Search Results: "kaction"

15 April 2017

Gunnar Wolf: On Dmitry Bogatov and empowering privacy-protecting tools

There is a thorny topic we have been discussing in nonpublic channels (say, the debian-private mailing list... It is impossible to call it a private list if it has close to a thousand subscribers, but it sometimes deals with sensitive material) for the last week. We have finally confirmation that we can bring this topic out to the open, and I expect several Debian people to talk about this. Besides, this information is now repeated all over the public Internet, so I'm not revealing anything sensitive. Oh, and there is a statement regarding Dmitry Bogatov published by the Tor project But I'll get to Tor soon. One week ago, the 25-year old mathematician and Debian Maintainer Dmitry Bogatov was arrested, accused of organizing riots and calling for terrorist activities. Every evidence so far points to the fact that Dmitry is not guilty of what he is charged of He was filmed at different places at the times where the calls for terrorism happened. It seems that Dmitry was arrested because he runs a Tor exit node. I don't know the current situation in Russia, nor his political leanings But I do know what a Tor exit node looks like. I even had one at home for a short while. What is Tor? It is a network overlay, meant for people to hide where they come from or who they are. Why? There are many reasons Uninformed people will talk about the evil wrongdoers (starting the list of course with the drug sellers or child porn distributors). People who have taken their time to understand what this is about will rather talk about people for whom free speech is not a given; journalists, political activists, whistleblowers. And also, about regular people Many among us have taken the habit of doing some of our Web surfing using Tor (probably via the very fine and interesting TAILS distribution The Amnesiac Incognito Live System), just to increase the entropy, and just because we can, because we want to preserve the freedom to be anonymous before it's taken away from us. There are many types of nodes in Tor; most of them are just regular users or bridges that forward traffic, helping Tor's anonymization. Exit nodes, where packets leave the Tor network and enter the regular Internet, are much scarcer Partly because they can be quite problematic to people hosting them. But, yes, Tor needs more exit nodes, not just for bandwidth sake, but because the more exit nodes there are, the harder it is for a hostile third party to monitor a sizable number of them for activity (and break the anonymization). I am coincidentially starting a project with a group of students of my Faculty (we want to breathe life again into LIDSOL - Laboratorio de Investigaci n y Desarrollo de Software Libre). As we are just starting, they are documenting some technical and social aspects of the need for privacy and how Tor works; I expect them to publish their findings in El Nigromante soon (which means... what? ), but definitively, part of what we want to do is to set up a Tor exit node at the university Well documented and with enough academic justification to avoid our network operation area ordering us to shut it down. Lets see what happens :) Anyway, all in all Dmitry is in for a heavy time. He has been detained pre-trial at least until June, and he faces quite serious charges. He has done a lot of good, specialized work for the whole world to benefit. So, given I cannot do more, I'm just speaking my mind here in this space. [Update] Dmitry's case has been covered in LWN. There is also a statement concerning the arrest of Dmitry Bogatov by the Debian project. This case is also covered at The Register.

21 August 2010

Guido G nther: Handling privileges with PolicyKit

I got tired of having to authenticate as root to change printer settings like paper size or printout mode via a GUI. Since system-config-printer uses PolicyKit things like allow myself to change printer settings when logged into the system should be possible without having to mess with cupsd.conf or sudo, are they? Which printer related actions are governed by PolicyKit:
pkaction   grep printer
shows about the following if you have cups-pk-helper installed. The later is used by system-config-printer to interface with PolicyKit:
So org.opensuse.cupspkhelper.mechanism.printer-local-edit seems to be what I'm looking for. Let's change the policy for this action:
cat <<EOF >/etc/polkit-1/localauthority/50-local.d/99-local.pkla 
This allows user foo to perform the action org.opensuse.cupspkhelper.mechanism.printer-local-edit if the user is logged into a local interactive session. The pklocalauthority(8) manpage has all the details. PolicyKit will pick up the configuration file changes on the fly. Lets see if this worked by getting the process id of the running system-config-printer and checking via pkcheck if the process is authorized to use that action:
PID=$(ps a   awk '/[p]ython .*system-config-printer/   print $1  ')
pkcheck --action-id org.opensuse.cupspkhelper.mechanism.printer-local-edit --process $PID
echo $?
If pkcheck returns with a zero return value everything is fine and user foo won't need any password to modify local printer settings from now on. Check the output of pkaction(1) to list more actions that can be setup this way. Flattr this

27 June 2010

Matt Zimmerman: Navigating the PolicyKit maze

I ve written a simple application which will automatically extract media from CDs and DVDs when they are inserted into the drive attached to my server. This makes it easy for me to compile all of my media in one place and access it anytime I like. The application uses the modern udisks API, formerly known as DeviceKit-disks, and I wrote it in part to learn get some experience working with udisks (which, it turns out, is rather nice indeed). Naturally, I wanted to grant this application the privileges necessary to mount, unmount and eject removable media. The server is headless, and the application runs as a daemon, so this would require explicit configuration. udisks uses PolicyKit for authorization, so I expected this to be very simple to do. In fact, it is very simple, but finding out exactly how to do it wasn t quite so easy. The Internet is full of web pages which recommend editing /etc/PolicyKit/PolicyKit.conf. As far as I can tell, nothing pays attention to this file anymore, and all of these instructions have been rendered meaningless. My system was also full of tools like polkit-auth, from the apparently-obsolete policykit package, which kept their configuration in some other ignored place, i.e. /var/lib/PolicyKit. It seems the configuration system has been through a revolution or two recently. In Ubuntu 10.04, the right place to configure these things seems to be /var/lib/polkit-1/localauthority, and this is documented in pklocalauthority(8). Authorization can be tested using pkcheck(1), and the default policy can be examined using pkaction(1). I solved my problem by creating a file in /var/lib/polkit-1/localauthority/50-local.d with a .pkla extension with the following contents:
[Access to removable media for the media group]
This took effect immediately and did exactly what I needed. I lost quite some time trying to figure out why the other methods weren t working, so perhaps this post will save the next person a bit of time. It may also inspire some gratitude for the infrastructure which makes all of this work automatically for more typical usage scenarios, so that most people don t need to worry about any of this. Along the way, I whipped up a patch to add a --eject option to the handy udisks(1) tool, which made it easier for me to test along the way.

11 April 2010

Gregor Herrmann: RC bugs 2010/14

a short overview of my RC bug activities. more than usual, most of them in the debian perl group, some of them new bugs.

8 October 2008

MJ Ray: Nestle Boycott 20th Anniversary

It’s the 20th anniversary of the Nestle Boycott this week. The theme is “Change Nestl , Change the World”. This is one of few boycotts that I wholeheartedly support and participate in. While reading a report from the NI cooperative, I learnt of a new outrage by Nestle. Over in Canada, Wellington Water Watchers document a Nestle plant that is (as I understand it), taking drinking water for free, bottling it as “Aqua Fina”, trucking it to cities and selling it. (Thanks to whoever it was gave me the WWW link - I didn’t find the email, so please claim it in a comment if you want it.) You may remember that when Coca-Cola tried to do the same by selling contaminated Kent tap water as “Dasani”, it was widely ridiculed as Peckham Spring. Finally, “Dasani” was withdrawn from sale. It’s disappointing that Nestle’s Peckham Spring seems to be on sale in Canada, at a lower “manufacturing” cost than Coke’s UK one. Do we really want multinationals selling us our tap water in an inefficient way? No. Boycott Nestle.

18 September 2007

Ross Burton: Infinite Undo in Tasks

Yesterday I landed in Subversion a branch of Tasks I've been working on to remove all confirmation dialogs and replace them with infinite undo/redo. I'm really pleased with the end result, there are no more dialogs getting in the way and every action is undoable. To implement this I adapted MarlinUndoManager from Marlin by the most excellent Iain Holmes. The basic design is that the application has a global undo context. When an operation which should be undoable occurs, you start the context, add as many undoables as required, and then end the context. Allowing a single undoable action to consist of multiple undoables lets the application reuse fine-grained logic to build coarse user-level actions (in Tasks this is used to build the Remove Completed action from multiple Delete Task actions). To make integrating this into applications even easier, I wrote a GtkAction which reflects the state of an undo context, so it is trivial to add redo/undo to the interface. There is one remaining task left before this is ready to be released: undo support in the edit dialog entries. Once this is done, the next release of Tasks will be announced. I also plan to work with Iain on cleaning up this code and submitting it for inclusion into GTK+. NP: Money Jungle, Duke Ellington, Charles Mingus, Max Roach

8 January 2006

MJ Ray: How boycotts work: one view

The problem of free software graphics hardware drivers was being discussed and it was suggested that we should only buy from friendly companies, which provoked a common sceptical claim that there's no point boycotting a product or company or country unless everyone else does. I think that may be assuming the aim is to bankrupt them rather than to change a bad decision. Since when has a boycott needed to be total in order to change a supplier's mind? You only need enough people to support it, not everyone. The value of "enough" changes for each thing: there are examples of relatively limited boycotts succeeding (Shell Brent Spar) and relatively long/large ones not yet succeeding (Nestl Baby Milk Action). Boycotts are consumers doing judo on corporations: Most corporations aim to maximise their profit. Boycotts are an overt way of linking lost sales to a particular issue. In theory, if it looks like it's costing more profit to suffer the boycott than to address the cause, the executives should fix it or the shareholders should replace them with some who will. So, it is helpful to boycott harmful companies noisily. (Full article continues on my site...)