questions

questions

[Jean Delvare]

Hi folks

Two questions:

1* How is it possible that the chipset documentation
(lm_sensors2/doc/chips/*) is still up-to-date when the generation scipt,
prog/doc/doc-features.pl, is broken since version 2.4.4?

2* How can the logical mapping and the compute mapping differ for a
given feature?

I am in process to rewriting the two doc generating scripts in prog/doc
(seems that Frodo left some times ago and the scripts are unmaintained)
and I need these two pieces of information to go on. All related
information will be welcome also.

Thanks.

-- 
Jean Delvare
http://www.ensicaen.ismra.fr/~delvare/

Questions

[Mark Studebaker]

did you rerun depmod after installing lm85?

Paul Aviles wrote:
> I am getting something weird.
> [root@www /]# modprobe lm85
> modprobe: Can't locate module lm85
> 
> [root@www /]# insmod lm85
> Using /lib/modules/2.4.22-1.2174.nptl/kernel/drivers/i2c/chips/lm85.o
> 
> Why will modprobe fail loading but insmod work?
> 
> Thanks
> 
> 
> 

Questions

[Mark Studebaker]

since your chip is an lm85 you must have a chip section headed with
chip "lm85-*"


Paul Aviles wrote:
> Jean,
> 
> Happy holidays to you all and best wishes for the new year!!
> 
> 
> 
> Quick question, I have sensors 2.8.8  running on a Tyan GS12 server with 
> FC1 and kernel 2.4.22-1.2174.nptl and I got everything working.
> 
> 
> 
> I am curious about a problem. Take a look at my results of sensors. I 
> have an alarm on in4 and also shows fan4 which I don't have. My 
> sensors.conf is also below and it is supposed to ignore in4 and fan4. Is 
> there any other way to eliminate those from being reported?
> 
> 
> 
> Thanks so much.
> 
> 
> 
> Paul
> 
> 
> #sensors
> 
> lm85-i2c-0-2e
> Adapter: SMBus I801 adapter at 1480
> in0:        +2.62 V  (min =  +0.00 V, max =  +3.32 V)
> in1:        +1.31 V  (min =  +0.00 V, max =  +2.99 V)
> in2:        +3.37 V  (min =  +0.00 V, max =  +4.38 V)
> in3:       +5.13 V  (min =  +0.00 V, max =  +6.64 V)
> in4:       +0.00 V  (min =  +0.00 V, max = +15.94 V)   ALARM
> fan1:      9294 RPM  (min =    0 RPM)
> fan2:      8169 RPM  (min =    0 RPM)
> fan3:      9712 RPM  (min =    0 RPM)
> fan4:         0 RPM  (min =    0 RPM)
> temp1:       +61?C  (low  =  -127?C, high =  +127?C)
> temp2:       +41?C  (low  =  -127?C, high =  +127?C)
> temp3:       +43?C  (low  =  -127?C, high =  +127?C)
> pwm1:       86
> pwm2:      113
> pwm3:       88
> vid:      +1.325 V  (VRM Version 9.1)
> 
> /etc/sensors.conf
> chip "adt7463-*"
> 
>    ignore pwm1
>    ignore pwm2
>    ignore pwm3
>    ignore in4
>    ignore fan4
> 
>    label in0 "+2.6V"
>    label in1 "CPU Volt"
>    label in2 "+3.3V"
>    label in3 "+5V"
> 
>    label fan1 "fan2"
>    label fan2 "fan1"
>    label fan3 "fan3"
> 
>    label pwm1 "pwm1 fan"
>    label pwm2 "pwm2 fan"
>    label pwm3 "pwm3 fan"
> 
>    label temp1 "CPU Temp"
>    label temp2 "Local Temp"
>    label temp3 "System Temp"
> 
>    set in0_min  2.6 * 0.95
>    set in0_max  2.6 * 1.05
>    set in1_min  1.45 * 0.95
>    set in1_max  1.45 * 1.05
>    set in2_min  3.3 * 0.95
>    set in2_max  3.3 * 1.05
>    set in3_min  5.0 * 0.95
>    set in3_max  5.0 * 1.05
> 
>    set vrm  9.1[
> 
> 

Questions

[Paul Aviles]

Jean,

Happy holidays to you all and best wishes for the new year!!



Quick question, I have sensors 2.8.8  running on a Tyan GS12 server with FC1 
and kernel 2.4.22-1.2174.nptl and I got everything working.



I am curious about a problem. Take a look at my results of sensors. I have 
an alarm on in4 and also shows fan4 which I don't have. My sensors.conf is 
also below and it is supposed to ignore in4 and fan4. Is there any other way 
to eliminate those from being reported?



Thanks so much.



Paul


#sensors

lm85-i2c-0-2e
Adapter: SMBus I801 adapter at 1480
in0:        +2.62 V  (min =  +0.00 V, max =  +3.32 V)
in1:        +1.31 V  (min =  +0.00 V, max =  +2.99 V)
in2:        +3.37 V  (min =  +0.00 V, max =  +4.38 V)
in3:       +5.13 V  (min =  +0.00 V, max =  +6.64 V)
in4:       +0.00 V  (min =  +0.00 V, max = +15.94 V)   ALARM
fan1:      9294 RPM  (min =    0 RPM)
fan2:      8169 RPM  (min =    0 RPM)
fan3:      9712 RPM  (min =    0 RPM)
fan4:         0 RPM  (min =    0 RPM)
temp1:       +61?C  (low  =  -127?C, high =  +127?C)
temp2:       +41?C  (low  =  -127?C, high =  +127?C)
temp3:       +43?C  (low  =  -127?C, high =  +127?C)
pwm1:       86
pwm2:      113
pwm3:       88
vid:      +1.325 V  (VRM Version 9.1)

/etc/sensors.conf
chip "adt7463-*"

    ignore pwm1
    ignore pwm2
    ignore pwm3
    ignore in4
    ignore fan4

    label in0 "+2.6V"
    label in1 "CPU Volt"
    label in2 "+3.3V"
    label in3 "+5V"

    label fan1 "fan2"
    label fan2 "fan1"
    label fan3 "fan3"

    label pwm1 "pwm1 fan"
    label pwm2 "pwm2 fan"
    label pwm3 "pwm3 fan"

    label temp1 "CPU Temp"
    label temp2 "Local Temp"
    label temp3 "System Temp"

    set in0_min  2.6 * 0.95
    set in0_max  2.6 * 1.05
    set in1_min  1.45 * 0.95
    set in1_max  1.45 * 1.05
    set in2_min  3.3 * 0.95
    set in2_max  3.3 * 1.05
    set in3_min  5.0 * 0.95
    set in3_max  5.0 * 1.05

    set vrm  9.1[ 



-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Questions

[Paul Aviles]

Man... I looked at that file for hours....

THANKS!!!!

----- Original Message ----- 
From: "Mark Studebaker" <mds4@verizon.net>
To: "Paul Aviles" <paul.aviles@palei.com>
Cc: <sensors@Stimpy.netroedge.com>
Sent: Friday, December 24, 2004 10:47 AM
Subject: Re: Questions


> since your chip is an lm85 you must have a chip section headed with
> chip "lm85-*"
>
>
> Paul Aviles wrote:
>> Jean,
>>
>> Happy holidays to you all and best wishes for the new year!!
>>
>>
>>
>> Quick question, I have sensors 2.8.8  running on a Tyan GS12 server with 
>> FC1 and kernel 2.4.22-1.2174.nptl and I got everything working.
>>
>>
>>
>> I am curious about a problem. Take a look at my results of sensors. I 
>> have an alarm on in4 and also shows fan4 which I don't have. My 
>> sensors.conf is also below and it is supposed to ignore in4 and fan4. Is 
>> there any other way to eliminate those from being reported?
>>
>>
>>
>> Thanks so much.
>>
>>
>>
>> Paul
>>
>>
>> #sensors
>>
>> lm85-i2c-0-2e
>> Adapter: SMBus I801 adapter at 1480
>> in0:        +2.62 V  (min =  +0.00 V, max =  +3.32 V)
>> in1:        +1.31 V  (min =  +0.00 V, max =  +2.99 V)
>> in2:        +3.37 V  (min =  +0.00 V, max =  +4.38 V)
>> in3:       +5.13 V  (min =  +0.00 V, max =  +6.64 V)
>> in4:       +0.00 V  (min =  +0.00 V, max = +15.94 V)   ALARM
>> fan1:      9294 RPM  (min =    0 RPM)
>> fan2:      8169 RPM  (min =    0 RPM)
>> fan3:      9712 RPM  (min =    0 RPM)
>> fan4:         0 RPM  (min =    0 RPM)
>> temp1:       +61?C  (low  =  -127?C, high =  +127?C)
>> temp2:       +41?C  (low  =  -127?C, high =  +127?C)
>> temp3:       +43?C  (low  =  -127?C, high =  +127?C)
>> pwm1:       86
>> pwm2:      113
>> pwm3:       88
>> vid:      +1.325 V  (VRM Version 9.1)
>>
>> /etc/sensors.conf
>> chip "adt7463-*"
>>
>>    ignore pwm1
>>    ignore pwm2
>>    ignore pwm3
>>    ignore in4
>>    ignore fan4
>>
>>    label in0 "+2.6V"
>>    label in1 "CPU Volt"
>>    label in2 "+3.3V"
>>    label in3 "+5V"
>>
>>    label fan1 "fan2"
>>    label fan2 "fan1"
>>    label fan3 "fan3"
>>
>>    label pwm1 "pwm1 fan"
>>    label pwm2 "pwm2 fan"
>>    label pwm3 "pwm3 fan"
>>
>>    label temp1 "CPU Temp"
>>    label temp2 "Local Temp"
>>    label temp3 "System Temp"
>>
>>    set in0_min  2.6 * 0.95
>>    set in0_max  2.6 * 1.05
>>    set in1_min  1.45 * 0.95
>>    set in1_max  1.45 * 1.05
>>    set in2_min  3.3 * 0.95
>>    set in2_max  3.3 * 1.05
>>    set in3_min  5.0 * 0.95
>>    set in3_max  5.0 * 1.05
>>
>>    set vrm  9.1[
>>
>>
>
>
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> 



-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fw: Questions

[Mark Studebaker]

see prog/rrd in our package.
also prog/tellerstats.

Paul Aviles wrote:
> I forgot, the samples under http://www2.lm-sensors.nu/~lm78/uses.html 
> are no good. Any cgi's out there to generate the graphs?
> 
> Thanks
> 
> Paul
> 
> 

Questions

[Paul Aviles]

I am getting something weird. 

[root@www /]# modprobe lm85
modprobe: Can't locate module lm85

[root@www /]# insmod lm85
Using /lib/modules/2.4.22-1.2174.nptl/kernel/drivers/i2c/chips/lm85.o

Why will modprobe fail loading but insmod work?

Thanks



-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Questions

[Paul Aviles]

Guys, im I trying to come up with an rpm for version 2.8.8 and I am getting 
no luck. Has anyone created the spec files for both the i2c and lmsensors?

Thanks

Paul 



-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fw: Questions

[Paul Aviles]

I forgot, the samples under http://www2.lm-sensors.nu/~lm78/uses.html are no 
good. Any cgi's out there to generate the graphs?

Thanks

Paul 



-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Questions

[Arun Maha]

[-- Attachment #1: Type: text/plain, Size: 117 bytes --]

Hi,
How to install a command (pmount) in poky distribution. What are the steps
to follow?

Thanks,
ARUNKUMAR K

[-- Attachment #2: Type: text/html, Size: 222 bytes --]

Re: Questions

[Hofemeier, Ulf]

[-- Attachment #1: Type: text/plain, Size: 693 bytes --]

Hi Arun,

You need to add poky manager support to Poky and install it by adding the following line to your build/conf/local.conf file.

https://wiki.yoctoproject.org/wiki/How_do_I

For the conf/local.conf entry please add this: IMAGE_INSTALL_append = " package"

After that you have to bitbake a new image that contains your package.

Thanks,
Ulf

From: <yocto-bounces@yoctoproject.org> on behalf of Arun Maha <2233arunkumar@gmail.com>
Date: Tuesday, March 28, 2017 at 2:14 AM
To: "yocto@yoctoproject.org" <yocto@yoctoproject.org>
Subject: [yocto] Questions

Hi,
How to install a command (pmount) in poky distribution. What are the steps to follow?

Thanks,
ARUNKUMAR K

[-- Attachment #2: Type: text/html, Size: 4069 bytes --]

Questions

[o1bigtenor]

Greetings

My raid 10 array was the subject of a number of exchanges on this
board a few months ago.
With the generous assistance of members here things were reestablished
and have been working well. Today I had a VirtualBox VM crater and in
the process cause other system issues. In process to clear the mess a
number of hard stops (shutting the system off using the button on the
case) were used. In rebooting I found that one of the drives in the
array is no longer responding issuing a number of clicks in the boot
up process with nothing else happening. Even though it is a RAID 10
array the array is no longer mounted nor available. I have removed the
faulty drive already. I have an appropriately sized drive available
that I could place into the machine.

1. should I reformat the drive (to be placed into the machine)?
2. what sequence of commands should I be using for this new drive to
be included into the array?
3. what sequence of commands should I use to remount the array?

TIA

Dee

Re: Questions

[Adam Goryachev]

On 14/02/2016 15:28, o1bigtenor wrote:
> Greetings
>
> My raid 10 array was the subject of a number of exchanges on this
> board a few months ago.
> With the generous assistance of members here things were reestablished
> and have been working well. Today I had a VirtualBox VM crater and in
> the process cause other system issues. In process to clear the mess a
> number of hard stops (shutting the system off using the button on the
> case) were used. In rebooting I found that one of the drives in the
> array is no longer responding issuing a number of clicks in the boot
> up process with nothing else happening. Even though it is a RAID 10
> array the array is no longer mounted nor available. I have removed the
> faulty drive already. I have an appropriately sized drive available
> that I could place into the machine.
>
> 1. should I reformat the drive (to be placed into the machine)?
> 2. what sequence of commands should I be using for this new drive to
> be included into the array?
> 3. what sequence of commands should I use to remount the array?

First thing I would suggest is to let everyone know the status of the 
current array, and how to get it working.

Can you send the output of cat /proc/mdstat and mdadm --misc --detail 
/dev/md?

Assuming the existing array is in a "normal" status, albeit degraded, 
then it should be pretty simple to just partition the new drive to match 
the other members, and then simply add the new partition to the array 
(mdadm --manage /dev/md? --add /dev/sdxy)

Try to take things slowly, as doing the wrong thing might make a simple 
recovery into a very sad event (loss of all the data).

Regards,
Adam

Regards,
Adam

Re: Questions

[o1bigtenor]

On Sun, Feb 14, 2016 at 12:34 AM, Adam Goryachev
<mailinglists@websitemanagers.com.au> wrote:
>
>
> On 14/02/2016 15:28, o1bigtenor wrote:
>>
>> Greetings
>>
>> My raid 10 array was the subject of a number of exchanges on this
>> board a few months ago.
>> With the generous assistance of members here things were reestablished
>> and have been working well. Today I had a VirtualBox VM crater and in
>> the process cause other system issues. In process to clear the mess a
>> number of hard stops (shutting the system off using the button on the
>> case) were used. In rebooting I found that one of the drives in the
>> array is no longer responding issuing a number of clicks in the boot
>> up process with nothing else happening. Even though it is a RAID 10
>> array the array is no longer mounted nor available. I have removed the
>> faulty drive already. I have an appropriately sized drive available
>> that I could place into the machine.
>>
>> 1. should I reformat the drive (to be placed into the machine)?
>> 2. what sequence of commands should I be using for this new drive to
>> be included into the array?
>> 3. what sequence of commands should I use to remount the array?
>
>
> First thing I would suggest is to let everyone know the status of the
> current array, and how to get it working.
>
> Can you send the output of cat /proc/mdstat and mdadm --misc --detail
> /dev/md?

# cat /proc/mdstat
Personalities : [raid10]
md0 : active (auto-read-only) raid10 sde1[5] sdc1[4] sdb1[3]
      1953518592 blocks super 1.2 512K chunks 2 near-copies [4/3] [U_UU]

unused devices: <none>

# mdadm --misc --detail /dev/md
mdadm: /dev/md does not appear to be an md device

# mdadm --misc --detail /dev/md/0
/dev/md/0:
        Version : 1.2
  Creation Time : Mon Mar  5 08:26:28 2012
     Raid Level : raid10
     Array Size : 1953518592 (1863.02 GiB 2000.40 GB)
  Used Dev Size : 976759296 (931.51 GiB 1000.20 GB)
   Raid Devices : 4
  Total Devices : 3
    Persistence : Superblock is persistent

    Update Time : Sat Feb 13 17:21:51 2016
          State : clean, degraded
 Active Devices : 3
Working Devices : 3
 Failed Devices : 0
  Spare Devices : 0

         Layout : near=2
     Chunk Size : 512K

           Name : debianbase:0  (local to host debianbase)
           UUID : 79baaa2f:0aa2b9fa:18e2ea6b:6e2846b3
         Events : 60241

    Number   Major   Minor   RaidDevice State
       5       8       65        0      active sync set-A   /dev/sde1
       2       0        0        2      removed
       4       8       33        2      active sync set-A   /dev/sdc1
       3       8       17        3      active sync set-B   /dev/sdb1


>
> Assuming the existing array is in a "normal" status, albeit degraded, then
> it should be pretty simple to just partition the new drive to match the
> other members, and then simply add the new partition to the array (mdadm
> --manage /dev/md? --add /dev/sdxy)

Drive I wish to use for replacement has had some use.
Should I be reformatting it?

Thank you Adam!

Regards

Dee

Re: Questions

[Adam Goryachev]

On 14 February 2016 10:53:48 pm AEDT, o1bigtenor <o1bigtenor@gmail.com> wrote:
>On Sun, Feb 14, 2016 at 12:34 AM, Adam Goryachev
><mailinglists@websitemanagers.com.au> wrote:
>>
>>
>> On 14/02/2016 15:28, o1bigtenor wrote:
>>>
>>> Greetings
>>>
>>> My raid 10 array was the subject of a number of exchanges on this
>>> board a few months ago.
>>> With the generous assistance of members here things were
>reestablished
>>> and have been working well. Today I had a VirtualBox VM crater and
>in
>>> the process cause other system issues. In process to clear the mess
>a
>>> number of hard stops (shutting the system off using the button on
>the
>>> case) were used. In rebooting I found that one of the drives in the
>>> array is no longer responding issuing a number of clicks in the boot
>>> up process with nothing else happening. Even though it is a RAID 10
>>> array the array is no longer mounted nor available. I have removed
>the
>>> faulty drive already. I have an appropriately sized drive available
>>> that I could place into the machine.
>>>
>>> 1. should I reformat the drive (to be placed into the machine)?
>>> 2. what sequence of commands should I be using for this new drive to
>>> be included into the array?
>>> 3. what sequence of commands should I use to remount the array?
>>
>>
>> First thing I would suggest is to let everyone know the status of the
>> current array, and how to get it working.
>>
>> Can you send the output of cat /proc/mdstat and mdadm --misc --detail
>> /dev/md?
>
># cat /proc/mdstat
>Personalities : [raid10]
>md0 : active (auto-read-only) raid10 sde1[5] sdc1[4] sdb1[3]
>     1953518592 blocks super 1.2 512K chunks 2 near-copies [4/3] [U_UU]
>
>unused devices: <none>
>
># mdadm --misc --detail /dev/md
>mdadm: /dev/md does not appear to be an md device
>
># mdadm --misc --detail /dev/md/0
>/dev/md/0:
>        Version : 1.2
>  Creation Time : Mon Mar  5 08:26:28 2012
>     Raid Level : raid10
>     Array Size : 1953518592 (1863.02 GiB 2000.40 GB)
>  Used Dev Size : 976759296 (931.51 GiB 1000.20 GB)
>   Raid Devices : 4
>  Total Devices : 3
>    Persistence : Superblock is persistent
>
>    Update Time : Sat Feb 13 17:21:51 2016
>          State : clean, degraded
> Active Devices : 3
>Working Devices : 3
> Failed Devices : 0
>  Spare Devices : 0
>
>         Layout : near=2
>     Chunk Size : 512K
>
>           Name : debianbase:0  (local to host debianbase)
>           UUID : 79baaa2f:0aa2b9fa:18e2ea6b:6e2846b3
>         Events : 60241
>
>    Number   Major   Minor   RaidDevice State
>       5       8       65        0      active sync set-A   /dev/sde1
>       2       0        0        2      removed
>       4       8       33        2      active sync set-A   /dev/sdc1
>       3       8       17        3      active sync set-B   /dev/sdb1
>
>
>>
>> Assuming the existing array is in a "normal" status, albeit degraded,
>then
>> it should be pretty simple to just partition the new drive to match
>the
>> other members, and then simply add the new partition to the array
>(mdadm
>> --manage /dev/md? --add /dev/sdxy)
>
>Drive I wish to use for replacement has had some use.
>Should I be reformatting it?
>

Not needed, the resync will overwrite the content. You just need to partition it the same as the other drive members. 

Then you can simply add it to the array and it will sync.

Also, you should have access to your stay content already if you just mount it (assuming it contains a file system )

Let us know if you need any more help. 

Regards
Adam

Re: Questions

[o1bigtenor]

Greetings

On Sun, Feb 14, 2016 at 6:24 AM, Adam Goryachev
<mailinglists@websitemanagers.com.au> wrote:
> On 14 February 2016 10:53:48 pm AEDT, o1bigtenor <o1bigtenor@gmail.com> wrote:
>>On Sun, Feb 14, 2016 at 12:34 AM, Adam Goryachev
>><mailinglists@websitemanagers.com.au> wrote:
>>>
>>>
>>> On 14/02/2016 15:28, o1bigtenor wrote:
>>>>
>>>> Greetings
>>>>
>>>> My raid 10 array was the subject of a number of exchanges on this
>>>> board a few months ago.
>>>> With the generous assistance of members here things were
>>reestablished
>>>> and have been working well. Today I had a VirtualBox VM crater and
>>in
>>>> the process cause other system issues. In process to clear the mess
>>a
>>>> number of hard stops (shutting the system off using the button on
>>the
>>>> case) were used. In rebooting I found that one of the drives in the
>>>> array is no longer responding issuing a number of clicks in the boot
>>>> up process with nothing else happening. Even though it is a RAID 10
>>>> array the array is no longer mounted nor available. I have removed
>>the
>>>> faulty drive already. I have an appropriately sized drive available
>>>> that I could place into the machine.
>>>>
>>>> 1. should I reformat the drive (to be placed into the machine)?
>>>> 2. what sequence of commands should I be using for this new drive to
>>>> be included into the array?
>>>> 3. what sequence of commands should I use to remount the array?
>>>
>>>
>>> First thing I would suggest is to let everyone know the status of the
>>> current array, and how to get it working.
>>>
>>> Can you send the output of cat /proc/mdstat and mdadm --misc --detail
>>> /dev/md?
>>
>># cat /proc/mdstat
>>Personalities : [raid10]
>>md0 : active (auto-read-only) raid10 sde1[5] sdc1[4] sdb1[3]
>>     1953518592 blocks super 1.2 512K chunks 2 near-copies [4/3] [U_UU]
>>
>>unused devices: <none>
>>
>># mdadm --misc --detail /dev/md
>>mdadm: /dev/md does not appear to be an md device
>>
>># mdadm --misc --detail /dev/md/0
>>/dev/md/0:
>>        Version : 1.2
>>  Creation Time : Mon Mar  5 08:26:28 2012
>>     Raid Level : raid10
>>     Array Size : 1953518592 (1863.02 GiB 2000.40 GB)
>>  Used Dev Size : 976759296 (931.51 GiB 1000.20 GB)
>>   Raid Devices : 4
>>  Total Devices : 3
>>    Persistence : Superblock is persistent
>>
>>    Update Time : Sat Feb 13 17:21:51 2016
>>          State : clean, degraded
>> Active Devices : 3
>>Working Devices : 3
>> Failed Devices : 0
>>  Spare Devices : 0
>>
>>         Layout : near=2
>>     Chunk Size : 512K
>>
>>           Name : debianbase:0  (local to host debianbase)
>>           UUID : 79baaa2f:0aa2b9fa:18e2ea6b:6e2846b3
>>         Events : 60241
>>
>>    Number   Major   Minor   RaidDevice State
>>       5       8       65        0      active sync set-A   /dev/sde1
>>       2       0        0        2      removed
>>       4       8       33        2      active sync set-A   /dev/sdc1
>>       3       8       17        3      active sync set-B   /dev/sdb1
>>
>>
>>>
>>> Assuming the existing array is in a "normal" status, albeit degraded,
>>then
>>> it should be pretty simple to just partition the new drive to match
>>the
>>> other members, and then simply add the new partition to the array
>>(mdadm
>>> --manage /dev/md? --add /dev/sdxy)
>>
>>Drive I wish to use for replacement has had some use.
>>Should I be reformatting it?
>>
>
> Not needed, the resync will overwrite the content. You just need to partition it the same as the other drive members.
>
> Then you can simply add it to the array and it will sync.
>
> Also, you should have access to your stay content already if you just mount it (assuming it contains a file system )
>
> Let us know if you need any more help.
>

Thank you to Mr Adam for his assistance!

Installed the drive and, with a wait time for results, everything is
working very well.

I am looking at replacing ALL the drives in the array so that I can
reduce the likelihood of these kind of issues for a longer period than
a few months.

Would you be able to tell me what steps should I be taking to replace
the entire array?

Should I replace the drives one at a time (sort of just like I did
this time) using the same commands?

If so is there an easy way of mounting the array?

Regards

Dee

Re: Questions

[Wols Lists]

On 15/02/16 12:12, o1bigtenor wrote:
> I am looking at replacing ALL the drives in the array so that I can
> reduce the likelihood of these kind of issues for a longer period than
> a few months.
> 
> Would you be able to tell me what steps should I be taking to replace
> the entire array?
> 
> Should I replace the drives one at a time (sort of just like I did
> this time) using the same commands?

If you have a spare SATA (I presume they're sata drives) slot, then
definitely not. It might be worth buying an add-in card to give you an
extra slot, they're only a few quid.

Look up "mdadm --replace". That'll keep the old drive in the array until
the new one has replaced it, keeping the array fully functional all the
time.

Doing --fail, --remove, --add places the array in danger until the
entire sequence is complete, and if you're doing it several times then
you're massively increasing the chances of trouble.

In fact, if you get an add-in card, you might be able to replace several
drives at once - I don't know - read up and see if it's supported (or not).

Cheers,
Wol

Re: Questions

[o1bigtenor]

On Mon, Feb 15, 2016 at 1:50 PM, Wols Lists <antlists@youngman.org.uk> wrote:
> On 15/02/16 12:12, o1bigtenor wrote:
>> I am looking at replacing ALL the drives in the array so that I can
>> reduce the likelihood of these kind of issues for a longer period than
>> a few months.
>>
>> Would you be able to tell me what steps should I be taking to replace
>> the entire array?
>>
>> Should I replace the drives one at a time (sort of just like I did
>> this time) using the same commands?
>
> If you have a spare SATA (I presume they're sata drives) slot, then
> definitely not. It might be worth buying an add-in card to give you an
> extra slot, they're only a few quid.
>
> Look up "mdadm --replace". That'll keep the old drive in the array until
> the new one has replaced it, keeping the array fully functional all the
> time.
>
> Doing --fail, --remove, --add places the array in danger until the
> entire sequence is complete, and if you're doing it several times then
> you're massively increasing the chances of trouble.
>
> In fact, if you get an add-in card, you might be able to replace several
> drives at once - I don't know - read up and see if it's supported (or not).

Looked through well over a hundred different pages and only found 1 page
that even hinted at what I am trying to do and details there were sparse.

Read through the man page (likely one of the best for understandability that
I have found so far) and it doesn't address the wholesale replacement of all
the drives in an array. Most of the other pages that I found were what I would
call old, ie before 2010, as I have found that all too often the software being
discussed has changed and then the instructions given are not always useful,
occasionally there is some value in these old pages but only sometimes.

Most often the documentation was focused on replacing a faulty disc.

This is NOT what I am proposing to do.

I have a present working array and with to replace its components with the
same size but new drives (which are NAS rated). Was thinking that using
the fail remove and add process 4 seperate times might not be a good thing
but I do not know of a different option. Compounding the difficulty is
that there
are no empty hard drive slots in the machine. I do have an external USB 3.0
2 drive holder that could be used.

The only suggestion in all the documents I perused was to place spare drives
into something like this external box and then add the drives into the array.
The process was not laid out and leaves me with a number of questions.

Is there a suggested method for replacing ALL the drives in an array (raid 10
in this case)?

If I use the external box how do I do this (external box only holds 2 drives) so
that I can transfer the information on the drives from the array to
the new drives
and then just replace the drives 2 at a time into the machine without
there being
issues because in the information transfer the drives will be sdg and
sdh (AFAIK)
and later they will be some of sdb, sdc, sde, and/or sdf.

If one of the gurus on the list has an already prepared process list
with the steps
and commands that would be wonderful. I am thinking that this document would
very much be appreciated by many others out there that are not on this list.

TIA

Dee

Re: Questions

[Adam Goryachev]

On 16/02/16 08:01, o1bigtenor wrote:
> On Mon, Feb 15, 2016 at 1:50 PM, Wols Lists <antlists@youngman.org.uk> wrote:
>> On 15/02/16 12:12, o1bigtenor wrote:
>>> I am looking at replacing ALL the drives in the array so that I can
>>> reduce the likelihood of these kind of issues for a longer period than
>>> a few months.
>>>
>>> Would you be able to tell me what steps should I be taking to replace
>>> the entire array?
>>>
>>> Should I replace the drives one at a time (sort of just like I did
>>> this time) using the same commands?
>> If you have a spare SATA (I presume they're sata drives) slot, then
>> definitely not. It might be worth buying an add-in card to give you an
>> extra slot, they're only a few quid.
>>
>> Look up "mdadm --replace". That'll keep the old drive in the array until
>> the new one has replaced it, keeping the array fully functional all the
>> time.
>>
>> Doing --fail, --remove, --add places the array in danger until the
>> entire sequence is complete, and if you're doing it several times then
>> you're massively increasing the chances of trouble.
>>
>> In fact, if you get an add-in card, you might be able to replace several
>> drives at once - I don't know - read up and see if it's supported (or not).
> Looked through well over a hundred different pages and only found 1 page
> that even hinted at what I am trying to do and details there were sparse.
>
> Read through the man page (likely one of the best for understandability that
> I have found so far) and it doesn't address the wholesale replacement of all
> the drives in an array. Most of the other pages that I found were what I would
> call old, ie before 2010, as I have found that all too often the software being
> discussed has changed and then the instructions given are not always useful,
> occasionally there is some value in these old pages but only sometimes.
>
> Most often the documentation was focused on replacing a faulty disc.
>
> This is NOT what I am proposing to do.
>
> I have a present working array and with to replace its components with the
> same size but new drives (which are NAS rated). Was thinking that using

I wanted to mention this, what drives do you have right now, and do know 
about SCT ERC?
Maybe start here (but you probably need to read more):
http://www.spinics.net/lists/raid/msg48199.html

Essentially, your current disks might be fine, but if you don't have the 
right settings, they could be "failing" regularly putting your data at 
risk. You should fix any issue here before you attempt to replace your 
drives.

> the fail remove and add process 4 seperate times might not be a good thing
> but I do not know of a different option. Compounding the difficulty is
> that there
> are no empty hard drive slots in the machine. I do have an external USB 3.0
> 2 drive holder that could be used.
>
> The only suggestion in all the documents I perused was to place spare drives
> into something like this external box and then add the drives into the array.
> The process was not laid out and leaves me with a number of questions.
>
> Is there a suggested method for replacing ALL the drives in an array (raid 10
> in this case)?

In order to replace all drives, I would suggest that you simply replace 
one drive 4 times (different drive each time).
The first question to ask, is your external USB drive bay reliable? If 
not, then there are other solutions that are probably less dangerous.

So, add your spare drive to the external USB drive bay, it should show 
up as /dev/sdy (for example)
Partition to match the rest of your existing drives
Add the new partition to your existing array: mdadm --manage /dev/md0 
--add /dev/sdx1
Replace one of the existing drives with the new one: mdadm /dev/md0 
--replace /dev/sda1 --with /dev/sdx1
Personally, because I distrust the external USB drive bay (don't ask me 
why, it just seems less reliable than internal sata), once the drive has 
finished being replaced, I would shutdown, remove the old drive, and 
install the replacement drive, then add another new spare, and repeat.

You can see this page for some extra information:
http://unix.stackexchange.com/questions/74924/how-to-safely-replace-a-not-yet-failed-disk-in-a-linux-raid5-array
> If I use the external box how do I do this (external box only holds 2 drives) so
> that I can transfer the information on the drives from the array to
> the new drives
> and then just replace the drives 2 at a time into the machine without
> there being
> issues because in the information transfer the drives will be sdg and
> sdh (AFAIK)
> and later they will be some of sdb, sdc, sde, and/or sdf.
I would suggest replacing one at a time.
> If one of the gurus on the list has an already prepared process list
> with the steps
> and commands that would be wonderful. I am thinking that this document would
> very much be appreciated by many others out there that are not on this list.
>
> TIA
>
>

Hope that helps.

Regards,
Adam

-- 
Adam Goryachev Website Managers www.websitemanagers.com.au

Re: Questions

[o1bigtenor]

On Mon, Feb 15, 2016 at 4:05 PM, Adam Goryachev
<mailinglists@websitemanagers.com.au> wrote:


>
> I wanted to mention this, what drives do you have right now, and do know
> about SCT ERC?
> Maybe start here (but you probably need to read more):
> http://www.spinics.net/lists/raid/msg48199.html

A major reason as to why the drives are getting replaced. Back in early 2012
when I setup the machine there was no obvious information that the ERC
type drives were needed so I just bought vanilla drives.
>
> Essentially, your current disks might be fine, but if you don't have the
> right settings, they could be "failing" regularly putting your data at risk.
> You should fix any issue here before you attempt to replace your drives.

I now have 2 long term drives which are likely still good and 2 cheap
drives that
are quite new but which I don't trust for long term reliability,
therefore the push
to change them all.
>
>> the fail remove and add process 4 seperate times might not be a good thing
>> but I do not know of a different option. Compounding the difficulty is
>> that there
>> are no empty hard drive slots in the machine. I do have an external USB
>> 3.0
>> 2 drive holder that could be used.
>>
>> The only suggestion in all the documents I perused was to place spare
>> drives
>> into something like this external box and then add the drives into the
>> array.
>> The process was not laid out and leaves me with a number of questions.
>>
>> Is there a suggested method for replacing ALL the drives in an array (raid
>> 10
>> in this case)?
>
>
> In order to replace all drives, I would suggest that you simply replace one
> drive 4 times (different drive each time).
> The first question to ask, is your external USB drive bay reliable? If not,
> then there are other solutions that are probably less dangerous.
>
> So, add your spare drive to the external USB drive bay, it should show up as
> /dev/sdy (for example)
> Partition to match the rest of your existing drives
> Add the new partition to your existing array: mdadm --manage /dev/md0 --add
> /dev/sdx1
> Replace one of the existing drives with the new one: mdadm /dev/md0
> --replace /dev/sda1 --with /dev/sdx1
> Personally, because I distrust the external USB drive bay (don't ask me why,
> it just seems less reliable than internal sata), once the drive has finished
> being replaced, I would shutdown, remove the old drive, and install the
> replacement drive, then add another new spare, and repeat.
>
> You can see this page for some extra information:
> http://unix.stackexchange.com/questions/74924/how-to-safely-replace-a-not-yet-failed-disk-in-a-linux-raid5-array
>>
>> If I use the external box how do I do this (external box only holds 2
>> drives) so
>> that I can transfer the information on the drives from the array to
>> the new drives
>> and then just replace the drives 2 at a time into the machine without
>> there being
>> issues because in the information transfer the drives will be sdg and
>> sdh (AFAIK)
>> and later they will be some of sdb, sdc, sde, and/or sdf.
>
> I would suggest replacing one at a time.

There is no way to do them one after another copying over all four and then
only needing to shut the box down once or failing that doing the process 2 times
necessitating only 2 shutdowns instead of 4 is there? The external USB box
does have room for 2 drives at once.

TIA

Dee

Re: Questions

[Adam Goryachev]

On 16/02/2016 22:46, o1bigtenor wrote:
> On Mon, Feb 15, 2016 at 4:05 PM, Adam Goryachev
> <mailinglists@websitemanagers.com.au> wrote:
>
>
>> I wanted to mention this, what drives do you have right now, and do know
>> about SCT ERC?
>> Maybe start here (but you probably need to read more):
>> http://www.spinics.net/lists/raid/msg48199.html
> A major reason as to why the drives are getting replaced. Back in early 2012
> when I setup the machine there was no obvious information that the ERC
> type drives were needed so I just bought vanilla drives.
>> Essentially, your current disks might be fine, but if you don't have the
>> right settings, they could be "failing" regularly putting your data at risk.
>> You should fix any issue here before you attempt to replace your drives.
> I now have 2 long term drives which are likely still good and 2 cheap
> drives that
> are quite new but which I don't trust for long term reliability,
> therefore the push
> to change them all.

Note, most drives either still support it, or else can be worked around 
to avoid the timeout mismatch. You should do this before continue to 
replace the drives, as you want to avoid this happening in the middle of 
replacing drives.
>>> the fail remove and add process 4 seperate times might not be a good thing
>>> but I do not know of a different option. Compounding the difficulty is
>>> that there
>>> are no empty hard drive slots in the machine. I do have an external USB
>>> 3.0
>>> 2 drive holder that could be used.
>>>
>>> The only suggestion in all the documents I perused was to place spare
>>> drives
>>> into something like this external box and then add the drives into the
>>> array.
>>> The process was not laid out and leaves me with a number of questions.
>>>
>>> Is there a suggested method for replacing ALL the drives in an array (raid
>>> 10
>>> in this case)?
>>
>> In order to replace all drives, I would suggest that you simply replace one
>> drive 4 times (different drive each time).
>> The first question to ask, is your external USB drive bay reliable? If not,
>> then there are other solutions that are probably less dangerous.
>>
>> So, add your spare drive to the external USB drive bay, it should show up as
>> /dev/sdy (for example)
>> Partition to match the rest of your existing drives
>> Add the new partition to your existing array: mdadm --manage /dev/md0 --add
>> /dev/sdx1
>> Replace one of the existing drives with the new one: mdadm /dev/md0
>> --replace /dev/sda1 --with /dev/sdx1
>> Personally, because I distrust the external USB drive bay (don't ask me why,
>> it just seems less reliable than internal sata), once the drive has finished
>> being replaced, I would shutdown, remove the old drive, and install the
>> replacement drive, then add another new spare, and repeat.
>>
>> You can see this page for some extra information:
>> http://unix.stackexchange.com/questions/74924/how-to-safely-replace-a-not-yet-failed-disk-in-a-linux-raid5-array
>>> If I use the external box how do I do this (external box only holds 2
>>> drives) so
>>> that I can transfer the information on the drives from the array to
>>> the new drives
>>> and then just replace the drives 2 at a time into the machine without
>>> there being
>>> issues because in the information transfer the drives will be sdg and
>>> sdh (AFAIK)
>>> and later they will be some of sdb, sdc, sde, and/or sdf.
>> I would suggest replacing one at a time.
> There is no way to do them one after another copying over all four and then
> only needing to shut the box down once or failing that doing the process 2 times
> necessitating only 2 shutdowns instead of 4 is there? The external USB box
> does have room for 2 drives at once.

Put two blank drives into the USB, replace first one, replace second one 
(would suggest second drive as non-matching pair). Shutdown, move two 
new drives internal, place two new drives into drive bay, and repeat for 
the last two drives.

I would suggest adding a bitmap for at least the time you are doing the 
replacements, then if you have a failure on the USB enclosure during the 
2nd or 4th drive, at least the 1st or 3rd will re-sync quickly.

Regards,
Adam

Re: Questions

[o1bigtenor]

On Tue, Feb 16, 2016 at 8:00 AM, Adam Goryachev
<mailinglists@websitemanagers.com.au> wrote:
>snip
>>
>> A major reason as to why the drives are getting replaced. Back in early
>> 2012
>> when I setup the machine there was no obvious information that the ERC
>> type drives were needed so I just bought vanilla drives.
>>>
>>> Essentially, your current disks might be fine, but if you don't have the
>>> right settings, they could be "failing" regularly putting your data at
>>> risk.
>>> You should fix any issue here before you attempt to replace your drives.
>>
>> I now have 2 long term drives which are likely still good and 2 cheap
>> drives that
>> are quite new but which I don't trust for long term reliability,
>> therefore the push
>> to change them all.
>
>
> Note, most drives either still support it, or else can be worked around to
> avoid the timeout mismatch. You should do this before continue to replace
> the drives, as you want to avoid this happening in the middle of replacing
> drives.
snip
>>>
>>> I would suggest replacing one at a time.
>>
>> There is no way to do them one after another copying over all four and
>> then
>> only needing to shut the box down once or failing that doing the process 2
>> times
>> necessitating only 2 shutdowns instead of 4 is there? The external USB box
>> does have room for 2 drives at once.
>
>
> Put two blank drives into the USB, replace first one, replace second one
> (would suggest second drive as non-matching pair). Shutdown, move two new
> drives internal, place two new drives into drive bay, and repeat for the
> last two drives.

How do I determine exactly which are the matching pairs?

Raid 10 means striped and mirrored so I have 2 pairs (AIUI).
I'm thinking its sde and sdf as a pair and then sdb and sdc as the other so if
that's true then I would start with say sde and sdc for the first set
and then do
sdf and sdb for the second.
>
> I would suggest adding a bitmap for at least the time you are doing the
> replacements, then if you have a failure on the USB enclosure during the 2nd
> or 4th drive, at least the 1st or 3rd will re-sync quickly.

Sorry - - - a bitmap - - - not sure what you mean?

Thanking you for your assistance.

Dee

Re: Questions

[Wols Lists]

On 16/02/16 11:46, o1bigtenor wrote:
> A major reason as to why the drives are getting replaced. Back in early 2012
> when I setup the machine there was no obvious information that the ERC
> type drives were needed so I just bought vanilla drives.

This is just what I've got a gut feel for, it seems to make sense of
what I've seen on the list ...

"new" drives of 2TB or more have the crippled drive firmware unless you
specifically buy raid.

The original release date of 1TB and less drives predates the crippling,
and the manufacturers haven't bothered to go back and "fix" this.

So 1TB drives - even desktop ones - seem usually to be okay. Anything
over that is suspect.

Cheers,
Wol

Incidentally, any reason for sticking with the same size drives? I'm
looking at replacing my Barracudas and might well upgrade from 3TB to
4TB, just because the price difference is minimal. That's despite /home
only being half full even though I have a 24MP camera ...

Re: Questions

[o1bigtenor]

On Tue, Feb 16, 2016 at 8:32 AM, Wols Lists <antlists@youngman.org.uk> wrote:
> On 16/02/16 11:46, o1bigtenor wrote:
>> A major reason as to why the drives are getting replaced. Back in early 2012
>> when I setup the machine there was no obvious information that the ERC
>> type drives were needed so I just bought vanilla drives.
>
> This is just what I've got a gut feel for, it seems to make sense of
> what I've seen on the list ...
>
> "new" drives of 2TB or more have the crippled drive firmware unless you
> specifically buy raid.
>
> The original release date of 1TB and less drives predates the crippling,
> and the manufacturers haven't bothered to go back and "fix" this.

I'll take your word for that but did buy NAS rated drives (just missed
getting some
enterprise drives which should have been even better!).
>
> So 1TB drives - even desktop ones - seem usually to be okay. Anything
> over that is suspect.
>
> Cheers,
> Wol
>
> Incidentally, any reason for sticking with the same size drives? I'm
> looking at replacing my Barracudas and might well upgrade from 3TB to
> 4TB, just because the price difference is minimal. That's despite /home
> only being half full even though I have a 24MP camera ...
>

Sticking with the same size drives for a number of reasons. The price
difference is
minimal but it is there. In 4 years of using I'm now at 300 GB which is not that
large compared to a 2TB array. I also am in the process of setting up
a server which
has 4 - 3TB drives in a raid 10 array for backup level 1.

Thanking you for your time and tips!

Dee

Re: Questions

[Wols Lists]

On 15/02/16 21:01, o1bigtenor wrote:
> I have a present working array and with to replace its components with the
> same size but new drives (which are NAS rated). Was thinking that using
> the fail remove and add process 4 seperate times might not be a good thing
> but I do not know of a different option. Compounding the difficulty is
> that there
> are no empty hard drive slots in the machine. I do have an external USB 3.0
> 2 drive holder that could be used.

Does it have a spare PCI slot? That's what I was getting at - can you
add two more sata slots? Presumably not if it's a cage, but if it's a
computer case? As I said, a spare PCI SATA card should be dirt cheap to
add temporary extra capacity. And does it matter if the case is open and
the drives lying around temporarily?
> 
> The only suggestion in all the documents I perused was to place spare drives
> into something like this external box and then add the drives into the array.
> The process was not laid out and leaves me with a number of questions.
> 
> Is there a suggested method for replacing ALL the drives in an array (raid 10
> in this case)?

As far as I'm aware, there's just the "mdadm --replace" I mentioned -
drive by drive. Given that it's raid 10, maybe you can just add another
mirror then fail an old one.

I'd just plug in the extra drives, run mdadm --replace, and then remove
the old drives. Just make sure you get the right drives! And always use
uuids so you know which drive is which!

Get Phil's lsdrv and it will probably give you all the drives, with
serial numbers, etc etc. I haven't managed to run it so I can't be sure
:-) But it's intended to give you all the stuff you need to recover an
array so it should give you the information you need to rebuild it.
> 
> If I use the external box how do I do this (external box only holds 2 drives) so
> that I can transfer the information on the drives from the array to
> the new drives
> and then just replace the drives 2 at a time into the machine without
> there being
> issues because in the information transfer the drives will be sdg and
> sdh (AFAIK)
> and later they will be some of sdb, sdc, sde, and/or sdf.

That's why they now have uuids.

ls /dev/disk/by-id

I *think* raid uses uuids internally. So swapping the drives out won't
be a problem - the sdx names are just used as a human-readable output.
But don't take that as gospel ... However, bear in mind that the kernel
does NOT guarantee that a drive will get the same sdx name from one boot
to the next. It so happens that that is the norm, but it's not
guaranteed ... so x changing for any value of sdx shouldn't be a problem.

Regardless, you should not be using sdx. Everything should be using
uuids, my /etc/fstab is a lovely mangle with all those long uuids
everywhere :-)

Cheers,
Wol

Questions

[刘立坤]

RGVhciBCYWNrcG9ydHMgVGVhbToKICAgICAgICAgSSB3YXMgdGhlIFNXIGVuZ2luZWVyIG9mIE5l
dXNvZnQgaW4gQ2hpbmEsICBJIHdhbnQgdG8gZG93bmxvYWQgCmJhY2twb3J0Ki4gV2hpY2ggdmVy
c2lvbiBvZiBzdGFibGUgcmVsZWFzZSAgc2hvdWxkIEkgY2hvb3NlIGZvciBsaW51eCAKa2VybmVs
IDIuNi4zMiBpbiBDZW5PUyA1LjUgPwoKQmVzdCB3aXNoZXMhCi0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLQpDb25maWRlbnRpYWxpdHkgTm90aWNlOiBUaGUgaW5mb3Jt
YXRpb24gY29udGFpbmVkIGluIHRoaXMgZS1tYWlsIGFuZCBhbnkgYWNjb21wYW55aW5nIGF0dGFj
aG1lbnQocykgCmlzIGludGVuZGVkIG9ubHkgZm9yIHRoZSB1c2Ugb2YgdGhlIGludGVuZGVkIHJl
Y2lwaWVudCBhbmQgbWF5IGJlIGNvbmZpZGVudGlhbCBhbmQvb3IgcHJpdmlsZWdlZCBvZiAKTmV1
c29mdCBDb3Jwb3JhdGlvbiwgaXRzIHN1YnNpZGlhcmllcyBhbmQvb3IgaXRzIGFmZmlsaWF0ZXMu
IElmIGFueSByZWFkZXIgb2YgdGhpcyBjb21tdW5pY2F0aW9uIGlzIApub3QgdGhlIGludGVuZGVk
IHJlY2lwaWVudCwgdW5hdXRob3JpemVkIHVzZSwgZm9yd2FyZGluZywgcHJpbnRpbmcsICBzdG9y
aW5nLCBkaXNjbG9zdXJlIG9yIGNvcHlpbmcgCmlzIHN0cmljdGx5IHByb2hpYml0ZWQsIGFuZCBt
YXkgYmUgdW5sYXdmdWwuSWYgeW91IGhhdmUgcmVjZWl2ZWQgdGhpcyBjb21tdW5pY2F0aW9uIGlu
IGVycm9yLHBsZWFzZSAKaW1tZWRpYXRlbHkgbm90aWZ5IHRoZSBzZW5kZXIgYnkgcmV0dXJuIGUt
bWFpbCwgYW5kIGRlbGV0ZSB0aGUgb3JpZ2luYWwgbWVzc2FnZSBhbmQgYWxsIGNvcGllcyBmcm9t
IAp5b3VyIHN5c3RlbS4gVGhhbmsgeW91LiAKLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tCg==

Questions

[Mohamet DIA]

[-- Attachment #1.1: Type: text/plain, Size: 699 bytes --]

Hi  Xen developers,

I am Momo and i do my internship in France. My Topic is to make a cloud
Platform. I decide to use XCP and Openstack. So, I have only one physical
server to do the test.
I use ubuntu 12.10 quantal. For XCP, I just do "apt-get install xcp-xapi".
It's work, no problem. But, when I tried to create a DOMU, I have a
problem. Indeed, the system create an xenbr0 interface without ip address,
but it's not a bridge (when i do brctl show, I don't see this). So, after
that, I don't have internet connection. I thhink that, the problem is the
version of Ubuntu.

So, I want to know if XCP works on Ubuntu12.10. Or, it's better to use
Ubuntu 12.04 or Debian???

Best regards
Mohamet DIA

[-- Attachment #1.2: Type: text/html, Size: 829 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

questions

[sixiaolin0]

[-- Attachment #1: Type: text/plain, Size: 179 bytes --]



Could you please tell me How to install seTools in FC4 ?
I tried many times but failed at last!
It always report some errors on version of the packets!
 Thank you for your help!

[-- Attachment #2: Type: text/html, Size: 373 bytes --]

Re: questions

[Christopher J. PeBenito]

On Thu, 2009-03-12 at 23:07 +0800, sixiaolin0 wrote:

> Could you please tell me How to install seTools in FC4 ?
> I tried many times but failed at last!
> It always report some errors on version of the packets!
>  Thank you for your help!

What version of SETools are you using, and can you include the error
messages?

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions

[Daniel J Walsh]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=x-gbk, Size: 823 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

sixiaolin0 wrote:
> 
> Could you please tell me How to install seTools in FC4 ?
> I tried many times but failed at last!
> It always report some errors on version of the packets!
>  Thank you for your help!
FC4 has not been supported in a couple of years.  Please update to a
Supported Fedora 9/10.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkm5LCUACgkQrlYvE4MpobOF3ACeJqhl/mSt8EW+xetIFtP7qwkr
WMIAn0uQh12W+fU+AHveW2H7uuBWeMXF
=1ZlQ
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions

[Russell Coker]

On Fri, 13 Mar 2009, Daniel J Walsh <dwalsh@redhat.com> wrote:
> > Could you please tell me How to install seTools in FC4 ?
> > I tried many times but failed at last!
> > It always report some errors on version of the packets!
> >  Thank you for your help!
>
> FC4 has not been supported in a couple of years.  Please update to a
> Supported Fedora 9/10.

Also RHEL4+, CentOS 4+, and Debian Etch or Lenny (preferably Lenny) are 
options.

If you use FC4 then just forget about host-based security.  Disconnecting the 
machine from the net is the correct way to secure such an old and unsupported 
version.

-- 
russell@coker.com.au
http://etbe.coker.com.au/          My Main Blog
http://doc.coker.com.au/           My Documents Blog


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions

[Shaz]

[-- Attachment #1: Type: text/plain, Size: 1132 bytes --]

On Fri, Mar 13, 2009 at 11:20 AM, Russell Coker <russell@coker.com.au>wrote:

> On Fri, 13 Mar 2009, Daniel J Walsh <dwalsh@redhat.com> wrote:
> > > Could you please tell me How to install seTools in FC4 ?
> > > I tried many times but failed at last!
> > > It always report some errors on version of the packets!
> > >  Thank you for your help!
> >
> > FC4 has not been supported in a couple of years.  Please update to a
> > Supported Fedora 9/10.
>
> Also RHEL4+, CentOS 4+, and Debian Etch or Lenny (preferably Lenny) are
> options.


What about Ubuntu 8.04 and onwards?


>
>
> If you use FC4 then just forget about host-based security.  Disconnecting
> the
> machine from the net is the correct way to secure such an old and
> unsupported
> version.
>
> --
> russell@coker.com.au
> http://etbe.coker.com.au/          My Main Blog
> http://doc.coker.com.au/           My Documents Blog
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.govwith
> the words "unsubscribe selinux" without quotes as the message.
>



-- 
Shaz

[-- Attachment #2: Type: text/html, Size: 2036 bytes --]

Re: questions

[Russell Coker]

On Sat, 14 Mar 2009, Shaz <shazalive@gmail.com> wrote:
> > > FC4 has not been supported in a couple of years.  Please update to a
> > > Supported Fedora 9/10.
> >
> > Also RHEL4+, CentOS 4+, and Debian Etch or Lenny (preferably Lenny) are
> > options.
>
> What about Ubuntu 8.04 and onwards?

I don't know about the status of Ubuntu SE Linux.  Caleb, can you comment?

We should get a web page listing the support for SE Linux in various 
distributions along with the email addresses of key people who can be queried 
about such things.  For starters it would have me for Debian, Dan for Fedora, 
RHEL, and implicitely CentOS, and maybe Caleb for Ubuntu.

-- 
russell@coker.com.au
http://etbe.coker.com.au/          My Main Blog
http://doc.coker.com.au/           My Documents Blog


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions

[Shaz]

[-- Attachment #1: Type: text/plain, Size: 1278 bytes --]

On Sat, Mar 14, 2009 at 10:24 PM, Russell Coker <russell@coker.com.au>wrote:

> On Sat, 14 Mar 2009, Shaz <shazalive@gmail.com> wrote:
> > > > FC4 has not been supported in a couple of years.  Please update to a
> > > > Supported Fedora 9/10.
> > >
> > > Also RHEL4+, CentOS 4+, and Debian Etch or Lenny (preferably Lenny) are
> > > options.
> >
> > What about Ubuntu 8.04 and onwards?
>
> I don't know about the status of Ubuntu SE Linux.  Caleb, can you comment?
>
> We should get a web page listing the support for SE Linux in various
> distributions along with the email addresses of key people who can be
> queried
> about such things.  For starters it would have me for Debian, Dan for
> Fedora,
> RHEL, and implicitely CentOS, and maybe Caleb for Ubuntu.


I have been trying some of the SELinux packages from the repos but can't
even enable it on boot! I wanted to have multiple platform experience
although I am pretty easy with FC8. Next I will try Gentoo.

I am also working on getting SELinux enabled in some of our mobile devices
so if there is any useful public domain work then please indicate it.

Thank you.


>
>
> --
> russell@coker.com.au
> http://etbe.coker.com.au/          My Main Blog
> http://doc.coker.com.au/           My Documents Blog
>



-- 
Shaz

[-- Attachment #2: Type: text/html, Size: 2141 bytes --]

Re: questions

[Russell Coker]

On Mon, 16 Mar 2009, Shaz <shazalive@gmail.com> wrote:
> I have been trying some of the SELinux packages from the repos but can't
> even enable it on boot! I wanted to have multiple platform experience
> although I am pretty easy with FC8. Next I will try Gentoo.

Which distributions did you try?

Debian/Lenny should work well if you follow my instructions:
http://doc.coker.com.au/computers/installing-se-linux-on-lenny/

> I am also working on getting SELinux enabled in some of our mobile devices
> so if there is any useful public domain work then please indicate it.

In the past I did some work on getting it running on Familiar on the iPaQ 
platform (ARM).  But when SE Linux migrated to XATTRs that was broken because 
JFFS2 didn't have XATTR support.  Recently XATTR support has been written, so 
it should be possible to get it going.

-- 
russell@coker.com.au
http://etbe.coker.com.au/          My Main Blog
http://doc.coker.com.au/           My Documents Blog

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions

[Shaz]

[-- Attachment #1: Type: text/plain, Size: 2426 bytes --]

On Mon, Mar 16, 2009 at 3:37 PM, Russell Coker <russell@coker.com.au> wrote:

> On Mon, 16 Mar 2009, Shaz <shazalive@gmail.com> wrote:
> > I have been trying some of the SELinux packages from the repos but can't
> > even enable it on boot! I wanted to have multiple platform experience
> > although I am pretty easy with FC8. Next I will try Gentoo.
>
> Which distributions did you try?


Just FC6 and FC8. Then went embedded with Debian derivatives. The
dependencies are a bit difficult to handle when working on different layers
of the software stack with different requirements. I am working on busybox
at the moment to get things started. I am using Willis' GSoC work and taking
ahead. It has policy19 while I am interested in policy21. Will that be a
problem?


>
>
> Debian/Lenny should work well if you follow my instructions:
> http://doc.coker.com.au/computers/installing-se-linux-on-lenny/


I studied some of your initial work for Debian and I am just going to read
the above and update accordingly. The earlier work was helpful to understand
all the things put together ... integration. Has anyone tried the IBM
SELinux from scratch tutorial. I assigned an internee to check it. Will it
be useful?

I am arranging a team who will maintain documentation and code for Debian
derivatives for ARMel. That should help the rest of us :)


>
>
> > I am also working on getting SELinux enabled in some of our mobile
> devices
> > so if there is any useful public domain work then please indicate it.
>
> In the past I did some work on getting it running on Familiar on the iPaQ
> platform (ARM).  But when SE Linux migrated to XATTRs that was broken
> because
> JFFS2 didn't have XATTR support.  Recently XATTR support has been written,
> so
> it should be possible to get it going.


The userspace support gives me problem because of the dependencies but it
should be getting fine in a few days. If the userspace had been
autoconficated then things would have been easy. Sometime ago someone at
some place identified autotools support for this purpose. I was looking for
it to try it. Has anyone tried it? The principal who submitted it was not
very friendly and at that time I was busy with learning policy models and
how they are being converged with SELinux infra.


>
>
> --
> russell@coker.com.au
> http://etbe.coker.com.au/          My Main Blog
> http://doc.coker.com.au/           My Documents Blog
>



-- 
Shaz

[-- Attachment #2: Type: text/html, Size: 3691 bytes --]

questions

[Kevin Diggs]

Hi,

	In idle_6xx.S one finds instructions like:

	lis   r4,powersave_nap@ha
	lwz   r4,powersave_nap@l(r4)

Can someone explain what this is doing? Presumably the first is loading 
an address and the second a value. What do the '@ha' and '@l' do?

	Also, is there any performance difference between:

	lbz rD,d(rA)
	lhz rD,d(rA)
	lwz rD,d(rA)

	While I'm wasting your time, I picked up an ADB infrared wireless 
keyboard. I think it works. But not under Linux. Should it?

	And is there any reason to prefer one over the other for doing byte 
swapping:

	lwbrx rD,rA,rB
	stwbrx rS,rA,rB

kevin

Re: questions

[Brad Boyer]

On Sun, May 25, 2008 at 05:32:29PM -0700, Kevin Diggs wrote:
> Hi,
> 
> 	In idle_6xx.S one finds instructions like:
> 
> 	lis   r4,powersave_nap@ha
> 	lwz   r4,powersave_nap@l(r4)
> 
> Can someone explain what this is doing? Presumably the first is loading 
> an address and the second a value. What do the '@ha' and '@l' do?

The @ha and @l are modifiers to turn a 32 bit constant into a 16 bit
constant that would be useful in particular contexts. The @l takes
the low halfword, while the @ha takes the high halfword and modifies
it so that if you add in the low halfword you get the full 32 bit
value. There are other modifiers for other uses. You need these in
ppc assembly because there isn't any way to directly use a 32 bit
immediate value. In this particular case, it's taking advantage of
the indirect addressing modes to load a word from a constant 32 bit
address. It loads the high halfword of the pointer into r4 with the
lis instruction, then the low halfword is added during the effective
address calculation. The value at that constant address is loaded
into r4. Normally a 32 bit constant gets loaded with lis and addi,
but this is a way to avoid the extra instruction because it intends
to use the result as a pointer. The indirect addressing gives you
a free addi as long as you don't need to save the result.

> 	Also, is there any performance difference between:
> 
> 	lbz rD,d(rA)
> 	lhz rD,d(rA)
> 	lwz rD,d(rA)

Normally you would use the one you need. I'd be surprised if there was
any difference in performance, but I also can't think of any reason
you would choose one over another for performance reasons even if there
was a difference.

> 	While I'm wasting your time, I picked up an ADB infrared wireless 
> keyboard. I think it works. But not under Linux. Should it?

If it acts like a normal ADB keyboard, it should work. Does it need a
special driver with the MacOS? If so, then it would probably need a
custom driver in Linux as well.

	Brad Boyer
	flar@allandria.com

questions

[inflo]

hi,
in the function kvm_init_msr_list(), when will it be true that (j < i) ?
in x86.c

the function kvm_arch_init() in x68.c, would it not make sense,
to put the  call to kvm_mmu_module_init() and kvm_init_msr_list  after
the 3 checks if kvm is already possible on this          machine, or is
that nonsense from me?  

flo

-------------------------------------------------------------------------
SF.Net email is sponsored by:
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services
for just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace

Questions.

[John Ronan]

Hi Folks,

I'm about to build a new node here, and I've actually now got time to  
do it properly (rather than having to rush it).  I want to enable IP  
on all interfaces/APRS on some normal Packet forwarding on another.

I'm waiting to see if our National TCP/IP Co-Ordinator is still co- 
ordinating ;), but I can still go on and do the design on paper.

2m Port will be 144.800 primarily APRS and will have TCP/IP
4m Port will be for forwarding to local FBB BBS (and TCP/IP) & APRS
UHF port will be 9K6, my plan for this port is to act as a TCP/IP  
port, but it will also allow ax25 connects & APRS

We've never really 'done' TCP/IP around here, so no real thought ever  
went into the network IP address allocation scheme (Anyone tried IPv6  
over AX25 btw).

If this was a wired network, I'd look for a /24 for each interface,  
but I don't know if thats the 'done thing', also the AX25 HOWTO seems  
out of date, I've emailed the author to as if its possible to suggest  
updates to the document

Any thoughts appreciated.

Regards
de John
EI7IG


--
John Ronan <jronan@tssg.org>, +353-51-302938
Telecommunications Software &  Systems Group,  http://www.tssg.org

Questions.

[Lakshmi N. Sundararajan]

Hello Team:
I have a basic question on the definition of a variable in use.

What is the definition of "bankwidth" on FLASH devices?
Is it the data bus width in bytes?
A 16bit data bus would have a bankwidth of 2?
An 8bit data bus FLASH would have a bankwidth of 1?

Please can someone clarify.

Thanks,
-LN

Re: Questions.

[Josh Boyer]

On 3/7/06, Lakshmi N. Sundararajan <lakshmi.s@promise.com> wrote:
> Hello Team:
> I have a basic question on the definition of a variable in use.
>
> What is the definition of "bankwidth" on FLASH devices?
> Is it the data bus width in bytes?
> A 16bit data bus would have a bankwidth of 2?
> An 8bit data bus FLASH would have a bankwidth of 1?

Yes, sort of.  The variable used to be called buswidth, however there
can be configurations where the bank is not fully addressable in the
buswidth.  So the bankwidth variable represents how you can access all
of the chips.

"Normal" boards will use bankwidth exactly as you described above.  See:

http://lists.infradead.org/pipermail/linux-mtd/2004-July/009974.html

and

http://lists.infradead.org/pipermail/linux-mtd/2004-July/009986.html

for more info.

josh

Questions

[Tobias Wollgam]

Hi.

If I google for grub2 I find some places where it seams that grub2 is 
used in distributions like Fedora and SuSE. Could this be true?

If I build the current cvs version of grub2 I got some pxe stuff. Does 
it work? How can I test it?

If I would start with network support how to begin? Does it make any 
sence to start now?

TIA,

 Tobias

(It's my same old problem: need an UNDI driver for grub :-(  )

Re: Questions

[Marco Gerards]

Tobias Wollgam <tobias.wollgam@materna.de> writes:

> Hi.
>
> If I google for grub2 I find some places where it seams that grub2 is 
> used in distributions like Fedora and SuSE. Could this be true?

It sounds like someone is really confused or just called the hacked
GRUB they distribute GRUB 2.

> If I build the current cvs version of grub2 I got some pxe stuff. Does 
> it work? How can I test it?

It can be used to load the core image using pxe.  If your BIOS is
capable of PXE you should be able to use this coreimage as it is
described in the README I think by using pxeboot.img instead of
boot.img.

--
Marco

Re: Questions

[Peter Jones]

On Thu, 2005-03-10 at 19:35 +0100, Tobias Wollgam wrote:
> Hi.
> 
> If I google for grub2 I find some places where it seams that grub2 is 
> used in distributions like Fedora and SuSE. Could this be true?

Fedora and RHEL certainly don't, though we are monitoring development
fairly closely and do plan on using it in the future.  Is there
something we've done that's giving the impression that we're using grub2
now?  I'd certainly like to stop any misinformation along those lines,
so let me know.

-- 
        Peter

Re: Questions

[Tobias Wollgam]

> On Thu, 2005-03-10 at 19:35 +0100, Tobias Wollgam wrote:
> > Hi.
> >
> > If I google for grub2 I find some places where it seams that grub2
> > is used in distributions like Fedora and SuSE. Could this be true?
>
> Fedora and RHEL certainly don't, though we are monitoring development
> fairly closely and do plan on using it in the future.  Is there
> something we've done that's giving the impression that we're using
> grub2 now?  I'd certainly like to stop any misinformation along those
> lines, so let me know.

The misinformation is not directly from RedHat, but have a look at:

http://www.linuxquestions.org/questions/archive/39/2004/07/3/207616

questions

[william e. bastian]

i just downloaded the rpm file, installed it in mandrake linux 9.2.  how 
do you get it to do anything?

Re: questions

[Julius Schwartzenberg]

william e. bastian schreef:

> i just downloaded the rpm file, installed it in mandrake linux 9.2.  
> how do you get it to do anything?

Try running xdosemu from a shell.

Questions

[Xiaonan Lu]

Hi, 
I am a new guy to linux and netfilter/proc. 
I am working on a program right now, its main purpose is develope a module to peek every outgoing packet to log the timestamp information. I hook this module at the netfilter's POST_ROUTING hook. 
Questions: 
When my module is hooked and begin to run, I can not use netscape, ssh, .etc anymore. The typical result is: I type: ssh <hostname> -l username, the machine seems to stop, no any response except I stop my module. It seems every IP packet were stop by somebody. In my module, I don't drop any packet, for every packet I get, I just record the timestamp and return NF_ACCEPT. 
Thanks
ping

-- 
__________________________________________________________
Sign-up for your own personalized E-mail at Mail.com
http://www.mail.com/?sr=signup

Search Smarter - get the new eXact Search Bar for free!
http://www.exactsearchbar.com/

Re: Questions

[Henrik Nordstrom]

On Wed, 12 Nov 2003, Xiaonan Lu wrote:

> When my module is hooked and begin to run, I can not use netscape, ssh,
> .etc anymore. The typical result is: I type: ssh <hostname> -l username,
> the machine seems to stop, no any response except I stop my module. It
> seems every IP packet were stop by somebody. In my module, I don't drop
> any packet, for every packet I get, I just record the timestamp and
> return NF_ACCEPT.

Verify your module. The problem is most likely to be found there.

Hint: Debugging kernel modules is very easily done using user-mode-linux 
<urlhttp://user-mode-linux.sourceforge.net/>. This allows you to run and 
debug the kernel as if it was no more than a plain application.

Regards
Henrik

questions

[Magosányi Árpád]

Hi!

I am experimenting with selinux. My previous experiments included
RSBAC with its RC model. It was (is) a system where there are
multiple chrooted environments, and there is an RC emulation
of Bell&LaPadula within them. Compared to that, the default
selinux configuration is _way_ complicated. Now I am thinking
about implementing either the above setup or a setup which is
a combination of the above and the default policy. I just have to
get in sync, and figure out how one can handle this complexity
in a secure manner. (I guess that constraints will help, but the
whole picture is far from clear.) This is why I have several
questions.

-What tools and techniques exist for analysing the policy?
 For example how can I list domains besides using grep and friends
 on the policy file?
 I am also interested in techniques of analysing and designing MAC
 policies in general, and using TE and RBAC in particular. I presume
 that there is something newer than the Red and Aqua books on the
 issue, but where?

- Is polyinstantiation is put back to selinux yet? Having moldy
 directories based on subject domain would be nice. If not, what
 workarounds exist?

- What about networking? I see that there is nodecon and portcom,
 and someone has written that some networking functionality is
 out because of rejection of the corresponding LSM hooks. Do
 they work? Do we have an iptables context match module?
 Will we?

Thanx.

-- 
GNU GPL: csak tiszta forrásból


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions

[James Morris]

On 24 Aug 2003, Magosányi Árpád wrote:

> - Is polyinstantiation is put back to selinux yet? Having moldy
>  directories based on subject domain would be nice. If not, what
>  workarounds exist?

There is no polyinstantiation (of e.g. directories, ports), and AFAIK,
never has been.

> - What about networking? I see that there is nodecon and portcom,
>  and someone has written that some networking functionality is
>  out because of rejection of the corresponding LSM hooks. Do
>  they work?

Some of the missing networking functionality is in the process of being 
redesigned and added back in.

> Do we have an iptables context match module?

Not that I know of.

>  Will we?

It is possible, if someone cares to do it.


- James
-- 
James Morris
<jmorris@redhat.com>



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: questions

[Kevin Carr]

Regarding your question:

-What tools and techniques exist for analysing the policy?
-For example how can I list domains besides using grep and friends
-on the policy file?

Tresys Technology is in ongoing development of a set of tools for
analyzing policies.  You can download the source from to following URL:
http://www.tresys.com/selinux_policy_tools.html.  The current version
has domain transfer analysis among other stuff.  We will be releasing a
newer version soon which will have some other great features.

-Kevin

-----Original Message-----
From: owner-selinux@tycho.nsa.gov [mailto:owner-selinux@tycho.nsa.gov]
On Behalf Of Magosányi Árpád
Sent: Saturday, August 23, 2003 5:12 PM
To: SELinux
Subject: questions

Hi!

I am experimenting with selinux. My previous experiments included
RSBAC with its RC model. It was (is) a system where there are
multiple chrooted environments, and there is an RC emulation
of Bell&LaPadula within them. Compared to that, the default
selinux configuration is _way_ complicated. Now I am thinking
about implementing either the above setup or a setup which is
a combination of the above and the default policy. I just have to
get in sync, and figure out how one can handle this complexity
in a secure manner. (I guess that constraints will help, but the
whole picture is far from clear.) This is why I have several
questions.

-What tools and techniques exist for analysing the policy?
 For example how can I list domains besides using grep and friends
 on the policy file?
 I am also interested in techniques of analysing and designing MAC
 policies in general, and using TE and RBAC in particular. I presume
 that there is something newer than the Red and Aqua books on the
 issue, but where?

- Is polyinstantiation is put back to selinux yet? Having moldy
 directories based on subject domain would be nice. If not, what
 workarounds exist?

- What about networking? I see that there is nodecon and portcom,
 and someone has written that some networking functionality is
 out because of rejection of the corresponding LSM hooks. Do
 they work? Do we have an iptables context match module?
 Will we?

Thanx.

-- 
GNU GPL: csak tiszta forrásból


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov
with
the words "unsubscribe selinux" without quotes as the message.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions

[David Caplan]

Magosányi Árpád wrote:
> 
> -What tools and techniques exist for analysing the policy?
>  For example how can I list domains besides using grep and friends
>  on the policy file?

You can check out our tools (http://www.tresys.com/setools), 
specifically apol for policy analysis.  Apol has many features which can 
help you break down the policy components as well as search through the 
rules with filters on object types/classes/permissions/attributes/etc.

David

___________________________
David Caplan
Tresys Technology, LLC.
dac@tresys.com


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: questions

[Art Wilson]

Magosányi, Tresys has developed (and is continuing to develop) a number
of tools for analyzing SELinux policy. These tools are included in the
SELinux distribution, and are also available from www.tresys.com: apol is
the primary policy analysis tool; sepcut allows
you to look at the various policy files and directories; seuser assists in
managing users on an SELinux system.

Art

awilson@tresys.com

-----Original Message-----
From: owner-selinux@tycho.nsa.gov [mailto:owner-selinux@tycho.nsa.gov]On
Behalf Of Magosányi Árpád
Sent: Saturday, August 23, 2003 5:12 PM
To: SELinux
Subject: questions


Hi!

I am experimenting with selinux. My previous experiments included
RSBAC with its RC model. It was (is) a system where there are
multiple chrooted environments, and there is an RC emulation
of Bell&LaPadula within them. Compared to that, the default
selinux configuration is _way_ complicated. Now I am thinking
about implementing either the above setup or a setup which is
a combination of the above and the default policy. I just have to
get in sync, and figure out how one can handle this complexity
in a secure manner. (I guess that constraints will help, but the
whole picture is far from clear.) This is why I have several
questions.

-What tools and techniques exist for analysing the policy?
 For example how can I list domains besides using grep and friends
 on the policy file?
 I am also interested in techniques of analysing and designing MAC
 policies in general, and using TE and RBAC in particular. I presume
 that there is something newer than the Red and Aqua books on the
 issue, but where?

- Is polyinstantiation is put back to selinux yet? Having moldy
 directories based on subject domain would be nice. If not, what
 workarounds exist?

- What about networking? I see that there is nodecon and portcom,
 and someone has written that some networking functionality is
 out because of rejection of the corresponding LSM hooks. Do
 they work? Do we have an iptables context match module?
 Will we?

Thanx.

--
GNU GPL: csak tiszta forrásból


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov
with
the words "unsubscribe selinux" without quotes as the message.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: questions

[Stephen Smalley]

On Mon, 2003-08-25 at 10:54, Art Wilson wrote:
> Magosányi, Tresys has developed (and is continuing to develop) a number
> of tools for analyzing SELinux policy. These tools are included in the
> SELinux distribution, and are also available from www.tresys.com: apol is
> the primary policy analysis tool; sepcut allows
> you to look at the various policy files and directories; seuser assists in
> managing users on an SELinux system.

Just as an aside, the Tresys setools aren't yet included in the new
userland tree for the 2.6-based SELinux and the new 2.4-based SELinux
(back port of the 2.6-based SELinux).  They still need to be transferred
over to the new tree and the Makefiles might need a little adjustment,
since everything is now installed into standard locations rather than
under /usr/local/selinux.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

questions

[Bita Gorji-Ara]

Hi everybody,

I'm investigating the capabilities of ACPI and see if
it is appropriate for us or not. Our system is a
real-time complex embedded system, running Linux on
Power PC. We are seeking for a suitable power
management policy . the OS and hardware should be
revised based on that policy. 

I want to consider all alternatives to ACPI and make
the final decision and I prefer to find something
commercial. does anybody have any good set of links to
ACPI alternative approaches?

thanks,

Bita.

__________________________________________________
Do You Yahoo!?
Yahoo! Health - Feel better, live better
http://health.yahoo.com


-------------------------------------------------------
This sf.net email is sponsored by: Dice - The leading online job board
for high-tech professionals. Search and apply for tech jobs today!
http://seeker.dice.com/seeker.epl?rel_code=31

questions

[Bita Gorji-Ara]

Hi everybody,
I'm investigating the capabilities of ACPI and see if
it is appropriate for us or not. Our system is a
real-time complex embedded system, running Linux on
Power PC. We are seeking for a suitable power
management policy . the OS and hardware should be
revised based on that policy. 

I want to consider all alternatives to ACPI and make
the final decision and I prefer to find something
commercial. does anybody have any good set of links to
ACPI alternative approaches?

thanks,
Bita.




__________________________________________________
Do You Yahoo!?
Yahoo! Health - Feel better, live better
http://health.yahoo.com


-------------------------------------------------------
This sf.net email is sponsored by: Dice - The leading online job board
for high-tech professionals. Search and apply for tech jobs today!
http://seeker.dice.com/seeker.epl?rel_code=31

Re: questions

[Simon Richter]

On Mon, 29 Jul 2002, Bita Gorji-Ara wrote:

> I'm investigating the capabilities of ACPI and see if
> it is appropriate for us or not. Our system is a
> real-time complex embedded system, running Linux on
> Power PC. We are seeking for a suitable power
> management policy . the OS and hardware should be
> revised based on that policy.

> I want to consider all alternatives to ACPI and make
> the final decision and I prefer to find something
> commercial. does anybody have any good set of links to
> ACPI alternative approaches?

The only viable alternative on the PowerPC would be the method Apple uses
with their Macs. Benjamin Herrenschmidt <benh-XVmvHMARGAS8U2dJNN8I7kB+6BGkLq7r@public.gmane.org> knows
more about this one, I believe. APM is a clearly i386 specific interface
and cannot be ported, and there are a few proprietary protocols.

I would go for ACPI, simply because the necessary toolchains and drivers
under Linux already exist.

   Simon

-- 
GPG public key available from http://phobos.fs.tum.de/pgp/Simon.Richter.asc
 Fingerprint: 040E B5F7 84F1 4FBC CEAD  ADC6 18A0 CC8D 5706 A4B4
Spread the word! Metal/Industrial party on May 22nd at Pulverturm, Munich.
NP: <add NP here>
UP: <add UPTIME here>




-------------------------------------------------------
This sf.net email is sponsored by: Dice - The leading online job board
for high-tech professionals. Search and apply for tech jobs today!
http://seeker.dice.com/seeker.epl?rel_code=31

Re: questions

[Alan Cox]

On Tue, 2002-07-30 at 13:56, Simon Richter wrote:
> The only viable alternative on the PowerPC would be the method Apple uses
> with their Macs. Benjamin Herrenschmidt <benh-XVmvHMARGAS8U2dJNN8I7kB+6BGkLq7r@public.gmane.org> knows
> more about this one, I believe. APM is a clearly i386 specific interface
> and cannot be ported, and there are a few proprietary protocols.
> 
> I would go for ACPI, simply because the necessary toolchains and drivers
> under Linux already exist.

For an embedded board its probably best to write your own pm code and
interface directly to kernel/pm.c



-------------------------------------------------------
This sf.net email is sponsored by: Dice - The leading online job board
for high-tech professionals. Search and apply for tech jobs today!
http://seeker.dice.com/seeker.epl?rel_code=31

Questions

[Justin R. Smith]

I am considering installing SELinux on my system and have a few
questions:

1. Is extensive reconfiguration required whenever one adds new software
to ones machine?

2. Has anyone run SELinux with Tomcat and JSP and servlets?
-- 



--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Questions

[Stephen Smalley]

On 2 Oct 2001, Justin R. Smith wrote:

> I am considering installing SELinux on my system and have a few
> questions:
>
> 1. Is extensive reconfiguration required whenever one adds new software
> to ones machine?

That depends on the software and your security objectives.  For example,
if the software package includes a program that must run with privilege,
then you will likely need to add a domain for the program or at least put
the program into an existing domain for similar programs.  If you want
to limit your software to least privilege, then you will naturally need to
define a domain and types for it.

> 2. Has anyone run SELinux with Tomcat and JSP and servlets?

We have not tried this.  I would expect that you would want to define
a domain and types for the Tomcat server, as has been done for apache by
MITRE.

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com





--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions...

[Pete Loscocco]

Casey Schaufler wrote:
> If you are going to have a policy which
> is based on a label and on a user id you may have
> something good, but you ain't got a [DM]AC policy.
> 

If the modifications to SELinux to allow selective override of DAC (or
any other capability that Linux currently has) that were suggested were
made, what you get is a system that:

- still has the current DAC policy. SELinux doesn't change the existing
  DAC mechanism. That is not being proposed here.
- still enforces a mandatory access control (MAC) policy. By MAC, I mean a
  policy central to the system that every process on the system is
  subject to and that can only be changed as allowed by that policy.
  That is what SELinux does today.
- enforces a MAC policy which can allow certain processes, depending on
  security attributes of the process, to override the DAC mechanism to
  access files, depending on the security attributes of the file. This
  is just a refinement of the functionality that the current Linux
  capability mechanism along with the SELinux control over it gives
  today. It is more expressive allowing privileges to be limited to
  only those that are necessary. It allows processes other than root
  processes have this privilege. Also it removes the necessity to grant
  any process the ability to arbitrarily violate the MAC or DAC
  policies which is often what has been done in traditional MAC
  implementations.

I would say that this is good. If what SELinux has now supports a
[DM]AC policy, what is being proposed still does, only in an even more
useful way. If what SELinux does is not supporting a [DM]AC policy, the
goal of a [DM]AC policy perhaps should be questioned.

--
Peter Loscocco, NSA
pal@epoch.ncsc.mil

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions...

[Casey Schaufler]

Pete Loscocco wrote:

> If the modifications to SELinux to allow selective override of DAC (or
> any other capability that Linux currently has) that were suggested were
> made, what you get is a system that:
> 
> - still has the current DAC policy. SELinux doesn't change the existing
>   DAC mechanism. That is not being proposed here.

Yes it is. The proposed policy changes the DAC behavior
of the system. If you had a good set of regression tests
they would indicate a failure.

> - enforces a MAC policy which can allow certain processes, depending on
>   security attributes of the process, to override the DAC mechanism to
>   access files, depending on the security attributes of the file.

At which point you have introduced interactions between the
MAC, DAC, and Privilege mechanisms. At this point you no longer
have seperate policies.

>   This is just a refinement ...

I don't see it as a refinement. I see the argument
presented as a rationalization.

> I would say that this is good. If what SELinux has now supports a
> [DM]AC policy, what is being proposed still does, only in an even more
> useful way. If what SELinux does is not supporting a [DM]AC policy, the
> goal of a [DM]AC policy perhaps should be questioned.

OKay. Seperate MAC, and DAC policies can be bad, and
integrated policies can be good.

Don't mind me. I just spent a dozen years trying to
get people to accept MAC on it's own, and it's been tough.
Go ahead, have MAC whomp all over the permission bits
that the populous has finaly figured out how to use.
No sweat off my nose, really.

-- 

Casey Schaufler				Manager, Trust Technology, SGI
casey@sgi.com				voice: 650.933.1634
casey_p@pager.sgi.com			Pager: 888.220.0607

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions...

[Pete Loscocco]

> 
> > At some point, we may experiment with extending
> > the mandatory access control architecture to permit the mandatory
> > access control policy to override discretionary access denials
> > to provide a similar mechanism to the Linux capabilities.
> 
> I guess I'm a little slow today. How would having MAC access
> superceding DAC access be anything like the capabilities scheme?
> 

As the system is today the MAC and DAC controls are completely
separate. In order for access to be granted both checks must pass. The
MAC policy respects the DAC decision. The current capability mechanism
provides a capability to override the DAC mechanism. A root process
having this capability is not restricted by file permissions (it still
is constrained by the MAC policy though). With slight changes to the
implementation, it is possible to provide DAC override using only the
MAC policy. On a per-type basis, a process can be allowed to override
the DAC policy. In a sense, the current capability mechanism would be
encoded in the TE policy. This is actually more powerful than the
current capability mechanism because it is not all or nothing. It is
possible to override DAC for one type of file but not another. It also
becomes possible to use the MAC mechanism to provide equivalent
controls as do the other capabilities. Again the achitecture allows for
finer-grained control than that of the current capability mechanism.

--
Peter Loscocco, NSA
pal@epoch.ncsc.mil

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

questions...

[jgko]

Hi all...
This is the first time to this mailing list...

I am wondering whether or not SELINUX checks DAC which supported by orginal LINUX for access control decision..

if so... is there any priority between Type Enforcement and DAC

otherwise,  all policy should be allowed...?

thank you in advace....


--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions...

[Stephen Smalley]

> I am wondering whether or not SELINUX checks DAC which supported 
> by orginal LINUX for access control decision..
> if so... is there any priority between Type Enforcement and DAC
> otherwise,  all policy should be allowed...?

The SELinux mandatory access controls are performed independently
of the existing Linux discretionary access controls.  Both forms
of access control must approve an operation in order for it to
be performed.  At some point, we may experiment with extending
the mandatory access control architecture to permit the mandatory
access control policy to override discretionary access denials
to provide a similar mechanism to the Linux capabilities.  In
one of the predecessors of SELinux (the DTOS system), the NSA
implemented this kind of extension, and used it to allow the
Type Enforcement policy to override discretionary denials.

--
Stephen D. Smalley, NAI Labs
sds@tislabs.com




--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions...

[Casey Schaufler]

Stephen Smalley wrote:

> At some point, we may experiment with extending
> the mandatory access control architecture to permit the mandatory
> access control policy to override discretionary access denials
> to provide a similar mechanism to the Linux capabilities.

I guess I'm a little slow today. How would having MAC access
superceding DAC access be anything like the capabilities scheme?

-- 

Casey Schaufler				Manager, Trust Technology, SGI
casey@sgi.com				voice: 650.933.1634
casey_p@pager.sgi.com			Pager: 888.220.0607

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions...

[Stephen Smalley]

On Thu, 22 Feb 2001, Casey Schaufler wrote:

> I guess I'm a little slow today. How would having MAC access
> superceding DAC access be anything like the capabilities scheme?

See Spence Minear's paper at
http://www.bsdcon.org/proceedings/spencer_minear/example_of_secure_bsd_os.ps
for a discussion of the parallels between Type Enforcement and POSIX.1e
capabilities.  In the DTOS system, Type Enforcement was used both
to identify subjects that could override MLS restrictions and to
identify subjects that could override Unix DAC restrictions.  At the
same time, Type Enforcement was used to strictly limit such subjects
to least privilege.  Their ability to override such restrictions
could be limited to a particular set of objects since the rules
are based on domain-type pairs.

--
Stephen D. Smalley, NAI Labs
sds@tislabs.com


 


--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions...

[Casey Schaufler]

Stephen Smalley wrote:
> 
> On Thu, 22 Feb 2001, Casey Schaufler wrote:
> 
> > I guess I'm a little slow today. How would having MAC access
> > superceding DAC access be anything like the capabilities scheme?
> 
> See Spence Minear's paper at
> http://www.bsdcon.org/proceedings/spencer_minear/example_of_secure_bsd_os.ps
> for a discussion of the parallels between Type Enforcement and POSIX.1e
> capabilities.  In the DTOS system, Type Enforcement was used both
> to identify subjects that could override MLS restrictions and to
> identify subjects that could override Unix DAC restrictions.  At the
> same time, Type Enforcement was used to strictly limit such subjects
> to least privilege.  Their ability to override such restrictions
> could be limited to a particular set of objects since the rules
> are based on domain-type pairs.

OKay, I get it now. I keep forgetting that you're replacing
the entire access control scheme.

A claim that MAC affects DAC like Capabilities gives me
a certain amount of discomfort. Tranditionally, You gots
yer DAC, you gots yer MAC, and you gots yer Capabilities
and you could remove any one without changing the behavior
of the others. This is the way it's speced in the POSIX1e
scheme, and the way it's implemented in Irix. To quote
an old co-worker, "the mixed metaphore never boils".
To provide interactions between a DAC policy and a MAC
policy may be useful, but it's neither fish nor fowl
at that point. If you are going to have a policy which
is based on a label and on a user id you may have
something good, but you ain't got a [DM]AC policy.

-- 

Casey Schaufler				Manager, Trust Technology, SGI
casey@sgi.com				voice: 650.933.1634
casey_p@pager.sgi.com			Pager: 888.220.0607

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

questions

[Magosanyi Arpad]

Hi!

I was playing a bit with this flasky linux.
Some irrelevant little notes:
- chmod a+x flask/mkaccess_vector.sh and chmod a+x flask/mkflask.sh was
necessary, on 2.2.17. Maybe writing the makefile in such a way that they
don't need execute permission would be a nice idea. I know that this is
absolutely unnecessary cosmetics.
- On policy_parse.y yacc always choked on line 228. There were two consecutive
lines containing a single ';'. I guess it is due to some syntax error in my
/etc/security/*, or the m4 tricks.
- Why redhat? I think that giving the patches relative to the upstream source
would be a nicer solution. I am still wrestling with the userspace, maybe
I do not have some tools or something. Having a Makefile instead a (horror!)
csh script would greatly simplify the task. (Well, I have modified the script
for bash, because I don't have csh on my system, and can use set -e)

Now I am trying to apply my pet patcset to the thingie. It is lvm and reiserfs.
Both applies cleanly, but I guess there shall be done some coding to actually
use them. I have studied the ext2 patches, and I am reasonably sure that I know
what to do with reiserfs, but have a problem: in the reiser code there is no
reserved or otherwise unused space in the disk inode structure. I could not find
anything resembling to resource fork or space for acl either. Maybe having the
inode<->psid mapping in the special directory for filesystems without direct 
support would be a reasonable temporary solution.
For lvm, I don't have a clue as what to look for. I guess that standard 
capability checks would be sufficient. I either don't know if these are 
implemented in the lvm code. Anyone having more ideas than me?

I am also interested in the network code (but first I want to get to the
stage where I can boot the thingie). I hope that Zorp's mandatory access
control can be combined with this. Is the following is true?:
In the current implementation flask can label hosts based on their
claimed IP address, but cannot handle other multilevel hosts due to lack
of ipsec integration?

-- 
GNU GPL: csak tiszta forrásból
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions

[Stephen Smalley]

On Tue, 26 Dec 2000, Magosanyi Arpad wrote:

> Some irrelevant little notes:
> - chmod a+x flask/mkaccess_vector.sh and chmod a+x flask/mkflask.sh was
> necessary, on 2.2.17. Maybe writing the makefile in such a way that they
> don't need execute permission would be a nice idea. I know that this is
> absolutely unnecessary cosmetics.

Good point.  Yes, we can certainly change the flask Makefile to
avoid the need for explicit execute permission on these two scripts.

> - On policy_parse.y yacc always choked on line 228. There were two consecutive
> lines containing a single ';'. I guess it is due to some syntax error in my
> /etc/security/*, or the m4 tricks.

I don't see two consecutive lines with a single ';' in policy_parse.y on
line 228.  Can you provide more information?  An error from yacc on
the policy language grammar wouldn't have anything to do with the
/etc/security files or the policy configuration itself.  Also,
what platform are you using to build the system?

> - Why redhat? I think that giving the patches relative to the upstream source
> would be a nicer solution. I am still wrestling with the userspace, maybe
> I do not have some tools or something. Having a Makefile instead a (horror!)
> csh script would greatly simplify the task. (Well, I have modified the script
> for bash, because I don't have csh on my system, and can use set -e)

The kernel patches are based on the kernel.org sources.  Perhaps we could
provide patches relative to the upstream sources for the other packages
in the future.  However, the kernel security enhancements and the policy
configuration are the priorities of the project.  The utility
modifications serve to demonstrate the kernel features, but are not
fundamental to the system.  The current scripts for building and
installing are likely to be replaced by RPM specfiles.

> I have studied the ext2 patches, and I am reasonably sure that I know
> what to do with reiserfs, but have a problem: in the reiser code there is no
> reserved or otherwise unused space in the disk inode structure. I could not find
> anything resembling to resource fork or space for acl either. Maybe having the
> inode<->psid mapping in the special directory for filesystems without direct 
> support would be a reasonable temporary solution.

In the Flask research prototype, this approach was used for the
inode-to-psid mapping, since the file system mandatory access controls
were implemented as a wrapper layer around the OSKit file system COM
interfaces and did not have access to the low-level inode structures.  
So you could certainly use this approach.

> For lvm, I don't have a clue as what to look for. I guess that standard 
> capability checks would be sufficient. I either don't know if these are 
> implemented in the lvm code. Anyone having more ideas than me?

I haven't used LVM.  

> I am also interested in the network code (but first I want to get to the
> stage where I can boot the thingie). I hope that Zorp's mandatory access
> control can be combined with this. Is the following is true?:
> In the current implementation flask can label hosts based on their
> claimed IP address, but cannot handle other multilevel hosts due to lack
> of ipsec integration?

Currently, Security-Enhanced Linux labels received messages based on
the receiving network interface.  Security contexts are associated
with hosts (nodes) and used in certain permission checks, but
the host identity is not currently used in determining the message
label since it is unreliable.  The plan is to integrate IPSEC support
with the network mandatory access controls as was done in the
Flask research prototype and the DTOS research prototype.

--
Stephen D. Smalley, NAI Labs
sds@tislabs.com










You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: questions

[Stephen Smalley]

> > - On policy_parse.y yacc always choked on line 228. There were two consecutive
> > lines containing a single ';'. I guess it is due to some syntax error in my
> > /etc/security/*, or the m4 tricks.

I found the two consecutive semicolon lines at line 288.  I 
guess that "228" was just a typo.  You can simply remove
the extraneous semicolon.

--
Stephen D. Smalley, NAI Labs
sds@tislabs.com



You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

questions

[Chu, Hao-Hua]

Hi,

Here are my questions ....
1. How does the readahead work in page cache?  (file->raend, ralen, ramax,
rawin)
2. What kind of pages are in the lru_cache?  (via lru_cache_add())

Thanks.

Hao   

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux.eu.org/Linux-MM/

questions

[Ted Merrill]

First a general comment:

There were some good comments about board support packages in the
mail archive for this list.
Yes, i realize board support packages are a pain, however:
The linux kernel source is going to explode if it has to support 
directly all of the board variations that will have linux ports.
Statements like "switch(machine_type)" won't cut it.
A more achievable goal is to have the kernel support directly
all of the common cpu chips, bus controllers and the like,
and configure the kernel with a combination of ifs and #ifs controlled
by configuration variables of fairly fine grain, selectable by
a board support configuration file that lives at a distance from
the rest of the code.

Now for the specific question of interest to me:

For the sort of projects that my company is working on,
vxWorks is a better fit than Linux because we don't really need
separate process/kernel address spaces.
What we're doing on the main processor isn't really that complicated
but does require IP networking... thus vxWorks or Linux.
We can (i hope) put up with this unwanted feature of Linux 
in order to get the good stuff, principally the publicly developed
networking software and debugging tools.
I'm thinking the doable thing with Linux is to have only a single
process (filling in for the init process) with multiple threads.
Sounds like the "sash" program could be the beginning of the model for this.
The single process approach combined with static linking
blows away the whole problem of stripping down the C library to fit...
I was trying to make a list of processes running on my pc
that might be needed (and so would be a problem).
We won't have a local disk and we won't be serving very much
but we probably will want to serve both telnet (to a debugging shell, not sh)
and snmp for debug and management purposes, thus we may need inetd ...
this might be some amount of work to turn into library functions.
I'm pretty clueless how snmpd can be reasonably used in an embedded
system were some of the data is in a process and some in the kernel...
i'll have to read up more.
Can anyone share any experience with this?

Thanks
Ted Merrill
ArrayComm, Inc.


** Sent via the linuxppc-embedded mail list. See http://lists.linuxppc.org/