The problem with SELinux (still)
Here's a list of almost all of the bugs that got fixed in recent Fedora 17SELinux policy update:
867107 - SELinux is preventing /usr/sbin/in.tftpd from using the 'dac_override' capabilities.
868656 - SELinux is preventing /usr/bin/python2.7 from using the 'sys_nice' capabilities.
868866 - SELinux is preventing /usr/sbin/fping from 'create'
A potential path to IPv6
For reasons beyond the scope of this entry, I wound up thinking aboutthinking about the (potential) transition to IPv6 again today. In thepast I've been solidly gloomy on the prospects for a transition to IPv6,in large part because IPv6 doesn't benefit the people who have to dothe work ; the people who benefit from a transition are thepeople who don't already have IPv4 addresses, not the people who do.But today a potential path out of this occurred
Explaining an RPM oddity
Recently, Jordan Sissel tweeted :
Hey guys I beat the final boss of RPM: gist.github.com/4053631
Because I believe that gists may expire, I'm going to quote it here:
Two packages. Same name. Same file. Different epoch.Both installed simultaneously.rpm.pork(~/projects/fpm) % rpm -ql fizz/tmp/test/tmp/testpork(~/projects/fpm) % rpm -qa | grep fizz
A reminder: string concatenation really is string concatenation
Once upon a time when I was starting to write Python, I scribbleddown the following code:
def warn(s): sys.stderr.write(sys.argv[0] + ": " + s + "\n")
(More or less. My actual code had an error and so didn't even work.)
Many Python programmers are wincing, because of course stringconcatenation is both somewhat inefficient and not the idiomatic way todo this; you should be using % string formatting
Why Unix doesn't have user-changeable namespaces
Today I was reading Plan 9 mounts and dependency injection ,and in a footnote ran across this:
For the longest time, Linux did not provide per-process mountnamespaces, and even today this feature is not available tounprivileged users — Plan 9, in contrast, had this featureavailable from the very beginning to all users.
As it happens there's an excellent reason why Unix (not just Linux)doesn't support this and why Plan 9 does, the same reason that chroot() is a
Some amusing cut and paste work from spammers
Recently I got a modest spate of advance fee fraud spam attempts withthe interesting feature that they either claimed to be from 'FederalBureau Of Investigation Seeking To Wiretap The Internet' or at leastcontained some variant of 'FBI seeking to wiretap the Internet' inaddition to the agency name. Advance fee fraud come-on messages arealmost never well written to start with but this text is relativelyglaringly out of place, which is part of why it stood out and stuckin my mind. The messages have some other
Devops, the return of system programmers?
Here's a thought I've been turning over in my mind for a while now: inthe right light, you can see the Devops movement partly as the return of system programmers , who have been outin the wilderness for a while due to the predictable trajectory of thefield .
Now, I've got a limitation here in that as an outside observer, I'm notsure that I really understand what 'Devops' is. But part of it certainlyseems to be an increased focus on
DTrace: figuring out what you have access to at tracepoints
I've said before that OpenSolaris (or Illumos) source code is anessential component for serious use of DTrace, because it's what youneed in practice to figure out how to get useful information out ofthe kernel. But sometimes you don't want to go spelunking throughOpenSolaris code to find structure definitions and all of that, andyou'd like a more convenient way. As it happens, there sort of is.
The first step is to find out what arguments are available at aparticular
Why I want to do full end-to-end performance tests
In light of the difficulty of doing real random IO tests , you might ask why we need to do that atall. Micro-benchmarks are easier and can be used to identify specificproblems; as a commentator noted, I could use some block IO testing totest for our recent problem . Thesimple summary of why is that well done end to end performance testingis going to be comprehensive.
The advantage of good end to end performance tests is that theyfind all problems, even problems that you don't
Your logs should always include IP addresses (in addition to hostnames)
Although I was grumpy about Exim's logging yesterday , there is one thing it gets absolutely right: it always logs the IP address as well as the hostname. The importance ofthis goes well beyond doing reverse lookups right ; evenif your program is fully validating the hostname, you should log the IPaddress as well. In fact, my view is that either the IP address or the( verified ) hostname alone is incomplete information andyou should always log both. Why is quite simple:
What IP address a