chtekk b10g - Gentoo

Beware of quotes passed to init-scripts!

nospam@example.com (Luca Longinotti) — Fri, 27 Aug 2010 04:55:05 +0200

Just a quick note in case I or others run into this again...
I use Trac to manage a few projects, more specifically Gentoo's www-apps/trac package to ease its deployment. One feature of the package I take advantage of is the init-script to manage the tracd standalone server.
I now wanted to enable authentication for my Trac installs, and all guides out there tell you to add

--auth="*,/path/to/digest/auth/file,domain"

to your commandline when starting Trac (notice the quotes!), I tried this on the shell, and it worked as expected.
I thus changed the TRACD_OPTS variable in /etc/conf.d/tracd to the following:



TRACD_OPTS="--auth=\"*,/path/to/digest/auth/file,domain\" --env-parent-dir /var/lib/trac/"

It started fine but authentication didn't work at all... Somewhat baffling, but after some investigation, I noticed that the quotes around the --auth argument were passed as-is to tracd, which then failed to find the environment *, since when splitting the --auth argument apart, "* would be used as environment name. The solution is simply to not set any type of quotes when starting tracd through the provided init-script, so that TRACD_OPTS looks as follows:



TRACD_OPTS="--auth=*,/path/to/digest/auth/file,domain --env-parent-dir /var/lib/trac/"

In hindsight logical, as the TRACD_OPTS variable gets evaluated only once and then passed to start-stop-daemon, which passes the arguments verbatim to tracd.

Retiring from Gentoo

nospam@example.com (Luca Longinotti) — Fri, 02 Apr 2010 18:23:25 +0200

I'm officially retiring as a Gentoo developer, simply because I've not really done anything in the last year and will not be getting back into the swing of things anytime in the future, so I feel it's time to retire.
It's been a fun 4.5 years, even if I wasn't present much as developer in the last 1.5 years, and I will definitely continue using Gentoo as my distribution of choice, nothing will change that.
I've had the honor of getting to know some amazing people during those years, and improve a lot of my skills and competences, and for that I'm grateful.
See you all around, Luca Longinotti.

tmux

nospam@example.com (Luca Longinotti) — Sun, 05 Oct 2008 14:48:40 +0200

I'm finally back on the net, after not having any internet access at my new apartment in Zürich after I moved there.
I now started my bachelor studies at the ETH Zürich, of course in Computer Science, though there's a little bit too much maths right now for me to be really excited about it, future semesters will be better I hope.
So I'll try to get back to a few Gentoo things in the near future, now that I also finally fixed up my main dev system (which had its disk die just before I moved)...
Still this blog entry's main focus is to tell you the name of a package I discovered today:

app-misc/tmux

After reinstalling this system I, as always before, emerged screen to take care of my detached terminal needs, I always had the problem with backspace not working correctly from the desktop, which I was never able to fix correctly, but it was bearable. This time it seems something else went wrong too, and inside my screen sessions it didn't source .bashrc or .bash_profile (which sources .bashrc), even if the shell was correctly set to a bash login shell...
So, while perusing Gentoo Wiki's Screen TIPs to see if anyone had seen something like this, at the end of that page I came across the mention of tmux, a "simple, modern, BSD-licensed alternative to GNU Screen".
Seeing that it only depended on ncurses (which is usually installed everywhere), and was only like 100kb of source, I installed it and tried it out. I have to say I'm impressed, this little tool does everything I did with screen too (mainly just having multiple, detached terminals and resuming them, which is probably no "advanced screen usage", but what most people will likely need), backspace works without any fiddling, the Bash stuff is correctly sourced, and the few commands are easy to adapt to, here a little overview:

tmux

Starts a new tmux session

CTRL-b d

Press CTRL-b, then d, to detach the terminal

tmux a

Reattach to the detached terminal

Still, read man tmux to get the full overview, and then happily do emerge -C screen, as I did.

Best regards, chtekk.

net-www/apache-1* masked.

nospam@example.com (Luca Longinotti) — Sat, 12 May 2007 15:44:29 +0200

This I just wrote to gentoo-dev and gentoo-server, finally ending Apache-1* support in Gentoo.

Hi all!
As announced in the 30 April 2007 edition of GWN [1], net-www/apache-1* as well as all packages depending/using it were masked, pending removal on 12 June 2007.
I fixed all packages, dependencies, etc. I could find to work correctly after the masking (generally removing Apache 1.X support from them).
If you find any issue still, please open a bug about it, assign it to apache-bugs@gentoo.org and make it block bug #178189 [2].
If you use or plan on using the apache-module or depend.apache eclasses, be aware that the need_apache function doesn't anymore export the apache2 USE flag to IUSE, since now it directly depends on Apache 2.X, so be sure to declare it in your ebuilds IUSE (I fixed the few cases
where this wasn't already done).
Thanks and happy upgrading to Apache 2.X!

[1] http://www.gentoo.org/news/en/gwn/20070430-newsletter.xml
[2] https://bugs.gentoo.org/show_bug.cgi?id=178189

Best regards, CHTEKK.

FOSDEM 07, here we come!

nospam@example.com (Luca Longinotti) — Thu, 22 Feb 2007 22:12:25 +0100

Yo all!
Tomorrow to FOSDEM 07 /me goes, along with hansmi, KillerFox and blubb from the swiss crowd!
Later on both flo and EleRas will join us too, so for me not only will it be "the great Gentoo dev gathering", but also "the great SysCP dev gathering", will all three of us present. As flo correctly guessed, I'll be sporting the black Gentoo t-shirt, which is amazingly comfortable, but flo's SysCP t-shirt intrigued me... Is it possible to have more of those @ flo? In black? /me loves black! We'll be able to discuss that at FOSDEM I think...
Now off to bed, as I have to get up early (~4AM) to catch the first train to get to Basel, where the others await, and from there off to Bruxelles.
Lugano-Basel-Frankfurt Am Main-Köln-Bruxelles is the exact route, almost 1000 Km, for a total en-route time of about 11 hours, yay!
On the PHP front, I've finally put PHP 5.2.1 and PHP 4.4.5, with all the needed patches and, of course, Suhosin support, into the PHP Overlay. I'll test it all during the next days and hopefully commit to the tree on Monday at the latest. Many bugs are fixed with the latest releases, concurrentmodphp support was greatly improved and fixed (especially wrt 64bit archs), and the new MySQL extension patches are included to have the connection charset settable per-SAPI, for each PHP version, using php.ini, instead of my.cnf.
Work on VCD is also going steady, we should be near feature-completion soon, so expect some form of pre-release in the next two weeks... Poke Hollow on #gentoo-vserver for more info.
Best regards, cya all, CHTEKK.

Happy 2007!

nospam@example.com (Luca Longinotti) — Mon, 01 Jan 2007 01:16:35 +0100

Happy new year people!!!

I wish you all a great 2007 full of fun and happiness and all the other good stuff (new hardware comes to mind ).
23C3 finished two days ago, it was really great fun with great talks and great people (yeah, Polish guy living in the USA, from the university near Atlanta, you know who you are ).
Now we've passed yesterday by visiting Berlin and at the moment we're connected through the Hostels connection... It depresses me to know it's at least twice as fast as my home DSL.
By the way, all this convinced me to come to FOSDEM 07, so be prepared to know the CHTEKK (or be scared, that all depends).
Cya, and happy new year, CHTEKK.

Greetings from 23C3.

nospam@example.com (Luca Longinotti) — Thu, 28 Dec 2006 12:42:23 +0100

Yo! Greetings from the 23C3, the Chaos Computer Congress in Berlin.
Great talks and great people here, at the moment I'm attending a talk about JSON RPC (who knows, maybe that can/will be used someday to improve SysCP ), and before that I attended a really great talk about backbone hacking.
As you can see from this blog post, the wireless network works well (as does the wired one).
With regards to Gentoo devs, I've already seen and got to know hansmi, KillerFox and Pylon. I've also been told that mabi is around and hanno should be too (at least based on the fact he gave a Lightning Talk about XGL yesterday, which I sadly missed), we should really define a place to meet and get to know eachother... That goes for Gentoo and SysCP users too.
I myself can usually be found attending some talk or down in the Hackcenter (central position, at a round table).
Have fun!
Best regards, CHTEKK.

New PostgreSQL and PHP (late)

nospam@example.com (Luca Longinotti) — Fri, 10 Nov 2006 22:45:59 +0100

As the title says, I'm late with this blog post, but better late than never...
The new dev-db/libpq and dev-db/postgresql ebuilds reached Portage on Thursday, they seem to work well (we've received positive feedback until now) and already solved a number of bugs! Thanks to dev-zero too for all the work spent on them, we make a good team!
Btw, it seems dbs are made to be maintained by two people... Me and dev-zero for PgSQL, me and vivo for MySQL, and it works very well! WEEEE TEAMWORK RULEZ! Thansk guys, it's great to work with you all!
On the PHP front, 5.2.0 reached the overlay, I still have to update the eclasses a little and fix some stuff, as well as update the 4.4.X and 5.1.X releases with some patches, which will probably happen tomorrow, and they'll probably be put into Portage on Sunday or Monday, sorry for the little delay, but at least the stuff's well tested and working then.
Best regards and a great weekend to all, CHTEKK.

News, news, ... ;)

nospam@example.com (Luca Longinotti) — Mon, 06 Nov 2006 01:00:30 +0100

Hi all, /me is back, since a few days now, and I've been working on updating stuff...
Today, together with vivo, MySQL 5.0.X stabilization was agreed on, and https://bugs.gentoo.org/144999 updated accordingly. x86 already responded and stabled dev-db/mysql-5.0.26-r1, the other arches will soon follow. The upgrade from 4.1.X should be painless, just remember to read the MySQL upgrading guide for instructions on how to backup your data before the upgrade, and be sure to run revdep-rebuild from gentoolkit after the upgrade, as all things linking to MySQL will need to be recompiled.
New PostgreSQL ebuilds are also coming up, those are the first of the new generation of PostgreSQL ebuilds, done together with dev-zero, that will fix up a lot of issues and ease maintainance of PostgreSQL a lot, as well as permitting some exciting new things in the future. ETA for those new ebuilds to enter Portage is this evening (UTC timezone).
PHP 5.2.0 is also finally out, congrats to the PHP Team, expect an ebuild for the final version in the PHP Overlay by Wednesday and in Portage by Saturday at most.
Samhain will also be updated soon to the newest versions, so if you use that, stay tuned.
Work on SysCP 1.3 is going on strong, more about that in another blog entry in the next days.
Best regards, CHTEKK.

/me away until 03.11

nospam@example.com (Luca Longinotti) — Fri, 27 Oct 2006 17:59:43 +0200

I'll be away from this evening UTC until evening UTC 03.11.2006, so don't search for me or await any reply from me.
Absolutely no internet access, so... See ya all in a week!
Best regards, CHTEKK.

#gentoo-db

nospam@example.com (admin) — Sun, 30 Jul 2006 16:40:47 +0200

#gentoo-db has just opened it's (virtual) doors (or windows or terminals, depends on what IRC client you use ).
The new channel is intented to provide a platform for discussions, concerning both support and development, centering on Gentoo and databases.
At the moment Gentoo MySQL and PostgreSQL people hang out there, but it's my hope to see other developers and/or teams that maintain database-related packages for Gentoo (Firebird, Oracle, SQLite, BerkeleyDB, ...) join too, as well as users with experience in SQL and database management, or just people intersted in databases and their uses.
Best regards, CHTEKK.

New PHP revisions in the tree

nospam@example.com (admin) — Fri, 14 Jul 2006 20:11:57 +0200

For all those who wondered, PHP in Gentoo is definitely not dead.
Just put new revisions in the tree (dev-lang/php-4.4.2-r6 and dev-lang/php-5.1.4-r4), that fix various bugs and security issues. On that note, a big thanks to Stefan Esser from Hardened-PHP.net for all his patches and work on securing PHP (and of course the Hardened-PHP patch itself)!
The new PHP revisions also introduce a better separation between eclasses and ebuilds, making their managing and addition of new features easier. One of those new additions for now is the "concurrentmodphp" USE flag. It enables to build mod_php4 and mod_php5 in a way that both can be loaded at the same time into the same Apache2 instance, each mod_php then has it's own mime-types (application/x-httpd-php4{-source} for PHP4 and application/x-httpd-php5{-source} for PHP5) and configuration modifiers (php4_admin_value/php4_admin_flag for PHP4 and php5_admin_value/php5_admin_flag for PHP5 and so on). This feature is highly experimental, I could confirm it working on my x86 system and partially on an x86_64 system, but I'd very much like for users to try it out on systems where breakage is allowed (developement systems or test systems) and report back their results to me (chtekk@gentoo.org), thanks! To try it, do the following:

emerge --sync

echo dev-lang/php >> /etc/portage/package.keywords

USE="apache2 concurrentmodphp" emerge =php-4* =php-5*

then don't forget to "etc-update" and re-emerge ALL of your installed PHP modules/extensions (such as dev-php4/pecl-zip etc.). Also all this does not work with the "java-internal" (PHP4) and "sharedext" (PHP4/5) USE flags enabled, so be sure to disable them when you emerge php.
Best regards, CHTEKK.

Speeding up MPM-itk

nospam@example.com (admin) — Tue, 11 Jul 2006 13:00:58 +0200

A few days ago I added support for MPM-itk ("mpm-itk" USE flag) to our Apache 2.0 packages. MPM-itk is a user-switching MPM, that is, it switches to an assigned user when processing the requests, instead of processing everything as user apache (MPM-perchild, metux-MPM and MPM-peruser are other examples of this).
In it's original form it accomplishes this by doing the following:

apache process as root, interpret the request --> fork() new process and switch (setuid(unprivuid) / setgid(unprivgid)) to unprivileged user for it, process the request --> kill of the setuid/setgid process, with the next request it will redo the process

Now, this is foolproof, but provokes an immense performance hit, especially on static pages. Benchmarks done with ab2 showed that a normal Apache2 (MPM-prefork) can process about 240 PHP req/sec and 4000 HTML req/seq, while the MPM-itk patched Apache 2.0 managed about 110 PHP req/sec and 240 HTML req/sec, so you see, the peformance hit is enormous, and it's obiously due to the overhead of always having to fork() a new Apache process and then kill if off, for every request!
I managed to successfully change the way the MPM works, and thus managed to bring it's speed to normal Apache levels (patch against MPM-itk available here), by changing the "worfklow" like this:

apache process as root, interpret the request --> switch (setresuid(unprivuid, unprivuid, 0) / setresgid(unprivgid, unprivgid, 0)) to unprivileged user, process the request --> switch back to root (setresuid(0, 0, 0) / setresgid(0, 0, 0)), with the next request it will redo the process

Now this solves the performance problems, as it doesn't anymore do the extra fork(), and fully reuses the process with the next request, but it introduces a new problem: a gaping security hole. Since the processed request cannot be trusted, everything in there can simply setuid/setgid to root and do operations as root! A simple call to, for example, the posix_setuid/posix_setgid functions of the PHP POSIX extensio are enough to switch the user back to root and let the rest of the PHP script just work as root... This is totally unacceptable for security. So, now my call for help: has anyone got any idea how it's possible to realize this in a secure manner??? I can't think of any way to securely switch the process from root to unpriv user and back to root, without giving the untrusted code executed in the request processing phase the same ability (that is, to switch back to root). Ideas and comments are very appreciated.

Old-style PHP, bye bye!

nospam@example.com (admin) — Sun, 21 May 2006 01:41:14 +0200

Adieu old-style PHP (dev-php/php et all)...
One of many ways to say that, as I'm posting this, I'm cvs up'ing the affected directories to start the removal of the already masked old-style PHP packages, as announced one month ago.
For all the ones that didn't yet migrate... Well, migrate NOW!
And generally, enjoy the fact that "emerge php" will now install dev-lang/php, and you won't have to specify the directory anymore.
Best regards, CHTEKK.

Old-style PHP finally masked

nospam@example.com (admin) — Sat, 22 Apr 2006 15:35:22 +0200

The title says it all, the old PHP packages were finally masked!
Sorry for the three days delay (22 Apr instead of 19 Apr), but in the end, it's all done.
Again, thanks a lot to all the people involved in this, without their work this would have never been possible.
Best regards, CHTEKK.