Friday, August 27. 2010Beware of quotes passed to init-scripts!
Just a quick note in case I or others run into this again...
I use Trac to manage a few projects, more specifically Gentoo's www-apps/trac package to ease its deployment. One feature of the package I take advantage of is the init-script to manage the tracd standalone server. I now wanted to enable authentication for my Trac installs, and all guides out there tell you to add --auth="*,/path/to/digest/auth/file,domain"to your commandline when starting Trac (notice the quotes!), I tried this on the shell, and it worked as expected. I thus changed the TRACD_OPTS variable in /etc/conf.d/tracd to the following:
It started fine but authentication didn't work at all... Somewhat baffling, but after some investigation, I noticed that the quotes around the --auth argument were passed as-is to tracd, which then failed to find the environment *, since when splitting the --auth argument apart, "* would be used as environment name. The solution is simply to not set any type of quotes when starting tracd through the provided init-script, so that TRACD_OPTS looks as follows:
In hindsight logical, as the TRACD_OPTS variable gets evaluated only once and then passed to start-stop-daemon, which passes the arguments verbatim to tracd. 
Friday, April 2. 2010Retiring from Gentoo
I'm officially retiring as a Gentoo developer, simply because I've not really done anything in the last year and will not be getting back into the swing of things anytime in the future, so I feel it's time to retire.
It's been a fun 4.5 years, even if I wasn't present much as developer in the last 1.5 years, and I will definitely continue using Gentoo as my distribution of choice, nothing will change that. I've had the honor of getting to know some amazing people during those years, and improve a lot of my skills and competences, and for that I'm grateful. See you all around, Luca Longinotti. Sunday, October 5. 2008Saturday, May 12. 2007Thursday, February 22. 2007FOSDEM 07, here we come!
Yo all!
Tomorrow to FOSDEM 07 /me goes, along with hansmi, KillerFox and blubb from the swiss crowd! Later on both flo and EleRas will join us too, so for me not only will it be "the great Gentoo dev gathering", but also "the great SysCP dev gathering", will all three of us present.  As flo correctly guessed, I'll be sporting the black Gentoo t-shirt, which is amazingly comfortable, but flo's SysCP t-shirt intrigued me... Is it possible to have more of those @ flo? In black? /me loves black! We'll be able to discuss that at FOSDEM I think...Now off to bed, as I have to get up early (~4AM) to catch the first train to get to Basel, where the others await, and from there off to Bruxelles. Lugano-Basel-Frankfurt Am Main-Köln-Bruxelles is the exact route, almost 1000 Km, for a total en-route time of about 11 hours, yay! On the PHP front, I've finally put PHP 5.2.1 and PHP 4.4.5, with all the needed patches and, of course, Suhosin support, into the PHP Overlay. I'll test it all during the next days and hopefully commit to the tree on Monday at the latest. Many bugs are fixed with the latest releases, concurrentmodphp support was greatly improved and fixed (especially wrt 64bit archs), and the new MySQL extension patches are included to have the connection charset settable per-SAPI, for each PHP version, using php.ini, instead of my.cnf. Work on VCD is also going steady, we should be near feature-completion soon, so expect some form of pre-release in the next two weeks... Poke Hollow on #gentoo-vserver for more info. Best regards, cya all, CHTEKK. Monday, January 1. 2007Happy 2007!
Happy new year people!!!
I wish you all a great 2007 full of fun and happiness and all the other good stuff (new hardware comes to mind  ).23C3 finished two days ago, it was really great fun with great talks and great people (yeah, Polish guy living in the USA, from the university near Atlanta, you know who you are ).Now we've passed yesterday by visiting Berlin and at the moment we're connected through the Hostels connection... It depresses me to know it's at least twice as fast as my home DSL. By the way, all this convinced me to come to FOSDEM 07, so be prepared to know the CHTEKK (or be scared, that all depends). Cya, and happy new year, CHTEKK. Thursday, December 28. 2006Greetings from 23C3.
Yo! Greetings from the 23C3, the Chaos Computer Congress in Berlin.
Great talks and great people here, at the moment I'm attending a talk about JSON RPC (who knows, maybe that can/will be used someday to improve SysCP ), and before that I attended a really great talk about backbone hacking.As you can see from this blog post, the wireless network works well (as does the wired one). With regards to Gentoo devs, I've already seen and got to know hansmi, KillerFox and Pylon. I've also been told that mabi is around and hanno should be too (at least based on the fact he gave a Lightning Talk about XGL yesterday, which I sadly missed), we should really define a place to meet and get to know eachother... That goes for Gentoo and SysCP users too. I myself can usually be found attending some talk or down in the Hackcenter (central position, at a round table). Have fun! Best regards, CHTEKK. Friday, November 10. 2006New PostgreSQL and PHP (late)
As the title says, I'm late with this blog post, but better late than never...
The new dev-db/libpq and dev-db/postgresql ebuilds reached Portage on Thursday, they seem to work well (we've received positive feedback until now) and already solved a number of bugs! Thanks to dev-zero too for all the work spent on them, we make a good team! Btw, it seems dbs are made to be maintained by two people... Me and dev-zero for PgSQL, me and vivo for MySQL, and it works very well! WEEEE TEAMWORK RULEZ! Thansk guys, it's great to work with you all! On the PHP front, 5.2.0 reached the overlay, I still have to update the eclasses a little and fix some stuff, as well as update the 4.4.X and 5.1.X releases with some patches, which will probably happen tomorrow, and they'll probably be put into Portage on Sunday or Monday, sorry for the little delay, but at least the stuff's well tested and working then. Best regards and a great weekend to all, CHTEKK. Monday, November 6. 2006News, news, ... ;)
Hi all, /me is back, since a few days now, and I've been working on updating stuff...
Today, together with vivo, MySQL 5.0.X stabilization was agreed on, and https://bugs.gentoo.org/144999 updated accordingly. x86 already responded and stabled dev-db/mysql-5.0.26-r1, the other arches will soon follow. The upgrade from 4.1.X should be painless, just remember to read the MySQL upgrading guide for instructions on how to backup your data before the upgrade, and be sure to run revdep-rebuild from gentoolkit after the upgrade, as all things linking to MySQL will need to be recompiled. New PostgreSQL ebuilds are also coming up, those are the first of the new generation of PostgreSQL ebuilds, done together with dev-zero, that will fix up a lot of issues and ease maintainance of PostgreSQL a lot, as well as permitting some exciting new things in the future. ETA for those new ebuilds to enter Portage is this evening (UTC timezone). PHP 5.2.0 is also finally out, congrats to the PHP Team, expect an ebuild for the final version in the PHP Overlay by Wednesday and in Portage by Saturday at most. Samhain will also be updated soon to the newest versions, so if you use that, stay tuned. Work on SysCP 1.3 is going on strong, more about that in another blog entry in the next days. Best regards, CHTEKK. Friday, October 27. 2006/me away until 03.11
I'll be away from this evening UTC until evening UTC 03.11.2006, so don't search for me or await any reply from me.
Absolutely no internet access, so... See ya all in a week! Best regards, CHTEKK. Sunday, July 30. 2006#gentoo-db
#gentoo-db has just opened it's (virtual) doors (or windows or terminals, depends on what IRC client you use
).The new channel is intented to provide a platform for discussions, concerning both support and development, centering on Gentoo and databases. At the moment Gentoo MySQL and PostgreSQL people hang out there, but it's my hope to see other developers and/or teams that maintain database-related packages for Gentoo (Firebird, Oracle, SQLite, BerkeleyDB, ...) join too, as well as users with experience in SQL and database management, or just people intersted in databases and their uses. Best regards, CHTEKK. Friday, July 14. 2006New PHP revisions in the tree
For all those who wondered, PHP in Gentoo is definitely not dead.
Just put new revisions in the tree (dev-lang/php-4.4.2-r6 and dev-lang/php-5.1.4-r4), that fix various bugs and security issues. On that note, a big thanks to Stefan Esser from Hardened-PHP.net for all his patches and work on securing PHP (and of course the Hardened-PHP patch itself)! The new PHP revisions also introduce a better separation between eclasses and ebuilds, making their managing and addition of new features easier. One of those new additions for now is the "concurrentmodphp" USE flag. It enables to build mod_php4 and mod_php5 in a way that both can be loaded at the same time into the same Apache2 instance, each mod_php then has it's own mime-types (application/x-httpd-php4{-source} for PHP4 and application/x-httpd-php5{-source} for PHP5) and configuration modifiers (php4_admin_value/php4_admin_flag for PHP4 and php5_admin_value/php5_admin_flag for PHP5 and so on). This feature is highly experimental, I could confirm it working on my x86 system and partially on an x86_64 system, but I'd very much like for users to try it out on systems where breakage is allowed (developement systems or test systems) and report back their results to me (chtekk@gentoo.org), thanks! To try it, do the following: emerge --syncthen don't forget to "etc-update" and re-emerge ALL of your installed PHP modules/extensions (such as dev-php4/pecl-zip etc.). Also all this does not work with the "java-internal" (PHP4) and "sharedext" (PHP4/5) USE flags enabled, so be sure to disable them when you emerge php. Best regards, CHTEKK. Tuesday, July 11. 2006Speeding up MPM-itk
A few days ago I added support for MPM-itk ("mpm-itk" USE flag) to our Apache 2.0 packages. MPM-itk is a user-switching MPM, that is, it switches to an assigned user when processing the requests, instead of processing everything as user apache (MPM-perchild, metux-MPM and MPM-peruser are other examples of this).
In it's original form it accomplishes this by doing the following: apache process as root, interpret the request --> fork() new process and switch (setuid(unprivuid) / setgid(unprivgid)) to unprivileged user for it, process the request --> kill of the setuid/setgid process, with the next request it will redo the processNow, this is foolproof, but provokes an immense performance hit, especially on static pages. Benchmarks done with ab2 showed that a normal Apache2 (MPM-prefork) can process about 240 PHP req/sec and 4000 HTML req/seq, while the MPM-itk patched Apache 2.0 managed about 110 PHP req/sec and 240 HTML req/sec, so you see, the peformance hit is enormous, and it's obiously due to the overhead of always having to fork() a new Apache process and then kill if off, for every request! I managed to successfully change the way the MPM works, and thus managed to bring it's speed to normal Apache levels (patch against MPM-itk available here), by changing the "worfklow" like this: apache process as root, interpret the request --> switch (setresuid(unprivuid, unprivuid, 0) / setresgid(unprivgid, unprivgid, 0)) to unprivileged user, process the request --> switch back to root (setresuid(0, 0, 0) / setresgid(0, 0, 0)), with the next request it will redo the processNow this solves the performance problems, as it doesn't anymore do the extra fork(), and fully reuses the process with the next request, but it introduces a new problem: a gaping security hole.  Since the processed request cannot be trusted, everything in there can simply setuid/setgid to root and do operations as root! A simple call to, for example, the posix_setuid/posix_setgid functions of the PHP POSIX extensio are enough to switch the user back to root and let the rest of the PHP script just work as root... This is totally unacceptable for security. So, now my call for help: has anyone got any idea how it's possible to realize this in a secure manner??? I can't think of any way to securely switch the process from root to unpriv user and back to root, without giving the untrusted code executed in the request processing phase the same ability (that is, to switch back to root). Ideas and comments are very appreciated.
Sunday, May 21. 2006Old-style PHP, bye bye!
Adieu old-style PHP (dev-php/php et all)...
One of many ways to say that, as I'm posting this, I'm cvs up'ing the affected directories to start the removal of the already masked old-style PHP packages, as announced one month ago. For all the ones that didn't yet migrate... Well, migrate NOW! And generally, enjoy the fact that "emerge php" will now install dev-lang/php, and you won't have to specify the directory anymore. Best regards, CHTEKK. Saturday, April 22. 2006Old-style PHP finally masked
The title says it all, the old PHP packages were finally masked!
Sorry for the three days delay (22 Apr instead of 19 Apr), but in the end, it's all done. Again, thanks a lot to all the people involved in this, without their work this would have never been possible. Best regards, CHTEKK. Tuesday, April 18. 2006dev-lang/php minor updates
I've just committed some updates to dev-lang/php, two of which may interst you:
1) the "nls" USE flag, which previously enabled the gettext extension, the mbstring extension and the sqlite-utf8 support, now only enables the gettext extension. The mbstring extension and sqlite-utf8 support were moved under the "unicode" USE flag. Affected ebuilds were already updated. 2) the EXTRA_ECONF variable was added to dev-lang/php, that way you can easily pass your own configure parameters to the ebuild if you want to try out some crazy stuff, just do: EXTRA_ECONF="--with-whatever-I-want" emerge dev-lang/php Two little notes: the variable doesn't get saved or remebered between emerges, so you have to add it to the command line each time, and anything you do that way is *totally unsupported*, so don't ever file bugs about it, thanks. Best regards, CHTEKK. UPDATE: it was now changed to EXTRA_ECONF instead of MY_CONF, to follow what a lot of other ebuilds already do. Monday, April 17. 2006Sunday, March 12. 2006Friday, March 3. 2006PHP status
PHP is still going strong, you now can find PHP 5.1.2 and PHP 4.4.2 in the PHP Overlay, and the eclasses/ebuilds have seen a lot of work, they are now simpler to use and all that, and all PHP patches were moved to tarballs (which will allow you to save some bandwidth on emerge --sync's
).Work has also started to solve bug #120088, we've got an idea and finally the time to try it out, it should work and satisfy all parties involved, but will require some good planning when the changes are introduced, more details on this as soon as I have working code to show people (just follow the Overlay's progress, should appear there in the experimental/ branch as soon as ready). Best regards, CHTEKK. Tuesday, February 28. 2006 |
QuicksearchSyndicate This BlogCreative CommonsCategoriesArchivesCalendar
Blog AdministrationPowered by
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Comments