Thanks to Daniel for suggesting I try burning my ISO image with brasero in response to my problems burning images using nautilus. Unfortunately brasero won't offer me a burn ISO option 497226: brasero: Burn button disabled. No indication of why.. I just tried wodim directly and ended up with the same (wrong) sum for the burnt disc as with nautilus cd burner (not suprising really). I wondered if I was being bitten by 386640: wodim doesn't fixate DVD+R with premastered ISO, but trying to fix the disc did not update the sum. Taking an image of the burnt disc, I notice that the burnt image is longer size-wise than the input ISO by 10240 bytes. This turns out to be 10240 of zeroes appended to the image.

So, in the Membership Status GR, we sent a clear message that we wanted those decisions to be postponed. Now, we have a responsibility to prove that we were not just rejecting any change, but that our vote was really a vote against the way those decisions were announced, and/or those particular decisions. I m convinced that our management of membership needs to be improved. I hope that in the next weeks/months, we will be able to discuss proposals about membership status. There s Joerg s, there s Lars , there s Raphael s, and there might be other ideas. Ideally, each of them would be discussed and improved separately (because we can t be expected to agree on one proposal right from the start), and finally we would get to vote on a coherent set of proposals (with an unbiaised ballot ;) to choose in which direction we want to change our management of membership. It would be great to use the DEP process or something similar for that. It is also interesting to compare this whole story with our current issue: a secretary that ignored valid criticism about a ballot and went on with asking to vote on it. In both cases, someone that is generally trusted and respected by the project made a mistake, and failed to acknowledge it, requiring strong actions from other DDs. I wonder how the secretary crisis will end

When I was little, we moved around a lot. One of the things I was almost most excited by was the first night in the new place. My sister and I would usually stay there on our own, on the floor or perhaps on a sponge. I've always found moving exciting, with the new possibilities that come with it.

I notice, though, that as I get older the camping gets progressively more 'yuppy'. We might bring food and snacks, or a radio, or a laptop. As we're waiting for our stuff to get here, we've got shiny new couches, a new bed for Leif, and a new dining room table and chairs. Pictures will come soon. =)

We're all settling in well. We've almost completed the basic tasks of becoming a citizen of Quebec again. The driver's licenses are changed over, Angie and Leif's medical applications are done (mine will be done tomorrow). We have updated library cards, are signing up for Communauto this week. And we have been served with our Welcome Tax

I've really appreciated being able to check in with new and old friends. It's weird timing because so many people are returning home for the holidays, but still good because it means that we have a bit of time to get settled.

So happy to be home! =)

Just a quick note that I was planning to write as soon as possible: I m (still) having fun with debian !. Yes, things go slowly, yes we consume a lot of energy to discuss again and again the same things.. But, hey, that s what I am proud of ! Somehow, I truly appreciate people with which I had strong disagreement. I didn t like the moments when this generated frustration for me, but when I look at the overall picture, I really believe there are not a lot of projects who can still go on *and* support the level of free speech and opinions that we have. Diversity of opinions is a difficult thing for big projects, and I am proud we can afford it ! "We will not hide problems from our users." is one of the most meaningful sentence I got from this project, and all of this makes real sense to me. It is democracy !

Next semester I am teaching a new undergraduate course tentatively titled Technology, Society, and Media: The Body under Transition, in Movement, and under (Massive) Transformation(s). As designed, the course should address technology and media in fairly broad stokes (which I do) but I narrow and control what is a truly unwieldy subject by framing the issues/readings in relation to the human body. Generally speaking, we will interrogate the ways in which technology engenders or erases bodily/human possibilities/capacities and especially the ethical and political ramifications that precipitate from the use/abuse of technology. We traverse a wide range of topics from the telegraph (and how it was used to speak with the dead) to the role of human enhancement technologies of today, to questions of surveillance and privacy, among many other topics. I am pretty far along with the syllabus and pretty happy with it. So far I think I have struck a nice balance between fun/light/accessible readings and some which are bit more theoretically dense. I am still looking for one or two pieces, perhaps one on tattoos and body modification and another about karaoke. If anyone knows any great articles on these topics, do pass along the information. I am probably most excited about the cluster of issues that address eugenics (and most students know next to nothing about America s central role in unleashing the Eugenics movement), disability rights activism, human enhancement technologies, and transhumanism. Considering human enhancement in light of previous efforts to enhance our population brings into relief the similar and distinct ethical issues that haunt this field. One of the most hot button issues of today concern the use of human enhancing drugs. The prestigious journal Nature has just published an editorial on the topic of cognitive enhancement drugs,Towards responsible use of cognitive-enhancing drugs by the healthy, which is a fairly interesting read and covers some of the main controversies. For me, however, the interesting issue is not only whether human enhancement is right or wrong though this is certainly important but what our embrace of these drugs tell us about the conditions under which our bodies live and labor. That is, I think we are actually missing out on posing some other important questions simply by framing this int terms of human enhancement. I suspect, and this is where ethnography would really help out, that many people turning to enhancement drugs may not be medically sick, in the technical sense but I don t think they are healthy either. Many who turn to these drugs feel pretty worn, pretty exhausted, pretty frazzled (the perfect word, I think, is agotado, Spanish for exhausted) and use these drugs as crutches, as band-aids, as an elixir to help out one preserver in tough work circumstances. I am sure there are folks who take these drugs feel fine and are just trying to push their limits and capacities but I troll many many many patient support sites and it also seems to me that many people live under a state of low-grade chronic state of unwellness. Given the pace of society, given what and how we eat, given the extraordinary rates of depression in our society ,given the fact that babies are born with 200 + chemicals in their bodies (what a way to start out life) I am skeptical that enhancement really captures what is going on with these drugs. I have not yet come up with the right term, but I am trying to come up with a phrase that would reflect the ways in which these drugs are not used as therapies for a discrete condition (Type 1 diabetes) but how they are a collective response to a state of low grade chronic unwellness that seems to mark the lives of a whole lot of people. This, I think, would be one responsible approach to human enhancement technologies that would contextualize their use within a much broader frame, one that is attuned to how bodies have been made, remade, and limited under actual material conditions of labor and life in the 21st century.

This is really ironic, I've been waiting for a long time to have the right to vote in Debian. Now I have it, but I'm not sure if I want to exercise it. I don't think I need to explain much, many already did that before on planet. It basically boils down to:

• A GR that's an irrelevant overreaction; and whatever gets out of it wouldn't change much: for the paranoids, if J rg really wanted to push his idea after a GR opposing it, he only needs to tweak it a little to be different from "the changes described on the debian-devel-announce mailing list" [ref] and get on with it. If the intention was to send a message, that doesn't need a GR.
• Another GR which is: a perversion of our voting system, disconnected with reality, and a trap. Heck, if I wasn't reading the fine print I would say that any DD that doesn't vote for "Reaffirm the Social Contract" [ref] should be expulsed expelled right away, as we all agreed to "uphold the Social Contract and the DFSG in your Debian work" [NM], right? But it turns out that you're actually voting to postpone Lenny until hell freezes over, or so.
  I also think that the Secretary is abusing his position to push his agenda here.
• We are being pathetic, should people still trust our judgement to build the "best operating system"?

So, I second Noodles' proposal, to make this sillyness go away for good. Meanwhile, I have to decide if voting 2..21 or not voting at all. Tags: Planet Debian, Debian, Pol tica

I am somewhat under the feeling that the Debian project is currently facing a critical moment of its history. The development momentum has slowed down a lot during last months (approximately since Debconf and even more since October. I feel just like we're facing a moment where either we release Lenny (which is technically a great progress over Etch and, being a little bit more than 18 months after Etch, well suited wrt "modernity")....or we delay it for several months and will suffer more and more from the long freeze process (remember sarge). The momentum is then very likely to continue moving elsewhere (should I say Ubuntu or did everybody understand already?). And now we have to vote about firmware blobs, a proposal that popped up because a few (*very* few) vocal folks who (in my opinion) live on a planet that has no connection with the real world, think that we should triple check the freeness of each and every bit that is likely to be run on a Debian machine. Moreover, the proposal is worded and was pushed in a way that all (but one) options that would allow us to release lenny will need a 3:1 majority, which is obviously very hard to achieve (and as, there are several such proposals, the vote will be spread out among all of them). So, those folks who make the release of lenny their priority are now facing an interesting tactical choice: how the ..... should we vote for this to happen? I personnally did choose to vote this way: 5462371. Yes, I ranked "reaffirm the Social Contract" after everything, which makes me sad....and I blame the play on words by the zealots who pushed that proposal for forcing me to do this. I think this is the best "tactical" choice for those (and I hope we are a strong majority) who still make the *release* of the best possible and most possibly free operating system their priority. Believe me or not: if we don't release lenny soon, we will die slowly and rot peacefully. We will rot being 150% free and proud to be 150% free on our little planet, outside the solar system and the real world. *This* is the choice we are facing. Ah, and before I forget: film at 11, of course. PS: no comment system on my blog (I don't want to deal with spam and put complicated systems there). Please comment in public in your own blog. I very much prefer this over private comments which will be mostly ignored.

David Welgon has a nice post regarding his opinions on pros and cons on running a startup in Europe (Italy) and the USA (SF/Bay area). The first of the Italy cons got my attention:

Less of a startup culture and mentality. It's more typical to get a "job for life" and hang on to it for all you're worth. Many Italians are tremendously creative, industrious, inventive people, but are going to find it more difficult to express that in some form of business.

I know I am unlike many people, specially in this field... But anyway. I live in Mexico. Many factors in The Way Things Work are pushing people towards having an enterpeneur mentality - And what you see as a point against, I see as a very big advantage.
Some people have what it takes to run a business, and that's great. However, I think it is wrong to assume most people will benefit from running their own business - And specially in a country as mine. I cannot speak much about Europe, but from what you say, it confirms it is a good model of what I'd like Mexico to morph into.
Too many people start their companies with dreams of glory, thinking they have something to differentiate from the rest of the marketplace - and they lack it. So instead of enriching an existing company with more, and better focused, technical talent, they will end up making it poorer with yet another generic company with nothing new to offer, paying famelic wages to their employees, finding a way to skip the social security payments. And there are lots of legal ways to do so in Mexico - and a growing segment of the population has neither health care nor retirement savings, as this makes their day-to-day incomes substantially more juicy... But the future will bite them hard. Well, not only them - It will bite all of us. I still think we will inevitably, sooner or later, evolve into a more caring society, a society where the strong protects the weak, where it (via the State, the government) ensures nobody has under the minimum needed to have a decent life.
And, although I am essentialy a Socialist at heart, I do recognize there is place for people getting more money than others - After all, courage and creativity should be encouraged, and true enterpeneurs should get compensed for what they give to the society - But the ridiculous, stupid differences we get to see, specially in third world countries (remember that the world's richest man, Carlos Slim, lives on the same city I do, and around ~15 years ago even lived less than five blocks away from me... But I do have close family where having food daily on the table is far from a fact) are something that should disappear for good.
Loyalty to your employer and long-term job commitment are two values I hold very dear, and hope to be able to practice. So far, I have worked for eight years for UNAM (1999-2003 and 2005-present), and I hope to continue here for many years to come. I was just talking about this with a friend - The payment itself is far less than what I could get somewhere else, but the work conditions and long-term viability are more than enough to repay for the difference. And I am sure many of my friends and acquintances would be much better off if they stopped prioritizing getting more money now in respect to leading a better, richer life - And, of course, if we all valued more giving back to the society, as we will probably all need to ask from it sooner or later.

Via Steve (new domain name, otherwise as usual), this inspiring little PowerPoint-ish presentation from Dr. Steven Chu, Obama s choice for Secretary of Energy: This video features about as many charts per minute as did An Inconvenient Truth, but left me far more hopeful about our long-term prospects on Earth. It is reassuring to see so many powerful positions being filled by people with domain expertise, rather than partisan hacks. If this administration doesn t get us back on course, we might as well stop having children. Technorati Tags: Steven Chu, Obama, Climate Change, Energy, Environment

Now we have seen what per-process namespaces and shared subtrees are and how to operate them, we can try to combine these two features. We ll be using our newns tool from this earlier post to create new namespaces. And for practical reasons, let s say you have a terminal with a 1$ prompt and a second terminal with a 2$ prompt (that will allow me to skip go to the second terminal phrases). In the kernel, per-process namespaces are a bit like bind mounts, such that shared subtrees work with namespaces like they do with bind mounts. As with standard bind mounts, the default shared subtree mode is private, which means mounts done on either namespaces will be private to the namespace. Only mount points active at the time of the new namespace creation will be in both namespaces:

1$ ./newns
1$ mount /dev/sda1 /mnt
1$ ls /mnt
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
2$ ls /mnt
2$ mount /dev/sda1 /cdrom
2$ ls /cdrom
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
1$ ls /cdrom
1$ umount /mnt
1$ exit # Exit from newns
2$ umount /cdrom


shared mode allows both namespaces to share subsequent mounts. As with bind mounts, and for obvious reasons, you need to change the subtree mode before creating the new namespace:

1$ mount --make-rshared /
1$ ./newns
1$ mount --bind /usr /mnt
1$ ls /mnt
bin games include lib lib32 lib64 local sbin share src X11R6
2$ ls /mnt
bin games include lib lib32 lib64 local sbin share src X11R6


Like with shared bind mounts, the new mount point can be unmounted from either namespace:

2$ umount /mnt
1$ ls /mnt
1$ exit # Exit from newns

A slave subtree will have mount points under its master (shared) subtrees propagated, while propagation won t happen in the other direction. Again, very much like bind mounts:

1$ mount --make-rshared / # For completeness, we already did that earlier
1$ ./newns
1$ mount --make-rslave /
1$ mount --bind /usr /mnt
1$ ls /mnt
bin games include lib lib32 lib64 local sbin share src X11R6
2$ ls /mnt
2$ mount --bind /usr /cdrom
2$ ls /cdrom
bin games include lib lib32 lib64 local sbin share src X11R6
1$ ls /cdrom
bin games include lib lib32 lib64 local sbin share src X11R6
1$ exit # Exit from newns
2$ umount /cdrom


Contrary to shared and slave, unbindable doesn t add value when used in two different namespaces. This is only something that will have impact on the current namespace:

1$ mount --make-rshared / # For completeness, we already did that earlier
1$ ./newns
2$ mount --make-runbindable /
2$ mount --bind /usr /mnt
mount: wrong fs type, bad option, bad superblock on /usr,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg tail or so
1$ mount --bind /usr /mnt
bin games include lib lib32 lib64 local sbin share src X11R6
1$ exit # Exit from newns
1$ mount --make-rprivate # Set back to default

Now we ve seen what can be done with namespaces and shared subtrees, let s see what nice features can be implemented with both. As Russell revealed, pam-namespace is able to polyinstanciate some directories following rules set in /etc/security/namespace.conf (see namespace.conf(5)). The sad thing is that it apparently can t just create a new namespace without polyinstanciating a directory, which could be useful if you only want separate namespaces, but no polyinstanciated directory. Russell s recipe goes as follows:

• At boot time, / is put in shared mode and /tmp in private mode.
• When opening a session, pam will create a new namespace, and bind mount /tmp-inst/$USER to /tmp.

What this means is that in the newly created namespace, a user reading in /tmp will actually be reading in /tmp-inst/$USER without the user knowing. Also, if root mounts something on the parent namespace, it will be propagated (/ being shared) to the user namespace. This means that mounting USB storage, for example, will be propagated to the user namespace. This also means that something mounted from the user namespace will also be propagated to the parent namespace. In both cases, this only applies to mounts occuring outside of /tmp, for which mounts don t get propagated. Note that without setting /tmp as private, when PAM would be mounting /tmp/inst/$USER, it would propagate as well, setting /tmp to /tmp/inst/$USER for everyone. So setting /tmp as private is mandatory. There is, however, a flaw in Russell s recipe: If any of the user mounts something under a submount of /, under /var for example, if /var is mounted, it won t be mounted to a user that already had a session opened. For that to be possible, you have to use --make-rshared instead of --make-shared in Russell s recipe. Some nice setup that can be done with all these, is the following: Add the following to /etc/security/namespace.conf:

/tmp tmpfs tmpfs root

Add the following to /etc/pam.d/common-session:

session required pam_namespace.so

Until here, it is pretty much the same as Russell s, except /tmp is a tmpfs instead of a real directory in /tmp-inst/, which can have some advantages. It doesn t seem to be possible to give pam-namespace a size for the tmpfs, though. Add the following to /etc/rc.local:

mount --make-rshared /
mount --bind /tmp /tmp
mount --make-private /tmp

Here again, this is the same as Russell s except for the correction for --make-rshared as seen above. If /tmp is already a mount point (on my systems, it is a tmpfs), you can remove mount --bind /tmp /tmp from above. Add the following to /etc/security/namespace.init:

mount --make-rslave /

Now, this is where it gets interesting: we re setting the whole tree as slave in the user namespace which means that if a user mounts a file system anywhere, it will only be seen in his session. Which means the user can more safely mount encrypted volumes: they won t be available to other users (root can still go wandering in /dev/kmem, though). And you don t even need SE linux for that. The caveat is that if you open a root session with su, from the user session, you are still inside the user boundaries, and don t have access to the virtual filesystem as it is for init. And if you mount something as root then, while it will appear in the user namespace, it won t appear neither in other users namespace nor in init s, which can be a good thing in some cases, but a burden in others. It means you may need to setup a special user that won t get a new namespace in /etc/security/namespace.conf. An alternative model would be to only set the user s home as slave, which means anything mounted by the user in his home directory would stay private in his namespace, while anything mounted outside would be shared with other namespaces. For that, you may want to replace the lines we added to /etc/security/namespace.init with the following:

HOME=$(getent passwd $3 cut -d: -f6)
mount --bind "$HOME" "$HOME"
mount --make-rslave "$HOME"


Either way, the remaining problem is that a root session opened with su from the user session won t get access to the original /tmp. As we saw, there are various use cases for namespaces and shared subtrees. I ll follow-up again on these features soon, as I ll be using them in yet another way to achieve a very different purpose.

Michael Arrington of Techcrunch comments on the US vs Europe in terms of startups: Joie De Vivre: The Europeans Are Out To Lunch It's a pretty rough and coarse-grained view of things, but there's a grain of truth there. I've written about this a little bit before. It's something that I feel qualified to talk about, having lived and worked in both the US and Europe (Italy and Austria to be precise), and in that time, generally gravitated towards startups. Here's my quick take on a list of what's good and bad about each. Please note that these are of course not true for everyone, that things are changing, but are still things I think are generally true, even when I could think of several counterexamples for some of them myself. Also, it's very important to keep in mind how diverse "Europe" is, so most of what I write is really about Italy, and to a much smaller degree, Austria. I'd be very curious to hear your own experiences in the comments. Europe Bad

• Less of a startup culture and mentality. It's more typical to get a "job for life" and hang on to it for all you're worth. Many Italians are tremendously creative, industrious, inventive people, but are going to find it more difficult to express that in some form of business.
• The side effects of this mean that there are fewer people to talk with, and network with, fewer potential employees willing to risk a startup, and so on. For instance, people are at times more suspicious of a new company - both clients and suppliers.
• As I mentioned in my other article, it takes a lot more money to get started in many European countries - something like 10,000 Euro in Italy. Other places like the UK are cheaper, and apparently Germany is introducing some legislation to ease the burden on new companies. I really hope this changes in Europe because it's such an easy change to make: don't extract money from companies until they're making it.
• More bureaucracy. I think that higher taxes, once you are profitable, might be worth paying for the social system you get in Europe, but the cost of sorting out paperwork falls inordinately on smaller, newer companies. Big, established firms can hire people to deal with all the rules and regulations, and probably have contacts in the government that can help them out in some cases. Smaller firms are the ones whose time is really going to be wasted running around to different offices trying to figure out what they have to do.
• Smaller, fragmented markets. Localization is not a lot of fun in some ways, and trying to translate everything into all the languages of the European Union is a huge undertaking. In the US, you get a huge market with just English and the US Dollar. Even beyond language issues, the culture changes less in the US from place to place, meaning that you have a more homogeneous target.
• Lack of acceptance of failure, both culturally and institutionally. If you go bankrupt in Italy, it's a very serious problem. Apparently (although this is second hand, I'm not 100% sure of it - maybe someone can confirm whether it's actually true?), you can even lose the right to vote. Plenty of people in the US try several times before they get it right.

Good

• Even if your undertaking fails, you still have health care. Likewise, there are other bits and pieces of social support (that change from country to country) that mean you're probably not going to land quite so hard on your rear if things go wrong.
• Lots of smart, educated people. I never lacked for plenty of smart people to talk shop with in Padova, and didn't miss the California bay area at all from that point of view. Open source is really big in Europe - perhaps, in part, because for many people it's a better avenue for their talents than creating a business, when doing so is difficult and less common.
• Work/life balance. Sorry Mike, but the amount of people who are truly going to strike it rich is pretty small. If they want to work hard, great, but it's nice to have some other options, in terms of good, lasting friendships (rather than everything revolving around work), knowing plenty of people from outside your field, people living in and belonging to a community (how many people spend their whole lives in the bay area?). When I moved from San Francisco to Padova in 2000, I went from a world gone mad with money and the dot com craze to one where there were rich and poor, families, young people, old people, and many people who were not working for some dot com. That's not to say that people don't work quite hard in Italy - two hour lunches are a thing of the past for most anyone I know.
• Smaller fragmented markets can be an advantage, too. By the time some valley-based startup finally gets around to noticing that languages other than English exist, it's possible to capture a smaller market. Ok, so you won't be the next Google that way, but there's good money to be had in doing so.
• In some ways, the staid, established, don't rock the boat way of doing things in some industries may present big opportunities for outsiders to come in and pull the carpet out from under everyone. This is especially true of internet/web companies that can get started quickly and cheaply.

US Bad

• If you're not careful, you can get completely sucked in to work - your life revolves around it, your friends are mostly work friends, and if something happens to your job, a lot of that goes poof. This is especially true in places like the bay area, where so many people are 'transients' - just there for a few years, without any real roots in the area. This is ok if you'll potentially make a big pile of money, but long term it's unhealthy.
• Less of a sense of building for the long term. Personally, I don't want a "job for life", but I think there is some value in loyalty (the genuine sort, not the sort created by legally not being able to lose a job) between employer and employee that has been lost in the US. Being able to count on someone growing with your company, and as an employee, knowing that your company will do what it can to help you out even in tough times are things that capture some value. The US seems to be heading towards a "Coasian" world where everyone is a freelancer, and while that efficiency is hard to deny, I wonder what is lost in the process.
• The competition is tough. Sure, it is in Europe too, but in Europe everyone may compete quite hard during the year, but still all take that one month vacation (although that is becoming a bit less common, especially amongst people my age), whereas in the US almost no one gets that kind of benefit - even if you wanted to take unpaid time off, people would look askance at that kind of behavior. That said, if you need to stay open in, say, August, in Italy, to compete, you are in big trouble, because for many businesses it's simply impossible because it's a chain reaction: all your suppliers and clients shut down, so you really have no choice.

Good

• There are certainly bureaucratic obstacles in the US, but are much more maneageable, and don't hit smaller/newer companies quite so badly.
• It's cheap to get started. As per my other article, the actual state filing fee in Oregon for an LLC is $55, and that's all you really need.
• The culture is definitely there, especially in the right places like the Bay Area, but even in plenty of others.
• You aren't bound to employees for life, and it's easy to find freelancers. I know I'm contradicting myself, but I think it's actually a complex issue, and there are definite advantages to not having people who expect or at least want to find that job for life.
• A large target market. Go online in one state, and you can, for the most part, deal with customers all over the US, in one language.
• Things turn around faster. I have more of a sense that when there are problems, they get fixed. Companies (the debacle of the automakers notwithstanding) are more often allowed to fail, or at least put in Chapter 11. Sometimes this means that when things are bad, they get really bad, but also turn around and get better sooner.

Conclusions An interesting example of all this from my own experience was Linuxcare. The company was, culturally, a Bay Area startup, with the headquarters in San Francisco, founded by very startup oriented guys (one of whom, Dave Sifry, went on to do technorati, and is currently working on yet another venture). However, most of the actual open source talent was in our satellite offices, in Australia, Italy and Canada, places where, perhaps, people were not so distracted by the prospect of "make money fast!!! hurry!!!" that they had time to work, learn, and create some really great open source code. To be honest, I find myself torn. Business-wise, I prefer the US. However, outside of that, there's a lot to be said for Europe. I also think that some of what's good about business in the US is coming to Europe, albeit slowly in some cases, in Europe. People my age here can see what's going on elsewhere, and try and copy what they like. A lot of what's good about Europe, though, might be more difficult to import into the US, especially the livability of the cities. In any case, I can conclude that it's a complex, difficult topic best discussed over a glass of wine.

As reply to my previous post about per-process namespaces, Russell wrote about pam-namespace and shared subtrees. As he reports, pam-namespace (that I discovered by the occasion) can do what I was suggesting would be nice for pam-tmpdir. Anyways, I was actually already planning to write about shared subtrees and how they can be useful with namespaces. In this first post, I will introduce shared subtrees, while in a follow-up post I will introduce how they can usefully be used with namespaces. As a preliminary note, you should know that while etch’s kernel supports shared subtrees, etch’s mount doesn’t support the necessary options. Lenny’s mount is unfortunately uninstallable on etch due to its dependency on a newer libc. But you can find a smount utility’s source code in Documentation/filesystems/sharedsubtree.txt in the kernel source, where other explanations about the feature are available. So, you can either backport lenny’s util-linux to etch, or build smount to replicate what I will be doing below. If you are using smount, just replace

mount --make-type path

with

smount path type

As seen in my previous post, bind-mounting allows to attach a file hierarchy at some other place in the virtual file system.

mount --bind / /mnt

will make all the contents of / (/bin, /etc, …) available through /mnt (/mnt/bin, /mnt/etc, …). On the other hand, sub-mounts will be ignored in such a case. For instance, /usr is usually a different mount point from /. It means /mnt/usr will be empty (provided it is empty in the underlying physical filesystem), instead of containing the same as /usr:

$ mount --bind / /mnt
$ ls /mnt/usr
$ ls /usr
bin games include lib lib32 lib64 local sbin share src X11R6
$ umount /mnt


If you also want /usr to be bind-mounted, you must use --rbind instead of --bind:

$ mount --rbind / /mnt
$ ls /mnt/usr
bin games include lib lib32 lib64 local sbin share src X11R6
$ ls /usr
bin games include lib lib32 lib64 local sbin share src X11R6


Obviously, sub-sub-mounts will also be propagated. Since recursively bind-mounting will create a bunch of mount points, unmounting can become a hassle. You can use the following command to unmount everything:

$ awk '$2 ~ /^\/mnt/ print $2 ' /proc/mounts sort -r xargs umount

Now, this is where shared subtrees come in. After the bind mount has been done, if you mount something on either side of the bind mount, the new mount is not propagated. This is called private subtrees, and is the default. But before doing anything else, let’s setup our testing environment:

$ mkdir -p /a/a /b
$ touch /a/b /a/c
$ ls /a
a b c
$ ls /b


After, bind-mounting /a onto /b, let’s see what happens when mounting something under /a, then under /b:

$ mount --bind /a /b
$ ls /b
a b c
$ mount --bind /usr /a/a
$ ls /a/a
bin games include lib lib32 lib64 local sbin share src X11R6
$ ls /b/a
$ umount /a/a
$ mount --bind /usr /b/a
$ ls /a/a
$ ls /b/a
bin games include lib lib32 lib64 local sbin share src X11R6
$ umount /b/a


As I said earlier, these new mounts are not propagated. Note that I used bind-mounts as sub mounts, but it would work all the same with other kind of mounts (device, fuse, etc.). There are 2 other modes that allow to have some propagation: shared and slave. shared allows mounts on both ends to be shared. Note you need to set the mode before bind-mounting:

$ umount /b
$ mount --bind /a /a # This is needed because /a is not initially a mount point and you can only apply subtree modes to mount points.
$ mount --make-shared /a
$ mount --bind /a /b
$ mount /dev/sda1 /a/a
$ ls /a/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ ls /b/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ umount /a/a
$ mount /dev/sda1 /b/a
$ ls /a/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ ls /b/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ umount /b/a


You can even mount on one end and unmount from the other:

$ mount /dev/sda1 /a/a
$ umount /b/a
$ ls /a/a


slave allows mounts on the “master” end (/a in our case) to propagate to the “slave” end (/b), but not the other way around. The “master” end need to be shared :

$ umount /b
$ mount --make-shared /a # Only for completeness, we already set /a as shared earlier.
$ mount --bind /a /b
$ mount --make-slave /b
$ mount /dev/sda1 /a/a
$ ls /a/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ ls /b/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ umount /a/a
$ mount /dev/sda1 /b/a
$ ls /a/a
$ ls /b/a
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
$ umount /b/a


There is a third mode, unbindable, that does something different:

$ umount /b
$ mount --make-unbindable /a
$ mount --bind /a /b
mount: wrong fs type, bad option, bad superblock on /a,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg tail or so
$ mount --bind /a/a /b
mount: wrong fs type, bad option, bad superblock on /a,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg tail or so


As you can see, it disallows bind mounting of /a and its subdirectories to some other place. Finally, to put back the default mode, you can use:

$ mount --make-private /a

Similarly to --bind, there is also a recursive version of each: rshared, rslave, runbindable and rprivate, to apply these to sub-mounts.

---

Mike Hommey blogged today about Per-process namespaces.
That reminded me to blog about switchsh, a very useful program (now in sid) to help workaround those programs that believe that /bin/sh is always /bin/bash, in other words: it bind-mounts bash as /bin/sh.

Package description follows:

Small program to bind-mount bash as /bin/sh for its child processes.

It can be used when bash is not the default shell interpreter but a given
program makes use of bashisms (features not required by Policy for sh) and one
wants to run it without changing (or can not change) the default sh.

Let's take a look at how switchsh can help us:

$ cat evil_script.sh
#!/bin/sh
echo -ne "Hello!\nPlease enter your name: "
read
echo "So, you are $REPLY, right?"

$ readlink /bin/sh
dash
$ ./evil_script.sh
-ne Hello!
Please enter your name:
read: 4: arg count
So, you are , right?
$ switchsh ./evil_script.sh
Hello!
Please enter your name: Raphael
So, you are Raphael, right?

But lets consider the following case:

$ cat evil_script.pl
#!/usr/bin/perl -W
my $res =  git gc &>/dev/null ;
if ($? eq 0)  
    print "Done\n";
  else  
    print STDERR "bang! something went wrong\n";
 

$ ./evil_script.pl
fatal: Not a git repository
Done
$ switchsh ./evil_script.pl
bang! something went wrong

But what happens when bashisms are used on a binary object? Say in OpenOffice.org, in X.org, Wine, or any other large project that take not less than a couple of hours to build in a "normal" machine? you really want to have switchsh in those cases (and file a bug as soon as you notice that running a program with and without switchsh makes it behave differently).

It’s almost Christmas and time to buy scientific toys for children. Here are some random ideas, of course it’s probably too late for the online stores to deliver - but there’s always next year. The MikroKopter is a kit helicopter based on four propellors (two rotating in each direction) and is capable of semi-autonomous flight while carrying a decent payload (such as a digital camera) [1]. The parts cost over E700 and the skill involved in assembling it is significant, but it would be an excellent present for anyone who is 14+. Of course the type of helicopter described in my previous post [2] is a much more affordable present and can be used by a young child. The scitoys.com site has a good range of scientific toys for sale [3], they are assembled into kits. The United Nuclear site has a huge range of chemical supplies and related things [4] that can be used for making some great science experiments and toys. They also have really detailed information about the potential hazards of the things that they sell (not that I was planning to buy Cesium or Uranium anyway). If buying exotic alloys elsewhere it’s probably a good idea to check the United Nuclear site for the hazard information (not all sites provide as much information as they should). Professor Bunsen is an Australian site selling similar produces to SciToys [5]. The range is slightly different, and if you are in Australia then it’s safer to buy locally - there is a significant amount of stuff on the United Nuclear site that would be unlikely to pass Australian customs. The Spirograph is a good way to introduce mathematical concepts to children [6], it would probably be a good present for children who’s parents are not interested in maths and science. Lego [7] is always good, but there are also other similar products to consider. Meccano is good for older children, but the ranges for younger children have some deficiencies (the 2+ stuff requires the finger strength of an adult to assemble all parts). The Italian company Quercetti has some great products [9]. Unfortunately their web site is only in Italian and they have no links to sites in other countries/languages (they do have the names of some distributors who may have web sites). Their products includes a gears set (suitable for teaching children as young as 1yo) and a model car with an engine that has pistons moving inside a clear plastic case, a two-speed gearbox, and a fully functional differential (designed for 2yo+). For more hands-on tasks that require supervision (not something that can go under a tree) one good option for ages 3+ is to disassemble a variety of computers and computer parts. CD-ROM drives are good because you can connect a 9V battery to the head assembly motor or the tray eject motor to make it work. Hard disks have insanely strong magnets inside them - don’t give two such magnets to a child. A multi-meter is a great educational toy that can be used for many great experiements (as well as for practical tasks such as determining which battery of a set is flat) [10]. The parts from a hard disk can be used to demonstrate how a generator works (the mechanism to move the heads provides you with strong magnets and a coil that fits them). Note that an analogue meter is needed for such experiments as the amount of electricity generated is small and AC - a digital meter will average it out to zero (at least for the more affordable meters that I have used). It’s probably best to own both a digital meter and an analogue one, the minimum age for owning such a meter is probably about 10, the minimum age for using one with supervision is about 3. An oscilloscope is a great educational toy [11], unfortunately they are quite expensive (Ebay seems to have nothing below about $450). They can be used for all sort of fun tasks such as measuring the speed of sound. The wikipedia page notes that you can get PC based Oscilloscopes (PCO) which are cheaper. I wonder if they have Linux support for such things… The OLPC is a great computer for kids in developing countries [12]. They are now available in Australia [13]. For most children in first-world countries a second-hand laptop of a more traditional design is probably a better option. There are a significant number of old laptops gathering dust which can easily have Linux installed with a variety of educational software. Buying an OLPC on the “give one get one” deal costs $400US plus tax and shipping, while a second-hand laptop can be purchased for significantly less than that. While giving an OLPC to some random needy child is a good thing, as the person who gives a laptop locally is probably going to provide support for it there are some benefits to giving a regular laptop. Conferences often have bags of random junk to give out to delegates, and trade shows always have lots of little toys with company logos on them. Such things are usually of little use - but children like them. Also the trinkets that computer companies give away are often educational. If you have a cupboard filled with such things then unloading them on some children is a good idea - of course you have to make sure that anything you give to young children can’t be swallowed and has no sharp points.

• [1] http://www.mikrokopter.de/ucwiki/en/MikroKopter


• [2] http://etbe.coker.com.au/2008/12/11/toy-helicopter/


• [3] http://scitoys.com/


• [4] http://unitednuclear.com/


• [5] http://www.profbunsen.com.au/


• [6] http://en.wikipedia.org/wiki/Spirograph


• [7] http://www.lego.com/


• [8] http://www.meccano.com/


• [9] http://www.quercetti.com/


• [10] http://en.wikipedia.org/wiki/Multimeter


• [11] http://en.wikipedia.org/wiki/Oscilloscope


• [12] http://laptop.org/


• [13] http://www.olpc.org.au/

Linux has had this neat feature for quite some time now: since 2.4.19 according to the docs. Yet, it is neither very known nor very used. I couldn’t even find a program that would create a new namespace for its subprocesses, similar to what chroot does with the root of the file hierarchy. This neat feature allows each process to have a different set of mount points. While you most of the time want processes to share their mount points, there are some cases where you may want to have some processes have a different set of mount points. Combined with bind mounts, it can allow some useful setups. In case you are not familiar with bind mounts, they allow to “attach” a part of the file hierarchy to some place else. For example:

$ ls /mnt
$ ls /usr
bin games include lib lib32 lib64 local sbin share src X11R6
$ mount --bind /usr /mnt
$ ls /mnt
bin games include lib lib32 lib64 local sbin share src X11R6

Now, take pam-tmpdir, for example. It sets $TMPDIR and $TMP to point to a user-specific temporary directory. Sadly, it is pretty useless for applications that don’t follow the standards of using these environment variables. Without namespaces, if you’d create a temporary directory and bind-mount it to /tmp, this new /tmp would be visible to everyone, to every process. But with namespaces, you can make this new /tmp only available to subprocesses. If pam-tmpdir were to do this, it would also allow applications trying to write to /tmp without resorting to $TMP or $TMPDIR to be using the temporary space, without impacting external processes, that would still be using the original /tmp. On x86-64, you can run both 64-bits and 32-bits applications. 64-bits applications would take libraries from /usr/lib, and 32-bits applications would search libraries in /usr/lib32. But badly crafted 32-bits applications could be trying to load libraries from /usr/lib, where only 64-bits versions are available. With namespaces, the broken 32-bits application could have /usr/lib32 bind-mounted to /usr/lib without the 64-bits applications knowing. You could certainly get a similar result with the following set of commands:

$ mount --rbind / /chroot
$ mount --rbind /usr/lib32 /chroot/usr/lib
$ chroot /chroot $application

(–rbind also attaches submounts, contrary to –bind) The downside, here, is that external processes will see all this setup under /chroot. The whole setup would be invisible to external processes if namespaces were used. Another nice use of namespaces would be to mount encrypted volumes under a different namespace, so that only a limited set of processes would be allowed to read the decrypted data. The sad thing is that you need the admin capability to create a new namespace, so that would need to be done by a setuid root program. There are, as far as a few hours fiddling showed me, 2 system calls that will setup a new namespace: clone(2), and unshare(2). The second is easier to use, though only available since 2.6.16. But while etch ships 2.6.18, the glibc coming with it doesn’t implement unshare(2), so we need to use syscall(2) instead. The following code will run /bin/sh, or any command given as argument after creating a new namespace. The new process and its subprocesses will inherit the new namespace.

#include <sched.h>
#include <syscall.h>
#include <unistd.h> int main(int argc, char *argv[])
  syscall(SYS_unshare, CLONE_NEWNS);
  if (argc > 1)
    return execvp(argv[1], &argv[1]);
  return execv("/bin/sh", NULL);



This tool, once built, is called newns in the following example.

$ mkdir /tmp/abc
$ ./newns
$ mount -n --bind /tmp/abc /tmp
$ touch /tmp/a
$ ls /tmp
a
<in another terminal>
$ ls /tmp
abc
$ ls /tmp/abc
a


When using namespaces, it is better not to have mount fill /etc/mtab, using the -n argument. /proc/mounts will contain the proper mount information about the namespace of the process reading it. /proc/PID/mounts will contain the mount information for the given process. As bind mounts also work on files, you can override some files. The following will run dash instead of bash (in subprocesses, too, obviously):

$ ./newns sh -c "mount -n --bind /bin/dash /bin/bash; /bin/bash"

Back to the idea of having encrypted volumes only available to some processes, the following should work (unverified):

$ ./newns sh -c "encfs /tmp/crypt-raw /tmp/crypt; /bin/bash"

Only the opened bash, and its subprocesses, would have access to /tmp/crypt. The newns tool used above could, to allow normal users to be able to fiddle with namespaces, be improved to be a setuid root program that would drop its privileges right after unshare(2) to take the same privileges as the calling process. As you can see, per-process namespaces have a wide range of possible uses ; it’s astonishing that it’s not more used yet, considering its age. Additionally to per-process namespaces, there are also a bunch of other (more recent) features that allow to implement vserver-like features with a vanilla kernel, such as networking netspaces (work under progress, though), PID namespaces and utsname (see uname(2)) namespaces. Actually, these features are designed to be used by vserver and openvz. I am looking forward to having unprivileged mounts implemented, so that users could fool around with bind mounts. Unprivileged namespaces would be a nice addition.

King Politics thinks the GOP anti-bailout faction has the politics of the day wrong:

The time for pragmatism is now, but Senate Republicans don t recognize that. Senate Republicans have yet to realize that the GOP lost so many seats in 2006 and 2008 because the American public has a greater desire for pragmatism than ideology.

I think that s true to a point but I suspect it has more to do with post-Katrina George W. Bush than any coherent definition of ideology. As much as the Democrats would like to pretend otherwise, ideological is not a term I d readily apply to the bumbling nature of Bush s second term. Nor am I really convinced that the average voter is doing much more than engaging in post-hoc rationalized-as-something-else economic voting, which doubtless makes me no fun at parties when I play a public opinion scholar. ( Yes, all this crap matters at the margins, and occasionally elections are won at the margins, but most of the time it doesn t matter. ) But I digress. There is a broader lesson, though, in that to the extent the Democrats believe that their recent success is due to their ideology it is at their long-term peril, particularly if they bypass pragmatism in favor of catering to the cobbled-together collection of rent-seekers that passes for the Democratic coalition. To the extent bailing out Detroit is seen as a Democatic handout to its paymasters particularly with the emerging frame of the greedy unions are standing in the way trumping any sort of concept that any deal that tells the UAW to can their contract is essentially an impairment of the obligation of contract (which, believe it or not, is unconstitutional) the auto bailout won t go over well in the 48 or so states that don t host significant Big Three production. On a related note, Steven Taylor notes the defining-down of the filibuster by the media to mean failure to win a cloture vote. While I accept the point graciously, I think this may be more a failure of us as a profession than the media per se; modern congressional procedures (not just filibusters and holds, but also esoterica such as the Rules Committee and UCAs), even superficially treated, aren t a strong point of most American government textbooks, and more often than not that s the only real government orientation budding journalists will get. I make a point of assigning Barbara Sinclair s Unorthodox Lawmaking in my Congress classes, but I doubt the average journalist gets that in-depth in their undergrad days. So here at least I think the blame falls somewhat closer to home than we might want to admit.

King Politics thinks the GOP anti-bailout faction has the politics of the day wrong:

The time for pragmatism is now, but Senate Republicans don t recognize that. Senate Republicans have yet to realize that the GOP lost so many seats in 2006 and 2008 because the American public has a greater desire for pragmatism than ideology.

I think that s true to a point but I suspect it has more to do with post-Katrina George W. Bush than any coherent definition of ideology. As much as the Democrats would like to pretend otherwise, ideological is not a term I d readily apply to the bumbling nature of Bush s second term. Nor am I really convinced that the average voter is doing much more than engaging in post-hoc rationalized-as-something-else economic voting, which doubtless makes me no fun at parties when I play a public opinion scholar. ( Yes, all this crap matters at the margins, and occasionally elections are won at the margins, but most of the time it doesn t matter. ) But I digress. There is a broader lesson, though, in that to the extent the Democrats believe that their recent success is due to their ideology it is at their long-term peril, particularly if they bypass pragmatism in favor of catering to the cobbled-together collection of rent-seekers that passes for the Democratic coalition. To the extent bailing out Detroit is seen as a Democatic handout to its paymasters particularly with the emerging frame of the greedy unions are standing in the way trumping any sort of concept that any deal that tells the UAW to can their contract is essentially an impairment of the obligation of contract (which, believe it or not, is unconstitutional) the auto bailout won t go over well in the 48 or so states that don t host significant Big Three production. On a related note, Steven Taylor notes the defining-down of the filibuster by the media to mean failure to win a cloture vote. While I accept the point graciously, I think this may be more a failure of us as a profession than the media per se; modern congressional procedures (not just filibusters and holds, but also esoterica such as the Rules Committee and UCAs), even superficially treated, aren t a strong point of most American government textbooks, and more often than not that s the only real government orientation budding journalists will get. I make a point of assigning Barbara Sinclair s Unorthodox Lawmaking in my Congress classes, but I doubt the average journalist gets that in-depth in their undergrad days. So here at least I think the blame falls somewhat closer to home than we might want to admit.

The best way to get me to read a blog entry you've made is to apologize about it in the next one ... So I've gone and clicked on the link to Amaya's previous entry. Getting a warning that I'm about to be presented with a page that may contain material only suitable for adults. What the hell, Amaya is an adult and so am I, so let's just confirm this. I was truly shocked to see her entry that indeed did contain the extremely dangerous word “love” in it (can't imagine what else may have triggered the filter.) Together with Youtube's apparent tightening of their filtering (I'd not have noticed except that Illiad commented on it) it seems the Intarwebs are now being converted to a happy teletubby-land. So I'm forced append this disclaimer now: Attention please, the text you've just read may have contained strong words, opinions, sentences, punctuation characters and all kinds of dangerous information only suitable for inhabitants of a small planet somewhere in the vicinity of Betelgeuse.