On 19/04/2008, Mark Shuttleworth <mark@ubuntu.com> wrote:
>
> In the case of Launchpad, we do view you as a co-owner of the data, so the
> resolution of this problem is important to us.
Great :-)
> Affero GPL is a strong candidate for the front line of thinking on the
> subject, and that's what I am inclined to use when we publish Launchpad's
> source code.
> ...
> I do agree that Affero is a better option than the straightforward GPL.
Also very good :-)
> if you can read it through the web, or
> modify it through the web, you should be able to do so programatically.
Yes!
http://dataportability.org/ is a loose confederation of web developers
worth involving in this effort, IMO.
And, more generally, this is the vision laid out by TBL in his
Semantic Web manifesto, although today all the TLA'd stuff the W3C
does today can obscure that vision as laid out 10 years ago. I'm very
glad that after developing a pretty shoddy hypertext system and by
chance making it royalty free and dominant, TBL took it upon himself
to make "the web done right" :-)
> Separately, we're working with Trac, Bugzilla, Debbugs and other tools to
> get replication in place so that you can in fact run a free software tool to
> manage your bugs for your project, and still collaborate with distributions
> who use Launchpad (Ubuntu, PLD Linux, Nexenta and others) as well as
> upstreams (Zope, AWN and 6,000 others).
AWESOME :-)
The gains for Gobuntu if it can pull the gNewSense bug tracker data
will be a massive boost to both projects and is not to be
underestimated in my opinion :-)
> We're also providing guidance and
> support for the folks integrating Bazaar into Savannah, so that you can use
> an indisputably free platform for project hosting and still be part of an
> efficient code collaboration with other projects that use Launchpad and
> Bazaar.
Collaboration between Canonical and GNU is great :-)
> I am still uncomfortable with the idea of having lots of Launchpad's, though.
> Launchpad was designed as a central platform to link different projects, and
> having multiple centers would decrease the value of it to the current users.
There are already multiple centers for GNU/Linux distribution development.
Currently they are not linked. Supposing it happens, how the structure
of the peering of such supernodes emerges may be good or bad compared
to the situation today where the supernodes are not connected. By
waiting for Ubuntu to really dominate the other distributions in terms
of mindshare, Canonical increases the chances that its supernode will
be closer to the center. That the other supernodes' senior management
include a bunch of clowns help too :-)
But there are more free culture movements than the GNU/Linux
distribution movement. The one I'm trying to bootstrap, the free font
movement, is going to need a range of platforms to manage projects of
a range scales, and the biggest on the scale is the one that
aggregates all the rest, like Launchpad does. When Launchpad and
platforms like it for running successful free culture projects are
available for independent deployment, free cultural development will
accelerate.
Creative Commons is also pushing this with its team of developers
working on ccHost, who are also worth involving in Launchpad's semweb
efforts.
Perhaps this can be looked at during UDS-Intrepid +1...
> That's not usually true of software - having more Gnome users is generally
> positive for the existing ones. This is a subtle point and not one that most
> free software folks will acknowledge. But then they may not use LP enough to
> appreciate what it means.
I think they do perceive the benefits of network effects that come
easily from centralisation, but they are intuitively suspicious of the
social policy that necessarily emerges from the structure of
centralised systems, and they fumble communicating this by bluntly
refusing to acknowledge the benefits exist. Its subtle stuff, as you
say.
> They usually revert to "you got, i want, gimme now" ;-)
Yes, but usually this is accompanied by "...or I'll do it myself, AND
THEN YOU'LL BE SORRY."
:-)
> The roadmap for Launchpad does get it to the point where it will
> more graciously handle that distributed nature, and at that point I will be
> more comfortable distributing it.
I look forward to it! :-)
--
Regards,
Dave
--
Gobuntu-devel mailing list
Gobuntu-devel@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/gobuntu-devel
Sun Apr 20 19:30:01 2008
Return-path: <gentoo-hardened+bounces-2037-tom=linux-archive.org@lists.gentoo.org>
Envelope-to: tom@linux-archive.org
Delivery-date: Sun, 20 Apr 2008 18:58:37 +0300
Received: from pigeon.gentoo.org ([69.77.167.62] helo=lists.gentoo.org)
by s2.java-tips.org with esmtp (Exim 4.68)
(envelope-from <gentoo-hardened+bounces-2037-tom=linux-archive.org@lists.gentoo.org>)
id 1Jnbw5-0007uC-6T
for tom@linux-archive.org; Sun, 20 Apr 2008 18:58:37 +0300
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id CD659E0509;
Sun, 20 Apr 2008 15:58:28 +0000 (UTC)
X-Original-To: gentoo-hardened@lists.gentoo.org
Delivered-To: gentoo-hardened@lists.gentoo.org
Received: from agave.telenet-ops.be (agave.telenet-ops.be [195.130.137.77])
by pigeon.gentoo.org (Postfix) with ESMTP id 89C39E0509
for <gentoo-hardened@lists.gentoo.org>; Sun, 20 Apr 2008 15:58:28 +0000 (UTC)
Received: from localhost (localhost.localdomain [127.0.0.1])
by agave.telenet-ops.be (Postfix) with SMTP id 11A8967D29
for <gentoo-hardened@lists.gentoo.org>; Sun, 20 Apr 2008 17:58:28 +0200 (CEST)
Received: from [192.168.1.2] (user-85-201-69-178.tvcablenet.be [85.201.69.178])
by agave.telenet-ops.be (Postfix) with ESMTP id E2EE267D20
for <gentoo-hardened@lists.gentoo.org>; Sun, 20 Apr 2008 17:58:27 +0200 (CEST)
Message-ID: <480B6823.6060208@tvcablenet.be>
Date: Sun, 20 Apr 2008 17:58:27 +0200
From: =?ISO-8859-1?Q?Fran=E7ois_Valenduc?=
<francois.valenduc@tvcablenet.be>
User-Agent: Thunderbird 2.0.0.12 (X11/20080420)
Precedence: bulk
List-Post: <mailto:gentoo-hardened@lists.gentoo.org>
List-Help: <mailto:gentoo-hardened+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-hardened+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-hardened+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-hardened.gentoo.org>
X-BeenThere: gentoo-hardened@lists.gentoo.org
Reply-to: gentoo-hardened@lists.gentoo.org
MIME-Version: 1.0
To: gentoo-hardened@lists.gentoo.org
Subject: Re: [gentoo-hardened] hwclock and selinux (and other problems)
References: <480AFE5B.3070602@tvcablenet.be> <14361.193.11.246.158.1208686092.squirrel@webmail. rymdraket.net> <480B16F7.3090908@tvcablenet.be> <1208699870.5307.4.camel@defiant.pebenito.net> <480B5055.6040806@tvcablenet.be>
In-Reply-To: <480B5055.6040806@tvcablenet.be>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable
Fran=E7ois Valenduc a =E9crit :
> Chris PeBenito a =E9crit :
>> On Sun, 2008-04-20 at 12:12 +0200, Fran=E7ois Valenduc wrote:
>> =20
>>> xake@rymdraket.net a =E9crit :
>>> =20
>>>>> type=3D1400 audit(1208682664.167:223): avc: denied { read write }=
for
>>>>> pid=3D29607 comm=3D"hwclock" path=3D"/var/log/faillog" dev=3Ddm-6 i=
no=3D271083
>>>>> scontext=3Droot:system_r:hwclock_t tcontext=3Dsystem_u

bject_r:fai=
llog_t
>>>>> tclass=3Dfile
>>>>> =20
>>>> This is just an error about hwclock being unable to write to=20
>>>> "faillog" so
>>>> there must be something that goes wrong (making hwclock want to=20
>>>> write to
>>>> faillog).
>>>>
>>>> =20
>>>>> I also got this error:
>>>>> type=3D1400 audit(1208679707.497:84): avc: denied { read } for
>>>>> pid=3D18454 comm=3D"hwclock" path=3D"/dev/urandom" dev=3Dtmpfs ino=3D=
2059
>>>>> scontext=3Droot:system_r:hwclock_t
>>>>> tcontext=3Dsystem_u

bject_r:urandom_device_t tclass=3Dchr_file
>>>>>
>>>>> However, I think I solved it by issuing the commands "setsebool -P
>>>>> global_ssp 1" and "load_policy"
>>>>> =20
>>>> This is becouse you have the hardened toolchain, compiling=20
>>>> everything with
>>>> PIE/SSP by default. SSP want a random number (picked from=20
>>>> /dev/urandom)
>>>> when the binaries start. SELinux disables access to urandom per=20
>>>> default so
>>>> you have to (as you did with sebool) tell SELinux that your system i=
s
>>>> compiled with SSP and thus the access to urandom should be permitted=
.
>>>>
>>>> =20
>>> Yes, this has been solved with sebool. However, I still got the=20
>>> second error (related to faillog). It also blocks distccd like this:=20
>>> (even if the corresponding selinux policy is loaded):
>>> type=3D1400 audit(1208681304.633:191): avc: denied { read write }=20
>>> for pid=3D27886 comm=3D"distccd" path=3D"/var/log/faillog" dev=3Ddm-=
6=20
>>> ino=3D271083 scontext=3Droot:system_r:distccd_t=20
>>> tcontext=3Dsystem_u

bject_r:faillog_t tclass=3Dfile
>>>
>>> Do you know how to solve this second type of errors ?
>>> Thanks for your help.
>>> =20
>>
>> Seems weird that either of these programs would be writing to faillog,
>> since that file is usually for logging login failures. Do you have an=
y
>> idea why this might be happening on your system?
>>
>> =20
>
> I also get other denials related to these two programs:
>
> type=3D1400 audit(1208708112.397:275): avc: denied { read } for =20
> pid=3D1935 comm=3D"distccd" path=3D"pipe:[15699]" dev=3Dpipefs ino=3D15=
699=20
> scontext=3Duser_u:system_r:distccd_t=20
> tcontext=3Dsystem_u:system_r:local_login_t tclass=3Dfifo_file
>
> type=3D1400 audit(1208707984.676:266): avc: denied { read } for =20
> pid=3D16744 comm=3D"hwclock" path=3D"pipe:[15699]" dev=3Dpipefs ino=3D1=
5699=20
> scontext=3Duser_u:system_r:hwclock_t=20
> tcontext=3Dsystem_u:system_r:local_login_t tclass=3Dfifo_file
>
> Maybe this is the real reason for the failure of these two programs.
>
> Fran=E7ois Valenduc
Finally I managed to get hwclock working. I am using LVM and I forgot to=20
install the corresponding policy. I didn't notice that it had not been=20
installed when I ran "emerge --newuse world" (after having switched to=20
the selinux profile). I also managed to get distcc working but only if I=20
use the "listen" options in "/etc/conf.d/distccd'. If I use "allow"=20
instead of "listen" to specify the authorized ip adresses, I get this err=
or:
type=3D1400 audit(1208706789.868:111): avc: denied { read write } for =20
pid=3D9304 comm=3D"distccd" name=3D"3" dev=3Ddevpts ino=3D5=20
scontext=3Droot:system_r:distccd_t tcontext=3Droot

bject_r:sshd_devpts_t=
=20
tclass=3Dchr_file
type=3D1400 audit(1208706789.879:112): avc: denied { ioctl } for =20
pid=3D9304 comm=3D"distccd" path=3D"/dev/pts/3" dev=3Ddevpts ino=3D5=20
scontext=3Droot:system_r:distccd_t tcontext=3Droot

bject_r:sshd_devpts_t=
=20
tclass=3Dchr_file
Thanks for your help.
Fran=E7ois Valenduc
--=20
gentoo-hardened@lists.gentoo.org mailing list