- luv-main - luv.asn.au

Another security concept
by Peter Ross 07 Oct '11

07 Oct '11

.. I discovered over the last months is Capsicum. http://www.cl.cam.ac.uk/research/security/capsicum/papers/2010usenix-login-… It comparts _parts_ of an application and grants specific rights to them. It also discusses and compares several methods, especially used to tame Chromium. While it is prototyped and partially included in FreebSD-Current (and upcoming release 9, I think), there is a port to Linux as well, supported by the project team. See, among others, the discussion here: https://lists.cam.ac.uk/pipermail/cl-capsicum-discuss/2011-January/msg00000… Regards Peter

2 1

FreeXperia
by Craig Sanders 07 Oct '11

07 Oct '11

On Thu, Oct 06, 2011 at 10:26:40PM +1100, Russell Coker wrote: > Sent from an Xperia X10 Android phone FYI, saw this on slashdot recently. thouught you might be interested http://news.slashdot.org/story/11/10/03/2357228/sony-ericsson-helps-out-fre… "Smartphone maker Sony Ericsson has decided to work closely with developers creating custom Android ROMs for devices in order to learn from them. The company said in a blog post that it has decided to support an open source developer group called 'FreeXperia,' which creates custom Android ROMs based on the CyanogenMod for several Sony Ericsson phones like the Xperia ARC and Play. Sony Ericsson maintained that it does not approve of some of the work carried out by independent developers but was keen to work with people who were creating custom ROMs." craig -- craig sanders <cas(a)taz.net.au> BOFH excuse #399: We are a 100% Microsoft Shop.

3 2

faking a debian package
by James Harper 07 Oct '11

07 Oct '11

I want to install libvirt-bin under Debian, but it depends on libxenstore3.0 and I don't want it installed because I already have xen installed (built from source) and installing the debian version breaks it. What are my options? I can think of: 1. rebuild the libvirt-bin and remove the dependency (easy enough, but the next upgrade of libvirt-bin will break it) 2. force package installation (not even sure I can do this anymore) 3. create a dummy libxenstore3.0 package with a high enough version that nothing can ever upgrade it 4. install libxenstore3.0 but somehow redirect the files (?) Any other suggestions? Thanks James

4 6

vlan's, igb, and 3.0.0
by James Harper 29 Sep '11

29 Sep '11

Is anyone using vlan's with a 3.0.0 (tried 3.1.0-rc7 too) kernel and the igb network driver? It just isn't working for me, even if I turn off all the offloads. Thanks James

1 0

Re: [luv-main] Microsoft requires Windows 8 logo systems to not bootunsigned OS's
by Andrew McNaughton 29 Sep '11

29 Sep '11

On 23/09/11 14:37, Daniel Pittman wrote: > On Thu, Sep 22, 2011 at 21:11, Jason White <jason(a)jasonjgw.net> wrote: >> Daniel Pittman <daniel(a)rimspace.net> wrote: >>> So, the biggest advantage is that it does work against all those >>> attacks that compromise the kernel and/or drivers to get into the >>> kernel after a restart. Which, indeed, is where many of the "root >>> kit" tools hit, on Windows. >> That's interesting... and the proposed solution just happens to be the one >> which also has potential to disadvantage competitors... > Well, assuming that the vendors are lazy, yeah. Which /probably/th > that the vendors will have an option to turn it off in the > configuration whatever, so you can install whatever on it. Because > Linux is enough of a server OS, these days, that the low margin, high > volume vendors probably don't want to go down the path of cutting off > part of their business, and producing two different EFI > implementations would cut into that. > > Allowing loading another key, probably screwing up any security > assurance for !Win32 systems in the process, feels like the cheap > option to me. I think that's exactly what's needed. People should read up on the secure boot process associated with the TPM chips that are in most recent computers, but typically not turned on. If there's a user process to load a new key into the TPM chip, then I don't see a problem with Windows and other OSes being secured in this way. Rather than boot sector viruses, people should probably be thinking about the requirements for full disk encryption to be effective, which is something we want. This basically requires that any non encrypted boot mechanisms must be secured in some fashion, and that's what the TPM implements these checksums for. The other alternative is implementing hardware encryption inside the disk drive itself (as in the hitachi drive that came with my Lenovo x220). This latter is a more expensive option though, and requires BIOS/UEFI support to ask for the password. I'm not clear on how many systems have that. My x220 is a UEFI based system, the TPM can be enabled and disabled from within the bios, and that's protected by the BIOS password. The system ships with the TPM disabled, and so far I haven't played with it. If it shipped with the TPM enabled, I wouldn't have thought that would prevent me installing Linux. I might have to disable it for a bit while I get things set up. I haven't yet gone very far down this road, but I have briefly looked over a 2008 howto at http://www.grounation.org/index.php?post/2008/07/04/8-how-to-use-a-tpm-with… which includes some details on how one loads a key into the TPM using linux. It's on my to-do list. So far I've just read enough to know that I can do it when I'm ready. So I'm not very worried about booting linux becoming an impossibility. If however hardware manufacturers were to ship systems with TPM enabled and no way to turn it off, or with no way for a user to load their own key, then that would be a different matter. Does the system that Microsoft is mandating necessarily include such user controls in order to be compliant? If not, then that is probably the point we should be aiming any legal efforts at. And perhaps there should be some requirement that if any system is restricted by the keys and ability to change them, such that it is only able to run windows, then that they must advertise that they are *only* compliant with windows 8, rather than just that they *are* compliant with windows 8. I am concerned that it might be harder to boot from a Linux CD in order to install. Not massively harder - it should require only that the TPM be disabled for a while. This will have some impact however on less confident installers. I'd like it to be possible to boot from a CD or USB for anyone who has the BIOS/UEFI password, without making any changes that would affect the subsequent boot. Anti-virus disks are another important one for booting outside the usual OS. I am a bit concerned that I probably won't be able to boot linux from the flash disk on my keyring on most systems in future. It's currently quite convenient. Andrew McNaughton

1 0

IEEE SSIT: Sat 1 Oct 11:40-1:10 Panel: Climate Change and Engineering responsibility
by Rodney Brown 29 Sep '11

29 Sep '11

Melbourne Saturday 1 October: Climate Change and Engineering responsibility 11.40am to 1.10pm, cnr Victoria & Lygon Street, Carlton South A panel at the Climate Change Social Change conference sponsored by University of Melbourne Office for Environmental Programs: http://climatechangesocialchange2011.wordpress.com/. Per day registration $35. Speakers: 1. Dr Michael Arnold, History and Philosophy of Science, University of Melbourne: An introduction to the interaction between technology and society. 2. Reihana Mohideen, electrical engineer and social development specialist advicing on "gender and energy" in energy sector projects in Asia: Practical experiences of engineering in the field, looking at the social impact of renewal energy projects. 3. Dr Greg Adamson, Department of Information Systems, University of Melbourne: Are technology approaches to climate change a distraction from addressing an underlying problem? 4. Sophie McKenzie, School of IT, Deakin University: How engineers can be encouraged to think about the wider context of the work they are undertaking. IEEE Society on Social Implications of Technology (Australian Chapter) [SSIT technical meetings address a wide range of topics on which IEEE as a whole has no specific view. We don't suggest that IEEE members should agree with all the speakers we invite, but we do hope that they are interesting.]

4 3

stop/start info in /etc/init.d
by James Harper 29 Sep '11

29 Sep '11

I want to make sure xend stops after corosync etc so that the cluster can take care of migrating the domains off of the machine when it reboots, but I don't want to modify the init.d files directly in case they get overwritten on an upgrade. Is there a place I can put this information to make sure the scripts get processed in the right order without actually changing the scripts themselves? Thanks James

3 2

Re: [luv-main] stop/start info in /etc/init.d
by James Harper 29 Sep '11

29 Sep '11

Hmmm... haven't tested yet but I think I can put my new headers in /etc/insserv/overrides/ > -----Original Message----- > From: luv-main-bounces(a)lists.luv.asn.au [mailto:luv-main- > bounces(a)lists.luv.asn.au] On Behalf Of James Harper > Sent: Thursday, 29 September 2011 11:34 AM > To: luv-main(a)lists.luv.asn.au > Subject: [luv-main] stop/start info in /etc/init.d > > I want to make sure xend stops after corosync etc so that the cluster > can take care of migrating the domains off of the machine when it > reboots, but I don't want to modify the init.d files directly in case > they get overwritten on an upgrade. > > Is there a place I can put this information to make sure the scripts get > processed in the right order without actually changing the scripts > themselves? > > Thanks > > James > _______________________________________________ > luv-main mailing list > luv-main(a)lists.luv.asn.au > http://lists.luv.asn.au/listinfo/luv-main

2 1

Re: [luv-main] Microsoft requires Windows 8 logo systems to not bootunsigned OS's
by Andrew Voumard 29 Sep '11

29 Sep '11

FYI, slashdot has picked up the issue: Australian Users Petitioning Against Windows 8 Secure Boot http://yro.slashdot.org/story/11/09/28/1311220/australian-users-petitioning… Andrew At 06:07 PM 28/09/2011, Luke Martinez wrote: >lol, There is *no* discussion i can find going on at linux-aus >except that a small thread on the post that I was reposting everywhere. :) > > >> Linux Australia have put a more positive spin on it.. > >> > >> > <http://www.zdnet.com.au/linux-aus-may-have-a-case-on-win-8-accc-339323233.h…>http://www.zdnet.com.au/linux-aus-may-have-a-case-on-win-8-accc-339323233.h… > > >> >on another note, it seems that ZDnet contacted Linux Australia >president John Ferlito. Hopefully they can continue to report on >this and raise awareness. > > Luke > >_______________________________________________ >luv-main mailing list >luv-main(a)lists.luv.asn.au >http://lists.luv.asn.au/listinfo/luv-main

1 0

Re: [luv-main] Microsoft requires Windows 8 logo systems to not bootunsigned OS's
by Luke Martinez 28 Sep '11

28 Sep '11

lol, There is *no* discussion i can find going on at linux-aus except that a small thread on the post that I was reposting everywhere. :) >> Linux Australia have put a more positive spin on it.. >>> >> >>> >> >>> http://www.zdnet.com.au/linux-aus-may-have-a-case-on-win-8-accc-339323233.h… >>> >> >> on another note, it seems that ZDnet contacted Linux Australia president John Ferlito. Hopefully they can continue to report on this and raise awareness. Luke

1 0