the F line and I had to scramble to figure out where to get out to get to the 1 line where Columbia University is. I ended up spending more than an hour in the metro, but I got there in the end. So I emerge from the 116th street metro station directly in front of the campus entrance gate and it starts raining. A thunderstorm swept across New York as soon as I stepped outside the metro station, so I took shelter a the side of the building. It kept raining. After a few minutes decided that I don t want to wait any more, so I put all my electronics into my backpack and went towards the dorm where my room was. The rain was warm, people around me were playing and running around in the wet grass, it was fun. The guard showed me where to go to check in. It was really simple sign here, here is you magnetic stripe key, have fun. And the room was just as spartan bed, desk, chair, closet, bathroom and a large fan under the window. The first night I did not know that I could actually turn that fan down, so I slept to the sound of full fan blasting, much like on the airplane. The dorm looks ancient it looks like it was build in the 60s and never changed since then. I mean, I ve lived in worse places, but people would at least change wall sockets or faucets or ceiling paint every other decade or so. The newest things here were the magnetic locks on the doors and a TV and a mini fridge in the hallway. After dropping my things I went off to the Mudd building across the campus to check in with people in the hacklab. It was just starting to take shape, but many great and familiar people were already there. It was like walking into a family home same warm welcome smiles and that great feel of belonging to the group. After I quick chat I went off downtown. The plan was that I left my old Canon 400D camera back at home and that I would buy a new Canon 550D here in New York on arrival. Unfortunately I underestimated the travel time on subway and by the time I got back downtown most shops where already closed. I got to checking out a Best Buy and was told there that they don t have 550D in stock. Next morning I went for a full scale search B&H Photo Video store, J&R Express, another BestBuy none of them had the Canon 550D (aka T2i) in stock in a body-only configuration. BestBuy had a few sets with the kit lens, but I did not want paying 100$ extra for something I already have. The last option was Adorama and I got lucky I nabbed the last 550D they had and it was body-only. Now I was back, with a camera in my hands and the Debconf10 could really begin!

27 July 2010

Wouter Verhelst: NBD: authentication and named exports

I just did some work on two NBD features: authentication and named exports. The first was written by Brad Allen back in 2008. I'd been thinking about an authentication scheme back at DebConf 8, and discussed it on the nbd-general mailinglist. Brad picked it up and ran with it, but it never got finished. Basically, what I did today was forward-port the code so that it would compile (and work) with today's version of the NBD utilities. I tested it and it works, but I'm not sure what to do with it. NBD is not encrypted; so there's no protection against TCP hijacking or some such. Oh well; I might still integrate it into nbd mainline. The second feature is something way more interesting. It had been on my long-term TODO list for quite a while, but I never sat down to implement it. Until today, that is. This patch has been compile-tested, but I haven't functionally tested it yet; I'll do that tomorrow. The main reason it took so long to implement, was that initial NBD handshake made that quite hard. Upon connecting, nbd-server as it currently exists will open the file or block device that it needs to export, and before nbd-client has sent anything sends information on that export (its size, whether or not it is read-only, etc) to the client. Unfortunately, this does mean that I cannot add new features to nbd-server while retaining full backwards compatibility if these features may involve changing what nbd-server sends during the initial handshake, as is the case here. This could be worked around by having the server first send information on a "default" export to the client, and then variate that if the client informs the server that it actually wants something else. But this would have been rather ugly, since it means that errors in open() or stat() calls for the initial "default" export would have to be non-fatal until the client actually tries to read or write to or from the device, at which point they would suddenly become fatal. This would open a can of worms near which I didn't want to tread. The way I fixed it in the end, however, is fairly simple. If names are used to specify an export, nbd-server can live with just one port to export all block devices that it supports, rather than needing many. As such, I can "reserve" one port for the new-style named exports. On this port, nbd-server would expect that clients send a name, and would not function correctly with clients that don't understand names. At the same time, nbd-server could still export the same block devices on other ports as well, using the old-style protocol, for clients that do not support named devices. This would of course require that both the client and the server know perfectly well what the port is, and that it does not change too easily. As such, I've just put in a request for an assigned port number over at IANA, so that I can be sure that the port will not change unexpectedly. This also means I won't make a public release with this change until the port number has been assigned, so that I don't need to support two 'default' nbd-server ports in the future (one "temporary" and one IANA-assigned port). For now, however, I think I'll go grab some food.

26 July 2010

Matt Zimmerman: Embracing the Web

The web offers a compelling platform for developing modern applications. How can free software benefit more from web technology, and at the same time promote more software freedom on the web? What would the world be like if FLOSS web applications were as plentiful and successful as traditional FLOSS applications are today? Web architecture The web, as a collection of interlinked hypertext documents available on the Internet, has been well established for over a decade. However, the web as an application architecture is only just hitting its stride. With modern tools and frameworks, it s relatively straightforward to build rich applications with browser-oriented frontends and HTTP-accessible backends. This architecture has its limitations, of course: browser compatibility nightmares, limited offline capabilities, network latency, performance challenges, server-side scalability, complicated multimedia story, and so on. Most of these are slowly but surely being addressed or ameliorated as web technology improves. However, for a large class of applications, these limitations are easily outweighed by the advantages: cross-platform support, instantaneous upgrades, global availability, etc. The web enables developers to reach the largest audience of users with the most compelling functionality, and simplifies users lives by giving them immediate access to their digital lives from anywhere. Some web advocates would go so far as to say that if an application can be built for the web, it should be built for the web because it will be more successful. It s no surprise that new web applications are being developed at a staggering rate, and I expect this trend to continue. So what? This trend represents a significant threat, and a corresponding opportunity, to free software. Relatively few web applications are free software, and relatively few free software applications are built for the web. Therefore, the momentum which is leading developers and users to the web is also leading them (further) away from free software. Traditionally, pragmatists have adopted free software applications because they offered immediate gratification: it s much faster and easier to install a free software application than to buy a proprietary one. The SaaS model of web applications offers the same (and better) immediacy, so free software has lost some of its appeal among pragmatists, who instead turn to proprietary web applications. Why install and run a heavyweight client application when you can just click a link? Many web applications perhaps even a majority are built using free software, but are not themselves free. A new generation of developers share an appreciation for free software tools and frameworks, but see little value in sharing their own software. To these developers, free software is something you use, not something you make. Free software cannot afford to ignore the web. Instead, we should embrace the web more completely, more powerfully, and more effectively than proprietary systems do. What would that look like? In my view, a FLOSS client platform which fully embraced the web would: Imagine a world where free web applications are as plentiful and malleable as free native applications are today. Developers would be able to branch, test and submit patches to them. What about Chrome OS? Chrome OS is a step in the right direction, but doesn t yet realize this vision. It s a traditional operating system which is stripped down and focused on running one application (a web browser) very, very well. In some ways, it elevates web applications to first-class status, though its paradigm is still fundamentally that of a web browser. It is not designed for development, but for consuming the web. Developers who want to create and deploy web applications must use a more traditional operating system to do so. It does not put the end user in control. On the contrary, the user is almost entirely dependent on SaaS applications for all of their needs. Although it is constructed using free software, it does not seem to deliver the principles or benefits of software freedom to the web itself. How? Just as free software was bootstrapped on proprietary UNIX, the present-day web is fertile ground for the development of free web applications. The web is based on open standards. There are already excellent web development tools, web application frameworks and server software which are FLOSS. Leading-edge web browsers like Firefox and Chrome/Chromium, where much web innovation is happening today, are already open source. This is a huge head start toward a free web. I think what s missing is a client platform which catalyzes the development and use of FLOSS web applications.

Russell Coker: Creating a SE Linux Chroot environment

Why use a Chroot environment? A large part of the use of chroot environments is for the purpose of security, it used to be the only way of isolating a user from a section of the files on a server. In many of the cases where a chroot used to be used for security it is now common practice to use a virtual server. Also another thing to note is that SE Linux provides greater access restrictions to most daemons than a chroot environment would so in many case using SE Linux with a sensible policy is a better option than using a chroot environment to restrict a daemon. So it seems to me that the security benefits that can be obtained by using a chroot environment have been dramatically decreased over the last 5+ years. One significant benefit of a chroot environment is that of running multiple different versions of software on one system. If for example you have several daemons that won t run correctly on the same distribution and if you don t want to have separate virtual machines (either because you don t run a virtualisation technology or because the resources/expense of having multiple virtual servers is unacceptable) then running multiple chroot environments is a reasonable option. The Simplest Solution The simplest case is when all the chroot environments are equally trusted, that means among many other things that they all have the latest security patches applied. Then you can run them all with the same labels, so every file in the chroot environment will have the same label as it s counterpart in the real root this will mean that for example a user from the real root could run /chroot/bin/passwd and possibly get results you don t desire. But it s generally regarded that the correct thing to do is to have a chroot environment on a filesystem that s mounted nosuid which will deal with most instances of such problems. One thing to note however is that the nosuid mount option also prevents SE Linux domain transitions, so it s not such a good option when you use SE Linux as domain transitions are often used to reduce the privileges assigned to the process. There are two programs for labeling files in SE Linux, restorecon is the most commonly used one but there is also setfiles which although being the same executable (restorecon is a symlink to setfiles) has some different command-line options. The following command on a default configuration of a Debian/Lenny system will label a chroot environment under /chroot with the same labels as the main environment: setfiles -r /chroot /etc/selinux/default/contexts/files/file_contexts /chroot I am considering adding an option to support chroot environments to restorecon, if I do that then I will probably back-port it to Lenny, but that won t happen for a while. For a simple chroot once the filesystem is labelled it s ready to go, then you can start daemons in the chroot environment in the usual way. Less trusted Chroot environments A reasonably common case is where the chroot environment is not as trusted. One example is when you run an image of an old server in a chroot environment. A good way of dealing with this is to selectively label parts of the filesystem as required. The following shell code instructs semanage to add file contexts entries for a chroot environment that is used for the purpose of running Apache. Note that I have given specific labels to device nodes null and urandom and the socket file log in the /dev directory of the chroot environment (these are the only things that are really required under /dev), and I have also put in a rule to specify that no other files or devices under /dev should be labelled. If /dev is bind mounted to /chroot/dev then it s important to not relabel all the devices to avoid messing up the real root environment and it s impractical to put in a specific rule for every possible device node. Note that the following is for a RHEL4 chroot environment, other distributions will vary a little some of the file names. semanage -i << END
fcontext -a -t root_t -f -d /chroot
fcontext -a -t bin_t /chroot/bin.*
fcontext -a -t usr_t /chroot/usr.*
fcontext -a -t usr_t /chroot/opt.*
fcontext -a -f -d /chroot/dev
fcontext -a -f -s -t devlog_t /chroot/dev/log
fcontext -a -f -c -t null_device_t /chroot/dev/null
fcontext -a -f -c -t urandom_device_t /chroot/dev/urandom
fcontext -a -t "<<none>>" "/chroot/dev/.*"
fcontext -a -t "<<none>>" "/chroot/proc.*"
fcontext -a -t lib_t /chroot/lib.*
fcontext -a -t lib_t /chroot/usr/lib.*
fcontext -a -t bin_t /chroot/usr/bin.*
fcontext -a -t httpd_exec_t -d /chroot/usr/bin/httpd
fcontext -a -t var_t /chroot/var.*
fcontext -a -t var_lib_t /chroot/var/lib.*
fcontext -a -t httpd_var_lib_t /chroot/var/lib/php.*
fcontext -a -t var_log_t /chroot/var/log.*
fcontext -a -t var_log_t -f /chroot/var/log/horde.log.*
fcontext -a -t httpd_log_t /chroot/var/log/httpd.*
fcontext -a -t var_run_t /chroot/var/run.*
fcontext -a -t httpd_var_run_t -f /chroot/var/run/httpd.pid
fcontext -a -t httpd_sys_content_t /chroot/var/www.*
END
You could create a shell script to run the above commands multiple times for multiple separate Apache chroot environments. If there is a need to isolate the various Apache instances from each other (as opposed to just protecting the rest of the system from a rogue Apache process) then you could start each copy of Apache with a different MCS sensitivity label which will provide adequate isolation for most purposes as long as no sensitivity label dominates the low level of any of the others. If you do that then the semanage commands require the -r option to specify the range. You could have one chroot environment under /chroot-0 with the sensitivity label of s0:c0 for it s files and another under /chroot-1 with the sensitivity label of s0:c1 for it s files. To start one environment you would use a command such as the following: runcon -l s0:c0 setsid chroot /chroot-0 /usr/sbin/httpd

25 July 2010

Russell Coker: SE Linux status in Debian/Squeeze

ffmpeg I ve updated my SE Linux repository for Squeeze to include a modified version of the ffmpeg packages without MMX support for the i386 architecture. When MMX support is enabled it uses assembler code which requires text relocations (see Ulrich Drepper s documentation for the explanation of this [1]). This makes it possible to run programs such as mplayer under SE Linux without granting excessive access something which we really desire because mplayer will usually be dealing with untrusted data. In my past tests with such changes to ffmpeg on my EeePC701 have resulted in no difference to my ability to watch movies from my collection, the ones that could be played without quality loss on a system with such a slow CPU could still be viewed correctly with the patched ffmpeg. $ mplayer
mplayer: error while loading shared libraries: /usr/lib/i686/cmov/libswscale.so.0: cannot restore segment prot after reloc: Permission denied The AMD64 architecture has no need for such patches, presumably due to having plenty of registers. I don t know whether other architectures need such patches, they might the symptom is having mplayer abort with an error such as the above when running in Enforcing Mode. The below apt sources.list line can be used to add my SE Linux repository: deb http://www.coker.com.au squeeze selinux dpkg In my repository for i386 and AMD64 architectures I have included a build of dpkg that fixes bug #587949. This bug causes some sym-links and directories to be given the wrong label by dpkg when a package is installed. Usually this doesn t impact the operation of the system and I was unable to think of a situation where it could be a security hole, but it can deny access in situations where it should be granted. I would appreciate some help in getting the patch in a form that can be accepted by the main dpkg developers, the patch I sent in the bug report probably isn t ideal even though it works quite well someone who knows absolutely nothing about SE Linux but is a good C coder with some knowledge of dpkg could beat it into shape. In my repository I don t currently provide any support for architectures other than i386 and AMD64. I could be persuaded to do so if there is a demand. How many people are using Debian SE Linux on other architectures? Of course there s nothing stopping someone from downloading the source from my AMD64 repository and building it for another architecture, I would be happy to refer people to an APT repository that someone established for the purpose of porting my SE Linux packages to another architecture. Policy selinux-policy-default version 20100524-2 is now in Testing. It s got a lot of little fixes and among other things allows sepolgen-ifgen to work without error which allows using the -R option of audit2allow see my post about audit2allow and creating the policy for milters for defails [2]. I have uploaded selinux-policy-default version 20100524-3 to Unstable. It has a bunch of little fixes that are mostly related to desktop use. You can now run KDE4 on Unstable in enforcing mode, login via kdm and expect that everything will work probably some things won t work, but some of my desktop systems work well with it. I have to admit that not all of my desktop systems run my latest SE Linux code, I simply can t have all my systems run unstable and risk outages. Let me know if you find any problems with desktop use of the latest SE Linux code, it s the focus of my current work. But if you find problems with chrome (from Google) or the Debian package chromium-browser then don t report them to me. They each use their own version of ffmpeg in the shared object /usr/lib/chromium-browser/libffmpegsumo.so which has text relocations and I don t have time to rebuild chromium-browser without text relocations I ll make sure it does the right thing when they get it working with the standard ffmpeg libraries. That said the text relocation problem doesn t seem to impact the use of Chromium, Youtube doesn t work even when the browser is run in permissive mode. GNOME is a lower priority than KDE for me at this time. But the only area where problems are likely to occur is with gdm and everything associated with logging in. Once your X session starts up GNOME and KDE look pretty similar in terms of access control. I would appreciate it if someone could test gdm and let me know how it goes. I ll do it eventually if no-one else does, but I ve got some other things to fix first.

Thorsten Glaser: FrOSCon 2010 ( Birthday FrOSCon ) approaching

FrOSCon 5 - 21./22. August 2010 is approaching rapidly. I m a bit envious at some of the tracks (I mean, really, geocaching (ok, I did the surrounging caches over the last years but still), learning python by means of game programming, etc. really sounds interesting and I know people who could benefit from a non-kids version of that as well) but this year s FrOSCon is nothing for me to curse about either: I managed to get both a booth for The MirOS Project (MirBSD, mksh and other subprojects) as well as one for Waldemar s FreeWRT (although wbx@ if he comes won t join there since he forked his own fork since its conception). Booth staff are, currently: tg@ and bsiegert@ (Developer), gecko2@ (Staff) for MirOS, tg@ and XTaran abe@ (Developer), kimnotyze (Hacker) for FreeWRT. (XTaran will probably be helping Debian/Grml too.) This year, it ll be my job (after 2 years of aptituz) to keep the Altbier-Fraktion watered, I m thinking one crate of Schl sser Alt and one crate of Hannen Alt? Have a look at the Program and don t tell me you won t come! It will rock! (Except there won t be Formorer s Chilli, but that s no reason, there s enough other stuff in manageable distance.) Besides interesting booths and talks, FrOSCon is still looking for helpers who will not only get free entrance but also catering during operation.

Russell Coker: SE Linux audit2allow -R and Milter policy

Since the earliest days there has been a command named audit2allow that takes audit messages of operations that SE Linux denied and produces policy that will permit those operations. A lesser known option for this program is the -R option to use the interfaces from the Reference Policy (the newer version of the policy that was introduced a few years ago). I have updated my SE Linux repository for Lenny [1] with new packages of policy and python-sepolgen that fix some bugs that stopped this from being usable. To use the -R option you have to install the selinux-policy-dev package and then run the command sepolgen-ifgen to generate the list of interfaces (for Squeeze I will probably make the postinst script of selinux-policy-dev do this). Doing this on Lenny requires selinux-policy-default version 0.0.20080702-20 or better and doing this on Debian/Unstable now requires selinux-policy-default version 0.2.20100524-2 (which is now in Testing) or better. Would it be useful if I maintained my own repository of SE Linux packages from Debian/Unstable that can be used with Debian/Testing? You can use preferences to get a few packages from Unstable with the majority from Testing, but that s inconvenient and anyone who wants to test the latest SE Linux stuff would need to include all SE Linux related packages to avoid missing an important update. If I was to use my own repository I would only include packages that provide a significant difference and let the trivial changes migrate through Testing in the normal way. The new Lenny policy includes a back-port of the new Milter policy from Unstable, this makes it a lot easier to write policy for milters. Here is an example of the basic policy for two milters, it allows the milters (with domains foo_milter_t and bar_milter_t) to start, to receive connections from mail servers, and to create PID files and Unix domain sockets. policy_module(localmilter,1.0.0)

milter_template(foo)
files_pid_filetrans(foo_milter_t, foo_milter_data_t, sock_file file )

milter_template(bar)
files_pid_filetrans(bar_milter_t, bar_milter_data_t, sock_file file )
allow bar_milter_t self:process signull;
type bar_milter_tmp_t;
files_tmp_file(bar_milter_tmp_t)
files_tmp_filetrans(bar_milter_t, bar_milter_tmp_t, file)
manage_files_pattern(bar_milter_t, tmp_t, bar_milter_tmp_t) After generating that policy I ran a test system in permissive mode and sent a test message. I ran audit2allow on the resulting AVC messages from /var/log/audit/audit.log and got the following output: #============= bar_milter_t ==============
allow bar_milter_t bin_t:dir search;
allow bar_milter_t bin_t:file getattr;
allow bar_milter_t home_root_t:dir search;
allow bar_milter_t ld_so_cache_t:file read getattr ;
allow bar_milter_t lib_t:file execute;
allow bar_milter_t mysqld_port_t:tcp_socket name_connect;
allow bar_milter_t net_conf_t:file read getattr ioctl ;
allow bar_milter_t self:process signal;
allow bar_milter_t self:tcp_socket read write create connect setopt ;
allow bar_milter_t unlabeled_t:association recvfrom sendto ;
allow bar_milter_t unlabeled_t:packet recv send ;
allow bar_milter_t urandom_device_t:chr_file read;
allow bar_milter_t usr_t:file read getattr ioctl ;
allow bar_milter_t usr_t:lnk_file read;
#============= foo_milter_t ==============
allow foo_milter_t ld_so_cache_t:file read getattr ;
allow foo_milter_t lib_t:file execute;
allow foo_milter_t mysqld_port_t:tcp_socket name_connect;
allow foo_milter_t net_conf_t:file read getattr ;
allow foo_milter_t self:capability setuid setgid ;
allow foo_milter_t self:tcp_socket write setopt shutdown read create connect ;
allow foo_milter_t unlabeled_t:association recvfrom sendto ;
allow foo_milter_t unlabeled_t:packet recv send ; Running the audit2allow command with the -R option gives the following output, it includes the require section that is needed for generating policy modules:
require
type sshd_t;
type ld_so_cache_t;
type bar_milter_t;
type foo_milter_t;
class process signal;
class tcp_socket setopt read create write connect shutdown ;
class capability setuid setgid ;
class fd use;
class file read getattr ;

#============= bar_milter_t ==============
allow bar_milter_t ld_so_cache_t:file read getattr ;
allow bar_milter_t self:process signal;
allow bar_milter_t self:tcp_socket read write create connect setopt ;
corecmd_getattr_sbin_files(bar_milter_t)
corecmd_search_sbin(bar_milter_t)
corenet_sendrecv_unlabeled_packets(bar_milter_t)
corenet_tcp_connect_mysqld_port(bar_milter_t)
dev_read_urand(bar_milter_t)
files_read_usr_files(bar_milter_t)
files_read_usr_symlinks(bar_milter_t)
files_search_home(bar_milter_t)
kernel_sendrecv_unlabeled_association(bar_milter_t)
libs_exec_lib_files(bar_milter_t)
sysnet_read_config(bar_milter_t)
#============= foo_milter_t ==============
allow foo_milter_t ld_so_cache_t:file read getattr ;
allow foo_milter_t self:capability setuid setgid ;
allow foo_milter_t self:tcp_socket write setopt shutdown read create connect ;
corenet_sendrecv_unlabeled_packets(foo_milter_t)
corenet_tcp_connect_mysqld_port(foo_milter_t)
kernel_sendrecv_unlabeled_association(foo_milter_t)
libs_exec_lib_files(foo_milter_t)
sysnet_read_config(foo_milter_t) To get this working I removed the require lines for foo_milter_t and bar_milter_t as it s not permitted to both define a type and require it in the same module. Then I replaced the set of tcp_socket operations write setopt shutdown read create connect with create_socket_perms as it s easiest to allow all the operations in that set and doesn t give any security risks. Finally I replaced the mysql lines such as corenet_tcp_connect_mysqld_port(foo_milter_t) with sections such as the following:
mysql_tcp_connect(foo_milter_t)
optional_policy(
mysql_stream_connect(foo_milter_t)
) This gives it all the access it needs and additionally the optional policy will allow Unix domain socket connections for the case where the mysqld is running on localhost.

Next.

Previous.