blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Broken_umask_handling_with_sshfs.html">Broken umask handling with sshfs</a></div>
  24   <div class="date">2010-08-26 13:30</div>
  25   <div class="body">
  26 <p>My file system sematics program
  27 <a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">presented
  28 a few days ago</a> is very useful to verify that a file system can
  29 work as a unix home directory,and today I had to extend it a bit.  I'm
  30 looking into alternatives for home directory access here at the
  31 University of Oslo, and one of the options is sshfs.  My friend
  32 Finn-Arne mentioned a while back that they had used sshfs with Debian
  33 Edu, but stopped because of problems.  I asked today what the problems
  34 where, and he mentioned that sshfs failed to handle umask properly.
  35 Trying to detect the problem I wrote this addition to my fs testing
  36 script:</p>
  37
  38 <pre>
  39 mode_t touch_get_mode(const char *name, mode_t mode) {
  40   mode_t retval = 0;
  41   int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, mode);
  42   if (-1 != fd) {
  43     unlink(name);
  44     struct stat statbuf;
  45     if (-1 != fstat(fd, &statbuf)) {
  46       retval = statbuf.st_mode & 0x1ff;
  47     }
  48     close(fd);
  49   }
  50   return retval;
  51 }
  52
  53 /* Try to detect problem discovered using sshfs */
  54 int test_umask(void) {
  55   printf("info: testing umask effect on file creation\n");
  56
  57   mode_t orig_umask = umask(000);
  58   mode_t newmode;
  59   if (0666 != (newmode = touch_get_mode("foobar", 0666))) {
  60     printf("  error: Wrong file mode %o when creating using mode 666 and umask 000\n",
  61            newmode);
  62   }
  63   umask(007);
  64   if (0660 != (newmode = touch_get_mode("foobar", 0666))) {
  65     printf("  error: Wrong file mode %o when creating using mode 666 and umask 007\n",
  66            newmode);
  67   }
  68
  69   umask (orig_umask);
  70   return 0;
  71 }
  72
  73 int main(int argc, char **argv) {
  74   [...]
  75   test_umask();
  76   return 0;
  77 }
  78 </pre>
  79
  80 <p>Sure enough.  On NFS to a netapp, I get this result:</p>
  81
  82 <pre>
  83 Testing POSIX/Unix sematics on file system
  84 info: testing symlink creation
  85 info: testing subdirectory creation
  86 info: testing fcntl locking
  87   Read-locking 1 byte from 1073741824
  88   Read-locking 510 byte from 1073741826
  89   Unlocking 1 byte from 1073741824
  90   Write-locking 1 byte from 1073741824
  91   Write-locking 510 byte from 1073741826
  92   Unlocking 2 byte from 1073741824
  93 info: testing umask effect on file creation
  94 </pre>
  95
  96 <p>When mounting the same directory using sshfs, I get this
  97 result:</p>
  98
  99 <pre>
 100 Testing POSIX/Unix sematics on file system
 101 info: testing symlink creation
 102 info: testing subdirectory creation
 103 info: testing fcntl locking
 104   Read-locking 1 byte from 1073741824
 105   Read-locking 510 byte from 1073741826
 106   Unlocking 1 byte from 1073741824
 107   Write-locking 1 byte from 1073741824
 108   Write-locking 510 byte from 1073741826
 109   Unlocking 2 byte from 1073741824
 110 info: testing umask effect on file creation
 111   error: Wrong file mode 644 when creating using mode 666 and umask 000
 112   error: Wrong file mode 640 when creating using mode 666 and umask 007
 113 </pre>
 114
 115 <p>So, I can conclude that sshfs is better than smb to a Netapp or a
 116 Windows server, but not good enough to be used as a home
 117 directory.</p>
 118
 119 <p>Update 2010-08-26: Reported the issue in
 120 <a href="http://bugs.debian.org/594498">BTS report #594498</a></p>
 121 </div>
 122   <div class="tags">
 123
 124
 125
 126    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 127
 128   </div>
 129  </div>
 130  <div class="padding"></div>
 131
 132  <div class="entry">
 133   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Elektronisk_stemmegiving_er_ikke_til____stole_p_____heller_ikke_i_Norge.html">Elektronisk stemmegiving er ikke til å stole på - heller ikke i Norge</a></div>
 134   <div class="date">2010-08-23 19:30</div>
 135   <div class="body">
 136 <p>I Norge pågår en prosess for å
 137 <a href="http://www.e-valg.dep.no/">innføre elektronisk
 138 stemmegiving</a> ved kommune- og stortingsvalg.  Dette skal
 139 introduseres i 2011.  Det er all grunn til å tro at valg i Norge ikke
 140 vil være til å stole på hvis dette blir gjennomført.  Da det hele var
 141 oppe til høring i 2006 forfattet jeg
 142 <a href="http://www.nuug.no/dokumenter/valg-horing-2006-09.pdf">en
 143 høringsuttalelse fra NUUG</a> (og EFN som hengte seg på) som skisserte
 144 hvilke punkter som må oppfylles for at en skal kunne stole på et valg,
 145 og elektronisk stemmegiving mangler flere av disse.  Elektronisk
 146 stemmegiving er for alle praktiske formål å putte ens stemme i en sort
 147 boks under andres kontroll, og satse på at de som har kontroll med
 148 boksen er til å stole på - uten at en har mulighet til å verifisere
 149 dette selv.  Det er ikke slik en gjennomfører demokratiske valg.</p>
 150
 151 <p>Da problemet er fundamentalt med hvordan elektronisk stemmegiving
 152 må fungere for at også ikke-krypografer skal kunne delta, har det vært
 153 mange rapporter om hvordan elektronisk stemmegiving har sviktet i land
 154 etter land.  En
 155 <a href="http://wiki.nuug.no/uttalelser/2006-elektronisk-stemmegiving">liten
 156 samling referanser</a> finnes på NUUGs wiki.  Den siste er fra India,
 157 der valgkomisjonen har valgt
 158 <a href="http://www.freedom-to-tinker.com/blog/jhalderm/electronic-voting-researcher-arrested-over-anonymous-source">å
 159 pusse politiet på en forsker</a> som har dokumentert svakheter i
 160 valgsystemet.</p>
 161
 162 <p>Her i Norge har en valgt en annen tilnærming, der en forsøker seg
 163 med teknobabbel for å få befolkningen til å tro at dette skal bli
 164 sikkert.  Husk, elektronisk stemmegiving underminerer de demokratiske
 165 valgene i Norge, og bør ikke innføres.</p>
 166
 167 <p>Den offentlige diskusjonen blir litt vanskelig av at media har
 168 valgt å kalle dette "evalg", som kan sies å både gjelde elektronisk
 169 opptelling av valget som Norge har gjort siden 60-tallet og som er en
 170 svært god ide, og elektronisk opptelling som er en svært dårlig ide.
 171 Diskusjonen gir ikke mening hvis en skal diskutere om en er for eller
 172 mot "evalg", og jeg forsøker derfor å være klar på at jeg snakker om
 173 elektronisk stemmegiving og unngå begrepet "evalg".</p>
 174 </div>
 175   <div class="tags">
 176
 177
 178
 179    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 180
 181   </div>
 182  </div>
 183  <div class="padding"></div>
 184
 185  <div class="entry">
 186   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Robot__reis_deg___.html">Robot, reis deg...</a></div>
 187   <div class="date">2010-08-21 22:10</div>
 188   <div class="body">
 189 <p>I dag fikk jeg endelig tittet litt på mine nyinnkjøpte roboter, og
 190 har brukt noen timer til å google etter interessante referanser og
 191 aktuell kildekode for bruk på Linux.  Det mest lovende så langt er
 192 <a href="http://ispykee.toyz.org/">ispykee</a>, som har en
 193 BSD-lisensiert linux-daemon som står som mellomledd mellom roboter på
 194 lokalnettet og en sentral tjeneste der en iPhone kan koble seg opp for
 195 å fjernstyre roboten.  Linux-daemonen implementerer deler av
 196 protokollen som roboten forstår.  Etter å ha knotet litt med å oppnå
 197 kontakt med roboten (den oppretter et eget ad-hoc wifi-nett, så jeg
 198 måtte gå av mitt vanlige nett for å få kontakt), og kommet frem til at
 199 den lytter på IP-port 9000 og 9001, gikk jeg i gang med å finne ut
 200 hvordan jeg kunne snakke med roboten vha. disse portene.  Robotbiten
 201 av protokollen er publisert av produsenten med GPL-lisens, slik at det
 202 er mulig å se hvordan protokollen fungerer.  Det finnes en java-klient
 203 for Android som så ganske snasen ut, men fant ingen kildekode for
 204 denne.  Derimot hadde iphone-løsningen kildekode, så jeg tok
 205 utgangspunkt i den.</p>
 206
 207 <p>Daemonen ville i utgangspunktet forsøke å kontakte den sentrale
 208 tjenesten som iphone-programmet kobler seg til.  Jeg skrev dette om
 209 til i stedet å sette opp en nettverkstjeneste på min lokale maskin,
 210 som jeg kan koble meg opp til med telnet og gi kommandoer til roboten
 211 (act, forward, right, left, etc).  Det involverte i praksis å bytte ut
 212 socket()/connect() med socket()/bind()/listen()/accept() for å gjøre
 213 klienten om til en tjener.</p>
 214
 215 <p>Mens jeg har forsøkt å få roboten til å bevege seg har min samboer
 216 skrudd sammen resten av roboten for å få montert kamera og plastpynten
 217 (armer, plastfiber for lys).  Nå er det hele montert, og roboten er
 218 klar til bruk.  Må få flyttet den over til mitt vanlige trådløsnett
 219 før det blir praktisk, men de bitene av protokollen er ikke
 220 implementert i ispykee-daemonen, så der må jeg enten få tak i en mac
 221 eller en windows-maskin, eller implementere det selv.</p>
 222
 223 <p>Vi var tre som kjøpte slike roboter, og vi har blitt enige om å
 224 samle notater og referanser på <a
 225 href="http://wiki.nuug.no/grupper/robot/">NUUGs wiki</a>.  Ta en titt
 226 der hvis du er nysgjerrig.</p>
 227 </div>
 228   <div class="tags">
 229
 230
 231
 232    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/robot">robot</a>.
 233
 234   </div>
 235  </div>
 236  <div class="padding"></div>
 237
 238  <div class="entry">
 239   <div class="title"><a href="http://people.skolelinux.org/pere/blog/2_Spykee_roboter_i_hus__n___skal_det_lekes.html">2 Spykee-roboter i hus, nå skal det lekes</a></div>
 240   <div class="date">2010-08-18 13:30</div>
 241   <div class="body">
 242 <p>Jeg kjøpte nettopp to
 243 <a href="http://www.spykee-robot.com/">Spykee</a>-roboter, for test og
 244 leking.  Kjøpte to da det var så billige, og gir meg mulighet til å
 245 eksperimentere uten å være veldig redd for å ødelegge alt ved å bytte
 246 ut firmware og slikt.  Oppdaget at lekebutikken på Bryn senter hadde
 247 en liten stabel på lager som de ikke hadde klart å selge ut etter
 248 fjorårets juleinnkjøp, og var villig til å selge for en femtedel av
 249 vanlig pris.  Jeg, Ronny og Jarle har skaffet oss restbeholdningen, og
 250 det blir morsomt å se hva vi får ut av dette.</p>
 251
 252 <p>Roboten har belter styrt av to motorer, kamera, høytaler, mikrofon
 253 og wifi-tilkobling.  Det hele styrt av en GPL-lisensiert databoks som
 254 jeg mistenker kjører linux.  Firmware-kildekoden ble visst publisert i
 255 mai.  Eneste utfordringen er at kontroller-programvaren kun finnes til
 256 Windows, men det må en kunne jobbe seg rundt når vi har kildekoden til
 257 firmwaren. :)</p>
 258
 259 <ul>
 260 <li><a href="http://en.wikipedia.org/wiki/Spykee">Wikipedia-oppføring</a></li>
 261 <li><a href=http://www.spykeeworld.com/spykee/US/freeSoftware.html">Nedlasting av firmware-kilden</a></li>
 262 <li><a href="http://wiki.nuug.no/grupper/robot">prosjektwiki hos NUUG</a></li>
 263 </ul>
 264 </div>
 265   <div class="tags">
 266
 267
 268
 269    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/robot">robot</a>.
 270
 271   </div>
 272  </div>
 273  <div class="padding"></div>
 274
 275  <div class="entry">
 276   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Rob_Weir__How_to_Crush_Dissent.html">Rob Weir: How to Crush Dissent</a></div>
 277   <div class="date">2010-08-15 22:20</div>
 278   <div class="body">
 279 <p>I found the notes from Rob Weir on
 280 <a href="http://feedproxy.google.com/~r/robweir/antic-atom/~3/VGb23-kta8c/how-to-crush-dissent.html">how
 281 to crush dissent</a> matching my own thoughts on the matter quite
 282 well.  Highly recommended for those wondering which road our society
 283 should go down.  In my view we have been heading the wrong way for a
 284 long time.</p>
 285 </div>
 286   <div class="tags">
 287
 288
 289
 290    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 291
 292   </div>
 293  </div>
 294  <div class="padding"></div>
 295
 296  <div class="entry">
 297   <div class="title"><a href="http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html">No hardcoded config on Debian Edu clients</a></div>
 298   <div class="date">2010-08-09 20:15</div>
 299   <div class="body">
 300 <p>As reported earlier, the last few days I have looked at how Debian
 301 Edu clients are configured, and tried to get rid of all hardcoded
 302 configuration settings on the clients.  I believe the work to be
 303 mostly done, and the clients seem to work just fine with dynamically
 304 generated configuration.</p>
 305
 306 <p>What is the point, you might ask?  The point is to allow a Debian
 307 Edu desktop to integrate into an existing network infrastructure
 308 without any manual configuration.</p>
 309
 310 <p>This is what happens when installing a Debian Edu client here at
 311 the University of Oslo using PXE.  With the PXE installation, I am
 312 asked for language (Norwegian Bokmål), locality (Norway) and keyboard
 313 layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
 314 accept to reformat the hard drive (yes), if I want to submit info to
 315 popcon.debian.org (no) and root password (secret).  After answering
 316 these questions, the installer goes ahead and does its thing, and
 317 after around 50 minutes it is done.  I press enter to finish the
 318 installation, and the machine reboots into KDE.  When the machine is
 319 ready and kdm asks for login information, I enter my university
 320 username and password, am told by kdm that a local home directory has
 321 been created and that I must log in again, and finally log in with the
 322 same username and password to the KDE 4.4 desktop.  At no point during
 323 this process did it ask for university specific settings, and all the
 324 required configuration was dynamically detected using information
 325 fetched via DHCP and DNS.  The roaming workstation is now ready for
 326 use.</p>
 327
 328 <p>How was this done, you might wonder?  First of all, here is the
 329 list of things that need to be configured on the client to get it
 330 working properly out of the box:</p>
 331
 332 <ul>
 333 <li>IP address/netmask and DNS server.</li>
 334 <li>Web proxy URL.</li>
 335 <li>LDAP server for NSS directory information (user, group, etc).</li>
 336 <li>Kerberos server for PAM password checking.</li>
 337 <li>SMB mount point to access the network home directory. (*)</li>
 338 <li>Central syslog server to send syslog messages to. (*)</li>
 339 <li>Sitesummary collector URL to submit info to central server. (*)</li>
 340 </ul>
 341
 342 <p>(Hm, did I forget anything?  Let me knew if I did.)</p>
 343
 344 <p>The points marked (*) are not required to be able to use the
 345 machine, but needed to provide central storage and allowing system
 346 administrators to track their machines.  Since yesterday, everything
 347 but the sitesummary collector URL is dynamically discovered at boot
 348 and installation time in the svn version of Debian Edu.</p>
 349
 350 <p>The IP and DNS setup is fetched during boot using DHCP as usual.
 351 When a DHCP update arrives, the proxy setup is updated by looking for
 352 http://wpat/wpad.dat and using the content of this WPAD file to
 353 configure the http and ftp proxy in /etc/environment and
 354 /etc/apt/apt.conf.  I decided to update the proxy setup using a DHCP
 355 hook to ensure that the client stops using the Debian Edu proxy when
 356 it is moved outside the Debian Edu network, and instead uses any local
 357 proxy present on the new network when it moves around.</p>
 358
 359 <p>The DNS names of the LDAP, Kerberos and syslog server and related
 360 configuration are generated using DNS information at boot.  First the
 361 installer looks for a host named ldap in the current DNS domain.  If
 362 not found, it looks for _ldap._tcp SRV records in DNS instead.  If an
 363 LDAP server is found, its root DSE entry is requested and the
 364 attributes namingContexts and defaultNamingContext are used to
 365 determine which LDAP base to use for NSS.  If there are several
 366 namingContexts attibutes and the defaultNamingContext is present, that
 367 LDAP subtree is used as the base.  If defaultNamingContext is missing,
 368 the subtrees listed as namingContexts are searched in sequence for any
 369 object with class posixAccount or posixGroup, and the first one with
 370 such an object is used as the LDAP base.  For Kerberos, a similar
 371 search is done by first looking for a host named kerberos, and then
 372 for the _kerberos._tcp SRV record.  I've been unable to find a way to
 373 look up the Kerberos realm, so for this the upper case string of the
 374 current DNS domain is used.</p>
 375
 376 <p>For the syslog server, the hosts syslog and loghost are searched
 377 for, and the _syslog._udp SRV record is consulted if no such host is
 378 found.  This algorithm works for both Debian Edu and the University of
 379 Oslo.  A similar strategy would work for locating the sitesummary
 380 server, but have not been implemented yet.  I decided to fetch and
 381 save these settings during installation, to make sure moving to a
 382 different network does not change the set of users being allowed to
 383 log in nor the passwords required to log in.  Usernames and passwords
 384 will be cached by sssd when the user logs in on the Debian Edu
 385 network, and will not change as the laptop move around.  For a
 386 non-roaming machine, there is no caching, but given that it is
 387 supposed to stay in place it should not matter much.  Perhaps we
 388 should switch those to use sssd too?</p>
 389
 390 <p>The user's SMB mount point for the network home directory is
 391 located when the user logs in for the first time.  The LDAP server is
 392 consulted to look for the user's LDAP object and the sambaHomePath
 393 attribute is used if found.  If it isn't found, the home directory
 394 path fetched from NSS is used instead.  Assuming the path is of the
 395 form /site/server/directory/username, the second part is looked up in
 396 DNS and used to generate a SMB URL of the form
 397 smb://server.domain/username.  This algorithm works for both Debian
 398 edu and the University of Oslo.  Perhaps there are better attributes
 399 to use or a better algorithm that works for more sites, but this will
 400 do for now. :)</p>
 401
 402 <p>This work should make it easier to integrate the Debian Edu clients
 403 into any LDAP/Kerberos infrastructure, and make the current setup even
 404 more flexible than before.  I suspect it will also work for thin
 405 client servers, allowing one to easily set up LTSP and hook it into a
 406 existing network infrastructure, but I have not had time to test this
 407 yet.</p>
 408
 409 <p>If you want to help out with implementing these things for Debian
 410 Edu, please contact us on debian-edu@lists.debian.org.</p>
 411
 412 <p>Update 2010-08-09: Simon Farnsworth gave me a heads-up on how to
 413 detect Kerberos realm from DNS, by looking for _kerberos TXT entries
 414 before falling back to the upper case DNS domain name.  Will have to
 415 implement it for Debian Edu. :)</p>
 416 </div>
 417   <div class="tags">
 418
 419
 420
 421    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 422
 423   </div>
 424  </div>
 425  <div class="padding"></div>
 426
 427  <div class="entry">
 428   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">Testing if a file system can be used for home directories...</a></div>
 429   <div class="date">2010-08-08 21:20</div>
 430   <div class="body">
 431 <p>A few years ago, I was involved in a project planning to use
 432 Windows file servers as home directory servers for Debian
 433 Edu/Skolelinux machines.  This was thought to be no problem, as the
 434 access would be through the SMB network file system protocol, and we
 435 knew other sites used SMB with unix and samba as the file server to
 436 mount home directories without any problems.  But, after months of
 437 struggling, we had to conclude that our goal was impossible.</p>
 438
 439 <p>The reason is simply that while SMB can be used for home
 440 directories when the file server is Samba running on Unix, this only
 441 work because of Samba have some extensions and the fact that the
 442 underlying file system is a unix file system.  When using a Windows
 443 file server, the underlying file system do not have POSIX semantics,
 444 and several programs will fail if the users home directory where they
 445 want to store their configuration lack POSIX semantics.</p>
 446
 447 <p>As part of this work, I wrote a small C program I want to share
 448 with you all, to replicate a few of the problematic applications (like
 449 OpenOffice.org and GCompris) and see if the file system was working as
 450 it should.  If you find yourself in spooky file system land, it might
 451 help you find your way out again.  This is the fs-test.c source:</p>
 452
 453 <pre>
 454 /*
 455  * Some tests to check the file system sematics.  Used to verify that
 456  * CIFS from a windows server do not work properly as a linux home
 457  * directory.
 458  * License: GPL v2 or later
 459  *
 460  * needs libsqlite3-dev and build-essential installed
 461  * compile with: gcc -Wall -lsqlite3 -DTEST_SQLITE fs-test.c -o fs-test
 462 */
 463
 464 #define _FILE_OFFSET_BITS 64
 465 #define _LARGEFILE_SOURCE 1
 466 #define _LARGEFILE64_SOURCE 1
 467
 468 #define _GNU_SOURCE /* for asprintf() */
 469
 470 #include &lt;errno.h>
 471 #include &lt;fcntl.h>
 472 #include &lt;stdio.h>
 473 #include &lt;string.h>
 474 #include &lt;stdlib.h>
 475 #include &lt;sys/file.h>
 476 #include &lt;sys/stat.h>
 477 #include &lt;sys/types.h>
 478 #include &lt;unistd.h>
 479
 480 #ifdef TEST_SQLITE
 481 /*
 482  * Test sqlite open, as done by gcompris require the libsqlite3-dev
 483  * package and linking with -lsqlite3.  A more low level test is
 484  * below.
 485  * See also &lt;URL: http://www.sqlite.org./faq.html#q5 >.
 486  */
 487 #include &lt;sqlite3.h>
 488 #define CREATE_TABLE_USERS                                              \
 489   "CREATE TABLE users (user_id INT UNIQUE, login TEXT, lastname TEXT, firstname TEXT, birthdate TEXT, class_id INT ); "
 490 int test_sqlite_open(void) {
 491   char *zErrMsg;
 492   char *name = "testsqlite.db";
 493   sqlite3 *db=NULL;
 494   unlink(name);
 495   int rc = sqlite3_open(name, &db);
 496   if( rc ){
 497     printf("error: sqlite open of %s failed: %s\n", name, sqlite3_errmsg(db));
 498     sqlite3_close(db);
 499     return -1;
 500   }
 501
 502   /* create tables */
 503   rc = sqlite3_exec(db,CREATE_TABLE_USERS, NULL,  0, &zErrMsg);
 504   if( rc != SQLITE_OK ){
 505     printf("error: sqlite table create failed: %s\n", zErrMsg);
 506     sqlite3_close(db);
 507     return -1;
 508   }
 509   printf("info: sqlite worked\n");
 510   sqlite3_close(db);
 511   return 0;
 512 }
 513 #endif /* TEST_SQLITE */
 514
 515 /*
 516  * Demonstrate locking issue found in gcompris using sqlite3.  This
 517  * work with ext3, but not with cifs server on Windows 2003.  This is
 518  * done in the sqlite3 library.
 519  * See also
 520  * &lt;URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html> and the
 521  * POSIX specification
 522  * &lt;URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html>.
 523  */
 524 int test_gcompris_locking(void) {
 525   struct flock fl;
 526   char *name = "testsqlite.db";
 527   unlink(name);
 528   int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, 0644);
 529   printf("info: testing fcntl locking\n");
 530
 531   fl.l_whence = SEEK_SET;
 532   fl.l_pid    = getpid();
 533   printf("  Read-locking 1 byte from 1073741824");
 534   fl.l_start  = 1073741824;
 535   fl.l_len    = 1;
 536   fl.l_type   = F_RDLCK;
 537   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 538
 539   printf("  Read-locking 510 byte from 1073741826");
 540   fl.l_start  = 1073741826;
 541   fl.l_len    = 510;
 542   fl.l_type   = F_RDLCK;
 543   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 544
 545   printf("  Unlocking 1 byte from 1073741824");
 546   fl.l_start  = 1073741824;
 547   fl.l_len    = 1;
 548   fl.l_type   = F_UNLCK;
 549   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 550
 551   printf("  Write-locking 1 byte from 1073741824");
 552   fl.l_start  = 1073741824;
 553   fl.l_len    = 1;
 554   fl.l_type   = F_WRLCK;
 555   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 556
 557   printf("  Write-locking 510 byte from 1073741826");
 558   fl.l_start  = 1073741826;
 559   fl.l_len    = 510;
 560   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 561
 562   printf("  Unlocking 2 byte from 1073741824");
 563   fl.l_start  = 1073741824;
 564   fl.l_len    = 2;
 565   fl.l_type   = F_UNLCK;
 566   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 567
 568   close(fd);
 569   return 0;
 570 }
 571
 572 /*
 573  * Test if permissions of freshly created directories allow entries
 574  * below them.  This was a problem with OpenOffice.org and gcompris.
 575  * Mounting with option 'sync' seem to solve this problem while
 576  * slowing down file operations.
 577  */
 578 int test_subdirectory_creation(void) {
 579 #define LEVELS 5
 580   char *path = strdup("test");
 581   char *dirs[LEVELS];
 582   int level;
 583   printf("info: testing subdirectory creation\n");
 584   for (level = 0; level &lt; LEVELS; level++) {
 585     char *newpath = NULL;
 586     if (-1 == mkdir(path, 0777)) {
 587       printf("  error: Unable to create directory '%s': %s\n",
 588              path, strerror(errno));
 589       break;
 590     }
 591     asprintf(&newpath, "%s/%s", path, "test");
 592     free(path);
 593     path = newpath;
 594   }
 595   return 0;
 596 }
 597
 598 /*
 599  * Test if symlinks can be created.  This was a problem detected with
 600  * KDE.
 601  */
 602 int test_symlinks(void) {
 603   printf("info: testing symlink creation\n");
 604   unlink("symlink");
 605   if (-1 == symlink("file", "symlink"))
 606     printf("  error: Unable to create symlink\n");
 607   return 0;
 608 }
 609
 610 int main(int argc, char **argv) {
 611   printf("Testing POSIX/Unix sematics on file system\n");
 612   test_symlinks();
 613   test_subdirectory_creation();
 614 #ifdef TEST_SQLITE
 615   test_sqlite_open();
 616 #endif /* TEST_SQLITE */
 617   test_gcompris_locking();
 618   return 0;
 619 }
 620 </pre>
 621
 622 <p>When everything is working, it should print something like
 623 this:</p>
 624
 625 <pre>
 626 Testing POSIX/Unix sematics on file system
 627 info: testing symlink creation
 628 info: testing subdirectory creation
 629 info: sqlite worked
 630 info: testing fcntl locking
 631   Read-locking 1 byte from 1073741824
 632   Read-locking 510 byte from 1073741826
 633   Unlocking 1 byte from 1073741824
 634   Write-locking 1 byte from 1073741824
 635   Write-locking 510 byte from 1073741826
 636   Unlocking 2 byte from 1073741824
 637 </pre>
 638
 639 <p>I do not remember the exact details of the problems we saw, but one
 640 of them was with locking, where if I remember correctly, POSIX allow a
 641 read-only lock to be upgraded to a read-write lock without unlocking
 642 the read-only lock (while Windows do not).  Another was a bug in the
 643 CIFS/SMB client implementation in the Linux kernel where directory
 644 meta information would be wrong for a fraction of a second, making
 645 OpenOffice.org fail to create its deep directory tree because it was
 646 not allowed to create files in its freshly created directory.</p>
 647
 648 <p>Anyway, here is a nice tool for your tool box, might you never need
 649 it. :)</p>
 650 </div>
 651   <div class="tags">
 652
 653
 654
 655    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 656
 657   </div>
 658  </div>
 659  <div class="padding"></div>
 660
 661  <div class="entry">
 662   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html">Autodetecting Client setup for roaming workstations in Debian Edu</a></div>
 663   <div class="date">2010-08-07 14:45</div>
 664   <div class="body">
 665 <p>A few days ago, I
 666 <a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">tried
 667 to install</a> a Roaming workation profile from Debian Edu/Squeeze
 668 while on the university network here at the University of Oslo, and
 669 noticed how much had to change to get it operational using the
 670 university infrastructure.  It was fairly easy, but it occured to me
 671 that Debian Edu would improve a lot if I could get the client to
 672 connect without any changes at all, and thus let the client configure
 673 itself during installation and first boot to use the infrastructure
 674 around it.  Now I am a huge step further along that road.</p>
 675
 676 <p>With our current squeeze-test packages, I can select the roaming
 677 workstation profile and get a working laptop connecting to the
 678 university LDAP server for user and group and our active directory
 679 servers for Kerberos authentication.  All this without any
 680 configuration at all during installation.  My users home directory got
 681 a bookmark in the KDE menu to mount it via SMB, with the correct URL.
 682 In short, openldap and sssd is correctly configured.  In addition to
 683 this, the client look for http://wpad/wpad.dat to configure a web
 684 proxy, and when it fail to find it no proxy settings are stored in
 685 /etc/environment and /etc/apt/apt.conf.  Iceweasel and KDE is
 686 configured to look for the same wpad configuration and also do not use
 687 a proxy when at the university network.  If the machine is moved to a
 688 network with such wpad setup, it would automatically use it when DHCP
 689 gave it a IP address.</p>
 690
 691 <p>The LDAP server is located using DNS, by first looking for the DNS
 692 entry ldap.$domain.  If this do not exist, it look for the
 693 _ldap._tcp.$domain SRV records and use the first one as the LDAP
 694 server.  Next, it connects to the LDAP server and search all
 695 namingContexts entries for posixAccount or posixGroup objects, and
 696 pick the first one as the LDAP base.  For Kerberos, a similar
 697 algorithm is used to locate the LDAP server, and the realm is the
 698 uppercase version of $domain.</p>
 699
 700 <p>So, what is not working, you might ask.  SMB mounting my home
 701 directory do not work.  No idea why, but suspected the incorrect
 702 Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
 703 the cause.  These are not properly configured during installation, and
 704 had to be hand-edited to get the correct Kerberos realm and server,
 705 but SMB mounting still do not work. :(</p>
 706
 707 <p>With this automatic configuration in place, I expect a Debian Edu
 708 roaming profile installation would be able to automatically detect and
 709 connect to any site using LDAP and Kerberos for NSS directory and PAM
 710 authentication.  It should also work out of the box in a Active
 711 Directory environment providing posixAccount and posixGroup objects
 712 with UID and GID values.</p>
 713
 714 <p>If you want to help out with implementing these things for Debian
 715 Edu, please contact us on debian-edu@lists.debian.org.</p>
 716 </div>
 717   <div class="tags">
 718
 719
 720
 721    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 722
 723   </div>
 724  </div>
 725  <div class="padding"></div>
 726
 727  <div class="entry">
 728   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">Debian Edu roaming workstation - at the university of Oslo</a></div>
 729   <div class="date">2010-08-03 23:30</div>
 730   <div class="body">
 731 <p>The new roaming workstation profile in Debian Edu/Squeeze is fairly
 732 similar to the laptop setup am I working on using Ubuntu for the
 733 University of Oslo, and just for the heck of it, I tested today how
 734 hard it would be to integrate that profile into the university
 735 infrastructure.  In this case, it is the university LDAP server,
 736 Active Directory Kerberos server and SMB mounting from the Netapp file
 737 servers.</p>
 738
 739 <p>I was pleasantly surprised that the only three files needed to be
 740 changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
 741 /etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
 742 (/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
 743 Most of the changes were to get the client to use the university LDAP
 744 for NSS and Kerberos server for PAM, but one was to change a hard
 745 coded DNS domain name in the mklocaluser hook from .intern to
 746 .uio.no.</p>
 747
 748 <p>This testing was so encouraging, that I went ahead and adjusted the
 749 Debian Edu scripts and setup in subversion to centralise the roaming
 750 workstation setup a bit more and avoid the hardcoded DNS domain name,
 751 so that when I test this tomorrow, I expect to get away with modifying
 752 only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
 753 university servers.</p>
 754
 755 <p>My goal is to get the clients to have no hardcoded settings and
 756 fetch all their initial setup during installation and first boot, to
 757 allow them to be inserted also into environments where the default
 758 setup in Debian Edu has been changed or as with the university, where
 759 the environment is different but provides the protocols Debian Edu
 760 uses.</p>
 761 </div>
 762   <div class="tags">
 763
 764
 765
 766    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 767
 768   </div>
 769  </div>
 770  <div class="padding"></div>
 771
 772  <div class="entry">
 773   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html">Circular package dependencies harms apt recovery</a></div>
 774   <div class="date">2010-07-27 23:50</div>
 775   <div class="body">
 776 <p>I discovered this while doing
 777 <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">automated
 778 testing of upgrades from Debian Lenny to Squeeze</a>.  A few packages
 779 in Debian still got circular dependencies, and it is often claimed
 780 that apt and aptitude should be able to handle this just fine, but
 781 some times these dependency loops causes apt to fail.</p>
 782
 783 <p>An example is from todays
 784 <a href="http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt">upgrade
 785 of KDE using aptitude</a>.  In it, a bug in kdebase-workspace-data
 786 causes perl-modules to fail to upgrade.  The cause is simple.  If a
 787 package fail to unpack, then only part of packages with the circular
 788 dependency might end up being unpacked when unpacking aborts, and the
 789 ones already unpacked will fail to configure in the recovery phase
 790 because its dependencies are unavailable.</p>
 791
 792 <p>In this log, the problem manifest itself with this error:</p>
 793
 794 <blockquote><pre>
 795 dpkg: dependency problems prevent configuration of perl-modules:
 796  perl-modules depends on perl (>= 5.10.1-1); however:
 797   Version of perl on system is 5.10.0-19lenny2.
 798 dpkg: error processing perl-modules (--configure):
 799  dependency problems - leaving unconfigured
 800 </pre></blockquote>
 801
 802 <p>The perl/perl-modules circular dependency is already
 803 <a href="http://bugs.debian.org/527917">reported as a bug</a>, and will
 804 hopefully be solved as soon as possible, but it is not the only one,
 805 and each one of these loops in the dependency tree can cause similar
 806 failures.  Of course, they only occur when there are bugs in other
 807 packages causing the unpacking to fail, but it is rather nasty when
 808 the failure of one package causes the problem to become worse because
 809 of dependency loops.</p>
 810
 811 <p>Thanks to
 812 <a href="http://lists.debian.org/debian-devel/2010/06/msg00116.html">the
 813 tireless effort by Bill Allombert</a>, the number of circular
 814 dependencies
 815 <a href="http://debian.semistable.com/debgraph.out.html">left in Debian
 816 is dropping</a>, and perhaps it will reach zero one day. :)</p>
 817
 818 <p>Todays testing also exposed a bug in
 819 <a href="http://bugs.debian.org/590605">update-notifier</a> and
 820 <a href="http://bugs.debian.org/590604">different behaviour</a> between
 821 apt-get and aptitude, the latter possibly caused by some circular
 822 dependency.  Reported both to BTS to try to get someone to look at
 823 it.</p>
 824 </div>
 825   <div class="tags">
 826
 827
 828
 829    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 830
 831   </div>
 832  </div>
 833  <div class="padding"></div>
 834
 835  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 836
 837 <div id="sidebar">
 838
 839
 840
 841
 842
 843 <h2>Archive</h2>
 844 <ul>
 845
 846 <li>2010
 847 <ul>
 848
 849 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 850
 851 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 852
 853 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 854
 855 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 856
 857 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 858
 859 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 860
 861 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 862
 863 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (9)</a></li>
 864
 865 </ul></li>
 866
 867 <li>2009
 868 <ul>
 869
 870 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 871
 872 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 873
 874 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 875
 876 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 877
 878 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 879
 880 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 881
 882 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 883
 884 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 885
 886 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 887
 888 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 889
 890 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 891
 892 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 893
 894 </ul></li>
 895
 896 <li>2008
 897 <ul>
 898
 899 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 900
 901 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 902
 903 </ul></li>
 904
 905 </ul>
 906
 907
 908
 909 <h2>Tags</h2>
 910 <ul>
 911
 912  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 913
 914  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 915
 916  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 917
 918  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
 919
 920  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (35)</a></li>
 921
 922  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (41)</a></li>
 923
 924  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (57)</a></li>
 925
 926  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 927
 928  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (8)</a></li>
 929
 930  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
 931
 932  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
 933
 934  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (2)</a></li>
 935
 936  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 937
 938  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 939
 940  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (74)</a></li>
 941
 942  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (97)</a></li>
 943
 944  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (14)</a></li>
 945
 946  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (15)</a></li>
 947
 948  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 949
 950  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (2)</a></li>
 951
 952  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 953
 954  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (12)</a></li>
 955
 956  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
 957
 958  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
 959
 960  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 961
 962  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 963
 964  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 965
 966  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
 967
 968 </ul>
 969
 970 </div>
 971
 972 <p style="text-align: right">
 973 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
 974 </p>
 975 </body>
 976 </html>