Using the “ulimit” controls over process resource use it is possible to limit RAM for processes and to limit the number of processes per UID. The problem is that this often is only good for accidental problems not dealing with malicious acts. For a multi-user machine each user needs to be allowed to have two processes to be able to do anything (IE the shell and a command that they execute). A more practical limit is five processes for a single shell session (one or two background jobs, a foreground job where one process pipes data to another, and the shell). But even five processes is rather small (a single Unix pipe can have more than that). A shell server probably needs a limit of 20 processes per user if each user will have the possibility of running multiple logins. For running the occasional memory intensive process such as GCC the per-process memory limit needs to be at least 20M, if the user was to compile big C++ programs then 100M may be needed (I’ve seen a G++ process use more than 90M of memory when compiling a KDE source file). This means that a single user who can launch 20 processes which can each use 20M of memory could use 400M of memory, if they have each process write to a pages in a random order then 400M of RAM would be essentially occupied by that user. If a shell server had 512M of RAM (which until quite recently was considered a lot of memory - the first multi-user Linux machine I ran on the net had 4M of RAM) then 400M of that could be consumed by a single hostile user. Leaving 100M for the real users might make the machine unusable. Note that the “hostile user” category also encompasses someone who gets fooled by the “here’s a cool program you should run” trick (which is common in universities). I put my first SE Linux Play Machine [1] on the net in the middle of 2002 and immediately faced problems with DOS attacks. I think that the machine had 128M of RAM and because the concept was new (and SE Linux itself was new and mysterious) many people wanted to login. Having 20 shell users logged in at one time was not uncommon, so a limit of 50 processes for users was minimal. Given that GCC was a necessary part of the service (users wanted to compile their own programs to test various aspects of SE Linux) the memory limit per process had to be high. The point of the Play Machine was to demonstrate that “root” was restricted by SE Linux such that even if all Unix access control methods failed then SE Linux would still control access (with the caveat that a kernel bug still makes you lose). So as all users logged into the same account (root) the process limit had to be adequate to handle all their needs, 50 processes was effectively the bare minimum. 50 processes with 5M of memory each is more than enough to cause a machine with 128M of RAM to swap to death. One thing to note is that root owned system processes count towards the ulimit for user processes as SE Linux does not have any resource usage controls. The aim of the SE Linux project is access control not protection against covert channels [2]. This makes it a little harder to restrict things as the number of processes run by daemons such as Postfix varies a little over time so the limits have to be a little higher to compensate, while Postfix is run with no limits the processes that it creates apply to the global limit when determining whether user processes can call fork(). So it was essentially impossible to implement any resource limits on my Play Machine that would prevent a DOS. I changed the MOTD (message of the day - displayed at login time) to inform people that a DOS attack is the wrong thing to do. I implemented some resource limits but didn’t seriously expect them to help much (the machine was DOSed daily). Recently I had a user of my Play Machine accidentally DOS it and ask whether I should install any resource limits. After considering the issue I realised that I can actually do so in a useful manner nowadays. My latest Play Machine is a Xen DomU which I have now assigned 300M of RAM, I have configured the limit for root processes to be 45, as the system and my login comprise about 30 processes that leaves 15 for unprivileged (user_r) logins. Of recent times my Play Machine hasn’t been getting a lot of interest, having two people logged in at the same time is unusual so 15 processes should be plenty. Each process is limited to 20M of memory so overflowing the 300M of RAM should take a moderate amount of effort. Recently I intentionally have not used swap space on that machine to save on noise when there’s a DOS attack (on the assumption that the DOS attack would succeed regardless of the amount of swap). Now that I have put resource limits in place I have installed 400M of swap space. A hostile user can easily prevent other unprivileged users from logging in by keeping enough long-running processes active - but they could achieve the same goal by having a program kill users shells as soon as they login (which a few people did in the early days). But it should not be trivial for them to prevent me from logging in via a simple memory or process DOS attack. Update: It was email discussion with Cam McKenzie that prompted this blog psot.

• [1] http://www.coker.com.au/selinux/play.html


• [2] http://en.wikipedia.org/wiki/Covert_channels

Share This

On the 20th of January (8 days before the start of linux.conf.au) I advertised contest to write blog posts related to computer security for the conference Planet [1]. The aim of the contest was to encourage (by money prizes) people who had no prior experience in computer security to get involved by writing blog posts. The rules permitted security professionals to enter but only for an honourable mention, the money was reserved for people without prior experience. The money that I initially advertised was a fraction of what was reserved for prizes, the idea being that if the contest went well then the prize pool could be easily increased but that if it didn’t go well then there would only be one small prize for someone to win by default. At the time I considered a single entry winning by default to be the worst case scenario. The eventual result was that there was only one entry, this was from Martin Krafft on the point of keysigning [2]. Martin has prior experience in the computer security field which excludes him from a money prize, but he gets the only honourable mention. From a quick conversation with him it seems that his desire from entering the contest was to get his ideas about weaknesses in the keysigning process spread more widely, so this seems like a fairly ideal result for him. I agree with Martin that there are significant issues related to the keysigning process, but my ideas about them are a little different (I’ll blog about it later). His point about people merely checking that the picture matches on the ID and not verifying what the ID means is significant, the fact is that the vast majority of people are not capable of recognising ID from other countries. Other than requiring passports (which differ little between countries) I can’t think of a good solution to this problem. Congratulations Martin! It is a good post and a worthy entry. Now as to why the contest failed. I spoke to some people at the end of the conference about this. One delegate (who I know has the skills needed to produce a winning entry) said that I advertised it too soon before the conference and didn’t give delegates time to write entries. While I can’t dispute his own reasons for not entering I find it difficult to believe that more than a small proportion of delegates had that motivation. The LCA Planet had some lengthy posts by other delegates, and the guy who won second prize in the hack-fest spent something like 20 hours coding on his entry during the conference time (I suspect that my contest had the potential for a better ratio of work to prize money). Also the 8 days before the conference started was a good time to write entries for the contest. One suggestion was that I propose that the conference organisers run such a contest next year. The problem with this is that it’s difficult to say “I tried this and failed, could you please try it too”. If nothing else I would need some significant reasons to believe that the contest has the potential to be more successful before attempting it on a larger scale. If the contest had been backed by the LCA organisers then it might have been more successful, but that possibility seems unlikely (and there is scope for an event to be more successful than mine while still being a failure). The reason that I consider it unlikely that official support would make it more successful is that I first advertised the event on my blog (syndicated to the conference Planet). Everyone who has a blog and attends the conference can be expected to have read about it. I then advertised it on the conference mailing list which I believe had as subscribers a large portion of the people who have enough spare time to create a blog specifically for the purpose of entering such a contest. A blogging contest related to a conference but which had a wider scope (IE not limited to one field but instead covering anything related to the conference) might be successful. If someone wants to run such a contest next year then it’s probably worth doing. Of course I have not given up on the plan of getting more people involved in computer security, expect to see some blog posts from me in the near future with other approaches to this. Suggestions would be appreciated.

• [1] http://etbe.coker.com.au/2008/01/20/lca-2008-security-blogging-contest/


• [2] http://madduck.net/blog/2008.01.28:on-the-point-of-keysigning/

Share This

• packages.ubuntu.com is now fully migrated to the new server. Since the old server was not shut down for four days after my contract expired, the actual downtime was very small (yay for busy admins ;)).
• After completing this move I now plan to finally migrate this site to the newer code base as used on packages.debian.org. My test side with the freshly merged code can be found at packages2.ubuntu.lichtenheld.net (no comments about ugly hostnames please...). Comments and patches (especially to the .css files) welcome. The location of the git repository can be found on the About page.
• New gimmick in the general code: The site now checks the Accept-Language header twice, once against the list of DDTP translations and once against the list of template translations. So, given a suitable Accept-Language header it will not necessarily fall back to English in all cases anymore. For all the bi-, tri-lingual people out there :). Not yet online on the main server, but coming soon.

Public Service Announcement: The LinuxBIOS project, a Free Software project which intends to replace the proprietary BIOS found in most computers these days, has been renamed to coreboot. The old name has become quite a misnomer in recent years; the name LinuxBIOS created the impression that it's a drop-in BIOS-replacement and that it's using Linux or is Linux-specific in any way. Neither is the case.

• coreboot is not a BIOS in the sense that it provides the legacy BIOS callbacks / interrupt routines. Instead, coreboot is just a small hardware initialization firmware. It does some basic hardware init, then hands over control to one of many possible payloads. This can be a boot loader such as FILO (or GRUB2, which shall ultimately replace FILO) if you want to boot from disk, or Plan 9, or memtest86, or a Linux kernel, or OpenBIOS/OpenFirmware/SmartFirmware, or...
• coreboot is not Linux or Linux-specific. Yes, it can indeed use Linux kernels as payload (i.e., you put the Linux kernel in your flash ROM chip together with coreboot) or boot a Linux kernel indirectly using FILO/GRUB2. But as mentioned above it can also be used (together with the fitting payload) to boot other OSes or systems such as Plan 9, Windows, FreeBSD, and others.

The initial author and project leader of LinuxBIOS/coreboot, Ron Minnich, explains in more detail why the renaming was done in his original announcement on the coreboot mailing list.

No Debian content here. Just like last year I decided to watch one of the largest sport events in the USA - the final game of the National Football League Super Bowl XLII (roman numerals are different for the sake of it ). I came to like the Japanese take on American football, so I watched the Superbowl last year and was appalled at the lack of any entertainment value in the game. I was told that it was one the worst Super bowls ever, so I gave it another try. Just like last year the American football looks to be very lawyer-friendly: bundles of complex rules and exceptions. The game could have been much simpler. Like for example, a lot of rues come from the fact that the game timer almost never stops. It is good for TV companies as they can plan their broadcast times better, but horrible for the stop-go game like the American football is. Just stopping the timer on every point the ball is stopped like they do in final seconds would cut out a lot of rules. Playclock and all. Rules on use of timeouts and stuff. Of course the game time would need to be adjusted down a bit. Now you have 4×15 minutes of ‘game’ where at most 20 minutes of that is in action. That game time is a lie - most of the time people are just standing around. Terminology irks me quite a lot. Why is it a “1st down” when there have been two “1st down”s just a few minutes ago? Something along the lines of “down counter reset” would be much clearer. And what is cryptic “1st & 10″ doing in the middle of the screen? It would have been much clearer if that info would be split: “Downs: 1/4″ and a measuring arrow between the ball and the yellow line with “10yd” written on it. And then there is an obscured “two in two” or “two for two” or “two in O” phrases which apparently means the same as “two 1st downs out of two tries” in the context. Can’t the commentators be a bit more elaborate and actually say the units of measurement? “Giants strength first tonight”? How about “in the lead”, English anyone? The camera placing editing is just horrible - the camera direction is switching all the time and that is confusing as hell. In normal football when professional camera teams are working, you always get all the shots from one side and even one general angle. If for clarity reasons a camera shot from other side is needed (usually in a replay) they always say that the image is from the reverse side in large letters on the screen. Here a lot of close-up shots were all over the place and even rotated around inside one shot! That might look fancy, but is just crappy camera work and editing. Then commentators start talking walls of numbers and walls of names. Unless you know by hearth who plays at what position, there is no way to understand what those people are saying. Than is just sloppy commentary. Is FOX incompetent in all possible ways? Then again the funky rules came into play just at the end of the first quarter - I have no idea why the ball was moved to the end line. Apparently the defender did or didn’t something. Did not see anything worth penalizing the team like that at all. They dropped the term ‘pass interference’ later on. Isn’t interfering with the pass the whole point of the defense play in this game??? Lawyer game, I’m telling you. And later on, pulling on guys arm while he is catching and being tackled apparently is just fine. And holding is illegal??? On the big penalty on the Giants the judge could have just said that the ball is out of bounds. Giving a 10yd penalty for such a minor thing is just ridiculous. The halftime show was kind of meh. Staged to extreme, but no soul nor sense. And what were all those people doing on the field? Isn’t that bad for the grass? And the commercials .. Average at best. Horrible at worst. For example a government commercial saying parents to protect their prescription medicine to .. help out your neighborhood drug dealer??? Oh and does anyone still doubt that media is controlled by republicans after that Coke commercial where the democrat is portrayed as bald and ugly and the republican is portrayed as the nice guy going for the compromise. And then they both Segway into the sunset? Brainwashing and prejudice embedded in a Coke commercial !?! WTF is going on in USA !? The 12-man-on-the-field penalty in the 3rd quarter is another legalese bullshit in the game. It is clear that the extra player had no effect on the game so it is just ridiculous for the judge to penalize the team for that. A couple small penalties were given for Patriots as well, judge bias was not as prevalent as last year. The camerawork stayed the same through the game - confusing, flashy and sloppy. Other cameras are in the shot line all the time. The game however did compensate for that all. The 4th quarter was very nice and exiting. I had no idea of the teams before the game, but I did like the Giants more - they just seemed to have more will and soul in their game. So I rooted for them since the 2nd quarter and it was very satisfying to see them win the game in the final seconds. Summary: good game, great final quarter, horrible coverage and crappy sideshows (adverts and halftime show).

Deinterlacing utf-8 from a 8bit encoding (say it's latin1, but it works with all 8bits encoding the same), and that could have multiple utf-8 rencoding, there is a very simple tool to write for the task. Let's assume that you have somewhere a function void charset_to_utf8(FILE *, int c) that takes a FILE * it writes the utf-8 encoded character c. Then write something that roughly looks like that:

   static int utf8_wclen(const unsigned char *s, int maxlen)
    
       static char const utf8_len[32] =  
           1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
           0, 0, 0, 0, 0, 0, 0, 0, 2, 2, 2, 2, 3, 3, 4, 0,
        ;
   
       int trail = utf8_len[(*s++) / 8];
       if (trail > maxlen)
           return 0;
       switch (trail)  
         case 4: if ((*s++ & 0xc0) != 0x80) return 0;
         case 3: if ((*s++ & 0xc0) != 0x80) return 0;
         case 2: if ((*s++ & 0xc0) != 0x80) return 0;
         case 1: return trail;
         default: return 0;
        
    
   
   int charset_utf8_deinterlace(FILE *f, void *data, int dlen)
    
       const unsigned char *s = data;
       int pos = 0, res = 0;
   
       while (pos < dlen)  
           int wclen = utf8_wclen(s + pos, dlen - pos);
           if (wclen)  
               fwrite(s, wclen, 1, f);
               pos += wclen;
               res = 1;
             else  
               /* assume its $charset */
               charset_to_utf8(f, s[pos++]);
            
        
       return res;
    

You can easily base a tool that mmaps a file passed as an argument, and prints an utf-8 clean file to stdout, and that exits with a specific code when it met something that looked like valid utf-8^[1]. let's call that tool recode_to_utf8, then if you fear you have multiple reencoding of your data, you need to do that:

 #! /bin/sh
 wrap_recode()  
   recode_to_utf8 "$1" > "$2"
   case $? in)
     0) true;;
     $still_utf8) false;;
     *) echo "WOOPS IO Error" 1>&2; exit 1;;
   esac
  

 cp your_source dirty
 while ! wrap_recode dirty utf8_clean; do
   iconv -f utf8 -t $charset utf8_clean -o dirty
 done
 rm -f dirty
 # result in utf8_clean

This is all very sketchy, but I've never found a tool that does the job properly, and it's quite simple to derive tools from the methods above. Note that it assumes that it's highly unlikely that a valid sequence of your original charset can form a valid utf-8 codepoint, which for text is usually true (at least in latin1).

This year at Linux.Conf.Au there was a student party sponsored by Google. The party was held in a bar and lots of free drinks were provided. This was fine for the university students, but for school kids it was obviously lacking. Some people point out that it’s “quite legal” to run a party that excludes children, the point however is whether it’s desirable to exclude them. Also the concept of a state where laws dictate all aspects of your life to a degree such that obeying the law is the only possibility is fortunately restricted to science fiction. Another common fallacy is when people point out that we should be grateful for Google’s sponsorship. As far as I am aware Google doesn’t insist on any particular conditions for sponsoring a party. If the conference organisers were to request a party at a more child-friendly venue (for example a restaurant - which if licensed could serve alcohol to adults who desire it) then I doubt that Google would refuse. Being grateful for Google’s sponsorship is entirely unrelated to the issue of whether their sponsorship money was spent in the best possible manner. My interest in this topic started at LCA 2007 when I heard complaints from young delegates who were excluded from the Google party. This year the Google party (a different event from the “Google student party”) allowed everyone to attend and issued coloured wrist-bands to indicate whether the person had shown suitable ID to be served alcohol. The Google party was inviting for all and I believe that it was a significant improvement over last year (more attention was paid to serving food than alcohol). I have suggested that at future events some tables be reserved for people who aren’t drinking. As a general rule people enjoy being around people who have consumed a similar type and quantity of mind-altering substances (something I learned from my friends in Amsterdam). There is of course demand for serious drinking, and it seems impossible to satisfy people who want to do serious drinking at the same party as people who won’t or can’t drink at all. If there is not going to be an official party that is suitable for U18s then I’ll arrange it and pay for it myself. The consensus of opinion seems to be that less than six U18s are not worth catering for (one of the common objections to my suggestions is that there may be only four or five U18s). I can pay for a party for that many people which (in terms of food and non-alcoholic drinks) compares well with whatever Google might offer for the drinkers. The rough idea is that U18s will have free food and non-alcoholic drinks. The venue will be some suitable restaurant (is there a Pizza hut or similar near the next LCA?). The party will be open to parents and delegates who are >18 and don’t plan to drink (but I’m sorry I can’t afford to shout you). Opportunities to learn about cool Linux stuff will abound (I expect that a number of knowledgable Linux people who can teach some interesting things will be interested in attending). If I’m paying then children who aren’t delegates will also be welcome to attend, but their parents would have to pay for their food/drink. But this is merely a matter of budget, if it was to be an official event or there were other sponsors then this might not be the case. What I would like right now is expressions of interest from young people who plan to attend the conference and from parents (who plan to attend the conference or whose children will attend). If it looks like there will be a suitably large number of people interested in this then the conference organisers may decide to make it an official event. Also comments from adults who would prefer an alcohol free event (whether it be due to medical reasons, religion, or choice) would be of interest. It’s all about the number of people who will attend.

Share This

I was bought a pair of these for Christmas. For the past few years I've been using a pair of Hitachi TMP028s - cheap clip on headphones that I've found far better than the popular ear bud style, but nothing special. The Sennheisers are much better again. They have a neat little padded cup that means they make a good fit with your ears, the headband is reasonably adjustable (I've had issues with my glasses with other headphones) and they come with a carry case and fold flat which means throwing them in my bag for my train commute much easier. All in all I've been very impressed in my use over the past month. And then today I finally put some batteries in to power the noise cancellation function. Wow. Much more effective than I expected. I was able to knock the volume on my iAudio down a fair bit and still hear the music better than usual. The noise of the train was still present, but reduced significantly to the point where it wasn't an issue at all. Definitely recommended.

First of all: no, I'm not a huge fan of the genre. In fact, when I don't feel too good, I tend to avoid them, since they can depress me at times. But once in a while, a romantic comedy doesn't hurt, and I do kindof like them at times. Early last week, I picked up a DVD of the first movie at a low-price DVD shop nearby, and watched it. The prince and me isn't my favourite movie in the genre; the plot surely is interesting, but I can't shake the feeling that things work out too easily in the end. Compare with Notting Hill, for example, where the two protagonists need to go through (I believe) three cycles of relationship/no relationship before the end of the movie; this, in my opinion, makes for far more interesting cinema. But, all in all, it certainly was an interesting watch. I might think the plot could've used some improvement; but that doesn't mean it's bad. The entire visual aura of the movie is great; they went through quite some effort to make it look well. For instance, in a number of scenes it's obvious that they made the clothing of the characters blend in with the background; and yet they still managed to create diversity in those colors during scenes, by making the clothing differ just that tiny bit, and different parts of the background as well; the entire scene would be built up of one painting-like shot after another, yet all of them slightly different. Impressive. And then I haven't even mentioned the casting, which was magnificent. Anyway. Since I kindof liked the movie, and since the sequel DVD wasn't expensive, either, I got that DVD as well. Boy. I've never quite seen a movie's sequel be so completely and utterly out of touch with its original. What horror. Except for the male protagonist, not a single actor of the original cast returned for the sequel. They had good reason, so it seems. The plot is utterly stupid. It revolves around an ancient law that made it somehow illegal for the couple to get married. Hello? Do you really think a king wouldn't have the influence to convince parliament to get rid of that law? Of course not, but then you wouldn't have a plot anymore. Now if the rest of the movie would make up for this silliness, then it wouldn't be so bad. Except it doesn't. This movie is bad in... let me count the ways.

1. The plot error, as explained above. Also, the plot was quite incoherent, for the most part.
2. The casting is terrible. The original King Haraald, father of the male protagonist, managed to create a believable king, with that somewhat eccentric and strange flair that most European royals seem to have these days. The queen had a bit of an iciness over her, warming up to an interesting character once she started to like Paige. Even the minor roles were so well played. In the sequel, none of this returned. The queen was just tight; an empty shell. The new Paige had a problem with overacting in some of the scenes. In fact, that was a common issue; I don't think I've ever quite seen this much overacting in one movie. Also, King Haraald didn't even remotely look like the original; not physically, and not in his acting.
3. Speaking of the King, and given the plot of the original movie, he shouldn't even have returned for the sequel; he abdicated because he was terribly ill; he should've been dead, for crying out loud!
4. The CGI was horrible. In the original movie, there were a few scenes where I'll bet CGI was used; not because it showed, but because I don't think it were possible to create that scene otherwise. In the sequel, you could tell when CGI was used due to the utter lack of natural feeling. Ever heard of a randomizer? It's what you use to avoid having a full room of butterflies all shake their wings at the exact same speed. Shudder.
5. The "painting" feeling and attention to detail of the original movie was nowhere to be found. In fact, at some point they show a castle which supposedly is in Denmark somewhere, but it shows the Czech flag, instead. Ugh.
6. Some of the gags were funny, but not as intended; because they were so silly. I've seen 3-year-olds make better jokes.

... I guess I could go on forever, but then there isn't much point in boring my audience. The short version: the original "The prince and me" is an interesting watch, but please forget about the horrible sequel... ... I guess there's a reason why they put it directly on DVD and skipped the theatres.

http://www.postgresql.org/about/news.918 I've always preferred PostgreSQL to Mysql. I think the "worse is better" compromise is ok in some cases, but it's scary to see money being handled in transactionless MyISAM tables that are so widely used; I've done work for a number of places that had that kind of setup, and extrapolating from that, it's got to be very, very common indeed. I guess they heard it was "faster"... but I've always likened that kind of faster to the kind of faster you get by riding a bicycle with no brakes down a hill. Mysql's made lots of improvements over the past few years and is beginning to approach the robustness that Postgres has always had, but I'm going to stick with Postgres, and I'm glad to see they keep churning out cool new things, using the same sort of community open source approach that works so well at the Apache Software Foundation.

Given three groups of groups of people A, B, C, responsible for 3 queues Qa, Qb, Qc ; and an elements e which have to go through Qa, then Qb, then Qc.

• A doesn’t process Qa because he sees that B doesn’t process Qb, so there’s no point in filling Qb
• B doesn’t process Qb because he thinks that C won’t process Qc, so there’s no point in filling Qc
• Qc is empty, which “proves” that C doesn’t think he isn’t the bottleneck

Possible solution: A, B, C, please prove your point!

• A, please process Qa, and put the pressure on B!
• B, please process Qb, and put the pressure on C!
• C, please process Qc (when you will have a queue)!

Now, let’s find a practical example to apply that … Any suggestions? :-)

I had a couple of annoyances with suspend in my laptop, namely that the screen would not lock prior to suspending (this seems to be #407224), and that sound would not work after resume (this seems to be an ALSA driver bug; muting and unmuting Master and PCM solves the issue). For this latter problem, I just wanted to drop a script somewhere to do the mute/unmute dance on resume automatically, but I was a bit lost as to where to put it. (Or, rather, I thought I’d be a bit lost even if I investigated.) Anyway, I recently moved to pm-utils from powersaved, since that’s what my kpowersave recommends first, and not only now my screen gets locked properly, but there is somewhat clear documentation as to where to put such scripts: /etc/pm/sleep.d. So I now have there a script like:

  case "$1" in
      thaw resume)
          amixer -q sset Master mute
          amixer -q sset Master unmute
          amixer -q sset PCM mute
          amixer -q sset PCM unmute
      ;;
      *)
      ;;
  esac

I only miss one thing: in my old suspend to disk scheme, the computer would change to a console where progress about the operation would be reported. Now it’s just a blank console. Guess it’s time to investigate again. (But overall I’m happy about the move.)

Recently I've been debugging a SQL Server 2005 replication setup, where the "Distribution clean up" job for the distributor database was failing. The error message in the agent history was:

Executed as user: <sqlagent_serviceuser>. Could not remove directory <UNC_path_to_snapshot_directory>.
Check the security context of xp_cmdshell and close other processes that may be accessing the directory.
[SQLSTATE 42000] (Error 20015).  The step failed.

The “<sqlagent_serviceuser>” was the Windows user that the SQL Server Agent service was running under, while the “<UNC_path_to_snapshot_directory>” was the network path to the directory where snapshots where created.

Looking around on some discussion forums, I found the same message reported several times but without any real solution; at least no solution that would work when I tried to apply it to this particular setup. Most answers to the problem focused on the xp_cmdshell procedure mentioned in the error, and how it would require certain configuration at the server end.

However, one answer on the MSDN forums did give a useful clue — it pointed to the SQL Books Online article about Securing the Snapshot Folder (which I should've read right away, rally). In a note, this page reads:

If a publication is dropped, replication attempts to remove the snapshot folder under the security context of the SQL Server service account. [...]

It's the SQL Server service account reference which is essential: even though the SQL Agent service account may be the one mentioned in the error message, the actual account that is used to try and delete the snapshot directories is the SQL Server service account instead. Giving that service account the necessary access rights fixed the problem; as in the Task Scheduler case, accurate error reporting on Microsoft's side might go a long way towards people disliking their software less.

Our Dear Leader Sam Hocevar has previously blogged about PIC and inline ASM. Today I came across a sort of extension to this problem. Consider the following code, which implements a double word compare and swap using the x86 cmpxchg8b instruction (for a bonus you can lock it to make it atomic). This type of CAS can be used to implement lock-free algorithms (I've previously blogged about that sort of thing). The problem is that the cmpxchg8b uses the ebx register, i.e. pseudo code looks like: PIC code reserves ebx for internal use, so if you try to compile that with -fPIC you will get an error about not being able to allocate ebx. A first attempt to create a PIC friendly version would simply save and restore ebx and not gcc anything about it, something like: Unfortunately, this isn't a generic solution. It works fine with the PIC case, because gcc will not allocate ebx for anything else. But in the non-PIC case, there is a chance that ebx will be used for addr. This would cause a probably fairly tricky bug to track down! The solution is to use the #if __PIC__ directive to either tell gcc you're clobbering ebx in the non-PIC case, or just keep two versions around; one that saves and restores ebx for PIC and one that doesn't.

I have this USB hard drive enclosure that can also share the files on the local network (LAN DRIVE HD9-U2LA, vendor id - 05e3:0702). Due to that it has an operating system and some other software inside. Unfortunately this software is rather slow to start and that cause the following kernel error when trying to mount this enclosure:

[90459.236000] usb 5-5: new high speed USB device using ehci_hcd and address 9
[90459.368000] usb 5-5: configuration #1 chosen from 1 choice
[90459.368000] scsi4 : SCSI emulation for USB Mass Storage devices
[90459.368000] usb-storage: device found at 9
[90459.368000] usb-storage: waiting for device to settle before scanning
[90464.368000] usb-storage: device scan complete
[90470.148000] usb 5-5: USB disconnect, address 9
[90470.148000] scsi 4:0:0:0: scsi: Device offlined - not ready after error recovery
The device is fine, it is just slow to start. To work around this bug you can change /sys/module/usb_storage/parameters/delay_use from a default 5 second delay to something larger. 60 seconds worked fine in my case.
echo 60 sudo tee /sys/module/usb_storage/parameters/delay_use
Anyone know what a proper solution could be?

On Sunday, the day before LCA 2008 officially started, Kelly and Rusty asked us first-timers to blog about events, specifically about what we liked and disliked. So far, this conference has been really enjoyable and busy, and I have not found the time to write about its content. The talk I just heard leaves me without an excuse, so there: I have recently had a very interesting and enlightening discussion with a blind Debian developer. When I saw on the conference schedule that Jason White would talk about using Linux with speech and Braille output interfaces, I passed up my opportunity to hear Andrew Tridgell talk about clustered Samba and attended his lecture instead. Jason covered a great number of aspects: from the history of the Braille system, and current, Free implementations thereof, via speech output, to strategies of integrating these techniques into existing programmes which are generally not designed with visually-impaired users in mind. He has a collection of references on his webpage, to which I shall refer for the technical content. His presentation left me very excited and impressed. Excited to see him giving a presentation with such enthusiasm and energy, and impressed because his talk (without notes or slides) was by far better than the job of the average presenter with access to notes and slides to display. Jason conveyed a lot of information in a very well-structured, capitivating report. I think he left most of the audience speechless (figuratively speaking; there were good questions). I feel uneasy with thanking Jason explicitly, or even writing this blog post. If you bear with me for a minute, then let me bridge to women involvement in open-source software. My position on this topic is quite clear: I make no distinctions where they are not obvious, and simultaneously I think it s awesome that more and more women are joining the predominantly male crowd (and their influence undeniably makes the community a more comfortable place). Every now and then, I would like to comment on that, such as I think it s awesome that you are working on this, being a woman (an oversimplified example). What I am trying to say is given how few women are involved with OSS, I appreciate all the more what you are doing. This is non-judgemental, I don t say this because I am trying to highlight someone s gender or sex. It s a communication issue, and I am learning, but I d also rather not limit what I say by making absolutely sure never to offend anyone. But when I utter such a comment, it might still greatly annoy someone or yield vicious returns. This is not always the case in fact, less than it used to be but I ve encountered it here and there, which made me more careful. So when I write about Jason s presentation and how great it was, I want to highlight how it s a greater achievement for him than it would be for me, because he is blind and I am not. I don t mean to single him out or put him on the spot. I am simply impressed, very impressed. And being who I am, I d like to say so. Thanks, Jason. Update: David Schmitt makes an interesting point:

The important question is now, why are we blind people doing great presentations more impressing than people with working eyes doing a great presentation? My personal answer isn t so great: because I didn t expect it. No wonder people get offended if you tell em to their face that I m impressed with his achievements, because I wouldn t have expected it.

I don t agree, or at least I fail to see it. I was impressed, I did not expect it (which isn t to say that I came in to Jason s talk expecting it to be any less than a good talk, I had no expectation! Please think for a second if this isn t immediately clear!) is that offensive? I didn t know Jason, had no way to know whether his presentations are great or less so, but then he pretty much blew me away. The presentation was better than what I am used to (from anyone), and the achievement is all the more greater because it seems to me that he has had to put much more effort into it, purely for accessibility reasons. I guess I should know better, but I still, after all these years, have a problem seeing through the end of it, understanding it. Kant to the rescue, my intentions are good (I claim), but this goes both ways regardless: in any communication, one ought to try hard never to offend. At the same time, one ought to try hard not to be offended until one can be reasonably sure that offence was intended. When I brought this up in Adaora Oniya s miniconf talk on communication challenges, Bdale Garbee recalled the policy in use when he was involved in protocol design work groups: send politely, receive with an open mind. I don t remember his exact words, but I think I got the gist. Update: I just talked to Jason and got his feedback on the issue. It boils down to a quote I ll transcribe: I want my work to be judged by its merit and not by who I am. It only leaves me wondering about the situation at hand: I was impressed by his very well-structured and presented talk and by the fact that he did such a good job given his visual impairment. In any case, I ll close the issue. Jason told me he d happily engage in further discussion and I stated that he is not offended. There is another lesson I learnt: the next time I blog about someone else in such a way, I should really get his/her clearance before publishing! Just to be sure

On January 26th 2008, the OCaml community has its first meeting in Europe. There was 5 different talks, including one from me. The meeting was pretty constructive and i think some great things should come out of it. In this post, i will focus on the Debian maintainer point of view. The meeting was organized by me, with the help of Garbriel Kerneis and Vincent Balat. I wish to thank Mme Turgis from ENST/ParisTech who has made possible all this to happen. Introduction: I announce the creation of OCamlCore, a SS2L. It will provide commercial support for OCaml and related products. It will also provide community with some resources (including a GForge, a planet, some SCM repository...) For now, i will open administration to Debian people who wish to help (for root rights) and from the whole community for other task (gforge and general administration). For now, i will choose alone who can administrate and who cannot... This is not a very open position, but this server is also for my company. Xavier Leroy give us a nice talk that has let us see some future direction:

• OCaml 3.11 will have native dynlink
• hope to integrate GHC like type system (GADT: Generalized Algebraic Data Types)
• need to work on parallelism, following different paradigm

But above all, Xavier talked about the fact that there is a lack of manpower at INRIA and invited the community to build tools and other things (including a CPAN like distribution) to make the language more widespread. He also stated that a lot of things will stay in place in the name of backward compatibility. OCsigen Vincent Balat has given us a nice talk about OCsigen, a new framework for programming web application. This program is already in Debian and it is at the root of Debian discussion about moving .cm[ao] into libxxx-ocaml package. This new framework allows to program web application using continuation, which should ease a lot of aspect. It also features static type checking, including static verification of the generated HTML pages. GODI I was impressed to see G. Stolpmann coming to the meeting. Unfortunately, i cannot follow the whole talk, since i have some phone call to make, in order to book the restaurant. From what i have seen, it seems that GODI is growing, in term of manpower. They have some issues with OCaml 3.10, because of camlp4 and some packages. At the end of the conference, he was pushing for a more general use of GODIVA. In particular, it requires to have a very uniform way of building software. It should be the foundation of a build standard for OCaml software. In my humble opinion, i don't agree on this point. Basically, its proposal was based on configure/make all, which is too C style way of doing. It is not bad, but just exclude ocamlbuild enabled software. ocamlbuild Nicolas Pouillard has made an introduction on how to use ocamlbuild. I have discovered how it was working, since i didn't have time to work on this topic. It seems a good thing. I hope to be able to try it at some point. The conclusion was about modifying ocamlbuild to allow the use of multiple plugins. For now, the plugin is a separate file which is compiled first and then loaded, as a special case. Nicolas is looking for a full OCaml way to handle this for multiple plugins. OCaml in Debian I have spoken about different aspect of Debian packaging. After a short introduction and some history about OCaml in Debian, I come to some conclusions/problems:

• we have an early integration, which makes Debian handle a lot of packages, but this is due to a long history
• we still are not able to cope with libraries incompatibilities when rebuilding, we only have addressed ocaml package ABI problem
• the debian package management system is not really compliant with the OCaml way of creating libraries, which is our main problem
• native compilation is broken on 3 arches (Xavier Leroy told us that this should be solved for ARM)
• use of Alioth has made us more efficient to integrate packages
• Debian team are working by step: from time to time we begin to integrate a lot of packages, mostly because of some maintainers wishing to integrate a software with a lot of dependencies

Talking with Xavier give me some additional informations:

• ARM is fixed, it should compile with Debian stable on ARM, he explains that the problem is related to the multi ABI flavor of ARM
• he says that we should not have any problem concerning bytecode stripping of executable, if there is still some we should find the OCaml library that triggers this behavior
• I realize that this behavior can be triggered by ocamlmakefile, that still have a "-custom" option
• he promises me that he will send me a simple test to find custom bytecode application (combination of "file X" and a specific string at the end of the file)

At the end of the presentation, there were some questions. I discover that many people are ignoring the ABI problem with OCaml and its libraries. They seem to discover that it requires regular rebuild of our packages. I also have a discussion about the fact that Debian binary distribution doesn't fit developers need. It seems that developers prefer to have the source of libraries they compile and also the most recent release. But at the same time, people avoid using GODI, which also have the problem of needing to wait for a particular library to be released... After some discussion, I point that some companies prefer to live in a frozen world, which Debian stable can provide. Living in a frozen world helps company developers to have the same environment from the beginning to the end of a project - which can last years. It also help to avoid build environment de-synchronization between company developers. There was also a question about interaction between installed OCaml package and GODI software. I cannot answer it, expect with a "patches are welcome". OCaml on a JVM using OCaml-Java Xavier Clerc explained us how he has achieved running a full OCaml environment on a JVM. This work was pretty impressive, because he was able to compile OCaml top level and provide it as an applet. This is something amazing (and working). He stated also that this should allow to do some binding with java graphical user interface from OCaml. I was pretty busy with a phone call (to a restaurant for the dinner), so i don't have attend the whole conference. Anyway, the project is promising, but it needs to recompile every library using its compiler. I think this is not suited for Debian for now. Workshop The workshop was shorter than it should have been. This is due to accumulated time shift during the day. However, it was pretty interesting, because everybody can talked almost freely. The initial discussion was about the "Unicode situation". This was a question about Unicode in Unison, but there is no real solution about it. For reader information, unison has problem with filename containing UTF-8 char. In particular when syncing two directories which are on two file system with a different encoding on each. Even if the file can be represented on the two file systems, the comparison (between UTF-8 and ISO8859-15) fails. This is because the comparison is a byte to byte comparison. We discuss further the idea of OSR (OCaml standard recommendation) which was briefly discussed in the morning. I think David Teller (who have also done a great part of the IRC retranscription) was very keen on this idea. I invited Nicolas Pouillard to discuss the three following subjects. About camlp4 documentation, Nicolas told people about the he set up. About ocamlfind and ocamlbuild, he went back to the multiple plugin problems. About ocamlbuild and GODI, Gerd, Nicolas and Xavier tried to build a list of what metadata can be shared. This includes list of files to be installed (PLIST in GODI). Concerning the "feedback from the Gallium", Xavier explains that he has done this in the morning (which is true). I think that Xavier implicitly agreed on the fact that if this kind of event happens again, he can do another talk about future of OCaml. Concerning Summer of Code, I just remind that people can write description of Google Summer of Code project in the cocan wiki. Another one remind about Jane St Capital summer of code. Points concerning common interfaces raise the discussion about OSR. The organization of next year events doesn't raise particular interest. I think people would be interested to have one next year, if something comes out of this meeting.

It’s probably impossible to get too much of Bruce Schneier, although I honestly wouldn’t mind if he stopped Friday Squid Blogging. His latest Wired.com article on the false dichotomy between security and privacy is an excellent counterpoint to a recent Lawrence Wright profile in the New Yorker on Director of National Intelligence Mike McConnell. The Lawrence Wright article was surprisingly uncritical, considering the New Yorker’s usual zealous approach. Check out, for example, his description of the “Clipper” chip:

In the nineties, new encryption software that could protect telephone conversations, faxes, and e-mails from unwarranted monitoring was coming on the market, but the programs could also block entirely legal efforts to eavesdrop on criminals or potential terrorists. Under McConnell s direction, the N.S.A. developed a sophisticated device, the Clipper Chip, with a superior ability to encrypt any electronic transmission; it also allowed law-enforcement officials, given the proper authority, to decipher and eavesdrop on the encrypted communications of others. Privacy advocates criticized the device, though, and the Clipper was abandoned by 1996. They convinced the folks on the Hill that they couldn t trust the government to do what it said it was going to do, Richard Wilhelm, who was in charge of information warfare under McConnell, says.

(emphasis added). Compare, for example, EPIC’s Clipper Chip information page. Schneier, by contrast, sees right through the core:

We’ve been told we have to trade off security and privacy so often — in debates on security versus privacy, writing contests, polls, reasoned essays and political rhetoric — that most of us don’t even question the fundamental dichotomy. But it’s a false one. Security and privacy are not opposite ends of a seesaw; you don’t have to accept less of one to get more of the other. Think of a door lock, a burglar alarm and a tall fence. Think of guns, anti-counterfeiting measures on currency and that dumb liquid ban at airports. Security affects privacy only when it’s based on identity, and there are limitations to that sort of approach. Since 9/11, approximately three things have potentially improved airline security: reinforcing the cockpit doors, passengers realizing they have to fight back and — possibly — sky marshals. Everything else — all the security measures that affect privacy — is just security theater and a waste of effort. By the same token, many of the anti-privacy “security” measures we’re seeing — national ID cards, warrantless eavesdropping, massive data mining and so on — do little to improve, and in some cases harm, security. And government claims of their success are either wrong, or against fake threats. The debate isn’t security versus privacy. It’s liberty versus control.

Read the whole essay. And send it to your mother, as well. Technorati Tags: Schneier, Privacy, Security

Share This

Good news everyone, first stable Gammu release in this year is out. Since 1.17.92 only few small fixes in SMS decoding and AT engine did happen, but there is quite big list of changes compared to 1.17.0:

• Fixed decoding of an empty SMS.
• Fixed some mistakes in API documentation.
• Fixed compilation under MS Visual C++ Express.
• Various small fixes if AT driver.
• Add simple shell script to generate JAD file from JAR.
• Added support for adding memory entries to 6510.
• Phone features now can be defined in configuration, so there is no need to modify common/gsmphones.c for testing different settings.
• Config file loading behaves more consistent in lookup. In some cases it can now find different configuration file.
• Fixed crash when there are too many messages (bug #466).
• Fixed crash when printing messages on Windows (bug #476).
• Do not ask phone for IMEI so often (bug #480).
• No need to set LD_LIBRARY_PATH for tests.
• Properly wait for SMSD child processes (bug #486).

You can download from usual place: http://cihar.com/gammu/.