By informing us of a new list, WikiChix Joe Reagle offer’s some insight as to why gendered spaces don’t always sit easily alongside or with liberal ideologies of equality:

Formally excluding anyone from the larger community prompts questions of: is this fair?, is this discriminatory?, shouldn’t we ensure the common space is accessible rather than spinning off groups?

Of course, much of liberal theory since it hones in on “formal” dimensions of equality, does not do so well with accounting for or accomodating those forms of biases and exlcusions that are either informal (i.e. cultural) or often structural (i.e. economic).

Well this is all a bit exciting. This is my first real foray into a country that doesn't speak English. Hong Kong was so bilingual it wasn't really a challenge. Here Hablas ingl s? is the first order of the day, otherwise I have to fumble my way through C mo consigo al terminal cuatro? with my head stuck in the Lonely Planet. The flight to Madrid was fairly uneventful. US Airways doesn't suck any more or less than United. No luggage lost or damaged. I bounced of Philadelphia, and that's a pretty cool airport. Lots of white rocking chairs littered in the middle of the concourse for general consumption, and a veritable shopping mall within the airport. Terminal 4 of Madrid Airport is a spiffy new looking thing. Very architectural, I like it. I've got a few hours to kill here while I wait for the European contingent to arrive, so I can catch up on my post-vacation work email backlog... Certainly a different way to spend a birthday.

Today I have effectively started with my Master Project! I have been been at it for a few days already in the past weeks though, but now I’m sitting on my own spot working on some proofs. So, what am I actually doing? Well that’s still hard to put in words yet and it also requires some process algebra and general math prior knowledge, but I’ll try. My graduation supervisor is Bas Luttik and in July he co-published a paper on defining a finite equational base (a set of equations from which all others can be derived) for a specific process algebra called CCS. This paper used a specific subset of CCS, namely without restriction (hiding) and relabelling. Restriction is an operator of the process algebra to block certain actions of happening, relabelling is an operator to replace actions by other actions. Take 1 of my project is to try to consider this algebra with restriction and finding a new equational base and proof that either it works or it can not be done. This is a risky assignment because it can lead to: we have tried but haven’t gotten either results. The short period to come will entail considering CCS with restriction but without concurrency to drastically reduce the cases to be considered. If we succeed, we’ll continue with CCS with restriction and concurrency. If we do not succeed it’s quite possible we’ll change my project assignment. More to come!

I don't know whether statically linking ffmpeg into packages brings any speed improvement, but it can at least help spending some mirror space and bandwidth. With static linking:

-rwxr-xr-x 1 joss joss  13M 2006-12-12 22:44 libgstffmpeg.so*
-rwxr-xr-x 1 joss joss 9,8M 2006-12-12 22:45 libgstpostproc.so*

With dynamic linking:

-rwxr-xr-x 1 joss joss 571K 2006-12-12 22:38 libgstffmpeg.so*
-rwxr-xr-x 1 joss joss  70K 2006-12-12 22:38 libgstpostproc.so*

So I am back to le study of le hackers, trying to write a super-secret paper that I will present in January and then of course I am back with and to my beloved book (which for now has the following title: “Freedom’s Pleasures: Hacker Practice And The Limits of Liberalism” but I am sure it will morph, endlessly). As part of my transition I just finished re-reading one of my favorite articles on the history of Usenet: If I want it, it s OK: Usenet and the (outer) limits of free speech by B. Pfaffenberger (available here for download. When I released one of my dissertation chapters where I addressed the phenomenon of the Cabal, Bryan was nice enough to write me and point me to his article, which also examines the existence of Backbone Usenet Cabal. The artile, which provides just the right mix of history and commentary, analyzes how a free speech ethic came to be valued on Usenet and the ways in which technological and social factors co-mingled to facilitate and dampen the free flow of expression. You are provided with classic Usenet quotes like:

Usenet is like a herd of performing elephants with diarrhea–massive, diffi-
cult to redirect, awe-inspiring, entertaining, and a source of mind-boggling
amounts of excrement when you least expect it. (Spafford, 1993b)

You learn about the early attempts to control spam by the likes of “CancelMoose:”

In 1995, a secret, shadowy figure known as the CancelMoose
devised a spam-canceling program called a cancelbot.”

And then in the end, he provides his challeng to one of the dominant STS theories of the time, SCOT: “It should be noted that this picture is at odds with the predictions of the social construc-
tion of technology (SCOT) theory (Pinch & Bijker, 1987), in which the outcome of a period
of technical controversy is ascribed solely to social factors. Underlying SCOT s dogmatism
is a justifiable aversion to technological determinism, the doctrine that a technology s con-
tent leads irresistably to predictable social consequences a doctrine that is simply the re-
verse of SCOT s insistence on social causation. Two wrongs, as we were taught in kinder-
garten, do not make a right. What we see in the history of Usenet is a contingent outcome
that is shaped neither exclusively by social nor by technical factors, but rather is best under-
stood as a long process in which contesting groups attempt to mold and shape the technol-
ogy to suit their ends sometimes successfully, and sometimes not. They are as likely to be
blindsided by technological developments as they were to succeed in changing the system
to meet their ends. As this article attests, it is one thing to create new technologies with a
coherent social vision, and it is quite another to control the way it grows and develops.” I could not agree with him more. I think what he is highlighting is that if we dip into the historical record, we have instances in which technology can trump the social and vice-versa (and often instead it is a co-mixture), so in the end, understanding the impact of technologies is less about theories of technology and more of a historical question…

Now this is interesting: BEA is coming out with a version of its application server that runs directly atop VMware. With this move, VMware takes another step toward becoming a full fledged operating system in its own right. VMware is already promoting the distribution of applications as virtual machine images, and operating systems are first and foremost application platforms. If VMware is an application platform, why not cut out the middle man entirely, particularly given that the middle man adds a few hundred megabytes of largely invisible baggage to the application, not to mention an enormous amount of maintenance burden for the ISVs that make or break an application platform? For me, the real question is: Why BEA and not VMware? A JavaOS makes a lot of sense, since it builds on one of the world’s largest developer communities—it’s a well known environment among developers, and there are a huge stable of applications that could take advantage of the new platform with minimal porting. Furthermore, applications are increasingly server based, with the browser providing the UI, so this matches well with industry trends and nicely addresses the problem that VMware would have a very hard time building any sort of graphical user interface into its platform, just given the nature of what it is. That said, VMware should really want to provide the JavaOS directly. With Xen and Virtual Server moving aggressively to bundle their products with widely deployed operating systems, the game’s already afoot, and if virtualization becomes just another operating system feature, VMware is at a distinct disadvantage, as it owns no operating system to bundle its product with. Finally, what about standards? New kind of operating system or operating system feature, there are going to be multiple application platforms if history is any indication (and it usually is), so how do applications take advantage of the new platforms without the inevitable fragmentation? It’s going to be an interesting space to watch, that’s for sure.

I started a Wiki Page about what could be improved in Debian. There are a few ideas already on that page, but I am curious what people come up with. I do hope that this page can serve at some point to pick a few key points that we can work towards for the next release (after etch). Note that these does not need to be features or cool software, but also stuff like the ultimate spam defense for list traffic or so...

Several years ago, Pinochet was prosecuted by the Spanish judge Baltasar Garz n:


On October 17, 1998, while traveling to the United Kingdom for medical treatment, Pinochet was arrested on a Spanish provisional warrant for the murder in Chile of Spanish citizens while he was president. Five days later, Pinochet was served with a second provisional arrest warrant from judge Baltasar Garz n of Spain charging him with systematic torture, murder, illegal detention, and disappearances. Pinochet was placed under house arrest in Britain while appealing the legal authority of the Spanish and British courts to try him, but eventually released on medical grounds by the then Home Secretary Jack Straw without facing trial. .

Garz n became my hero since that very moment.

Since then I have been repeating like crazy: Pinochet, al talego , which barely means Get Pinochet behind bars . Now I am smiling as I think Pinochet, al hoyo , which I will not even try to translate. I pity the worms his unpunished criminal corpse will breed.

Go take a look at the Valech Report.

Cheers!

(Translated from my same post in Spanish) A few days ago, McDonald published a cartoon on the end of the dictator Pinochet. Yesterday, fascist dictator Augusto Pinochet died in the Military Hospital in Santiago, after heart and lung diseases, being 91 years old. Now, current president Michelle Bachelet, a moderate socialist, in case Pinochet is given State memorials, could be attending the ceremony (in a predominantly conservative country as Chile), even after she was tortured and persecuted under the dictatorship and his father was murdered under the regimen, after serving Salvador Allende‘ government. Shitty life, huh? Viva Chile!, just as the ironman stated.

I work at the Ministerio de Administraciones P blicas, the MAP. My main task there is to administer an email cluster for something between 8.000 and 10.000 users, based on free software (LDAP, Postfix, Amavis...) which has been pretty fulfilling so far.

The problem they have is a lot of consultants from external companies that come for big or small projects and they know of no easy way of being able to grant enough permissions to achieve certain tasks without giving away the root password and having to change it every other day. I am one of these external consultants, only I am there for a long term project. I have been there for more than a year and a half now, and our contract was just renovated for two more years. This basically means I am doing my job pretty well.

But a couple of months ago, the company I work for, Alanta, agreed with the MAP on me giving a 12h a training session on sudo. After spending 100 hours in preparing my slides on a sudo workshop (spanish only, sorry), starting from file permissions to ssh public-private key pairs, and ending with sudo, a high amount of stress, as I had to work full time as I prepared this in paralel, I bitterly complained to my boss. (That s when the cleaning started, BTW).

So we had a nice lunch in which I was given a 200 EUR 2GB 2nd Generation Silver Ipod Nano. Which is nice, but taking into account that when I worked for IBM as a certified trainer I made something between 24-60 EUR per hour, depending on the subject, and all the material (slides, exercises, TOC and Trainer material) was already done for me, so I just had to prepare and give my lessons, I felt patronized and a bit insulted, even if I did not expect any compensation for this extra effort that really damaged my (mental) health. Getting presents in exchange for hard work doesn t make sense for me, specially when I can hardly make it to the end of the month, constantly being in (small, to be honest) debt.

But you could be making more money, couldn t you? Yes, sure. But at what price? I like the relaxed work environment and the lack of sexism in my current project. I have plenty of spare time, and my life quality is overall great, I can walk home from work, I am not juiced and then disposed of, despite the punctual stressful periods everyone gets every once in a while (which are rare here, at MAP).

And this thing will never run IpodLinux or Rockbox. I feel like I want to throw it out the window. It lacks support for my favourite music file formats, UTF-8 and hangs up more than MS Windows 95.

A few month ago, I blogged a way to spread Free Software effectively, especially in developing countries: By deploying Free Software in internet caf s, where most people learn their way around computers. Most of them (and there are a lot, much more than in Europe) have a buisness plan that relies on software for free, but currently they achieve that through pirating Windows and software like Cybercafe Pro. Back than, I wrote this more or less theoretically, but it happend that I ended up having some time to actually start working on it.While Free Software, especially Debian, provides a very good base to build internet caf s from, one key component is more or less missing: Software to hand out these codes ( timecodes ) to the customer, to let them log in and surf for the time they bought. Very recently, Zybacafe was released, but I did not really like it, nor felt like maintaining a Pascal/Lazarus based Debian package. So I went ahead and implemented my own ideas.The Idea is to keep it very simple, very modularized and integrate deeply with normal unix ideas. So what we have now is a PostgreSQL database (one table so far), and all communication just goes via this table, so we don t have to design or implement complicated protocols. A python gtk application for the front desk generates the timecodes that are then, on paper, passed to the customer. The workstations greet the user with standard GDM, but our pam modules authenticates the timecode instead of a username/password pair. While using the system, a small floating window informs the user about the remaining time. If he does not log out voluntarily, a system daemon will kill all his processes eventually.The long term mission is to form that into a Custom Debian Distribution that will install the server hassle-less, and besides being pre-configured for the internet caf s needs, also immediately serves as an automated installation server for the workstations (think FAI), all useing stock Debian packages, as far as possible. Another pam module could, upon login, mount the homedirectory as a copy-on-write overlay of a template user s home directory, and through away the changes afterwards. The goal is to offer easier installation, less maintenance, better robustness and more flexibility than the current common non-free systems.But, of course, this project needs help. First of all: Users! If you have any use for time-limited logins (Internet caf , school surf terminaly, parents with otherwise not to bed going kids), you can be an earliy adaptor. Developers are very welcome as well, and due to the modular structure, cooperation should be quite smooth.The development happens on alioth, where we have the subversion repositry, as well as on the Debian wiki page. Alpha packages for these components can be found on the alioth group s webspace. We do not have a mailing list yet, but feel free to e-mail me. We will set up a mailing list once there is a need for it. Thank s to the KACE for supporting this.

It looks like November-December are the most popular months for people coming to visit me, or crashing at my place in their way to their final destination.

In November I had the pleasure to host Sulamita, while she was on her way to India. One of the most interesting girls I have met this year.

Baby Jesus left yesterday, after spending several days at my place. He brought Salmiakki, smoked salmon and smoked reindeer with him, which I used to like before I became vegan (and later pescatarian). The salmon was incredible, though.

Just as I was writing these lines, Luk, who was also going to stay at my place before The Extremadura QA Meeting called me from BRU airport claiming his ticket had been cancelled :( I called C sar and found out that the travel agent they work with had not bothered to confirm several people s flights, so he will be coming to Spain on the 13th, just like everyone else. He will not be staying at my place, and will miss out on the smoked reindeer, that will be eaten by some other carnivore, I guess .

The great man I got the Linksys from lies sick in my bed, and spends almost as much time at my place than at his own, so I guess he doesn t count.

Saw this on Baen’s Bar

Loser- INTP 46% Extraversion, 53% Intuition, 66% Thinking, 33% Judging

Talked to another human being lately? I’m serious. You value knowledge above ALL else. You love new ideas, and become very excited over abstractions and theories. The fact that nobody else cares still hasn’t become apparent to you… Nerd’s a great word to describe you, and I seriously couldn’t care less about the different definitions of the word and why you’re actually more of a geek than a nerd. Don’t pretend you weren’t thinking that. You want every single miniscule fact and theory to be presented correctly. Critical? Sarcastic? Cynical? Pessimistic? Just a few words to describe you when you’re at your very best…*cough* Sorry, I mean worst. Picking up the dudes or dudettes isn’t something you find easy, but don’t worry too much about it. You can blame it on your personality type now. On top of all this, you’re shy. Nice one, wench. No wonder you’re on OKCupid! Now, quickly go and delete everything about “theoretical questions” from your profile page. As long as nobody tries to start a conversation with you, just MAYBE you’ll now have a chance of picking up a date. But don’t get your hopes up. I am interested though. If a tree fell over in a forest, would it really make a sound? ***************** If you want to learn more about your personality type in a slightly less negative way, check out this. ***************** The other personality types are as follows… Loner - Introverted Sensing Feeling Perceiving Pushover - Introverted Sensing Feeling Judging Criminal - Introverted Sensing Thinking Perceiving Borefest - Introverted Sensing Thinking Judging Almost Perfect - Introverted iNtuitive Feeling Perceiving Freak - Introverted iNtuitive Feeling Judging Crackpot - Introverted iNtuitive Thinking Judging Clown - Extraverted Sensing Feeling Perceiving Sap - Extraverted Sensing Feeling Judging Commander - Extraverted Sensing Thinking Perceiving Do Gooder - Extraverted Sensing Thinking Judging Scumbag - Extraverted iNtuitive Feeling Perceiving Busybody - Extraverted iNtuitive Feeling Judging Prick - Extraverted iNtuitive Thinking Perceiving Dictator - Extraverted iNtuitive Thinking Judging

My test tracked 4 variables How you compared to other people your age and gender: You scored higher than 53% on Extraversion You scored higher than 25% on Intuition You scored higher than 52% on Thinking You scored higher than 15% on Judging

Link: The Brutally Honest Personality Test written by UltimateMaster on OkCupid Free Online Dating, home of the The Dating Persona Test

From time to time, I use technorati to monitor for links to my blog. I intentionally do not allow comments or trackbacks, but often people send me replies in their own blogs. In technorati, I noticed a link to my blog that wasa quite surprising. Spammers have been around for some time, that take part of your blog posting and add their random shite to it. This was somewhat different. This spammer quoted an old version of a blog posting. When I wrote that blog positing, I noticed like 10-20 minutes later that I had a fact wrong, so I changed that, even renaming the blog postings title. This spammer still had the old title, that only live for some 20 minutes at most. So either this spammer was very lucky in crawling my blog exactly at that time - or they've received a ping for it. I'm usually pinging different services using the ping-o-matic. I'm convinced at least one of these services allows you to subscribe to all blog posts that contain certain keywords (I've seen political web sites linking to posts favourable for their candidate within minutes!), and I have the impression some spammers are doing this. They're probably sending trackbacks to my site then, hoping that I'll add a link back to them automatically, or that they'll at least go up in the Google rankings. Update: I've found out that Google blog search still has that incorrect version of my blog posting; the spammers site heavily links back to Google blog search; the search terms were "computer science"... so apparently they are not indirectly subscribed to my pings, but they're just polling Google blogsearch every five minutes.

Kernel Modules Almost all drivers for Linux are maintained within the Linux Kernel Project. But some drivers are maintained outside in seperate projects. We distinguish between two kind of drivers.

• out-of-tree These modules are only adding their driver into an existing kernel sub-system, without needing modifications on that very sub-system. Therefore, we can easily build them outside of the kernel with using only the kernel headers, and not requiring to patch anything in the kernel source itself. In Debian, these modules are packaged as $ driver -source packages, containing the sources to build automagically a binary module package $ driver -modules-$ kernel_version with module-assistant. Examples: unionfs, ipw3945, ...
• in-tree These modules are adding their driver into an existing sub-system, but requiring some modifications on that very sub-system, or they are also introducing one or more new sub-systems. Therefore, we can not build them without patch the kernel source and rebuild the whole kernel tree. In Debian, these modules are packaged as kernel-patch-$ driver , containing the patches to be applied against a kernel tree to be built with make-kpkg. Examples: kernel-patch-2.6-reiser4, kernel-patch-openvz, ...

Conglomeration Packages From the user point of view, out-of-tree modules are not ideal. Although it is very easy to build the binary module packages for a driver, they require to have their build dependencies installed. This would be acceptable on a development machine, but not on a client. Therefore, some module maintainers started to build the binary modules for every kernel image available in Debian, so users can just apt-get install those prebuild packages. From the archive point of view, this is a mess. While the distribution is under development, every new kernel release and every kernel ABI bump requires a rebuild of all out-of-tree modules, resulting in new binary packages and hence NEW queue spamming for the ftp-master team. While the distribution is in maintenance after beeing released as stable, point releases suffer from this too, making it a major pain in the ass for the security team. The solution: conglomeration packages. Conglomeration packages are empty packages depending on a given set of $ driver -source packages and only building the binary modules out of them. This way, the NEW queue spamming is limited to one single source package for each new kernel release or kernel ABI bump (actually three of them: linux-modules-extra-2.6 for main, linux-modules-contrib-2.6 for contrib, and linux-modules-nonfree-2.6 for non-free). Status in Etch The conglomeration package for the modules of main is maintained by the kernel team. For contrib and non-free, I needed to take care about them myself. Fortunately, they were accepted two days ago, so there is enough time left to let them properly migrate to testing. Module Maintainers please join I can only speak for contrib and non-free: If you are a module maintainer and the license terms of your module do allow binary redistribution and auto-building, you are heartily invited to join the conglomeration package. Please submit a wishlist bug report against the respective conglomeration package, or, feel free to contact me directly if you have any questions.

Last Friday I was tinkering with apcupsd and rrdtool and decided to join both: I’d monitor the mains voltage during a period of 24 hours, to see if it varied during the day. Well, apparently, it does. To my untrained eye it looks like it varies with the load in the electric network: the voltage is at its highest during nighttime, and hits its lowest point at 13:30 (solar mid-day in Galicia); then rises again while people is having lunch then dips until after 18:00. The discontinuity at about 20:15 was due to my briefly stopping apcupsd to change a configuration in my UPS. Now, I don’t know if the mains voltage really varies so much during the day or if it is because my UPS’s voltmeter is a piece of shit (which it, apparently, is) and is affected by the presence of non-resistive loads or whatnot, but the graph is interesting anyhow. Detailed explanations by people who know more about electricity than yours truly will be appreciated. On an unrelated subject, I’m teaching myself how to juggle a reverse cascade. To do it properly, it requires better timing and more homogeneous throws than I’m currently able to do. So, to master it, I first need to suck less at juggling. We’re working on it.

Amaya, the song you quoted in your previous post (My World) isn't 80s. It was composed by first Guns N' Roses incarnation (Axl, Slash and co) during the Use Your Illusion sessions (90-91) and close the two albums. The history behind the song is that they were on mushrooms after working during all the night in the Live and Let Die cover. Axl wanted to do something quick and they came up with that. The song has nothing to do with Guns and Roses because Axl was into industrial that time and though it was ok close the illusions that way.

While we're at it, the second incarnation of the band successfully toured Europe this year and is right now doing some gigs in USA. From the new material i would recommend: There Was a Time and Better. You can watch proshots from the European leg of the tour everywhere on the web. Have fun!

Daniel Burrows writes about Samsung embedding DRM in (some of?) its DVD drives. While I must say that I'm not surprised (not because it's Samsung, but because I expect DRM to be embedded deep in hardware more and more to counter software-based attacks won't work anymore), it will now make me feel bad about buying a Q40, which I'm thinking about doing: it's a really slick sub-note, only a bit more than 1kg (with the small battery) and running up to ca. 5 or 6 hours with the (included at no extra charge) high power battery (as per specs). Good display, too, from what I could see at the shop, and it has an Intel graphics chip. Memory stick/MMD/SD card reader included as well, so I'd have something to look forward to when kernel 2.6.48 or so comes out and these readers will finally work. And, opposed to what IBM/Lenovo produce, they actually have some competent designers^W^W^W^W^W^WI actually like how it looks. DRM: I think this battle will have to be fought in politics. Battling the vendors is fine, but will be endless, the real goal should be to anchor a broad right to tinker in the bill of rights which also extends to non-commercially used information. (Adding the “non-commercial” bit in here because authors do have the right to be reimbursed when somebody earns money with their creation.) What I do in private with the DVD I legally bought, or with the satellite signal that is sent to my home for free (and I can't even opt out) is non commercial use. Update: The problem is that Daniel is a doofus. (in his own words.) So Samsung's reputation is safe for now. But I have to agree with him, still: it is a realistic expectation in these days that the hardware supports DRM in some way.

I’ve enjoyed reading Richard Gott’ article named Latin America is preparing to settle accounts with its white settler elite, where he goes deeply on how the recent political movements in the region has been marked more on lineage and classism than in anything else. Read the article in English here, or in Spanish, here (thanks to Rebeli n).

Following from my 5 minute OSDC talk yesterday on 5 security improvements needed in Linux distributions I gave a 5 minute talk on installing SE Linux on Debian etch. To display the notes I formatted them such that they were in 24 line pages and used less at a virtual console to display them. The ultra-light laptop I was using has only 64M of RAM which isn't enough for a modern X environment and I couldn't be bothered getting something like Familiar going on it.

After base install you install the policy and the selinux-basics package:

# apt-get install selinux-basics selinux-policy-refpolicy-targeted
The following extra packages will be installed:
checkpolicy libsemanage1 mime-support policycoreutils python python-minimal
python-selinux python-semanage python-support python2.4 python2.4-minimal
selinux-utils
Suggested packages:
python-doc python-tk python-profiler python2.4-doc logcheck syslog-summary
The following NEW packages will be installed:
checkpolicy libsemanage1 mime-support policycoreutils python python-minimal
python-selinux python-semanage python-support python2.4 python2.4-minimal
selinux-basics selinux-policy-refpolicy-targeted selinux-utils
0 upgraded, 14 newly installed, 0 to remove and 0 not upgraded.
Need to get 6362kB of archives.
After unpacking 41.5MB of additional disk space will be used.
Do you want to continue [Y/n]?

The package install process also configures the policy for the machine. The next step is to label the filesystems, this took 26 seconds on my Celeron 500MHz laptop with 20,000 files on an old IDE disk. The time is in proportion to number of files, often bottlenecked on CPU. A more common install might have 5* as many files with a 5* faster CPU so 30 seconds is probably common for labelling. See the following:

# fixfiles relabel

Files in the /tmp directory may be labeled incorrectly, this command
can remove all files in /tmp.  If you choose to remove files from /tmp,
a reboot will be required after completion.

Do you wish to clean out the /tmp directory [N]? y
Cleaning out /tmp
/sbin/setfiles:  labeling files under /
matchpathcon_filespec_eval:  hash table stats: 14599 elements, 14245/65536 buckets used, longest chain length 2
/sbin/setfiles:  labeling files under /boot
matchpathcon_filespec_eval:  hash table stats: 19 elements, 19/65536 buckets used, longest chain length 1
/sbin/setfiles:  Done.

The next step is to edit /boot/grub/menu.list to enable SE Linux, auditing, and put it in enforcing mode:

title   Debian GNU/Linux, kernel 2.6.17-2-686
root    (hd0,1)
kernel  /vmlinuz-2.6.17-2-686 root=/dev/x selinux=1 audit=1 ro enforcing=1
initrd  /initrd.img-2.6.17-2-686

Then reboot.

After rebooting view the context of your shell, note that the login shell will have a domain of unconfined_t when the targeted policy is used:

# id -Z
system_u:system_r:unconfined_t

Now let's view all processes that are confined:

# ps axZ  grep -v unconfined_t grep -v kernel_t grep -v initrc_t
LABEL                             PID TTY   STAT   TIME COMMAND
system_u:system_r:init_t            1 ?     Ss     0:02 init [2]
system_u:system_r:udev_t         1999 ?     S.s    0:01 udevd --daemon
system_u:system_r:syslogd_t      3306 ?     Ss     0:00 /sbin/syslogd
system_u:system_r:klogd_t        3312 ?     Ss     0:00 /sbin/klogd -x
system_u:system_r:apmd_t         3372 ?     Ss     0:00 /usr/sbin/acpid -c /etc
system_u:system_r:gpm_t          3376 ?     Ss     0:00 /usr/sbin/gpm -m /dev/i
system_u:system_r:crond_t        3402 ?     Ss     0:00 /usr/sbin/cron
system_u:system_r:local_login_t  3423 tty1  Ss     0:00 /bin/login --
system_u:system_r:local_login_t  3424 tty2  Ss     0:00 /bin/login --
system_u:system_r:getty_t        3425 tty3  Ss+    0:00 /sbin/getty 38400 tty3
system_u:system_r:getty_t        3426 tty4  Ss+    0:00 /sbin/getty 38400 tty4
system_u:system_r:getty_t        3429 tty5  Ss+    0:00 /sbin/getty 38400 tty5
system_u:system_r:getty_t        3430 tty6  Ss+    0:00 /sbin/getty 38400 tty6
system_u:system_r:dhcpc_t        3672 ?     S.s    0:00 dhclient3 -pf /var/run/

The initial install of policy inserts modules to match installed software, if you install new software then you need to add new modules with the semodule command:

# semodule -i /usr/share/selinux/refpolicy-targeted/apache.pp
security:  3 users, 7 roles, 824 types, 67 bools
security:  58 classes, 11813 rules
audit(1165532434.664:21): policy loaded auid=4294967295
# semodule -i /usr/share/selinux/refpolicy-targeted/bind.pp
security:  3 users, 7 roles, 836 types, 68 bools
security:  58 classes, 12240 rules
audit(1165532467.874:22): policy loaded auid=4294967295

Note that the security and audit messages come from the kernel via printk, it is displayed on console login but you need to view the system log if logged in via ssh or running an xterm. Now you have to relabel the files that are related to the new policy:

# restorecon -R -v /etc /usr/sbin /var/run /var/log
restorecon reset /etc/bind context system_u:object_r:etc_t->system_u:object_r:named_zone_t
restorecon reset /etc/bind/named.conf context system_u:object_r:etc_t->system_u:object_r:named_conf_t
[...]
restorecon reset /etc/apache2 context system_u:object_r:etc_t->system_u:object_r:httpd_config_t
restorecon reset /etc/apache2/httpd.conf context system_u:object_r:etc_runtime_t->system_u:object_r:httpd_config_t
[...]
restorecon reset /usr/sbin/named context system_u:object_r:sbin_t->system_u:object_r:named_exec_t
restorecon reset /usr/sbin/apache2 context system_u:object_r:sbin_t->system_u:object_r:httpd_exec_t
restorecon reset /usr/sbin/rndc context system_u:object_r:sbin_t->system_u:object_r:ndc_exec_t
restorecon reset /usr/sbin/named-checkconf context system_u:object_r:sbin_t->system_u:object_r:named_checkconf_exec_t
[...]
restorecon reset /var/run/bind context system_u:object_r:var_run_t->system_u:object_r:named_var_run_t
restorecon reset /var/run/bind/run context system_u:object_r:var_run_t->system_u:object_r:named_var_run_t
restorecon reset /var/run/bind/run/named.pid context system_u:object_r:initrc_var_run_t->system_u:object_r:named_var_run_t
restorecon reset /var/run/motd context system_u:object_r:initrc_var_run_t->system_u:object_r:var_run_t
restorecon reset /var/run/apache2 context system_u:object_r:var_run_t->system_u:object_r:httpd_var_run_t
restorecon reset /var/run/apache2/cgisock.3558 context system_u:object_r:var_run_t->system_u:object_r:httpd_var_run_t
restorecon reset /var/run/apache2.pid context system_u:object_r:initrc_var_run_t->system_u:object_r:httpd_var_run_t
restorecon reset /var/log/apache2 context system_u:object_r:var_log_t->system_u:object_r:httpd_log_t
restorecon reset /var/log/apache2/error.log context system_u:object_r:var_log_t->system_u:object_r:httpd_log_t
restorecon reset /var/log/apache2/access.log context system_u:object_r:var_log_t->system_u:object_r:httpd_log_t

The -v option to restorecon causes it to give verbose output concerning it's operations. Often you won't do it in real use, but it's good to illustrate the use.

Now you have to restart the daemons:

# killall -9 apache2
# /etc/init.d/apache2 start
Starting web server (apache2)....
# /etc/init.d/bind9 restart
Stopping domain name service...: bind.
Starting domain name service...: bind.

Apache and BIND now run in confined domains, see the following ps output:

system_u:system_r:httpd_t   3833 ?     Ss     0:00 /usr/sbin/apache2 -k start
system_u:system_r:httpd_t   3834 ?     S      0:00 /usr/sbin/apache2 -k start
system_u:system_r:httpd_t   3839 ?     Sl     0:00 /usr/sbin/apache2 -k start
system_u:system_r:httpd_t   3841 ?     Sl     0:00 /usr/sbin/apache2 -k start
system_u:system_r:named_t   3917 ?     Ssl    0:00 /usr/sbin/named -u bind

It's not particularly difficult. I covered the actual install of SE Linux in about 1.5 minutes. I had considered just ending my talk there on a note of "it's so easy I don't need 5 minutes to talk about it" but decided that it was best to cover something that you need to do once it's installed.

If you want to know more about SE Linux then ask on the mailing list (see http://www.nsa.gov/selinux for subscription details), or ask on #selinux on freenode.