* [refpolicy] [PATCH] hadoop 1/10 -- unconfined
From: Paul Nuzzi @ 2010-10-07 16:35 UTC (permalink / raw)
To: refpolicy
In-Reply-To: <4CADDC29.6030606@gentoo.org>
On 10/07/2010 10:41 AM, Chris PeBenito wrote:
> On 10/05/10 15:59, Paul Nuzzi wrote:
>> On 10/04/2010 02:18 PM, Christopher J. PeBenito wrote:
>>> On 10/04/10 13:15, Paul Nuzzi wrote:
>>>> On 10/01/2010 01:56 PM, Christopher J. PeBenito wrote:
>>>>> On 10/01/10 11:17, Paul Nuzzi wrote:
>>>>>> On 10/01/2010 08:02 AM, Dominick Grift wrote:
>>>>>>> On Thu, Sep 30, 2010 at 03:39:40PM -0400, Paul Nuzzi wrote:
>>>>>>>> I updated the patch based on recommendations from the mailing list.
>>>>>>>> All of hadoop's services are included in one module instead of
>>>>>>>> individual ones. Unconfined and sysadm roles are given access to
>>>>>>>> hadoop and zookeeper client domain transitions. The services are started
>>>>>>>> using run_init. Let me know what you think.
>>>>>>>
>>>>>>> Why do some hadoop domain need to manage generic tmp?
>>>>>>>
>>>>>>> files_manage_generic_tmp_dirs(zookeeper_t)
>>>>>>> files_manage_generic_tmp_dirs(hadoop_t)
>>>>>>> files_manage_generic_tmp_dirs(hadoop_$1_initrc_t)
>>>>>>> files_manage_generic_tmp_files(hadoop_$1_initrc_t)
>>>>>>> files_manage_generic_tmp_files(hadoop_$1_t)
>>>>>>> files_manage_generic_tmp_dirs(hadoop_$1_t)
>>>>>>
>>>>>> This has to be done for Java JMX to work. All of the files are written to
>>>>>> /tmp/hsperfdata_(hadoop/zookeeper). /tmp/hsperfdata_ is labeled tmp_t while
>>>>>> all the files for each service are labeled with hadoop_*_tmp_t. The first service
>>>>>> will end up owning the directory if it is not labeled tmp_t.
>>>>>
>>>>> The hsperfdata dir in /tmp certainly the bane of policy writers. Based on a quick look through the policy, it looks like the only dir they create in /tmp is this hsperfdata dir. I suggest you do something like
>>>>>
>>>>> files_tmp_filetrans(hadoop_t, hadoop_hsperfdata_t, dir)
>>>>> files_tmp_filetrans(zookeeper_t, hadoop_hsperfdata_t, dir)
>>>>>
>>>>> filetrans_pattern(hadoop_t, hadoop_hsperfdata_t, hadoop_tmp_t, file)
>>>>> filetrans_pattern(zookeeper_t, hadoop_hsperfdata_t, zookeeper_tmp_t, file)
>>>>>
>>>>
>>>> That looks like a better way to handle the tmp_t problem.
>>>>
>>>> I changed the patch with your comments. Hopefully this will be one of the last updates.
>>>> Tested on a CDH3 cluster as a module without any problems.
>>>
>>> There are several little issues with style, but it'll be easier just to fix them when its committed.
>>>
>>> Other comments inline.
>>>
>>
>> I did my best locking down the ports hadoop uses. Unfortunately the services use high, randomized ports making
>> tcp_connect_generic_port a must have. Hopefully one day hadoop will settle on static ports. I added hadoop_datanode port 50010 since it is important to lock down that service. I changed the patch based on the rest of the comments.
>
> Merged. I've made several changes:
Thanks to everyone who helped get this merged.
>
> * a pass cleaning up the style.
> * adjusted some regular expressions in the file contexts: .* is the same as (.*)? since * means 0 or more matches.
> * renamed a few interfaces
> * two rules that I dropped as they require further explanation
>
>> +files_read_all_files(hadoop_t)
>
> A very big privilege.
"hadoop fs -put" takes any file you are allowed to access and puts it into the distributed file system.
> and
>
>> +fs_associate(hadoop_tasktracker_t)
This might not be needed.
> This is a domain, so the only files with this type should be the /proc/pid ones, which don't require associate permissions.
>
>
>> ---
>> policy/modules/kernel/corenetwork.te.in | 5
>> policy/modules/roles/sysadm.te | 8
>> policy/modules/services/hadoop.fc | 54 ++++
>> policy/modules/services/hadoop.if | 352 +++++++++++++++++++++++++++++
>> policy/modules/services/hadoop.te | 379 ++++++++++++++++++++++++++++++++
>> policy/modules/system/unconfined.te | 8
>> 6 files changed, 806 insertions(+)
>>
>> diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
>> index 2ecdde8..73163db 100644
>> --- a/policy/modules/kernel/corenetwork.te.in
>> +++ b/policy/modules/kernel/corenetwork.te.in
>> @@ -105,6 +105,8 @@ network_port(giftd, tcp,1213,s0)
>> network_port(git, tcp,9418,s0, udp,9418,s0)
>> network_port(gopher, tcp,70,s0, udp,70,s0)
>> network_port(gpsd, tcp,2947,s0)
>> +network_port(hadoop_datanode, tcp, 50010,s0)
>> +network_port(hadoop_namenode, tcp, 8020,s0)
>> network_port(hddtemp, tcp,7634,s0)
>> network_port(howl, tcp,5335,s0, udp,5353,s0)
>> network_port(hplip, tcp,1782,s0, tcp,2207,s0, tcp,2208,s0, tcp, 8290,s0, tcp,50000,s0, tcp,50002,s0, tcp,8292,s0, tcp,9100,s0, tcp,9101,s0, tcp,9102,s0, tcp,9220,s0, tcp,9221,s0, tcp,9222,s0, tcp,9280,s0, tcp,9281,s0, tcp,9282,s0, tcp,9290,s0, tcp,9291,s0, tcp,9292,s0)
>> @@ -211,6 +213,9 @@ network_port(xdmcp, udp,177,s0, tcp,177,s0)
>> network_port(xen, tcp,8002,s0)
>> network_port(xfs, tcp,7100,s0)
>> network_port(xserver, tcp,6000-6020,s0)
>> +network_port(zookeeper_client, tcp, 2181,s0)
>> +network_port(zookeeper_election, tcp, 3888,s0)
>> +network_port(zookeeper_leader, tcp, 2888,s0)
>> network_port(zebra, tcp,2600-2604,s0, tcp,2606,s0, udp,2600-2604,s0, udp,2606,s0)
>> network_port(zope, tcp,8021,s0)
>>
>> diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
>> index cad05ff..d2bc2b1 100644
>> --- a/policy/modules/roles/sysadm.te
>> +++ b/policy/modules/roles/sysadm.te
>> @@ -152,6 +152,10 @@ optional_policy(`
>> ')
>>
>> optional_policy(`
>> + hadoop_run(sysadm_t, sysadm_r)
>> +')
>> +
>> +optional_policy(`
>> # allow system administrator to use the ipsec script to look
>> # at things (e.g., ipsec auto --status)
>> # probably should create an ipsec_admin role for this kind of thing
>> @@ -392,6 +396,10 @@ optional_policy(`
>> yam_run(sysadm_t, sysadm_r)
>> ')
>>
>> +optional_policy(`
>> + hadoop_zookeeper_run_client(sysadm_t, sysadm_r)
>> +')
>> +
>> ifndef(`distro_redhat',`
>> optional_policy(`
>> auth_role(sysadm_r, sysadm_t)
>> diff --git a/policy/modules/services/hadoop.fc b/policy/modules/services/hadoop.fc
>> new file mode 100644
>> index 0000000..a09275d
>> --- /dev/null
>> +++ b/policy/modules/services/hadoop.fc
>> @@ -0,0 +1,54 @@
>> +/etc/hadoop.*(/.*)? gen_context(system_u:object_r:hadoop_etc_t,s0)
>> +
>> +/etc/rc\.d/init\.d/hadoop-(.*)?-datanode -- gen_context(system_u:object_r:hadoop_datanode_initrc_exec_t,s0)
>> +/etc/rc\.d/init\.d/hadoop-(.*)?-jobtracker -- gen_context(system_u:object_r:hadoop_jobtracker_initrc_exec_t,s0)
>> +/etc/rc\.d/init\.d/hadoop-(.*)?-namenode -- gen_context(system_u:object_r:hadoop_namenode_initrc_exec_t,s0)
>> +/etc/rc\.d/init\.d/hadoop-(.*)?-secondarynamenode -- gen_context(system_u:object_r:hadoop_secondarynamenode_initrc_exec_t,s0)
>> +/etc/rc\.d/init\.d/hadoop-(.*)?-tasktracker -- gen_context(system_u:object_r:hadoop_tasktracker_initrc_exec_t,s0)
>> +/etc/rc\.d/init\.d/hadoop-zookeeper -- gen_context(system_u:object_r:zookeeper_server_initrc_exec_t,s0)
>> +/etc/init\.d/hadoop-datanode -- gen_context(system_u:object_r:hadoop_datanode_initrc_exec_t,s0)
>> +/etc/init\.d/hadoop-jobtracker -- gen_context(system_u:object_r:hadoop_jobtracker_initrc_exec_t,s0)
>> +/etc/init\.d/hadoop-namenode -- gen_context(system_u:object_r:hadoop_namenode_initrc_exec_t,s0)
>> +/etc/init\.d/hadoop-secondarynamenode -- gen_context(system_u:object_r:hadoop_secondarynamenode_initrc_exec_t,s0)
>> +/etc/init\.d/hadoop-tasktracker -- gen_context(system_u:object_r:hadoop_tasktracker_initrc_exec_t,s0)
>> +/etc/init\.d/zookeeper -- gen_context(system_u:object_r:zookeeper_server_initrc_exec_t,s0)
>> +
>> +/etc/zookeeper(/.*)? gen_context(system_u:object_r:zookeeper_etc_t,s0)
>> +/etc/zookeeper\.dist(/.*)? gen_context(system_u:object_r:zookeeper_etc_t,s0)
>> +
>> +/usr/lib/hadoop(.*)?/bin/hadoop -- gen_context(system_u:object_r:hadoop_exec_t,s0)
>> +
>> +/usr/bin/zookeeper-client -- gen_context(system_u:object_r:zookeeper_exec_t,s0)
>> +/usr/bin/zookeeper-server -- gen_context(system_u:object_r:zookeeper_server_exec_t,s0)
>> +
>> +/var/zookeeper(/.*)? gen_context(system_u:object_r:zookeeper_server_var_t,s0)
>> +/var/lib/zookeeper(/.*)? gen_context(system_u:object_r:zookeeper_server_var_t,s0)
>> +
>> +/var/lib/hadoop(.*)? gen_context(system_u:object_r:hadoop_var_lib_t,s0)
>> +/var/lib/hadoop(.*)?/cache/hadoop/dfs/data(/.*)? gen_context(system_u:object_r:hadoop_datanode_var_lib_t,s0)
>> +/var/lib/hadoop(.*)?/cache/hadoop/dfs/name(/.*)? gen_context(system_u:object_r:hadoop_namenode_var_lib_t,s0)
>> +/var/lib/hadoop(.*)?/cache/hadoop/dfs/namesecondary(/.*)? gen_context(system_u:object_r:hadoop_secondarynamenode_var_lib_t,s0)
>> +/var/lib/hadoop(.*)?/cache/hadoop/mapred/local/jobTracker(/.*)? gen_context(system_u:object_r:hadoop_jobtracker_var_lib_t,s0)
>> +/var/lib/hadoop(.*)?/cache/hadoop/mapred/local/taskTracker(/.*)? gen_context(system_u:object_r:hadoop_tasktracker_var_lib_t,s0)
>> +
>> +/var/lock/subsys/hadoop-datanode -- gen_context(system_u:object_r:hadoop_datanode_lock_t,s0)
>> +/var/lock/subsys/hadoop-namenode -- gen_context(system_u:object_r:hadoop_namenode_lock_t,s0)
>> +/var/lock/subsys/hadoop-jobtracker -- gen_context(system_u:object_r:hadoop_jobtracker_lock_t,s0)
>> +/var/lock/subsys/hadoop-tasktracker -- gen_context(system_u:object_r:hadoop_tasktracker_lock_t,s0)
>> +/var/lock/subsys/hadoop-secondarynamenode -- gen_context(system_u:object_r:hadoop_secondarynamenode_lock_t,s0)
>> +
>> +/var/log/hadoop(.*)? gen_context(system_u:object_r:hadoop_log_t,s0)
>> +/var/log/hadoop(.*)?/hadoop-hadoop-datanode-(.*)? gen_context(system_u:object_r:hadoop_datanode_log_t,s0)
>> +/var/log/hadoop(.*)?/hadoop-hadoop-jobtracker-(.*)? gen_context(system_u:object_r:hadoop_jobtracker_log_t,s0)
>> +/var/log/hadoop(.*)?/hadoop-hadoop-namenode-(.*)? gen_context(system_u:object_r:hadoop_namenode_log_t,s0)
>> +/var/log/hadoop(.*)?/hadoop-hadoop-secondarynamenode-(.*)? gen_context(system_u:object_r:hadoop_secondarynamenode_log_t,s0)
>> +/var/log/hadoop(.*)?/hadoop-hadoop-tasktracker-(.*)? gen_context(system_u:object_r:hadoop_tasktracker_log_t,s0)
>> +/var/log/hadoop(.*)?/history(/.*)? gen_context(system_u:object_r:hadoop_jobtracker_log_t,s0)
>> +/var/log/zookeeper(/.*)? gen_context(system_u:object_r:zookeeper_log_t,s0)
>> +
>> +/var/run/hadoop(.*)? -d gen_context(system_u:object_r:hadoop_var_run_t,s0)
>> +/var/run/hadoop(.*)?/hadoop-hadoop-datanode\.pid -- gen_context(system_u:object_r:hadoop_datanode_initrc_var_run_t,s0)
>> +/var/run/hadoop(.*)?/hadoop-hadoop-namenode\.pid -- gen_context(system_u:object_r:hadoop_namenode_initrc_var_run_t,s0)
>> +/var/run/hadoop(.*)?/hadoop-hadoop-jobtracker\.pid -- gen_context(system_u:object_r:hadoop_jobtracker_initrc_var_run_t,s0)
>> +/var/run/hadoop(.*)?/hadoop-hadoop-tasktracker\.pid -- gen_context(system_u:object_r:hadoop_tasktracker_initrc_var_run_t,s0)
>> +/var/run/hadoop(.*)?/hadoop-hadoop-secondarynamenode\.pid -- gen_context(system_u:object_r:hadoop_secondarynamenode_initrc_var_run_t,s0)
>> diff --git a/policy/modules/services/hadoop.if b/policy/modules/services/hadoop.if
>> new file mode 100644
>> index 0000000..e919bcb
>> --- /dev/null
>> +++ b/policy/modules/services/hadoop.if
>> @@ -0,0 +1,352 @@
>> +##<summary>Software for reliable, scalable, distributed computing.</summary>
>> +
>> +#######################################
>> +##<summary>
>> +## The template to define a hadoop domain.
>> +##</summary>
>> +##<param name="domain_prefix">
>> +## <summary>
>> +## Domain prefix to be used.
>> +## </summary>
>> +##</param>
>> +#
>> +template(`hadoop_domain_template',`
>> + gen_require(`
>> + attribute hadoop_domain;
>> + type hadoop_log_t, hadoop_var_lib_t, hadoop_var_run_t;
>> + type hadoop_exec_t, hadoop_hsperfdata_t;
>> + ')
>> +
>> + ########################################
>> + #
>> + # Shared declarations.
>> + #
>> +
>> + type hadoop_$1_t, hadoop_domain;
>> + domain_type(hadoop_$1_t)
>> + domain_entry_file(hadoop_$1_t, hadoop_exec_t)
>> +
>> + type hadoop_$1_initrc_t;
>> + type hadoop_$1_initrc_exec_t;
>> + init_script_domain(hadoop_$1_initrc_t, hadoop_$1_initrc_exec_t)
>> +
>> + role system_r types { hadoop_$1_initrc_t hadoop_$1_t };
>> +
>> + type hadoop_$1_lock_t;
>> + files_lock_file(hadoop_$1_lock_t)
>> + files_lock_filetrans(hadoop_$1_initrc_t, hadoop_$1_lock_t, file)
>> +
>> + type hadoop_$1_log_t;
>> + logging_log_file(hadoop_$1_log_t)
>> + filetrans_pattern(hadoop_$1_initrc_t, hadoop_log_t, hadoop_$1_log_t, {dir file})
>> + filetrans_pattern(hadoop_$1_t, hadoop_log_t, hadoop_$1_log_t, {dir file})
>> +
>> + type hadoop_$1_var_lib_t;
>> + files_type(hadoop_$1_var_lib_t)
>> + filetrans_pattern(hadoop_$1_t, hadoop_var_lib_t, hadoop_$1_var_lib_t, file)
>> +
>> + type hadoop_$1_initrc_var_run_t;
>> + files_pid_file(hadoop_$1_initrc_var_run_t)
>> + filetrans_pattern(hadoop_$1_initrc_t, hadoop_var_run_t, hadoop_$1_initrc_var_run_t, file)
>> +
>> + type hadoop_$1_tmp_t;
>> + files_tmp_file(hadoop_$1_tmp_t)
>> + files_tmp_filetrans(hadoop_$1_t, hadoop_hsperfdata_t, dir)
>> + filetrans_pattern(hadoop_$1_t, hadoop_hsperfdata_t, hadoop_$1_tmp_t, file)
>> +
>> + ####################################
>> + #
>> + # Shared hadoop_$1 initrc policy.
>> + #
>> +
>> + allow hadoop_$1_initrc_t hadoop_$1_t:process { signal signull };
>> + allow hadoop_$1_initrc_t self:capability { setuid setgid };
>> + allow hadoop_$1_initrc_t self:fifo_file rw_fifo_file_perms;
>> + allow hadoop_$1_initrc_t self:process setsched;
>> +
>> + consoletype_exec(hadoop_$1_initrc_t)
>> + corecmd_exec_bin(hadoop_$1_initrc_t)
>> + corecmd_exec_shell(hadoop_$1_initrc_t)
>> +
>> + domtrans_pattern(hadoop_$1_initrc_t, hadoop_exec_t, hadoop_$1_t)
>> + dontaudit hadoop_$1_initrc_t self:capability sys_tty_config;
>> +
>> + files_read_etc_files(hadoop_$1_initrc_t)
>> + files_read_usr_files(hadoop_$1_initrc_t)
>> + files_search_pids(hadoop_$1_initrc_t)
>> + files_search_locks(hadoop_$1_initrc_t)
>> + fs_getattr_xattr_fs(hadoop_$1_initrc_t)
>> +
>> + hadoop_exec_config_files(hadoop_$1_initrc_t)
>> +
>> + init_rw_utmp(hadoop_$1_initrc_t)
>> + init_use_script_ptys(hadoop_$1_initrc_t)
>> +
>> + kernel_read_kernel_sysctls(hadoop_$1_initrc_t)
>> + kernel_read_sysctl(hadoop_$1_initrc_t)
>> + kernel_read_system_state(hadoop_$1_initrc_t)
>> +
>> + logging_send_syslog_msg(hadoop_$1_initrc_t)
>> + logging_send_audit_msgs(hadoop_$1_initrc_t)
>> + logging_search_logs(hadoop_$1_initrc_t)
>> +
>> + manage_files_pattern(hadoop_$1_initrc_t, hadoop_$1_lock_t, hadoop_$1_lock_t)
>> + manage_files_pattern(hadoop_$1_initrc_t, hadoop_$1_initrc_var_run_t, hadoop_$1_initrc_var_run_t)
>> + manage_files_pattern(hadoop_$1_initrc_t, hadoop_$1_log_t, hadoop_$1_log_t)
>> + manage_dirs_pattern(hadoop_$1_initrc_t, hadoop_var_run_t, hadoop_var_run_t)
>> + manage_files_pattern(hadoop_$1_initrc_t, hadoop_var_run_t, hadoop_var_run_t)
>> +
>> + miscfiles_read_localization(hadoop_$1_initrc_t)
>> +
>> + optional_policy(`
>> + nscd_socket_use(hadoop_$1_initrc_t)
>> + ')
>> +
>> + term_use_generic_ptys(hadoop_$1_initrc_t)
>> +
>> + userdom_dontaudit_search_user_home_dirs(hadoop_$1_initrc_t)
>> +
>> + ####################################
>> + #
>> + # Shared hadoop_$1 policy.
>> + #
>> +
>> + allow hadoop_$1_t hadoop_domain:process signull;
>> + allow hadoop_$1_t self:fifo_file rw_fifo_file_perms;
>> + allow hadoop_$1_t self:process execmem;
>> + allow hadoop_$1_t hadoop_var_run_t:dir getattr;
>> +
>> + corecmd_exec_bin(hadoop_$1_t)
>> + corecmd_exec_shell(hadoop_$1_t)
>> +
>> + dev_read_rand(hadoop_$1_t)
>> + dev_read_urand(hadoop_$1_t)
>> + dev_read_sysfs(hadoop_$1_t)
>> + dontaudit hadoop_$1_t self:netlink_route_socket rw_netlink_socket_perms;
>> +
>> + files_read_etc_files(hadoop_$1_t)
>> + files_search_pids(hadoop_$1_t)
>> + files_search_var_lib(hadoop_$1_t)
>> +
>> + hadoop_exec_config_files(hadoop_$1_t)
>> +
>> + java_exec(hadoop_$1_t)
>> +
>> + kernel_read_network_state(hadoop_$1_t)
>> + kernel_read_system_state(hadoop_$1_t)
>> +
>> + logging_search_logs(hadoop_$1_t)
>> +
>> + manage_dirs_pattern(hadoop_$1_t, hadoop_$1_var_lib_t, hadoop_$1_var_lib_t)
>> + manage_dirs_pattern(hadoop_$1_t, hadoop_hsperfdata_t, hadoop_hsperfdata_t)
>> + manage_files_pattern(hadoop_$1_t, hadoop_$1_log_t, hadoop_$1_log_t)
>> + manage_files_pattern(hadoop_$1_t, hadoop_$1_var_lib_t, hadoop_$1_var_lib_t)
>> + manage_files_pattern(hadoop_$1_t, hadoop_$1_tmp_t, hadoop_$1_tmp_t)
>> + miscfiles_read_localization(hadoop_$1_t)
>> +
>> + optional_policy(`
>> + nscd_socket_use(hadoop_$1_t)
>> + ')
>> +
>> + sysnet_read_config(hadoop_$1_t)
>> +
>> + allow hadoop_$1_t self:tcp_socket create_stream_socket_perms;
>> + corenet_all_recvfrom_unlabeled(hadoop_$1_t)
>> + corenet_all_recvfrom_netlabel(hadoop_$1_t)
>> + corenet_tcp_bind_all_nodes(hadoop_$1_t)
>> + corenet_tcp_sendrecv_generic_if(hadoop_$1_t)
>> + corenet_tcp_sendrecv_generic_node(hadoop_$1_t)
>> + corenet_tcp_sendrecv_all_ports(hadoop_$1_t)
>> + # Hadoop uses high ordered random ports for services
>> + # If permanent ports are chosen, remove line below and lock down
>> + corenet_tcp_connect_generic_port(hadoop_$1_t)
>> +
>> + allow hadoop_$1_t self:udp_socket create_socket_perms;
>> + corenet_udp_sendrecv_generic_if(hadoop_$1_t)
>> + corenet_udp_sendrecv_all_nodes(hadoop_$1_t)
>> + corenet_udp_bind_all_nodes(hadoop_$1_t)
>> +')
>> +
>> +########################################
>> +##<summary>
>> +## Execute hadoop in the
>> +## hadoop domain.
>> +##</summary>
>> +##<param name="domain">
>> +## <summary>
>> +## Domain allowed to transition.
>> +## </summary>
>> +##</param>
>> +#
>> +interface(`hadoop_domtrans',`
>> + gen_require(`
>> + type hadoop_t, hadoop_exec_t;
>> + ')
>> +
>> + files_search_usr($1)
>> + libs_search_lib($1)
>> + domtrans_pattern($1, hadoop_exec_t, hadoop_t)
>> +')
>> +
>> +########################################
>> +##<summary>
>> +## Execute hadoop in the hadoop domain,
>> +## and allow the specified role the
>> +## hadoop domain.
>> +##</summary>
>> +##<param name="domain">
>> +## <summary>
>> +## Domain allowed to transition.
>> +## </summary>
>> +##</param>
>> +##<param name="role">
>> +## <summary>
>> +## Role allowed access.
>> +## </summary>
>> +##</param>
>> +##<rolecap/>
>> +#
>> +interface(`hadoop_run',`
>> + gen_require(`
>> + type hadoop_t;
>> + ')
>> +
>> + hadoop_domtrans($1)
>> + role $2 types hadoop_t;
>> +
>> + allow $1 hadoop_t:process { ptrace signal_perms };
>> + ps_process_pattern($1, hadoop_t)
>> +')
>> +
>> +########################################
>> +##<summary>
>> +## Execute zookeeper client in the
>> +## zookeeper client domain.
>> +##</summary>
>> +##<param name="domain">
>> +## <summary>
>> +## Domain allowed to transition.
>> +## </summary>
>> +##</param>
>> +#
>> +interface(`hadoop_domtrans_zookeeper_client',`
>> + gen_require(`
>> + type zookeeper_t, zookeeper_exec_t;
>> + ')
>> +
>> + corecmd_search_bin($1)
>> + files_search_usr($1)
>> + domtrans_pattern($1, zookeeper_exec_t, zookeeper_t)
>> +')
>> +
>> +########################################
>> +##<summary>
>> +## Execute zookeeper server in the
>> +## zookeeper server domain.
>> +##</summary>
>> +##<param name="domain">
>> +## <summary>
>> +## Domain allowed to transition.
>> +## </summary>
>> +##</param>
>> +#
>> +interface(`hadoop_domtrans_zookeeper_server',`
>> + gen_require(`
>> + type zookeeper_server_t, zookeeper_server_exec_t;
>> + ')
>> +
>> + corecmd_search_bin($1)
>> + files_search_usr($1)
>> + domtrans_pattern($1, zookeeper_server_exec_t, zookeeper_server_t)
>> +')
>> +
>> +########################################
>> +##<summary>
>> +## Execute zookeeper server in the
>> +## zookeeper domain.
>> +##</summary>
>> +##<param name="domain">
>> +## <summary>
>> +## Domain allowed to transition.
>> +## </summary>
>> +##</param>
>> +#
>> +interface(`hadoop_zookeeper_initrc_domtrans_server',`
>> + gen_require(`
>> + type zookeeper_server_initrc_exec_t;
>> + ')
>> +
>> + init_labeled_script_domtrans($1, zookeeper_server_initrc_exec_t)
>> +')
>> +
>> +########################################
>> +##<summary>
>> +## Execute zookeeper client in the
>> +## zookeeper client domain, and allow the
>> +## specified role the zookeeper client domain.
>> +##</summary>
>> +##<param name="domain">
>> +## <summary>
>> +## Domain allowed to transition.
>> +## </summary>
>> +##</param>
>> +##<param name="role">
>> +## <summary>
>> +## Role allowed access.
>> +## </summary>
>> +##</param>
>> +##<rolecap/>
>> +#
>> +interface(`hadoop_zookeeper_run_client',`
>> + gen_require(`
>> + type zookeeper_t;
>> + ')
>> +
>> + hadoop_domtrans_zookeeper_client($1)
>> + role $2 types zookeeper_t;
>> +
>> + allow $1 zookeeper_t:process { ptrace signal_perms };
>> + ps_process_pattern($1, zookeeper_t)
>> +')
>> +
>> +########################################
>> +##<summary>
>> +## Give permission to a domain to read
>> +## hadoop_etc_t
>> +##</summary>
>> +##<param name="domain">
>> +##<summary>
>> +## Domain needing read permission
>> +##</summary>
>> +##</param>
>> +#
>> +interface(`hadoop_read_config_files', `
>> + gen_require(`
>> + type hadoop_etc_t;
>> + ')
>> +
>> + allow $1 hadoop_etc_t:dir search_dir_perms;
>> + allow $1 hadoop_etc_t:lnk_file { read getattr };
>> + allow $1 hadoop_etc_t:file read_file_perms;
>> +')
>> +
>> +########################################
>> +##<summary>
>> +## Give permission to a domain to
>> +## execute hadoop_etc_t
>> +##</summary>
>> +##<param name="domain">
>> +##<summary>
>> +## Domain needing read and execute
>> +## permission
>> +##</summary>
>> +##</param>
>> +#
>> +interface(`hadoop_exec_config_files', `
>> + gen_require(`
>> + type hadoop_etc_t;
>> + ')
>> +
>> + hadoop_read_config_files($1)
>> + allow $1 hadoop_etc_t:file { execute execute_no_trans};
>> +')
>> diff --git a/policy/modules/services/hadoop.te b/policy/modules/services/hadoop.te
>> new file mode 100644
>> index 0000000..587c393
>> --- /dev/null
>> +++ b/policy/modules/services/hadoop.te
>> @@ -0,0 +1,379 @@
>> +policy_module(hadoop, 1.0.0)
>> +
>> +########################################
>> +#
>> +# Hadoop declarations.
>> +#
>> +
>> +attribute hadoop_domain;
>> +
>> +type hadoop_t;
>> +type hadoop_exec_t;
>> +application_domain(hadoop_t, hadoop_exec_t)
>> +ubac_constrained(hadoop_t)
>> +
>> +type hadoop_etc_t;
>> +files_config_file(hadoop_etc_t)
>> +
>> +type hadoop_var_lib_t;
>> +files_type(hadoop_var_lib_t)
>> +
>> +type hadoop_log_t;
>> +logging_log_file(hadoop_log_t)
>> +
>> +type hadoop_var_run_t;
>> +files_pid_file(hadoop_var_run_t)
>> +
>> +type hadoop_tmp_t;
>> +files_tmp_file(hadoop_tmp_t)
>> +ubac_constrained(hadoop_tmp_t)
>> +
>> +type hadoop_hsperfdata_t;
>> +files_tmp_file(hadoop_hsperfdata_t)
>> +ubac_constrained(hadoop_hsperfdata_t)
>> +
>> +hadoop_domain_template(datanode)
>> +hadoop_domain_template(jobtracker)
>> +hadoop_domain_template(namenode)
>> +hadoop_domain_template(secondarynamenode)
>> +hadoop_domain_template(tasktracker)
>> +
>> +########################################
>> +#
>> +# Hadoop zookeeper client declarations.
>> +#
>> +
>> +type zookeeper_t;
>> +type zookeeper_exec_t;
>> +application_domain(zookeeper_t, zookeeper_exec_t)
>> +ubac_constrained(zookeeper_t)
>> +
>> +type zookeeper_etc_t;
>> +files_config_file(zookeeper_etc_t)
>> +
>> +type zookeeper_log_t;
>> +logging_log_file(zookeeper_log_t)
>> +
>> +type zookeeper_tmp_t;
>> +files_tmp_file(zookeeper_tmp_t)
>> +ubac_constrained(zookeeper_tmp_t)
>> +
>> +########################################
>> +#
>> +# Hadoop zookeeper server declarations.
>> +#
>> +
>> +type zookeeper_server_t;
>> +type zookeeper_server_exec_t;
>> +init_daemon_domain(zookeeper_server_t, zookeeper_server_exec_t)
>> +
>> +type zookeeper_server_initrc_exec_t;
>> +init_script_file(zookeeper_server_initrc_exec_t)
>> +
>> +type zookeeper_server_var_t;
>> +files_type(zookeeper_server_var_t)
>> +
>> +# This will need a file context specification.
>> +type zookeeper_server_var_run_t;
>> +files_pid_file(zookeeper_server_var_run_t)
>> +
>> +type zookeeper_server_tmp_t;
>> +files_tmp_file(zookeeper_server_tmp_t)
>> +
>> +########################################
>> +#
>> +# Hadoop policy.
>> +#
>> +
>> +allow hadoop_t self:capability sys_resource;
>> +allow hadoop_t self:process { getsched setsched signal signull setrlimit execmem };
>> +allow hadoop_t self:fifo_file rw_fifo_file_perms;
>> +allow hadoop_t self:key write;
>> +allow hadoop_t self:tcp_socket create_stream_socket_perms;
>> +allow hadoop_t self:udp_socket create_socket_perms;
>> +allow hadoop_t hadoop_domain:process signull;
>> +
>> +dontaudit hadoop_t self:netlink_route_socket rw_netlink_socket_perms;
>> +
>> +read_files_pattern(hadoop_t, hadoop_etc_t, hadoop_etc_t)
>> +read_lnk_files_pattern(hadoop_t, hadoop_etc_t, hadoop_etc_t)
>> +can_exec(hadoop_t, hadoop_etc_t)
>> +
>> +manage_dirs_pattern(hadoop_t, hadoop_var_lib_t, hadoop_var_lib_t)
>> +manage_dirs_pattern(hadoop_t, hadoop_log_t, hadoop_log_t)
>> +manage_dirs_pattern(hadoop_t, hadoop_tmp_t, hadoop_tmp_t)
>> +manage_dirs_pattern(hadoop_t, hadoop_hsperfdata_t, hadoop_hsperfdata_t)
>> +manage_files_pattern(hadoop_t, hadoop_var_lib_t, hadoop_var_lib_t)
>> +manage_files_pattern(hadoop_t, hadoop_tmp_t, hadoop_tmp_t)
>> +
>> +getattr_dirs_pattern(hadoop_t, hadoop_var_run_t, hadoop_var_run_t)
>> +
>> +files_tmp_filetrans(hadoop_t, hadoop_hsperfdata_t, dir)
>> +filetrans_pattern(hadoop_t, hadoop_hsperfdata_t, hadoop_tmp_t, file)
>> +
>> +kernel_read_network_state(hadoop_t)
>> +kernel_read_system_state(hadoop_t)
>> +
>> +corecmd_exec_bin(hadoop_t)
>> +corecmd_exec_shell(hadoop_t)
>> +
>> +corenet_all_recvfrom_unlabeled(hadoop_t)
>> +corenet_all_recvfrom_netlabel(hadoop_t)
>> +corenet_sendrecv_hadoop_namenode_client_packets(hadoop_t)
>> +corenet_sendrecv_portmap_client_packets(hadoop_t)
>> +corenet_sendrecv_zope_client_packets(hadoop_t)
>> +corenet_tcp_bind_all_nodes(hadoop_t)
>> +corenet_tcp_connect_hadoop_namenode_port(hadoop_t)
>> +corenet_tcp_connect_hadoop_datanode_port(hadoop_t)
>> +corenet_tcp_connect_portmap_port(hadoop_t)
>> +corenet_tcp_connect_zope_port(hadoop_t)
>> +corenet_tcp_sendrecv_all_nodes(hadoop_t)
>> +corenet_tcp_sendrecv_all_ports(hadoop_t)
>> +corenet_tcp_sendrecv_generic_if(hadoop_t)
>> +# Hadoop uses high ordered random ports for services
>> +# If permanent ports are chosen, remove line below and lock down
>> +corenet_tcp_connect_generic_port(hadoop_t)
>> +corenet_udp_bind_all_nodes(hadoop_t)
>> +corenet_udp_sendrecv_all_nodes(hadoop_t)
>> +corenet_udp_sendrecv_all_ports(hadoop_t)
>> +corenet_udp_sendrecv_generic_if(hadoop_t)
>> +
>> +dev_read_rand(hadoop_t)
>> +dev_read_sysfs(hadoop_t)
>> +dev_read_urand(hadoop_t)
>> +
>> +files_dontaudit_search_spool(hadoop_t)
>> +files_read_usr_files(hadoop_t)
>> +files_read_all_files(hadoop_t)
>> +
>> +fs_getattr_xattr_fs(hadoop_t)
>> +
>> +java_exec(hadoop_t)
>> +
>> +miscfiles_read_localization(hadoop_t)
>> +
>> +userdom_dontaudit_search_user_home_dirs(hadoop_t)
>> +userdom_use_user_terminals(hadoop_t)
>> +
>> +optional_policy(`
>> + nis_use_ypbind(hadoop_t)
>> +')
>> +
>> +optional_policy(`
>> + nscd_socket_use(hadoop_t)
>> +')
>> +
>> +########################################
>> +#
>> +# Hadoop datanode policy.
>> +#
>> +
>> +allow hadoop_datanode_t self:process signal;
>> +corenet_tcp_bind_hadoop_datanode_port(hadoop_datanode_t)
>> +corenet_tcp_connect_hadoop_datanode_port(hadoop_datanode_t)
>> +corenet_tcp_connect_hadoop_namenode_port(hadoop_datanode_t)
>> +fs_getattr_xattr_fs(hadoop_datanode_t)
>> +manage_dirs_pattern(hadoop_datanode_t, hadoop_var_lib_t, hadoop_var_lib_t)
>> +
>> +########################################
>> +#
>> +# Hadoop jobtracker policy.
>> +#
>> +
>> +corenet_tcp_bind_zope_port(hadoop_jobtracker_t)
>> +corenet_tcp_connect_hadoop_datanode_port(hadoop_jobtracker_t)
>> +corenet_tcp_connect_hadoop_namenode_port(hadoop_jobtracker_t)
>> +create_dirs_pattern(hadoop_jobtracker_t, hadoop_jobtracker_log_t, hadoop_jobtracker_log_t)
>> +manage_dirs_pattern(hadoop_jobtracker_t, hadoop_var_lib_t, hadoop_var_lib_t)
>> +setattr_dirs_pattern(hadoop_jobtracker_t, hadoop_jobtracker_log_t, hadoop_jobtracker_log_t)
>> +
>> +########################################
>> +#
>> +# Hadoop namenode policy.
>> +#
>> +
>> +corenet_tcp_bind_hadoop_namenode_port(hadoop_namenode_t)
>> +corenet_tcp_connect_hadoop_namenode_port(hadoop_namenode_t)
>> +manage_dirs_pattern(hadoop_namenode_t, hadoop_var_lib_t, hadoop_var_lib_t)
>> +manage_files_pattern(hadoop_namenode_t, hadoop_var_lib_t, hadoop_var_lib_t)
>> +
>> +########################################
>> +#
>> +# Hadoop secondary namenode policy.
>> +#
>> +
>> +corenet_tcp_connect_hadoop_namenode_port(hadoop_secondarynamenode_t)
>> +manage_dirs_pattern(hadoop_secondarynamenode_t, hadoop_var_lib_t, hadoop_var_lib_t)
>> +
>> +########################################
>> +#
>> +# Hadoop tasktracker policy.
>> +#
>> +
>> +allow hadoop_tasktracker_t self:process signal;
>> +
>> +corenet_tcp_connect_hadoop_datanode_port(hadoop_tasktracker_t)
>> +corenet_tcp_connect_hadoop_namenode_port(hadoop_tasktracker_t)
>> +corenet_tcp_connect_zope_port(hadoop_tasktracker_t)
>> +
>> +filetrans_pattern(hadoop_tasktracker_t, hadoop_log_t, hadoop_tasktracker_log_t, dir)
>> +fs_associate(hadoop_tasktracker_t)
>> +fs_getattr_xattr_fs(hadoop_tasktracker_t)
>> +
>> +manage_dirs_pattern(hadoop_tasktracker_t, hadoop_var_lib_t, hadoop_var_lib_t)
>> +manage_dirs_pattern(hadoop_tasktracker_t, hadoop_tasktracker_log_t, hadoop_tasktracker_log_t);
>> +
>> +########################################
>> +#
>> +# Hadoop zookeeper client policy.
>> +#
>> +
>> +allow zookeeper_t self:process { getsched sigkill signal signull execmem };
>> +allow zookeeper_t self:fifo_file rw_fifo_file_perms;
>> +allow zookeeper_t self:tcp_socket create_stream_socket_perms;
>> +allow zookeeper_t self:udp_socket create_socket_perms;
>> +allow zookeeper_t zookeeper_server_t:process signull;
>> +
>> +read_files_pattern(zookeeper_t, zookeeper_etc_t, zookeeper_etc_t)
>> +read_lnk_files_pattern(zookeeper_t, zookeeper_etc_t, zookeeper_etc_t)
>> +
>> +setattr_dirs_pattern(zookeeper_t, zookeeper_log_t, zookeeper_log_t)
>> +append_files_pattern(zookeeper_t, zookeeper_log_t, zookeeper_log_t)
>> +create_files_pattern(zookeeper_t, zookeeper_log_t, zookeeper_log_t)
>> +read_files_pattern(zookeeper_t, zookeeper_log_t, zookeeper_log_t)
>> +setattr_files_pattern(zookeeper_t, zookeeper_log_t, zookeeper_log_t)
>> +logging_log_filetrans(zookeeper_t, zookeeper_log_t, file)
>> +
>> +manage_dirs_pattern(zookeeper_t, hadoop_hsperfdata_t, hadoop_hsperfdata_t)
>> +manage_files_pattern(zookeeper_t, zookeeper_tmp_t, zookeeper_tmp_t)
>> +files_tmp_filetrans(zookeeper_t, hadoop_hsperfdata_t, dir)
>> +filetrans_pattern(zookeeper_t, hadoop_hsperfdata_t, zookeeper_tmp_t, file)
>> +
>> +can_exec(zookeeper_t, zookeeper_exec_t)
>> +
>> +kernel_read_network_state(zookeeper_t)
>> +kernel_read_system_state(zookeeper_t)
>> +
>> +corecmd_exec_bin(zookeeper_t)
>> +corecmd_exec_shell(zookeeper_t)
>> +
>> +dontaudit zookeeper_t self:netlink_route_socket rw_netlink_socket_perms;
>> +
>> +corenet_all_recvfrom_unlabeled(zookeeper_t)
>> +corenet_all_recvfrom_netlabel(zookeeper_t)
>> +corenet_sendrecv_zookeeper_client_client_packets(zookeeper_t)
>> +corenet_tcp_bind_all_nodes(zookeeper_t)
>> +corenet_tcp_connect_zookeeper_client_port(zookeeper_t)
>> +corenet_tcp_sendrecv_all_nodes(zookeeper_t)
>> +corenet_tcp_sendrecv_all_ports(zookeeper_t)
>> +corenet_tcp_sendrecv_generic_if(zookeeper_t)
>> +# Hadoop uses high ordered random ports for services
>> +# If permanent ports are chosen, remove line below and lock down
>> +corenet_tcp_connect_generic_port(zookeeper_t)
>> +corenet_udp_bind_all_nodes(zookeeper_t)
>> +corenet_udp_sendrecv_all_nodes(zookeeper_t)
>> +corenet_udp_sendrecv_all_ports(zookeeper_t)
>> +corenet_udp_sendrecv_generic_if(zookeeper_t)
>> +
>> +dev_read_rand(zookeeper_t)
>> +dev_read_sysfs(zookeeper_t)
>> +dev_read_urand(zookeeper_t)
>> +
>> +files_read_etc_files(zookeeper_t)
>> +files_read_usr_files(zookeeper_t)
>> +
>> +miscfiles_read_localization(zookeeper_t)
>> +
>> +sysnet_read_config(zookeeper_t)
>> +
>> +userdom_dontaudit_search_user_home_dirs(zookeeper_t)
>> +userdom_use_user_terminals(zookeeper_t)
>> +
>> +java_exec(zookeeper_t)
>> +
>> +optional_policy(`
>> + nscd_socket_use(zookeeper_t)
>> +')
>> +
>> +########################################
>> +#
>> +# Hadoop zookeeper server policy.
>> +#
>> +
>> +allow zookeeper_server_t self:capability kill;
>> +allow zookeeper_server_t self:process { execmem getsched sigkill signal signull };
>> +allow zookeeper_server_t self:fifo_file rw_fifo_file_perms;
>> +allow zookeeper_server_t self:netlink_route_socket rw_netlink_socket_perms;
>> +allow zookeeper_server_t self:tcp_socket create_stream_socket_perms;
>> +allow zookeeper_server_t self:udp_socket create_socket_perms;
>> +
>> +read_files_pattern(zookeeper_server_t, zookeeper_etc_t, zookeeper_etc_t)
>> +read_lnk_files_pattern(zookeeper_server_t, zookeeper_etc_t, zookeeper_etc_t)
>> +
>> +manage_dirs_pattern(zookeeper_server_t, zookeeper_server_var_t, zookeeper_server_var_t)
>> +manage_files_pattern(zookeeper_server_t, zookeeper_server_var_t, zookeeper_server_var_t)
>> +files_var_lib_filetrans(zookeeper_server_t, zookeeper_server_var_t, { dir file })
>> +
>> +setattr_dirs_pattern(zookeeper_server_t, zookeeper_log_t, zookeeper_log_t)
>> +append_files_pattern(zookeeper_server_t, zookeeper_log_t, zookeeper_log_t)
>> +create_files_pattern(zookeeper_server_t, zookeeper_log_t, zookeeper_log_t)
>> +read_files_pattern(zookeeper_server_t, zookeeper_log_t, zookeeper_log_t)
>> +setattr_files_pattern(zookeeper_server_t, zookeeper_log_t, zookeeper_log_t)
>> +logging_log_filetrans(zookeeper_server_t, zookeeper_log_t, file)
>> +
>> +manage_files_pattern(zookeeper_server_t, zookeeper_server_var_run_t, zookeeper_server_var_run_t)
>> +files_pid_filetrans(zookeeper_server_t, zookeeper_server_var_run_t, file)
>> +
>> +manage_dirs_pattern(zookeeper_server_t, hadoop_hsperfdata_t, hadoop_hsperfdata_t)
>> +manage_files_pattern(zookeeper_server_t, zookeeper_server_tmp_t, zookeeper_server_tmp_t)
>> +files_tmp_filetrans(zookeeper_server_t, hadoop_hsperfdata_t, dir)
>> +filetrans_pattern(zookeeper_server_t, hadoop_hsperfdata_t, zookeeper_server_tmp_t, file)
>> +
>> +can_exec(zookeeper_server_t, zookeeper_server_exec_t)
>> +
>> +kernel_read_network_state(zookeeper_server_t)
>> +kernel_read_system_state(zookeeper_server_t)
>> +
>> +corecmd_exec_bin(zookeeper_server_t)
>> +corecmd_exec_shell(zookeeper_server_t)
>> +
>> +corenet_all_recvfrom_unlabeled(zookeeper_server_t)
>> +corenet_all_recvfrom_netlabel(zookeeper_server_t)
>> +corenet_sendrecv_zookeeper_election_client_packets(zookeeper_server_t)
>> +corenet_sendrecv_zookeeper_leader_client_packets(zookeeper_server_t)
>> +corenet_sendrecv_zookeeper_client_server_packets(zookeeper_server_t)
>> +corenet_sendrecv_zookeeper_election_server_packets(zookeeper_server_t)
>> +corenet_sendrecv_zookeeper_leader_server_packets(zookeeper_server_t)
>> +corenet_tcp_bind_all_nodes(zookeeper_server_t)
>> +corenet_tcp_bind_zookeeper_client_port(zookeeper_server_t)
>> +corenet_tcp_bind_zookeeper_election_port(zookeeper_server_t)
>> +corenet_tcp_bind_zookeeper_leader_port(zookeeper_server_t)
>> +corenet_tcp_connect_zookeeper_election_port(zookeeper_server_t)
>> +corenet_tcp_connect_zookeeper_leader_port(zookeeper_server_t)
>> +corenet_tcp_sendrecv_generic_if(zookeeper_server_t)
>> +corenet_tcp_sendrecv_generic_node(zookeeper_server_t)
>> +corenet_tcp_sendrecv_all_ports(zookeeper_server_t)
>> +# Hadoop uses high ordered random ports for services
>> +# If permanent ports are chosen, remove line below and lock down
>> +corenet_tcp_connect_generic_port(zookeeper_server_t)
>> +corenet_udp_sendrecv_generic_if(zookeeper_server_t)
>> +corenet_udp_sendrecv_all_nodes(zookeeper_server_t)
>> +corenet_udp_sendrecv_all_ports(zookeeper_server_t)
>> +corenet_udp_bind_all_nodes(zookeeper_server_t)
>> +
>> +dev_read_rand(zookeeper_server_t)
>> +dev_read_sysfs(zookeeper_server_t)
>> +dev_read_urand(zookeeper_server_t)
>> +
>> +files_read_etc_files(zookeeper_server_t)
>> +files_read_usr_files(zookeeper_server_t)
>> +
>> +fs_getattr_xattr_fs(zookeeper_server_t)
>> +
>> +logging_send_syslog_msg(zookeeper_server_t)
>> +
>> +miscfiles_read_localization(zookeeper_server_t)
>> +
>> +sysnet_read_config(zookeeper_server_t)
>> +
>> +java_exec(zookeeper_server_t)
>> diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
>> index f976344..f1e6c9f 100644
>> --- a/policy/modules/system/unconfined.te
>> +++ b/policy/modules/system/unconfined.te
>> @@ -118,6 +118,10 @@ optional_policy(`
>> ')
>>
>> optional_policy(`
>> + hadoop_run(unconfined_t, unconfined_r)
>> +')
>> +
>> +optional_policy(`
>> inn_domtrans(unconfined_t)
>> ')
>>
>> @@ -210,6 +214,10 @@ optional_policy(`
>> xserver_domtrans(unconfined_t)
>> ')
>>
>> +optional_policy(`
>> + hadoop_zookeeper_run_client(unconfined_t, unconfined_r)
>> +')
>> +
>> ########################################
>> #
>> # Unconfined Execmem Local policy
>
>
^ permalink raw reply
* Re: RFC: btusb firmware load help
From: Bala Shanmugam @ 2010-10-07 16:35 UTC (permalink / raw)
To: Marcel Holtmann
Cc: Shanmugamkamatchi Balashanmugam, Luis Rodriguez, Johannes Berg,
linux-bluetooth, linux-kernel@vger.kernel.org,
linux-wireless@vger.kernel.org, Deepak Dhamdhere, Sree Durbha
In-Reply-To: <1286465072.6145.151.camel@aeonflux>
On 10/7/2010 8:54 PM, Marcel Holtmann wrote:
> Hi Bala,
>
>> Thanks Johannes. This would be better option to change PID in firmware
>> as blacklisting 3002 might create problems for 3011 chipsets.
>> Will try and let you people know.
> The misbehaving 3002 needs to be blacklisted in btusb.c anyway. However
> after loading the firmware to 3002 device, it should change its PID to
> something else.
>
> I am still trying to figure out if this is one stage firmware loading or
> a two stage firmware loading. This is all pretty unclear and nobody has
> answered this clearly so far.
>
> Regards
>
> Marcel
>
>
Marcel,
eeprom based 3011 chips comes up with PID 3000 giving control to DFU
driver [ath3k]. ath3k downloads the
firmware changing PID to 3002. Now btusb gets control.
In sflash based devices to reduce windows suspend/resume time we had a
small firmware in flash which
enables the device to get detected as Generic Bluetooth USB device with
PID 3002. So control reaches btusb when device is plugged in, leaving
no option for us to load the actual firmware.
Solution would be to blacklist 3002 in btusb, enable ath3k to get
control for both the devices, download the firmware and change PID to
3003 so that control with come to btusb.
Thanks for your time.
Regards,
Bala.
^ permalink raw reply
* [Buildroot] Tentative conclusion on the libtool work
From: Lionel Landwerlin @ 2010-10-07 16:34 UTC (permalink / raw)
To: buildroot
In-Reply-To: <20101007165744.490fca33@surf>
On Thu, Oct 7, 2010 at 4:57 PM, Thomas Petazzoni
<thomas.petazzoni@free-electrons.com> wrote:
> On Tue, 28 Sep 2010 22:36:52 +0200
> Thomas Petazzoni <thomas.petazzoni@free-electrons.com> wrote:
>
>> In my opinion, we should settle on a solution before mid-october, in
>> order to merge it before the end of october and give us enough time
>> for testing before the release at the end of november. Considering
>> how much time Martin and Lionel have dedicated to this issue, I think
>> that their respective work deserve some attention.
>
> >From the various comments on this list and discussions on IRC, it seems
> that the consensus is that :
>
> ?*) We should merge Martin Banky's work, as it keeps the existing
> ? ?known-working approach and just extends it to support packages that
> ? ?have used libtool 2.2 to generate their libtool script.
>
> ? ?Peter, if you're ok, I can give some build tests to Martin's work
> ? ?and send you a pull request for it.
>
> ?*) We should upgrade our own libtool package to libtool 2.2, so that
> ? ?packages such as libgtk2 that needs to be autoreconf'ed *and* need
> ? ?libtool >= 2.2 can actually be autoreconf'ed.
>
> ? ?Lionel, would you mind preparing such a patch set ?
>
> Do we agree on this solution ?
Yep, agree. I will send it tonight.
>
> Ideally, it'd be nice to merge it within the next few weeks, at least
> before the end of October, so that we can bump libgtk2 and have all
> this in 2010.11.
>
> Regards,
>
> Thomas
> --
> Thomas Petazzoni, Free Electrons
> Kernel, drivers, real-time and embedded Linux
> development, consulting, training and support.
> http://free-electrons.com
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot
>
^ permalink raw reply
* Re: RFC: btusb firmware load help
From: Bala Shanmugam @ 2010-10-07 16:33 UTC (permalink / raw)
To: Marcel Holtmann
Cc: Shanmugamkamatchi Balashanmugam, Luis Rodriguez, Johannes Berg,
linux-bluetooth, linux-kernel@vger.kernel.org,
linux-wireless@vger.kernel.org, Deepak Dhamdhere, Sree Durbha
In-Reply-To: <1286465072.6145.151.camel@aeonflux>
On 10/7/2010 8:54 PM, Marcel Holtmann wrote:
> Hi Bala,
>
>> Thanks Johannes. This would be better option to change PID in firmware
>> as blacklisting 3002 might create problems for 3011 chipsets.
>> Will try and let you people know.
> The misbehaving 3002 needs to be blacklisted in btusb.c anyway. However
> after loading the firmware to 3002 device, it should change its PID to
> something else.
>
> I am still trying to figure out if this is one stage firmware loading or
> a two stage firmware loading. This is all pretty unclear and nobody has
> answered this clearly so far.
>
> Regards
>
> Marcel
>
>
h
^ permalink raw reply
* LVM2 WHATS_NEW make.tmpl.in
From: agk @ 2010-10-07 16:33 UTC (permalink / raw)
To: lvm-devel
CVSROOT: /cvs/lvm2
Module name: LVM2
Changes by: agk at sourceware.org 2010-10-07 16:33:35
Modified files:
. : WHATS_NEW make.tmpl.in
Log message:
Allow CC to be overridden at build time (for 'scan-build make').
Patches:
http://sourceware.org/cgi-bin/cvsweb.cgi/LVM2/WHATS_NEW.diff?cvsroot=lvm2&r1=1.1746&r2=1.1747
http://sourceware.org/cgi-bin/cvsweb.cgi/LVM2/make.tmpl.in.diff?cvsroot=lvm2&r1=1.111&r2=1.112
--- LVM2/WHATS_NEW 2010/10/05 17:34:05 1.1746
+++ LVM2/WHATS_NEW 2010/10/07 16:33:34 1.1747
@@ -1,5 +1,6 @@
Version 2.02.75 -
=====================================
+ Allow CC to be overridden at build time (for 'scan-build make').
Rename 'flags' to 'status' in struct metadata_area.
Avoid segfault by limiting partial mode for lvm1 metadata. (2.02.74)
Add dm_zalloc and use it and dm_pool_zalloc throughout.
--- LVM2/make.tmpl.in 2010/09/27 19:09:34 1.111
+++ LVM2/make.tmpl.in 2010/10/07 16:33:35 1.112
@@ -17,9 +17,8 @@
@SET_MAKE@
-CC = @CC@
+CC ?= @CC@
RANLIB = @RANLIB@
-SHELL = /bin/sh
INSTALL = @INSTALL@
MKDIR_P = @MKDIR_P@
MSGFMT = @MSGFMT@
^ permalink raw reply
* Re: RFC: btusb firmware load help
From: Bala Shanmugam @ 2010-10-07 16:32 UTC (permalink / raw)
To: Johannes Berg
Cc: Shanmugamkamatchi Balashanmugam, Luis Rodriguez, Marcel Holtmann,
linux-bluetooth, linux-kernel@vger.kernel.org,
linux-wireless@vger.kernel.org, Deepak Dhamdhere, Sree Durbha
In-Reply-To: <1286464555.20974.3.camel@jlt3.sipsolutions.net>
On 10/7/2010 8:45 PM, Johannes Berg wrote:
>> Thanks Johannes. This would be better option to change PID in firmware
>> as blacklisting 3002 might create problems for 3011 chipsets.
> What would be the problem with 3011? Does it also use the 3002 ID, but
> not use firmware upload???
>
> johannes
>
AR3011 when plugged-in uses PID 3000 and control goes to DFU driver [ath3k].
ath3k downloads the firmware to the device changing its PID to 3002.
Now btusb gets the control and attaches the device to bluetooth core.
So blacklisting 3002 in btusb will create issues for AR3011 chipsets.
In firmware if we change the PID from 3002 to 3003 as you suggested and
blacklist 3002 in btusb
we can make both devices work.
Regards,
Bala.
^ permalink raw reply
* Re: [PATCH] mfd: jz4740-adc - fix jz4740_adc_set_enabled
From: Lars-Peter Clausen @ 2010-10-07 16:32 UTC (permalink / raw)
To: Axel Lin; +Cc: linux-kernel, Samuel Ortiz
In-Reply-To: <1286437880.18303.2.camel@mola>
Axel Lin wrote:
> When enabled is false, clear BIT(engine) of JZ_REG_ADC_ENABLE register.
>
> Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Thanks
- Lars
> ---
> drivers/mfd/jz4740-adc.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/mfd/jz4740-adc.c b/drivers/mfd/jz4740-adc.c
> index 3ad492c..9dd1b33 100644
> --- a/drivers/mfd/jz4740-adc.c
> +++ b/drivers/mfd/jz4740-adc.c
> @@ -153,7 +153,7 @@ static inline void jz4740_adc_set_enabled(struct jz4740_adc *adc, int engine,
> if (enabled)
> val |= BIT(engine);
> else
> - val &= BIT(engine);
> + val &= ~BIT(engine);
> writeb(val, adc->base + JZ_REG_ADC_ENABLE);
>
> spin_unlock_irqrestore(&adc->lock, flags);
^ permalink raw reply
* Re: [PATCH V2] Use firmware provided index to register a network interface
From: Matt Domsch @ 2010-10-07 16:31 UTC (permalink / raw)
To: Greg KH
Cc: Narendra_K, netdev, linux-hotplug, linux-pci, Jordan_Hargrave,
Vijay_Nijhawan, Charles_Rose
In-Reply-To: <20101007151134.GA25713@kroah.com>
On Thu, Oct 07, 2010 at 08:11:34AM -0700, Greg KH wrote:
> On Thu, Oct 07, 2010 at 07:23:35AM -0700, Narendra_K@Dell.com wrote:
> > Hello,
> >
> > V1 -> V2:
> >
> > This patch addresses the scenario of buggy firmware/BIOS tables. The
> > patch introduces a command line parameter 'no_netfwindex', passing which
> > firmware provided index will not be used to derive 'eth' names. By
> > default, firmware index will be used and the parameter can be used to
> > work around buggy firmware/BIOS tables.
> >
> > Please find the patch below.
> >
> > From: Narendra K <narendra_k@dell.com>
> > Subject: [PATCH] Use firmware provided index to register a network device
> >
> > This patch uses the firmware provided index to derive the ethN name.
> > If the firmware provides an index for the corresponding pdev, the N
> > is derived from the index.
>
> No, this has the very big chance to reorder existing network names and
> should all be done in userspace with the firmware information exported
> in sysfs, if the user so desires.
Existing names that use 70-persistent-net.rules won't change. They
were non-deterministically assigned and recorded in that file, so
they'll persist. At most, they'll have to deal with the same
"eth0_rename" garbage that anyone wanting to get a consistent name
from other than MAC address would get. The only reason the
auto-created 70-persistent-net.rules works is that most people don't
change their NIC configuration after install, so it has no renaming to do.
The kernel patch has the advantage of not requiring users to change
their scripts, by reserving the first N values for onboard devices as
BIOS describes them.
Userspace udev rules require us to change user behavior, and likely
their scripts, to use a new namespace such as ethlom1, in order to get
deterministic naming.
> > It took some time to find out the details asked above. Right,
> > windows does not use SMBIOS type 41 record to derive names. But as
> > a datapoint, windows also has the same problem.
> If windows does not use this field, then you can guarantee it will
> show up incorrectly in BIOSes and never be tested by manufacturers
> before they ship their machines.
There are 2 methods of exporting the information that have gotten
confusing here.
1) SMBIOS type 41 method. Windows does not use this today, and I
can't speak to their future plans. Narendra's kernel patch does,
as has biosdevname, the udev helper we first wrote for this purpose, for several years.
2) soon-to-be-released PCIe Firmware Spec, exporting label and index
as an ACPI _DSM(). It is anticipated that Windows will use this
information in some fashion at some point, per our conversations
with Microsoft as part of the PCI SIG proposal process. We've held
off submitting a kernel patch until the spec is public.
Cases:
1) BIOS doesn't provide this information (the common case today for
all but Dell 10G and newer servers), nothing is reserved, and
therefore the existing 70-persistent-net.rules take effect to name
devices. No change in behavior for existing systems. New installs
will have NICs named non-deterministically, and recorded in
70-persistent-net.rules. Users desiring consistent naming must
adjust 70-persistent-net.rules after install, and to avoid
eth0_rename collisions, must rename into another namespace.
2) BIOS provides this information correctly (Dell 10G and newer servers, or
anyone else implementing the spec). The first N values for onboard
devices are reserved and assigned by the kernel to onboard
devices. 70-persistent-net.rules may still try to rename the
ports, and may fail with eth0_rename collisions. Users would have
to adjust 70-persistent-net.rules to accommodate, but they do not
have to change the namespace from ethX to something else. New
installs will have onboard NICs named deterministically, and recorded in
70-persistent-net.rules.
3) BIOS provides this information incorrectly (none known today).
Some number of N values may be reserved, more or fewer than
actually present. In either case, it's possible that
70-persistent-net.rules would have to be adjusted to accommodate,
but they do not have to change the namespace from ethX to something
else. New installs will have onboard NICs named deterministically,
if not ideally due to buggy BIOS, and recorded in
70-persistent-net.rules.
What I can't find here is a solution where the user gets determistic
naming, without being forced to change the namespace and adjust their
scripts. Can anyone? I'm not opposed to "do it all in userspace" -
really, I'm not. But the 'where' is only part of the problem. No
userspace solution has yet been proposed that doesn't require a
namespace change, and I'm still hoping to avoid that.
Thanks,
Matt
--
Matt Domsch
Technology Strategist
Dell | Office of the CTO
^ permalink raw reply
* Re: [PATCH V2] Use firmware provided index to register a network interface
From: Matt Domsch @ 2010-10-07 16:31 UTC (permalink / raw)
To: Greg KH
Cc: Narendra_K, netdev, linux-hotplug, linux-pci, Jordan_Hargrave,
Vijay_Nijhawan, Charles_Rose
In-Reply-To: <20101007151134.GA25713@kroah.com>
On Thu, Oct 07, 2010 at 08:11:34AM -0700, Greg KH wrote:
> On Thu, Oct 07, 2010 at 07:23:35AM -0700, Narendra_K@Dell.com wrote:
> > Hello,
> >
> > V1 -> V2:
> >
> > This patch addresses the scenario of buggy firmware/BIOS tables. The
> > patch introduces a command line parameter 'no_netfwindex', passing which
> > firmware provided index will not be used to derive 'eth' names. By
> > default, firmware index will be used and the parameter can be used to
> > work around buggy firmware/BIOS tables.
> >
> > Please find the patch below.
> >
> > From: Narendra K <narendra_k@dell.com>
> > Subject: [PATCH] Use firmware provided index to register a network device
> >
> > This patch uses the firmware provided index to derive the ethN name.
> > If the firmware provides an index for the corresponding pdev, the N
> > is derived from the index.
>
> No, this has the very big chance to reorder existing network names and
> should all be done in userspace with the firmware information exported
> in sysfs, if the user so desires.
Existing names that use 70-persistent-net.rules won't change. They
were non-deterministically assigned and recorded in that file, so
they'll persist. At most, they'll have to deal with the same
"eth0_rename" garbage that anyone wanting to get a consistent name
from other than MAC address would get. The only reason the
auto-created 70-persistent-net.rules works is that most people don't
change their NIC configuration after install, so it has no renaming to do.
The kernel patch has the advantage of not requiring users to change
their scripts, by reserving the first N values for onboard devices as
BIOS describes them.
Userspace udev rules require us to change user behavior, and likely
their scripts, to use a new namespace such as ethlom1, in order to get
deterministic naming.
> > It took some time to find out the details asked above. Right,
> > windows does not use SMBIOS type 41 record to derive names. But as
> > a datapoint, windows also has the same problem.
> If windows does not use this field, then you can guarantee it will
> show up incorrectly in BIOSes and never be tested by manufacturers
> before they ship their machines.
There are 2 methods of exporting the information that have gotten
confusing here.
1) SMBIOS type 41 method. Windows does not use this today, and I
can't speak to their future plans. Narendra's kernel patch does,
as has biosdevname, the udev helper we first wrote for this purpose, for several years.
2) soon-to-be-released PCIe Firmware Spec, exporting label and index
as an ACPI _DSM(). It is anticipated that Windows will use this
information in some fashion at some point, per our conversations
with Microsoft as part of the PCI SIG proposal process. We've held
off submitting a kernel patch until the spec is public.
Cases:
1) BIOS doesn't provide this information (the common case today for
all but Dell 10G and newer servers), nothing is reserved, and
therefore the existing 70-persistent-net.rules take effect to name
devices. No change in behavior for existing systems. New installs
will have NICs named non-deterministically, and recorded in
70-persistent-net.rules. Users desiring consistent naming must
adjust 70-persistent-net.rules after install, and to avoid
eth0_rename collisions, must rename into another namespace.
2) BIOS provides this information correctly (Dell 10G and newer servers, or
anyone else implementing the spec). The first N values for onboard
devices are reserved and assigned by the kernel to onboard
devices. 70-persistent-net.rules may still try to rename the
ports, and may fail with eth0_rename collisions. Users would have
to adjust 70-persistent-net.rules to accommodate, but they do not
have to change the namespace from ethX to something else. New
installs will have onboard NICs named deterministically, and recorded in
70-persistent-net.rules.
3) BIOS provides this information incorrectly (none known today).
Some number of N values may be reserved, more or fewer than
actually present. In either case, it's possible that
70-persistent-net.rules would have to be adjusted to accommodate,
but they do not have to change the namespace from ethX to something
else. New installs will have onboard NICs named deterministically,
if not ideally due to buggy BIOS, and recorded in
70-persistent-net.rules.
What I can't find here is a solution where the user gets determistic
naming, without being forced to change the namespace and adjust their
scripts. Can anyone? I'm not opposed to "do it all in userspace" -
really, I'm not. But the 'where' is only part of the problem. No
userspace solution has yet been proposed that doesn't require a
namespace change, and I'm still hoping to avoid that.
Thanks,
Matt
--
Matt Domsch
Technology Strategist
Dell | Office of the CTO
^ permalink raw reply
* Re: [PATCH 1/7] Bluetooth: Add low energy commands and events
From: Gustavo F. Padovan @ 2010-10-07 16:31 UTC (permalink / raw)
To: Marcel Holtmann; +Cc: Ville Tervo, linux-bluetooth
In-Reply-To: <1286446105.6145.71.camel@aeonflux>
Hi Marcel,
* Marcel Holtmann <marcel@holtmann.org> [2010-10-07 12:08:25 +0200]:
> Hi Ville,
>
> > Add needed HCI command and event to create LE connections.
> >
> > Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
>
> Acked-by: Marcel Holtmann <marcel@holtmann.org>
There is a comment in patch 3/7 from Anderson that may affect this
patch, so I'm going to wait Ville say if he actually want to remove that
piece of the code or not to merge this one in the tree.
--
Gustavo F. Padovan
ProFUSION embedded systems - http://profusion.mobi
^ permalink raw reply
* [PATCH] jffs2: Do not assume erase will fail
From: Joakim Tjernlund @ 2010-10-07 16:29 UTC (permalink / raw)
To: linux-mtd; +Cc: Joakim Tjernlund
Test if it did and then abort.
Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
---
fs/jffs2/nodemgmt.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/jffs2/nodemgmt.c b/fs/jffs2/nodemgmt.c
index 694aa5b..49ee5de 100644
--- a/fs/jffs2/nodemgmt.c
+++ b/fs/jffs2/nodemgmt.c
@@ -260,9 +260,9 @@ static int jffs2_find_nextblock(struct jffs2_sb_info *c)
spin_lock(&c->erase_completion_lock);
/* An erase may have failed, decreasing the
- amount of free space available. So we must
- restart from the beginning */
- return -EAGAIN;
+ amount of free space available. */
+ if (list_empty(&c->free_list))
+ return -EAGAIN; /* restart from the beginning */
}
next = c->free_list.next;
--
1.7.2.2
^ permalink raw reply related
* Re: [doesn't work] JFFS2: Dynamically choose inocache hash size
From: Joakim Tjernlund @ 2010-10-07 16:24 UTC (permalink / raw)
To: Daniel Drake; +Cc: dsd.olpc, linux-mtd
In-Reply-To: <AANLkTikGL87-J-EbRiStmRaVN=g-rH7XL6SNB0zYwuaQ@mail.gmail.com>
dsd.olpc@gmail.com wrote on 2010/10/07 18:09:59:
>
> On 7 October 2010 16:33, Joakim Tjernlund <joakim.tjernlund@transmode.se> wrote:
> > Does #define INOCACHE_HASHSIZE <something bigger> work?
>
> Yes. Tested for years as value 1024 in OLPC builds.
OK, Good.
>
> > if so I would guess something is using inocache_hashsize before
> > it is initialized.
>
> Me too. But it's initialized early, at the same time as inocache_list.
> And all users of inocache_hashsize use the list at the same time. So
> if that were as obvious as it sounds, we'd be seeing bigger problems.
Sure, but something might still use it before. Try adding an
assert(inocache_hashsize) wherever you use inocache_hashsize.
^ permalink raw reply
* Re: [PATCH] kvm: fix typo in copyright notice
From: Marcelo Tosatti @ 2010-10-07 16:20 UTC (permalink / raw)
To: Nicolas Kaiser; +Cc: Avi Kivity, Joerg Roedel, kvm, linux-kernel
In-Reply-To: <20101006142322.15b4aa26@absol.kitzblitz>
On Wed, Oct 06, 2010 at 02:23:22PM +0200, Nicolas Kaiser wrote:
> Fix typo in copyright notice.
>
> Signed-off-by: Nicolas Kaiser <nikai@nikai.net>
> ---
> arch/x86/kvm/emulate.c | 2 +-
> arch/x86/kvm/i8254.c | 2 +-
> arch/x86/kvm/i8259.c | 2 +-
> arch/x86/kvm/irq.c | 2 +-
> arch/x86/kvm/lapic.c | 2 +-
> arch/x86/kvm/mmu.c | 2 +-
> arch/x86/kvm/mmu_audit.c | 2 +-
> arch/x86/kvm/paging_tmpl.h | 2 +-
> arch/x86/kvm/svm.c | 2 +-
> arch/x86/kvm/timer.c | 2 +-
> arch/x86/kvm/vmx.c | 2 +-
> arch/x86/kvm/x86.c | 2 +-
> virt/kvm/irq_comm.c | 2 +-
> virt/kvm/kvm_main.c | 2 +-
> 14 files changed, 14 insertions(+), 14 deletions(-)
Applied, thanks.
^ permalink raw reply
* Re: [PATCH] trace "exit to userspace" event
From: Marcelo Tosatti @ 2010-10-07 16:18 UTC (permalink / raw)
To: Gleb Natapov; +Cc: avi, kvm
In-Reply-To: <20101005131432.GO11145@redhat.com>
On Tue, Oct 05, 2010 at 03:14:32PM +0200, Gleb Natapov wrote:
> Add tracepoint for userspace exit.
>
> Signed-off-by: Gleb Natapov <gleb@redhat.com>
> diff --git a/include/trace/events/kvm.h b/include/trace/events/kvm.h
> index 6dd3a51..fb44da0 100644
> --- a/include/trace/events/kvm.h
> +++ b/include/trace/events/kvm.h
> @@ -6,6 +6,31 @@
> #undef TRACE_SYSTEM
> #define TRACE_SYSTEM kvm
>
> +#define ERSN(x) { KVM_EXIT_##x, "KVM_EXIT_" #x }
> +
> +#define kvm_trace_exit_reason \
> + ERSN(UNKNOWN), ERSN(EXCEPTION), ERSN(IO), ERSN(HYPERCALL), \
> + ERSN(DEBUG), ERSN(HLT), ERSN(MMIO), ERSN(IRQ_WINDOW_OPEN), \
> + ERSN(SHUTDOWN), ERSN(FAIL_ENTRY), ERSN(INTR), ERSN(SET_TPR), \
> + ERSN(TPR_ACCESS), ERSN(S390_SIEIC), ERSN(S390_RESET), ERSN(DCR),\
> + ERSN(NMI), ERSN(INTERNAL_ERROR), ERSN(OSI)
> +
> +TRACE_EVENT(kvm_userspace_exit,
> + TP_PROTO(__u32 reason),
> + TP_ARGS(reason),
> +
> + TP_STRUCT__entry(
> + __field( __u32, reason )
> + ),
> +
> + TP_fast_assign(
> + __entry->reason = reason;
> + ),
> +
> + TP_printk("reason %s", __print_symbolic(__entry->reason,
> + kvm_trace_exit_reason))
> +);
> +
> #if defined(__KVM_HAVE_IOAPIC)
> TRACE_EVENT(kvm_set_irq,
> TP_PROTO(unsigned int gsi, int level, int irq_source_id),
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index b8499f5..8800713 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -1458,6 +1458,8 @@ static long kvm_vcpu_ioctl(struct file *filp,
> if (arg)
> goto out;
> r = kvm_arch_vcpu_ioctl_run(vcpu, vcpu->run);
> + if (r >= 0)
> + trace_kvm_userspace_exit(vcpu->run->exit_reason);
> break;
> case KVM_GET_REGS: {
> struct kvm_regs *kvm_regs;
> --
> Gleb.
Exit codes are also valid for r == -EINTR and -EAGAIN cases, eg
EXIT_INTR. Better print it out for all cases, and let the reader
decide whether exit_reason is valid.
^ permalink raw reply
* Re: Introduce support for little endian PowerPC
From: Hollis Blanchard @ 2010-10-07 16:25 UTC (permalink / raw)
To: Olof Johansson
Cc: Benjamin Herrenschmidt, paulus, linuxppc-dev, linux-kernel,
Ian Munsie
In-Reply-To: <20101001220343.GA10494@lixom.net>
On Fri, Oct 1, 2010 at 3:03 PM, Olof Johansson <olof@lixom.net> wrote:
> On Sat, Oct 02, 2010 at 06:51:55AM +1000, Benjamin Herrenschmidt wrote:
>> On Fri, 2010-10-01 at 12:59 -0500, Kumar Gala wrote:
>> > I'm not against it, and I agree some of the patches seem like good
>> > clean up. I'm concerned about this bit rotting pretty quickly.
>>
>> Maybe. Most of it doesn't seem to be that bit-rottable.
>>
>> The changes to the asm stuff in misc_32.S for example are functions we
>> never ever touch once written (libgcc replacements) so I don't see them
>> rotting more with LE support than they did with BE :-)
>
> Does KVM/qemu support running LE guest on BE host? That'd help keeping
> the bitrot lower. :)
Surprisingly, qemu has very poor support for the concept of
endianness. The fact that BE PowerPC works on both BE and LE hosts in
Qemu today is more accidental than anything else (the special curse of
endianness is that two wrongs make a right). Supporting LE PowerPC
guests would be a dramatic effort, and I'm pretty sure it would impact
other qemu architectures as well.
-Hollis
^ permalink raw reply
* Re: Introduce support for little endian PowerPC
From: Hollis Blanchard @ 2010-10-07 16:25 UTC (permalink / raw)
To: Olof Johansson; +Cc: paulus, linuxppc-dev, Ian Munsie, linux-kernel
In-Reply-To: <20101001220343.GA10494@lixom.net>
On Fri, Oct 1, 2010 at 3:03 PM, Olof Johansson <olof@lixom.net> wrote:
> On Sat, Oct 02, 2010 at 06:51:55AM +1000, Benjamin Herrenschmidt wrote:
>> On Fri, 2010-10-01 at 12:59 -0500, Kumar Gala wrote:
>> > I'm not against it, and I agree some of the patches seem like good
>> > clean up. =A0I'm concerned about this bit rotting pretty quickly.
>>
>> Maybe. Most of it doesn't seem to be that bit-rottable.
>>
>> The changes to the asm stuff in misc_32.S for example are functions we
>> never ever touch once written (libgcc replacements) so I don't see them
>> rotting more with LE support than they did with BE :-)
>
> Does KVM/qemu support running LE guest on BE host? That'd help keeping
> the bitrot lower. :)
Surprisingly, qemu has very poor support for the concept of
endianness. The fact that BE PowerPC works on both BE and LE hosts in
Qemu today is more accidental than anything else (the special curse of
endianness is that two wrongs make a right). Supporting LE PowerPC
guests would be a dramatic effort, and I'm pretty sure it would impact
other qemu architectures as well.
-Hollis
^ permalink raw reply
* Re: [lm-sensors] [PATCH v4] hwmon: (lm90) Add support for
From: Jean Delvare @ 2010-10-07 16:24 UTC (permalink / raw)
To: lm-sensors
In-Reply-To: <1286464011-14356-1-git-send-email-guenter.roeck@ericsson.com>
Hi Guenter,
On Thu, 7 Oct 2010 08:06:51 -0700, Guenter Roeck wrote:
> Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
> ---
> v4 changes:
> - Use higher shift value in update interval calculation to further reduce
> rounding errors.
> - Use DIV_ROUND_CLOSEST instead of manual rounding.
>
> v3 changes:
> - Removed unnecessary constant.
> - Improved update interval calculation to avoid rounding error.
>
> drivers/hwmon/lm90.c | 97 +++++++++++++++++++++++++++++++++++++++++++++++---
> 1 files changed, 92 insertions(+), 5 deletions(-)
>
Applied, thanks.
--
Jean Delvare
_______________________________________________
lm-sensors mailing list
lm-sensors@lm-sensors.org
http://lists.lm-sensors.org/mailman/listinfo/lm-sensors
^ permalink raw reply
* NFS bug with utime/file create
From: Lukas Hejtmanek @ 2010-10-07 16:06 UTC (permalink / raw)
To: linux-nfs
Hello,
I noticed an interesing bug in 2.6.26 kernel, not sure whether this has been
fixed in newer version or not.
I have an application, that does basically the following code:
int
main(int argc, char *argv[]) {
int fd = open(argv[1], O_WRONLY|O_CREAT|O_TRUNC, 0666);
char buff[300];
write(fd, buff, 300);
while(1) {
utime(argv[1], NULL);
sleep(30);
}
return 0;
}
another application that runs on a different client does:
17:57:30.605304 nanosleep({24, 0}, {24, 0}) = 0
17:57:54.605526 stat64("/storage/home/xhejtman/gangadir/workspace/xhejtman/LocalXML/0",
{st_mode=S_IFDIR|0700, st_size=59, ...}) = 0
17:57:54.606029 mkdir("/storage/home/xhejtman/gangadir/workspace/xhejtman/LocalXML/0/output",
0777) = -1 EEXIST (File exists)
17:57:54.606414 open("/storage/home/xhejtman/gangadir/workspace/xhejtman/LocalXML/0/output/__jobstatus__",
O_RDONLY|O_LARGEFILE) = 3
17:57:54.607073 fstat64(3, {st_mode=S_IFREG|0644, st_size=300, ...}) = 0
17:57:54.607230 mmap2(NULL, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb74ef000
17:57:54.607325 _llseek(3, 0, [0], SEEK_CUR) = 0
17:57:54.607408 read(3, "\0\0\0\0\0\0\0\0\336e\356,\345\177\0\0\0\0\0\0\0\0\0\0"..., 1048576) = 300
17:57:54.607765 read(3, "", 1048576) = 0
17:57:54.607854 close(3) = 0
17:57:54.608128 munmap(0xb74ef000, 1048576) = 0
17:57:54.608224 stat64("/storage/home/xhejtman/gangadir/workspace/xhejtman/LocalXML/0/output/__jobstatus__",
{st_mode=S_IFREG|0644, st_size=300, ...}) = 0
The first application tries to create a file (something like:
open("time_elapsed.txt", O_WRONLY|O_CREAT|O_TRUNC, 0666) (*)
at this point, it emits PUTFH, SAVEFH, OPEN, GETFH, GETATTR, RESTOREFH,
GETATTR compount. The server replies with NFS4ERR_EXPIRED.
The client tries to RENEW, the server replies NFS4ERR_EXPIRED.
The client restarts using SETCLIENTID and so on. During this phase, the first
application emits utime call. It seems that orignial open (*) get lost and system
deadlocks.
Using NFS debugs, I can see a warning, that the lease is not expired (from the
client's point of view, but the server is conviced that the lease is expired).
I can reliably reproduce it with diane/ganga framework. I cannot fully reproduce it
just using simple C programs.
Is there something I could do?
--
Lukáš Hejtmánek
^ permalink raw reply
* [PATCH] Sort TODO by priority
From: Luiz Augusto von Dentz @ 2010-10-07 16:21 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.dentz-von@nokia.com>
Items shall be sorted by priority and latter by complexity so that tasks
with higher priority and lower complexity always appear on top.
---
TODO | 58 +++++++++++++++++++++++++++++-----------------------------
1 files changed, 29 insertions(+), 29 deletions(-)
diff --git a/TODO b/TODO
index 271fc45..3885c78 100644
--- a/TODO
+++ b/TODO
@@ -25,6 +25,29 @@ ATT/GATT
Complexity: C2
Owner: Claudio Takahasi <claudio.takahasi@openbossa.org>
+- Add ATT/GATT parsing to hcidump
+
+ Priority: Medium
+ Complexity: C2
+
+- GATT server: fix MTU exchange
+
+ Priority: Medium
+ Complexity: C2
+
+- GATT server: fix read by UUID (read by handle works)
+
+ Priority: Medium
+ Complexity: C2
+
+- gatttool: add an interactive command prompt mode. Many LE devices
+ expect the connection to stay up a long time and disable advertising
+ after a disconnection so it's inconvenient to use gatttool in the
+ current "single operation at a time" mode.
+
+ Priority: Medium
+ Complexity: C2
+
- gatttool should have the ability to wait for req responses before
quitting (some servers require a small sleep even with cmd's). Maybe a
--delay-exit or --timeout command line switch.
@@ -42,13 +65,6 @@ ATT/GATT
Priority: Low
Complexity: C1
-- Attribute server shall implement attribute permission verification,
- returning an error code if necessary. See Volume 3, Part F, 3.2.5
- for more information.
-
- Priority: Low
- Complexity: C2
-
- Attribute server should process queued GATT/ATT commands if the
client disconnects. The client can simply send a command and quit,
without wait for a response(ex: Write Command). For this scenario
@@ -58,11 +74,6 @@ ATT/GATT
Priority: Low
Complecity: C1
-- Long reads/writes don't work (consisting of multiple request packets)
-
- Priority: Low
- Complexity: C2
-
- Add sdp discovery support to gattool with BR (--sdp, default is 0x1f)
Priority: Low
@@ -74,25 +85,14 @@ ATT/GATT
Priority: Low
Complexity: C1
-- Add ATT/GATT parsing to hcidump
-
- Priority: Medium
- Complexity: C2
-
-- GATT server: fix MTU exchange
-
- Priority: Medium
- Complexity: C2
-
-- GATT server: fix read by UUID (read by handle works)
+- Long reads/writes don't work (consisting of multiple request packets)
- Priority: Medium
+ Priority: Low
Complexity: C2
-- gatttool: add an interactive command prompt mode. Many LE devices
- expect the connection to stay up a long time and disable advertising
- after a disconnection so it's inconvenient to use gatttool in the
- current "single operation at a time" mode.
+- Attribute server shall implement attribute permission verification,
+ returning an error code if necessary. See Volume 3, Part F, 3.2.5
+ for more information.
- Priority: Medium
+ Priority: Low
Complexity: C2
--
1.7.1
^ permalink raw reply related
* Re: [PATCH v6 04/12] Add memory slot versioning and use it to provide fast guest write interface
From: Avi Kivity @ 2010-10-07 16:20 UTC (permalink / raw)
To: Gleb Natapov
Cc: Marcelo Tosatti, Gleb Natapov, kvm, linux-mm, linux-kernel, mingo,
a.p.zijlstra, tglx, hpa, riel, cl
In-Reply-To: <20101007160340.GD4120@minantech.com>
On 10/07/2010 06:03 PM, Gleb Natapov wrote:
> > >
> > > Isn't SET_USER_MEMORY_REGION so slow that calling it 2^32 times
> > > isn't really feasible?
> >
> > Assuming it takes 1ms, it would take 49 days.
> >
> We may fail ioctl when max value is reached. The question is how much slot
> changes can we expect from real guest during its lifetime.
>
A normal guest has a 30 Hz timer for reading the vga framebuffer,
multiple slots. Let's assume 100 Hz frequency, that gives 490 days
until things stop working.
--
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.
^ permalink raw reply
* Re: [PATCH v6 04/12] Add memory slot versioning and use it to provide fast guest write interface
From: Avi Kivity @ 2010-10-07 16:20 UTC (permalink / raw)
To: Gleb Natapov
Cc: Marcelo Tosatti, Gleb Natapov, kvm, linux-mm, linux-kernel, mingo,
a.p.zijlstra, tglx, hpa, riel, cl
In-Reply-To: <20101007160340.GD4120@minantech.com>
On 10/07/2010 06:03 PM, Gleb Natapov wrote:
> > >
> > > Isn't SET_USER_MEMORY_REGION so slow that calling it 2^32 times
> > > isn't really feasible?
> >
> > Assuming it takes 1ms, it would take 49 days.
> >
> We may fail ioctl when max value is reached. The question is how much slot
> changes can we expect from real guest during its lifetime.
>
A normal guest has a 30 Hz timer for reading the vga framebuffer,
multiple slots. Let's assume 100 Hz frequency, that gives 490 days
until things stop working.
--
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
^ permalink raw reply
* [PATCH] omap3evm: Add vio regulator supply required for ads7846 driver
From: hvaibhav @ 2010-10-07 16:20 UTC (permalink / raw)
To: linux-omap; +Cc: Vaibhav Hiremath
From: Vaibhav Hiremath <hvaibhav@ti.com>
Signed-off-by: Vaibhav Hiremath <hvaibhav@ti.com>
---
arch/arm/mach-omap2/board-omap3evm.c | 20 ++++++++++++++++++++
1 files changed, 20 insertions(+), 0 deletions(-)
diff --git a/arch/arm/mach-omap2/board-omap3evm.c b/arch/arm/mach-omap2/board-omap3evm.c
index 633c89e..34db4e4 100644
--- a/arch/arm/mach-omap2/board-omap3evm.c
+++ b/arch/arm/mach-omap2/board-omap3evm.c
@@ -532,6 +532,25 @@ static struct regulator_init_data omap3_evm_vpll2 = {
.consumer_supplies = &omap3_evm_vpll2_supply,
};
+/* ads7846 on SPI */
+static struct regulator_consumer_supply omap3evm_vio_supply =
+ REGULATOR_SUPPLY("vcc", "spi1.0");
+
+/* VIO for ads7846 */
+static struct regulator_init_data omap3evm_vio = {
+ .constraints = {
+ .min_uV = 1800000,
+ .max_uV = 1800000,
+ .apply_uV = true,
+ .valid_modes_mask = REGULATOR_MODE_NORMAL
+ | REGULATOR_MODE_STANDBY,
+ .valid_ops_mask = REGULATOR_CHANGE_MODE
+ | REGULATOR_CHANGE_STATUS,
+ },
+ .num_consumer_supplies = 1,
+ .consumer_supplies = &omap3evm_vio_supply,
+};
+
static struct twl4030_platform_data omap3evm_twldata = {
.irq_base = TWL4030_IRQ_BASE,
.irq_end = TWL4030_IRQ_END,
@@ -544,6 +563,7 @@ static struct twl4030_platform_data omap3evm_twldata = {
.codec = &omap3evm_codec_data,
.vdac = &omap3_evm_vdac,
.vpll2 = &omap3_evm_vpll2,
+ .vio = &omap3evm_vio,
};
static struct i2c_board_info __initdata omap3evm_i2c_boardinfo[] = {
--
1.6.2.4
^ permalink raw reply related
* [PATCH] omap3evm:DSS: Replace TWL gpio API to gpio*_cansleep
From: hvaibhav @ 2010-10-07 16:19 UTC (permalink / raw)
To: linux-omap; +Cc: Vaibhav Hiremath
From: Vaibhav Hiremath <hvaibhav@ti.com>
Since access to TWL GPIO's can go into sleep, and using normal
gpio_get/set_value() API will lead to kernel dump (of WARN_ON()).
On OMAP3EVM LCD backlight & DVI encoder is controller through
TWL GPIO, so replacing normal gpio_get/set_value() to
gpio_get_set_value_cansleep().
Signed-off-by: Vaibhav Hiremath <hvaibhav@ti.com>
---
arch/arm/mach-omap2/board-omap3evm.c | 12 ++++++------
1 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/arm/mach-omap2/board-omap3evm.c b/arch/arm/mach-omap2/board-omap3evm.c
index adfb7ad..633c89e 100644
--- a/arch/arm/mach-omap2/board-omap3evm.c
+++ b/arch/arm/mach-omap2/board-omap3evm.c
@@ -234,9 +234,9 @@ static int omap3_evm_enable_lcd(struct omap_dss_device *dssdev)
gpio_set_value(OMAP3EVM_LCD_PANEL_ENVDD, 0);
if (get_omap3_evm_rev() >= OMAP3EVM_BOARD_GEN_2)
- gpio_set_value(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 0);
+ gpio_set_value_cansleep(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 0);
else
- gpio_set_value(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 1);
+ gpio_set_value_cansleep(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 1);
lcd_enabled = 1;
return 0;
@@ -247,9 +247,9 @@ static void omap3_evm_disable_lcd(struct omap_dss_device *dssdev)
gpio_set_value(OMAP3EVM_LCD_PANEL_ENVDD, 1);
if (get_omap3_evm_rev() >= OMAP3EVM_BOARD_GEN_2)
- gpio_set_value(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 1);
+ gpio_set_value_cansleep(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 1);
else
- gpio_set_value(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 0);
+ gpio_set_value_cansleep(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 0);
lcd_enabled = 0;
}
@@ -288,7 +288,7 @@ static int omap3_evm_enable_dvi(struct omap_dss_device *dssdev)
return -EINVAL;
}
- gpio_set_value(OMAP3EVM_DVI_PANEL_EN_GPIO, 1);
+ gpio_set_value_cansleep(OMAP3EVM_DVI_PANEL_EN_GPIO, 1);
dvi_enabled = 1;
return 0;
@@ -296,7 +296,7 @@ static int omap3_evm_enable_dvi(struct omap_dss_device *dssdev)
static void omap3_evm_disable_dvi(struct omap_dss_device *dssdev)
{
- gpio_set_value(OMAP3EVM_DVI_PANEL_EN_GPIO, 0);
+ gpio_set_value_cansleep(OMAP3EVM_DVI_PANEL_EN_GPIO, 0);
dvi_enabled = 0;
}
--
1.6.2.4
^ permalink raw reply related
* [PATCH] omap3evm:DSS: Replace TWL gpio API to gpio*_cansleep
From: hvaibhav @ 2010-10-07 16:19 UTC (permalink / raw)
To: linux-omap; +Cc: Vaibhav Hiremath
From: Vaibhav Hiremath <hvaibhav@ti.com>
Since access to TWL GPIO's can go into sleep, and using normal
gpio_get/set_value() API will lead to kernel dump (of WARN_ON()).
On OMAP3EVM LCD backlight & DVI encoder is controller through
TWL GPIO, so replacing normal gpio_get/set_value() to
gpio_get_set_value_cansleep().
Signed-off-by: Vaibhav Hiremath <hvaibhav@ti.com>
---
arch/arm/mach-omap2/board-omap3evm.c | 12 ++++++------
1 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/arm/mach-omap2/board-omap3evm.c b/arch/arm/mach-omap2/board-omap3evm.c
index adfb7ad..633c89e 100644
--- a/arch/arm/mach-omap2/board-omap3evm.c
+++ b/arch/arm/mach-omap2/board-omap3evm.c
@@ -234,9 +234,9 @@ static int omap3_evm_enable_lcd(struct omap_dss_device *dssdev)
gpio_set_value(OMAP3EVM_LCD_PANEL_ENVDD, 0);
if (get_omap3_evm_rev() >= OMAP3EVM_BOARD_GEN_2)
- gpio_set_value(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 0);
+ gpio_set_value_cansleep(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 0);
else
- gpio_set_value(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 1);
+ gpio_set_value_cansleep(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 1);
lcd_enabled = 1;
return 0;
@@ -247,9 +247,9 @@ static void omap3_evm_disable_lcd(struct omap_dss_device *dssdev)
gpio_set_value(OMAP3EVM_LCD_PANEL_ENVDD, 1);
if (get_omap3_evm_rev() >= OMAP3EVM_BOARD_GEN_2)
- gpio_set_value(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 1);
+ gpio_set_value_cansleep(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 1);
else
- gpio_set_value(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 0);
+ gpio_set_value_cansleep(OMAP3EVM_LCD_PANEL_BKLIGHT_GPIO, 0);
lcd_enabled = 0;
}
@@ -288,7 +288,7 @@ static int omap3_evm_enable_dvi(struct omap_dss_device *dssdev)
return -EINVAL;
}
- gpio_set_value(OMAP3EVM_DVI_PANEL_EN_GPIO, 1);
+ gpio_set_value_cansleep(OMAP3EVM_DVI_PANEL_EN_GPIO, 1);
dvi_enabled = 1;
return 0;
@@ -296,7 +296,7 @@ static int omap3_evm_enable_dvi(struct omap_dss_device *dssdev)
static void omap3_evm_disable_dvi(struct omap_dss_device *dssdev)
{
- gpio_set_value(OMAP3EVM_DVI_PANEL_EN_GPIO, 0);
+ gpio_set_value_cansleep(OMAP3EVM_DVI_PANEL_EN_GPIO, 0);
dvi_enabled = 0;
}
--
1.6.2.4
^ permalink raw reply related
* Re: [RFC] arch generic way to trigger unknown NMIs
From: Andi Kleen @ 2010-10-07 16:17 UTC (permalink / raw)
To: Don Zickus
Cc: Andi Kleen, mingo, fweisbec, robert.richter, gorcunov,
linux-kernel
In-Reply-To: <20101007154758.GA22385@redhat.com>
On Thu, Oct 07, 2010 at 11:47:58AM -0400, Don Zickus wrote:
> > > No I prefer a single one too, but there didn't seem to be a
> > > send_IPI_self() command, so I took the short route and sent it to
> > > everyone. :-(
> >
> > You're not sending it to everyone, everyone but you.
> >
> > Anyways for standard APIC send_IPI_cpu should be easy enough
> > to add. Standard NMI is usually to CPU #0 only.
>
> Would that still be x86 specific though? I could probably code that up,
> though I wonder if it would be accepted just for a test case.
The whole APIC interface is x86 specific.
"just a test case" is the wrong perspective.
Testing is important, if a feature is not tested it likely won't
work. That's especially important for anything error handling related.
-Andi
--
ak@linux.intel.com -- Speaking for myself only.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.