Since today, this features was added to msecgui, showing the summary for three of the most important parts of system security: the firewall status, security overview and status of system updates.

Summary screen for msec

Of course, we all know that it is cooker version, and it is by no means final point on the UI design and functionalities . And, as usual, comments are more than welcome!

Since 2009.1, msec was supporting an arbitrary number of custom security levels, providing two levels by default: standard, focused on casual desktops, and secure, focused on security-concerned machines. Clearly, this was not covering all the possible use cases, and, while it was possible to create custom security levels for different users needs, few users actually dared to do so.

Starting with 2010.1, msec will provide a larger number of custom, task-oriented security levels. Among such levels, initially are the netbook (focused on low-end machines, running mostly on batteries, with a single local user and no remote accesses); fileserver (focused on a network server, such as SAMBA, NFS, or a database server, where only authenticated users are allowed), and webserver (focused on a web-facing server, attending unauthenticated and unknown users). The idea is to allow users to focus on their specific tasks (e.g., creating a web server, or configuring the netbook), without going too deep into the configuration options.

The msecgui UI was also improved to support those levels, among with user-created custom levels:

Msec levels selection, including the provided levels among with user-created ones

Besides those changes, the UI was simplified a bit thanks to a great cooker discussion and comments from Fabrice Facorat (and will be further improved in newer versions), the support for configuring the log retention period was introduced, and a few bugs were fixed.

More changes are still to be implemented in msec, but I thought that the ones I described in this post are interesting enough to deserve a new msec release.

Stay tuned for future updates!

However, at this age, it is obvious that the hard disk of the notebook was not prepared to endure such challenges nicely. Both of its speed (5400 RPMs), durability, capacity, and so on were targeted on a more light use.

On the other hand, the system has 3GB of RAM, which is more than enough for most of my tasks. So after some thinking, I’ve been using some small script to automatically improve the system performance by offloading the most I/O-consuming stuff to RAM for the past few months.

How does it works? Simple. I have a small script which grabs content of a disk directory which I expect to receive heavy use (for example, /usr/lib/firefox, or the rpm BUILD/ directories which receive lots of I/O when building packages, and so on), and converts them into a RAM disk. This way, when anything inside such directory is accessed, it requires absolutely no hard disk I/O, the seek times are non-existent as well, and the throughput is incredible.

For example, if I build mozilla-thunderbird by using real hard disk BUILD directory, it takes almost 2 hours to build. If I use ramdisk for just the BUILD directory, the time required for such task drops down to about 30 minutes. The firefox startup time (both cold and hot – e.g., the first execution and consecutive ones) have the same time of about 1 second; and so on.

So, without further words, this is the script I am using:

#!/bin/bash
#
# This script remounts a directory in tmpfs (ramdisk) to speed it up
#

DIR=$1
SIZE=$2

if [ ! "$UID" = "0" ]; then
    # this script must run by root. Let's try sudo'ing to root..
    exec sudo $0 $*
fi

if [ ! -d $DIR ]; then
    echo "Usage: $0 <full path to a directory>"
    exit 1
fi

if [ "a$SIZE" = "a" ]; then
    OPTIONS=""
else
    OPTIONS="-o size=$SIZE"
fi

# first, copy everything somewhere to reuse it later
TMP=`mktemp`
tar cpf $TMP $DIR

# remount dir as ramdisk
mount -t tmpfs $OPTIONS $DIR $DIR

# unpack everything back
(cd / && tar xpf $TMP)
rm -f $TMP

To use it, just save it under a name like toram and use it on the directory you want to move to ramdisk. The second optional parameter is the size of the ramdisk to use – as by default tmpfs mounts itself with 50% of available ram, sometimes you may want to use more or less memory.

Just some examples on how to use it:

# toram `pwd`/BUILD (will remount current BUILD directory in RAM)
# toram /usr/lib/firefox-3.6 (will remount firefox directory in ram)

I hope this could be useful to someone .

First of all, starting with Mandriva 2010.1, msec will support user-defined periodicity for all periodic security checks. Therefore, it is possible to specify if each test should be executed daily (like in all previous msec versions), weekly or even monthly. In my opinion, this feature is one of the most interesting among all others, because it allows you to fine-tune the balance between security checks and daily I/O load caused by some expensive checks.

By default, checks which require lots of I/O (e.g., checking for unowned files, or world-writable files, and so on) will run weekly on the standard security level. Why so? Because this check was responsible for approximately 80% of all time required to run the periodic checks, and on most of the machines its results did not differ between consecutive days. Surely, it is nice to have a daily notification of all those changes, but the I/O cost of it is unacceptable high. Of course, you can define the periodicity of all such checks to be daily when you want, by using msecgui application of editing the configuration file manually .

Another interesting feature was the de-duplication of variables between main msec configuration file (security.conf) and the level configuration file (for example, level.standard). On previous versions, all variables were defined in security.conf, even if they have exactly the same value as the default one for the current security level. This way, it was easier to see all the configuration at once by looking into /etc/security/msec/security.conf file. On the other hand, it lead to duplication of almost all variables..

So for 2010.1, the behavior when saving the configuration file was modified to be more logical (and similar to the one of msecgui, which displays variables that differ from the default values for the security level in different way). If you want to redefine a variable, just specify it in security.conf and this change will take effect. If you want to disable a variable completely, just define it to an empty value (like, CHECK_SOMETHING=), like in previous versions, and it will be disabled.

To simplify this, we could use the following analogy: in previous msec versions (e.g., 2009.1 and 2010.0), the security.conf file contains the whole security configuration of msec plus the name of the security level which is used as base. In 2010.1, it contains the reference to the base security level plus only the variables which must be overridden for this level. In other words, on Mandriva 2010.1 just by looking at the msec security file it is possible to say “this machine is configured to use the same configuration as on standard security level, except those three checks that should be disabled).

There is yet another reason for this change, which will be described in details when it gets implemented (probably in a few coming weeks). So stay tuned for more news .

Another feature was the possibility of running the RedHat sectool checks periodically, among with all other msec checks. Just install sectool package from the contrib, and its checks will be executed automatically by msec.

Additionally, the integration between msec and msecperms applications was improved, making it easier to switch security levels and creating custom levels.

Besides those changes, several msec messages were improved to make them easier to understand by non-geek users , and, like usual, several bugs were fixed.

Like always, I am very interested in your feedback on those changed. Please, feel free to drop me a note whether you like these features, dislike them, or any other kind of comments about msec.

After the last of the LOTR movies, I was a bit lost. There was no more need to wait for the next movies. I felt almost like ‘the cinema has got to its top, and I don’t think any other movie will entertain me, and allow me to go to the other worlds as the LOTR did’. For several years, I was waiting for the next LOTR movies like a child who is waiting for the Santa’s gifts at the end of the year. And suddenly I felt like all the wishes were fulfilled.

However, some new movies appeared and made me feel almost as when I was waiting for the Fellowship of the Ring, The Two Towers and The Return of the King – movies like the Spiderman series, The Jason Bourne series, the last episode in the Starwars movies (well, the 3rd episode to be correct), Pirates of the Caribbean, 300, the new Batman and The Dark Knight movies, and many others. However, most of those movies appeared before 2009, so I started the year thinking ‘oh my.. this year will be a really boring one, with nothing interesting to watch’.

Well, to sum it in a few words.. I was completely wrong. The year of 2009 brought me a lot more excellent movies that I could possible hope. Just to name a few: Watchmen (until the very end of the year, I thought it would be simple the best movie in a long long time), 500 Days of Summer, Zombieland, Terminator Salvation, Inglorious Bastards, Taken, Star Trek, Pandorum (almost-the-best SciFi movie in a long long time), District 9, and many many others. I have to say that all those movies were great, and left a mark in my memories.

And then Avatar came and put them all into the background.

I already expected a lot from this movie, and also was quite afraid that it would not live up to the expectations. However, I had a lot of trust in James Cameron – the cinema magician who created Terminator, Aliens, True Lies, Abyss and Titanic.. and he made yet another cinema miracle. In my opinion, Avatar is the biggest happening in the cinema world of this decade. And it is specially true for the ones out there who happen live some part of their life in different worlds – worlds created by writers, cinema guys, or RPG games.

The writers manage to create great worlds, and make you believe that they are real in your mind. Role-playing games put you in those worlds, and make you part of it. But with Avatar, James Cameron was the first guy to in fact create a different world, and let us to live in it for a while. That world feels so real, that you forget about all the computer-generated graphics, effects, and a (few) plot holes, so you just lose a few hours of your real life to spend them on Pandora.

So, to sum it all up – if you haven’t done it yet, go watch Avatar – and, if possible, watch it in 3D. You’ll probably feel the same feeling as the people in the beginning of the past century had, by watching the first movies ever.

I think that resumes pretty much everything I have to say about it .

Now that we are entering the year 2010, I thought that it would be interesting to give you some quick follow-up on how many updates were done during the last few years.

In 2009, there were a total of 436 security updates for all Mandriva-supported packages (e.g., the packages in Main repository), and a total of 288 bugfix updates. The bugfixes are usually provided by the package maintainers, who are responsible for issuing the fix/patch, properly testing the updated package, and send it to the secteam. Secteam does the final validation, signs the package with the update key, and releases the advisory (which is sent to a mailing list and to the Mandriva web site). Later, the packages are sent to the mirrors, and become available to the users.

With security updates, it is a bit different. The entire process is usually handled by the secteam, which is responsible for identifying the security issue, locating the relevant patch or solution, updating and testing the fix, and releasing the updated packages. After that, those updates have a similar fate to the bugfix ones (e.g., signing, releasing the advisory, and so on).

If we look into the detailed numbers, things become quite more interesting:

• In 2006, we had 67 bugfix updates and 250 security updates. In total, 10769 RPM files were provided as updates.
• In 2007, there were 144 bugfix updates and 262 security updates, with a total of 17786 updated rpm files
• In 2008, we had 213 bugfix updates and 264 security updates, totaling 25718 rpms provided as updates
• And in 2009, there were 288 bugfix updates and 436 security updates, with a total of 41024 rpms provided as updates.

So I’d say that Mandriva users are pretty well supported .

With just a few pictures it was already possible to note the difference – I could not ever EVER got close to those pictures with all my previous cameras (like Nokia N95 and Sony CyberShot W90):

However, after a few days with my new camera, I found out that it came with some dust on its sensor. Not much, but clearly visible on pictures with uniform colors (like sky or white wall). For example, it is possible to see the dust spot on the left half of the following picture – if you zoom in, you’ll clearly see that there is some dark spot covering part of a cloud and appearing in the sky:

One could say ‘Ahh, but that is just a small tiny spot.. nobody will notice it’. But… I do notice it, and I don’t like it. So I started looking for solutions for this issue.

In first place, I tried cleaning the sensor using a air blower (without luck). The dust spot moved a bit with the air flow (a few microns) and landed to its new place (permanently, I afraid). The next step was to ask the official Nikon support in Brazil, which is located in São Paulo city, about 250km from where I live. Their answer was is that the sensor cleaning should cost around R$ 100 (about 60 US$) + shipping. Quite expensive in my opinion.

So the next step was to start thinking like a computer geek. The photo is digital, so it is nothing more than a bunch of bits . So there SHOULD be some software or at least algorithm suitable for cleaning this all. After a quick research, I found that there is the Nikon Capture NX software which removes the dust pretty well. However, it is

• commercial
• expensive
• orders you to take photos in RAW only. I like RAW, but… the memory card is not infinite.

So another option was to clean the dust in gimp. Manually… and it is needless to say that this approach is.. well.. boring, time-consuming and pretty much futile.

However, when all the hope was, apparently, lost, the Great Google Gods sent me a wonderful link to the Resynthesizer plugin – which is AMAZINGLY EFFICIENT in solving the dust issues.

So, dear readers, without other words, I’ll show you the few needed steps to fix the dust on your photos:

1. Install resynthesizer plugin. On Mandriva systems, you can cheat and run a magic urpmi gimp2-resynthesizer command which will do the trick. On other systems, go to the resynthesizer web site, download, compile and install the plugin. it is trivial, so I won’t go into additional details here.

2. Grab your dust-damaged image and open it in gimp. As you can see, there is a horrible dust on the left part of the otherwise-blue sky:

Gimp with the dust-cleaning victim

1. Select a region around the dust to remove:

Selecting the dust to remove

1. Press CTRL-X to remove the selected area:

Removing the dust

1. Now, select a bit larger region around the white spot:

Selecting some space around the dust spot

1. Go to Filters->Map->Resynthesize and run the Resynthesize filter:

The Resynthesizer plugin in all its glory

1. Wait, wait, and…:

Magic!

1. That’s it!:

A perfect clear sky!

Of course, it all could be done manually in gimp. However, the Resynthesizer plugin just makes it easier and better.

So what is the result? A bit more magic + some Hugin hacking and…:

Yes, that’s right. Every image on panorama had a dust spot, which I cleared up with Resynthesizer. So next time you encounter some dust on your photo, remember that there is a GREAT open-source plugin for gimp out there to help!

Enjoy, and have a Happy New Year!

The first photo ever of my megane, taken in 2005

Well, first of all, this was definitely the best car I ever had or driven. It is extremely stable, fast, easy to control and comfortable. Yet by some reason, it seems to be quite an outcast here in Brazil, and it leads to problems related to the repair parts and their prices.

During those 4 years I never ever had any serious problems with this car, and I can recall at least 5 times when it really saved my life when any other car would have been completely destroyed or at least seriously damaged. The car’s stability is phenomenal, and its easy of control at any speed and in all situations are remarkable.

Do not try this at home

So this post is sort of a tribute to my old Renault Megane. It was amazing to have you, and thanks for the ride!

And, as the year is coming an end, I’d also wish a Merry Christmas and a happy 2010 to everyone who read, commented or just passed by and looked at this blog! See ya!

Of course, there also were some cooker breakages as well during this year . But, on the other hand, cooker is not fun at all when it is stable (albeit I am using it on my machine constantly).

So far, I can say that it is being a very cool experience . Mandriva distributions is getting better and better, and I am very proud of making part of Mandriva team and being able to contribute a bit to its development.

The number of played tracks is scaring..

I’d say that about 13000 tracks in this counter were played with mpd and a few custom scripts to control it..

Net_monitor has evolved a lot since its first/new release. The interface was compacted, more features added and overall look-and-feel improved considerable.

net_monitor monitoring a wired connection

net_monitor monitoring a wireless ad-hoc connection

netprofile also received a few updates – most notable, the support for save, load and reset action, and a simple yet functional plymouth integration during boot:

Selecting a profile on boot

I don’t know how useful this integration is however (at least, for me). Most of the time my computer is either in suspend or hibernating mode, so I would see this screen about once a month .

Our old friend net_monitor, present in your favorite Mandriva distro!

The net_monitor currently used in all Mandriva versions is written in perl, is using internal drakx-net api (and is, therefore, only usable on Mandriva), and also have some issues such as memory leaks and non-usual interface. After a few thoughts and discussions we came to conclusion that it would be more adequate to project and rewrite it from scratch, turning it more modular, expansible and focused on common use cases.

Initially, I thought on using perl to write it, so it would still be part of drakx-net suite. However, after thinking on the code and the way it should work I felt that my brain was going to melt down (perl is a nice language, but it is certainly not that compatible with me). So I ended up with python, which is my language of choice (together with C). Also, I’ve received many comments saying that the net_monitor is no more relevant, as every desktop environment provides its own network monitoring tool, and it should be dropped from drakx-net. By combining those issues, we came to decision that it would be more proper to separate net_monitor into a different package – this way, it won’t depend on any drakx-net internal functionalities, and user could uninstall it if required and use his own network monitoring tool if he wants to. And, at the same time, users would still have a cute little network monitoring application on their machines.

So, as a picture says more than a thousand words, I guess I’ll just add some pictures here than additional KBs of text (EDIT: please note that the look and features of net_monitor have changed significantly in Mandriva since this post):

net_monitor monitoring a wireless connection

net_monitor monitoring a connection for which network accounting was not enabled

net_monitor displaying some statistics about your network usage (provided by vnstat)

looking at daily traffic statistics on my notebook for the past month

...and hourly statistics...

...and finding our when I killed my bandwidth..

Surely, this is just an early and preliminary version, with many missing features and such. If you want to give it a try, just install net_monitor package, and it will create /usr/bin/net_monitor executable for you. It won’t conflict with existent net_monitor from drakx-net which is installed in /usr/sbin, so both of them may coexist on your system. If you look at /usr/share/doc/net_monitor/TODO, you’ll see some of the ideas that I intend to add to it, but the idea is to keep it simple and not transform it into an emacs of network monitoring . And, of course, feel free to add your comments and suggestions (and bug reports) here!

P.S.: Just to prevent comments like ‘you should focus on fixing bugs instead of wasting time writing new things’. Net_monitor is present in Mandriva for years now, and if you look at bugzilla list it has a number of bugs and issues. So I am not creating a new app – I am bringing back from the land of the dead an old one .

P.P.S.: Answering in advance to another question – yes, it would work on any Linux distro which has python and pygtk. You’ll just have to add some tricks into your network startup scripts to enable vnstat integration, but it will work just fine even without that.

One quick trick to improve this situation is by converting some images to png with ImageMagick and running pngcrush on them. A simple script can be used to do so:

    #!/bin/bash
    totalsize=0
    for file in *jpg; do
            # file.jpg becomes file.png
            newfile=${file/jpg/png}
            # convert to png
            convert $file 1.png
            # compact with pngcrush
            pngcrush -brute 1.png $newfile > /dev/null
            # calculate old and new sizes
            newsize=$(wc -c < $newfile)
            oldsize=$(wc -c < $file)
            if [ $newsize -lt $oldsize ]; then
                    echo "$file: reduced from $oldsize to $newsize bytes"
                    # remove old jpg file
                    rm -f $file
                    # replace all references to old file everywhere
                    sed -i -e "s/$file/$newfile/g" *
                    totalsize=$[$totalsize + $oldsize - $newsize]
            else
                    # old file is smaller, remove new file
                    rm -f $newfile
            fi
    done
    echo "total reduction: $totalsize"
    # remove temporary file
    rm -f 1.png

By running it on the website in question, it managed to shrink the front page by about 200KB of image data. Considering 10000 daily accesses, it would save about 2GB of network traffic per day.

Dward Fortress learning curve

If you enjoy state-of-the-art ASCII graphics, infinite gameplay, endless game possibilities and want to spend most of the rest of your life trying to understand how to play this game , you’ll certainly enjoy it!

The game page is here, and if you want a direct link to latest Linux version it is here. Ohh, and if you want some a bit more user-friendly UI, check out here.

So, why not? From now on, this blog will land on Linux-Planet too!

With base on previous post, I was working (among other things) on few msec ideas. And now it looks like a good time to put them out to cooker.

First of all, I added support for exceptions into msec periodic check. I wanted to make it as flexible as possible, and I think I managed to implement everything I wanted. Right now, for each supported periodic check, it is possible to define as many exceptions as necessary. So, for example, if you run a local mandriva mirror with unsecure permissions on files, or want to exclude certain rules from firewall check, or some local users that appear unsafe to msec are safe to you, you can tell it to msec, and it will not bother you about it anymore.

For this, /etc/security/msec/exceptions file is used, and it is possible to define as many rules as necessary for each check there. The syntax is quite simple: RULE_NAME exception. To illustrate, that’s what I put into my local exception list on my machine:

CHECK_UNOWNED /home/chroot
CHECK_UNOWNED /home/images/chroot
CHECK_WRITABLE /home/chroot
CHECK_WRITABLE /home/images/chroot
CHECK_OPEN_PORT /deluge
CHECK_USER_FILES gdm
CHECK_OPEN_PORT eugeni:ircd

This way, I won’t receive msec alerts about unowned and world-writable permissions in chroots, about gdm home directory being accessible to the world, and about network ports used by deluge or connected to local ircd server. Each exception is a regexp, so the possibilities are endless.

Of course, it is possible to do it in the gui:

Showing the list of configured exceptions in msecgui

Adding a new exception

Besides that, as suggested in the last post, I also added a summary to periodic msec checks. So if you want to have a quick look on the results, you don’t have to read the entire mail.

Also, a few annoying bugs were fixed and few features were added.

But, besides that, I also contacted vdanen, the author of the rsec tool, and the sectool guys about some possible interaction between our projects. Hopefully, we’ll have some news soon.

Meanwhile, enjoy new msec and (as always) feel free to give your feedback over it.

As you probably know, msec underwent a huge redesign for Mandriva 2009.1, and it is getting a lot of attention for 2010.0. But that’s still not enough – even if it became a quite flexible and extensible package, it still has its rough edges, and I intend to solve them all. Of course, it won’t became a perfect package that would rule-them-all, but I intend to get as close to this objective as far as it is humanly possible .

So, please, if you use msec, or rsec, or sectool or any other security-concerned framework – please, speak about what you want to see in them, what are the points you are missing, and what features were left unimplemented for the time being.

As for me, I have the following items in the roadmap:

• implement skip list/exceptions for msec, for every possible test, in a similar way to mandriva bug #53307
• do my best to provide a nice common source base for both msec and rsec (I hope vdanen would be interested in that as well). Right now it is possible to configure msec to behave exactly as rsec, doing security checks and nothing besides that, but that is not that trivial to do (well.. it is for me, but not for any casual user out there ), and it should be beneficial to both projects
• provide support for sectool plugins in msec – either directly, or by converting them to msec-parseable format
• work with rsec/sectool/checksecurity/seccheck developers to provide a similar set of features for all those projects. We live in opensource world, and advances in one projects would certainly benefit all of us – specially in such critical area as system security.

So, if you have suggestions, ideas, features or any sort of comments – please, speak. We’ll hear you.

Para quem quiser mergulhar numa aventura emocionante, conhecer as teorias, mitos e lendas do Grande Caos, comparar a sua inteligência com a artificial, e participar de uma busca dinâmica afim de e averiguar a verdadeira autonomia de computação, sintam-se convidados a se escalar nessa jornada!

http://www.teses.usp.br/teses/disponiveis/55/55134/tde-05082009-205709/

Please note that it is NOT the right way to do it, and it is in fact a big big hack – I simply grab the binary .zip from chromium site, repackage it as rpm, and define some rpm hacks to work around different shared library names. But it works fine for me (on i586), so I decided to share it in case someone else could be interested.

To install it with urpmi, the following would do the trick:

urpmi.addmedia --mirrorlist http://eugeni.dodonov.net/rpm eugeni i586
urpmi chrome

this will install the browser startup script in /usr/bin/chrome, and also add an entry to the menu. Please note that this is a dirty hack , but it makes it a bit easier to test new chromium packages without lots of manual tricks.

Let’s think about a simple use case. You are using your notebook at home, and everything is fine. However, every time you have to go to work, you have to change several settings related to your network connection, proxy configuration and firewall. Of course, you can do it all manually, or even wrap out a script, but.. there is no need for it with the new netprofile!

So, the goal of this post is to illustrate how to accomplish this task with new netprofile and updated drakx-net applications.

The first thing you have to do is to go to draknetprofile application, and create a new network profile (Update: scroll down to the botton of the post to see the actual draknetprofile screenshots):

draknetprofile graphical interface

When you create a new profile, you have to give it a name (for example, work):

Creating new network profile

After you are finished, this new profile will be created and, automatically, activated:

New network profile was created and activated

From now on, whey you use other drakx-net application, they will detect that you have multiple network profiles, and show you some helpful text to let you know what profile you are using currently. So you can configure your firewall:

firewall configuration with new network profile

Your network connections:

Configuring network settings for new network profile

Your proxy settings:

proxy configuration for new network profile

And other network settings you want:

network center displaying currently used profile

When you go back home, you simply right-click on the net_applet tray icon and activate the default profile again:

net_applet switching profiles

And this will (almost) instantly restore your settings stored on the default profile:

draknetcenter with default profile

You can repeat this procedure for any other profile and configuration. Of course, if you do not want to use netprofile at all, everything will just work.

I hope this clarifies a bit the netprofile application, and how it can help you to simplify your life in different network environment.

EDIT: Updating this post, this is how draknetprofile looks in Mandriva 2010 Beta:

Default netprofile view, with modules details hidden in Advanced section

Advanced view of draknetprofile, showing modules configuration

What is netprofile? The idea of this application is quite simple. For different network environments one requires different network settings. For example, you may use a fixed IP at home, with firewall disabled, and no proxy. At work, you must use a corporate proxy and a DHCP address for your ethernet connection. And while at a LAN house or Internet cafe, a full-featured firewall must be used, your ethernet connection disabled and a tor proxy (for example) to be in effect.

How to achieve this in a working system? Usually you must manually reconfigure the network settings, edit configuration files for network, firewall and proxy, and so on. And this is where netprofile comes into action.

The netprofile uses the concept of network profiles to represent different network environments. You start with the ‘default’ profile, and you may use your system normally. If you want to setup a different network environment, you may ’switch’ to a different profile (a new profile will be created if necessary). Your current settings will be saved to your previous profile, and all changes to system configuration will now apply to your new profile.

To illustrate:

• You configure your system to use fixed IP address and a specific firewall configuration.
• You go to work, where different network environment takes place. You switch to the work profile (‘netprofile switch work’, or using net_applet gui), and if it is the first time you use this profile, it is created with base on your current settings.
• You configure your network card to use DHCP, configure your corporate-specific proxy and firewall settings, and continue using your machine normally.
• When you come back home, you switch the profile back to default, and your previous settings are restored.

You may also specify what network profile to use on boot, by passing the ‘PROFILE=‘ option to the boot loader. If you have multiple profiles, and no boot parameter was specified, a menu dialog will appear on boot asking you to select the profile to use.

The new netprofile is based on modular architecture. While we have a core application (netprofile), all functionality is performed by modules. Right now we have the following modules:

• network – to store/restore network settings: ethernet, ppp, isdn, wireless and other connection settings.
• firewall – to manage firewall (iptables and shorewall) settings
• firewall6 – to manage firewall settings for IPv6 networks
• proxy – to manage system-wide proxies.

Also, I am thinking on the following modules:

• netfs – to manage remote shares and network file systems. For example, at work you may access a centralized NFS server, and at home a SMBFS/CIFS connection to your home server.
• authentication – you may use local users at home, and ldap/yp authentication at work. Transparently. With one mouse click/command to switch between them .

The inevitable question: why do we need it if we have NetworkManager and similar apps? Well, I have a few arguments:

• NetworkManager is great, has a modular design, and also supports network profiles. However, it is focused on network settings only, and not on proxy, firewall, authentication, and so on.
• NetworkManager is also based on a pluggable architecture. However, it is not that easy to write plugins for it.
• Not all distributions support NetworkManager. Netprofile, on its turn, will work on any unix system (or, even better, on anything that support running shell scripts. Yes, you can use it on windows too, with a few hacks ). Of course, it works better on Mandriva because it has drakxtools – Mandriva-specific scripts and applications. And we have draknetprofile as part of drakxtools, which works as shown on the following screenshot:

draknetprofile application to control netprofile profiles in Mandriva Linux

That’s it for now. If you want to experiment with netprofile, feel free to download it and play with it. It should be available on next Mandriva Linux 2010.0 release together with many other exciting new features !

This could be the best movie ever!

(found here)

• Nexuiz
• OpenArena
• Doom3
• Quake4
• World of Goo (this one actually managed to keep me awake until 5am for a few days)
• Caster
• Cube
• …

and, besides those, we still have wine which plays most of the games just fine (except some of the bleeding edge ones, and the ones which are hurt by the the-f**ing-hating-mouse-rotation-bug like call of duty 4).

But.. even with all that progress, I miss the good old games. Of course, Crysis, Assassin’s Creed, Call of Duty 1/2/3/4, Dead Space and all other thousands of recently released games look pretty amazing, but I feel that most of modern games are not even close to the old ones. I still remember being awake for 24+ hours playing Baldur’s Gate, and loosing some of the faculty exams because of the Baldur’s Gate 2. And I’ll probably never forget how scary it was to play Doom on a 386 in a dark room. Nor wolfenstein 3d on a 286 for the first time. And, speaking about game story, few games came close to Baldur’s Gate, Planescape: Torment, Fallout 1/2, Final Fantasy VII (a.k.a. how-you-felt-when-Ariel-died??)/VIII..

But, speaking of 3d-shooters. The best so far (at least, for me) are: Doom, Doom 2, Heretic, Hexen, Duke3D/Blood/Shadow Warrior, Serious Sam 1/1.5/2, Half-Life, Prey, Quake1/2/4, …. Most (all?) of those games are based on the same concepts we have seen in early 90ths. I could mention Halo/Gears of War, which introduced some changes in the gameplay, but not that much to say that it was a break-through. You still keep walking around, grabbing new weapons (and dropping less useful ones, like in Medal of Honor/Call of Duty/Halo/…), killing stronger and more stronger enemies, and that’s it. Occasionally there are some innovations, like portals and gravity (Prey) or maybe some sort of character development (Daikatana, Call of Duty, Unreal Tournament) or time/physics manipulations (Half-Life 2) and environment interaction (Doom 3, Unreal Tournament), but nothing ground-breaking.

So far, I am feeling like the progress stopped in the way the games are developed. We have new physics, graphics, sounds, polygons and so on, but few games are introducing something truly new. On the other hand, maybe we have reached the point when everything is already implemented, and the games just have to focus on the state-of-the-art graphics only, and forget about all other items..

So, if you read so far, what do you think about that? Are there any modern games which are truly outstanding (and run on Linux – either natively or using wine)? I promise to test all the suggestion and post my impressions on this blog.

TomoyoGui received some attention this week, and it slowly becomes more and more functional. The performance of huge tomoyo policy parsing was greatly improved (on my running system it has about 3MB in form of a text file), and the dependencies among sub-domains are now calculated.

The gui was improved to simplify the listing of domains, and now it allows you to do a quick search for desired application, and select all sub-domains of a process by double-clicking it. We are now also fully compatible with tomoyo’s ccs-savepolicy and ccs-loadpolicy formats.

Also, I am slowly progressing towards the idea of a application-based profiles (like in AppArmor – may it rest in peace! ). While tomoyo does not supports that in an easy form (everything is a huge text file), I had some ideas on how to make it work. So in some not-so-far future it will be implemented and described here.

So, as an image says more than a thousand words, some screenshots:

Initial view of tomoyo with some helpful and user-friendly text

Just a double-click away from selecting ACPID subdomains

Peeking into what a domain is allowed to do

Multiple selection of unrelated domains

Besides that, msec also received a few updates – now supporting the SECURE_TMP variable and improved diff_check procedure.

And in other news – the best football team in the world with the best football player in the world scored yet another victory in Brazilian championship . If you missed that, you can always see the goals again thanks to youtube!

Initial view

Active security domains

As far as I know, this is the first GUI for Tomoyo out there (except the TomoyoGUI Eclipse Plugin, but it seems to be quite eclipse-bound and abandoned. Its page is in Japanese, but the all-mighty google translator helped me to take a peek into it). But, of course, I might be wrong – so please let me know if you know of any other GUI for Tomoyo Linux.

Obviously there are still a lot of things to do:

• add support for auditing/tomoyo security log into msec
• add support for reloading profile on-the-fly
• saving/loading/changing settings on the fly
• support complex statements
• everything else

so keep an eye on this blog for more news.

Regards, Dr. Eugeni