Krzysztof Burghardt’s blog » English

ESE Key Daemon 1.2.7 released

Krzysztof Burghardt — Mon, 05 Jul 2010 07:35:52 +0000

New version of ESE Key Daemon was released today.

New features include the ability to handle multiple key combinations and distinguish between key presses and releases. A problem with the handling of the last line in a configuration file when there is no newline on the last line is gone. Numeric keys are now also allowed in the configuration file.

Download: esekeyd-1.2.7.tar.gz (.asc)

MD5: 5937ad6d7815dbc6ab6983411a9f37d4
SHA1: 07671be42b61973a3270aaf1b41c3467568ae7ac

Debian GNU/Linux on Dell Inspiron 1764

Krzysztof Burghardt — Mon, 26 Apr 2010 18:17:59 +0000

Installing, configuring and using Debian GNU/Linux on Dell Inspiron 1764 (N0476409) notebook.

Hardware overview

Intel Core i5-520M (2.4GHz, 4 Threads, turbo Boost up to 2.93GHz, 3M cache)
17.3″ WLED High Definition+ (1600×900) TFT Display
1GB ATI Mobility Radeon HD 5450
4096MB 1067MHz Dual Channel DDR3 SDRAM (2×2048)
500GB (5400RPM) Serial ATA Hard Drive
DVD +/- RW Drive (read/write CD & DVD)
Dell Wireless 1520 (802.11a/b/g/n)
Dell Bluetooth 365
Integrated 1,3MP webcam

Devices that works with Linux

CPU: both cores and HT works, recent Linux kernels support speedstep,
USB: works (even with Debian Installer images),
DVD+/-RW: works (even with Debian Installer images),
Graphic: basic features (2D, hardware accelerated 3D rendering) works with proprietary drivers only, most other features (CAL, POWERplay, multihead) unsupported; no FLOSS alternative,
Sound: works, but I need to pass options to module to make sound work properly,
Ethernet: works (even with Debian Installer images),
Wireless LAN: basic features (STA mode) supported by proprietary drivers only, other features (monitor mode and packet injection) not supported; no FLOSS alternative,
Bluetooth: works (as HCI only after reset with hid2hci),
Card reader: works (tested with MicroSD and Memory Stick PRO Duo, both with adapters),
Webcam: works.

Also “Suspend to RAM” works using sysfs method of hibernate script. “Suspend to disk” works using ususpend method.

Devices that does not work with Linux

none :-D

Devices

Configuration

Graphic

Download and install fglrx driver. Google is full of instruction how to install it, so I skip this step.

When driver is installed and fglrx is loaded into kernel its time to configure X.Org. Probably aticonfig would be best choice, but it fails on Mobility Radeon HD 5000 series cards with message:

# aticonfig --initial
aticonfig: No supported adapters detected

Download my xorg.conf and put it into /etc/X11 directory. Then start X-server using startx command. My default layout include Inspiron’s built-in TFT screen, ATI Mobility Radeon HD 5450, ALPS touchpad and any other mice connected to it.

You will probably see “AMD unsupported hardware” watermark in lower right corner of the screen. There is no configuration option to remove it. Removal is possible by patching fglrx_drv.so file. Kano posted small script to replace call to EnableLogo with NOPs on Phoronix Forums’ thread “Unsupported Hardware watermark”:

#!/bin/sh
DRIVER=/usr/lib/xorg/modules/drivers/fglrx_drv.so
for x in $(objdump -d $DRIVER|awk '/call/&&/EnableLogo/{print "\\x"$2"\\x"$3"\\x"$4"\\x"$5"\\x"$6}'); do
sed -i "s/$x/\x90\x90\x90\x90\x90/g" $DRIVER
done

Sound

Create file /etc/modprobe.d/sound with following content:

alias snd-card-0 snd-hda-intel
options snd-hda-intel model=dell index=0

Reload alsa driver (or reboot).

Wireless LAN

Drivers need to be compiled from sources. First prepare your system for kernel module building. Install build-essential and module-assistant packages.Then prepare kernel headers:

# aptitude install build-essential module-assistant
# m-a prepare

When kernel headers are ready download 802.11 Linux STA driver for Broadcom’s IEEE 802.11a/b/g/n devices (this includes BCM4311, BCM4312, BCM4313, BCM4321 and BCM4322). Compile it. Install. And finally load into running kernel:

# cd /usr/src
# wget http://www.broadcom.com/docs/linux_sta/hybrid-portsrc-x86_64-v5.60.48.36.tar.gz
# mkdir hybrid-portsrc-x86_64-v5.60.48.36
# cd hybrid-portsrc-x86_64-v5.60.48.36
# tar zxf ../hybrid-portsrc-x86_64-v5.60.48.36.tar.gz
# make
# mkdir /lib/modules/`uname -r`/local
# cp wl.ko /lib/modules/`uname -r`/local
# depmod -A
# modprobe -v wl

Command dmesg | tail should output something similar to this:

wlan0: Broadcom BCM4353 802.11 Hybrid Wireless Controller 5.60.48.36

Bluetooth

Dell Bluetooth 365 is detected as HCI on kernel 2.6.32-bpo.4-amd64 only if previously reset with hid2hci (get a copy form bluez 4.6). This is actually a feature, not a bug. Use recent hid2hci to put device into HCI mode:

# hid2hci -m dell -v 413c -p 8162
Attempting to switch device 413c:8162 to HCI mode was successful

Integration of AA Google 404 with Atahualpa

Krzysztof Burghardt — Fri, 13 Nov 2009 01:41:55 +0000

AskApache Google 404 default 404.php does not work properly with Atahualpa theme. To fix those problems create another 404.php file in /themes/atahualpa with this content:

ob_start();

include(TEMPLATEPATH . '/functions/bfa_get_options.php');
get_header();

if (function_exists('aa_google_404'))
aa_google_404();
else
{
?>

_e('Not Found','atahualpa'); ?>

_e("Sorry, but you are looking for something that isn't here.","atahualpa"); ?>

}

bfa_center_content($bfa_ata['center_content_bottom']);

get_footer();

exit();

?>

When it is done, choose wp-content/themes/atahualpa/404.php as 404 File Handling and enable AA Google 404.

Virtual destinations are faster than Camel routing

Krzysztof Burghardt — Sat, 31 Oct 2009 20:26:08 +0000

Routing messages from one input queue to two output queues in ActiveMQ can be done in two different ways. Apache Camel, a powerful rule-based routing engine often used with ActiveMQ, is a typical choice. Virtual composite queue is another solution. Which to choose? The faster.

Apache Camel

Camel configuration I use:

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://camel.apache.org/schema/spring http://camel.apache.org/schema/spring/camel-spring.xsd">

id="camel" xmlns="http://camel.apache.org/schema/spring">
>
uri="activemq:INPUT-QUEUE"/>
uri="activemq:OUTPUT-1-QUEUE"/>
uri="activemq:OUTPUT-2-QUEUE"/>
>
>

id="activemq" class="org.apache.activemq.camel.component.ActiveMQComponent" >
name="connectionFactory">
class="org.apache.activemq.ActiveMQConnectionFactory">
name="brokerURL" value="vm://localhost?create=false&waitForStart=10000" />
name="userName" value="${activemq.username}"/>
name="password" value="${activemq.password}"/>
>
>
>
>

Benchmark took 3 minutes 31 seconds to send 10 thousand messages through Camel:

$ time ./amqinject INPUT-QUEUE 10000
0.651u 0.490s 3:31.43 0.5%      0+0k 0+0io 0pf+0w

Unfortunately “Number Of Pending Messages” was always about 1024 and amqinject gets blocked in send() call:

INFO | Usage Manager memory limit reached on queue://INPUT-QUEUE. Producers will be throttled to the rate at which messages are removed from this destination to prevent flooding it. See http://activemq.apache.org/producer-flow-control.html for more info

Virtual Composite Queue

Virtual destinations are configured in tag. Here is my configuration:

>
physicalName="INPUT-QUEUE" />
physicalName="OUTPUT-1-QUEUE" />
physicalName="OUTPUT-2-QUEUE" />
>

>
>
>
name="INPUT-QUEUE">
>
physicalName="OUTPUT-1-QUEUE" />
physicalName="OUTPUT-2-QUEUE" />
>
>
>
>
>

Amqinject never blocked and it took only 2 minutes 29 seconds to complete:

% time ./amqinject INPUT-QUEUE 10000
0.718u 0.539s 2:29.33 0.8%      0+0k 0+0io 0pf+0w

Migrating from ActiveMQ-CPP/CMS version 2.2 to 3.0

Krzysztof Burghardt — Sun, 23 Aug 2009 00:02:55 +0000

Migrating from ActiveMQ-CPP/CMS version 2.2.6 to 3.0.1 is very easy. There are only two minor problems to deal with.

First problem: exceptions

No idea what “N3cms12CMSExceptionE” is? Use getCause() on cms::CMSException
objects to get std::exception*. Do not call what() directly. Do not try to call what() from any base classes.

catch (cms::CMSException& e) {
cout << e.getCause()->what() << endl;
}

And now “N3cms12CMSExceptionE” is “No Matching Factory Registered for format := tcp”.

Second problem: library initialization

“No Matching Factory Registered for format := tcp” suggests that library was not initialized properly or some protocol-related modules was not loaded. Version 3.0 (and above) requires explicit initialization of ActiveMQ library.

To fix this problem include activemq/library/ActiveMQCPP.h and call ActiveMQCPP::initializeLibrary().

#include
// ...
activemq::library::ActiveMQCPP::initializeLibrary();

FreeBSD with X.Org on QEMU

Krzysztof Burghardt — Fri, 27 Mar 2009 19:03:03 +0000

X.Org form ports works fine with cirrus driver, but starts in 800×600 only. Small tweak to configuration file is needed to run X in higher resolutions.

Install X.Org and drivers

First install xorg, xf86-video-cirrus and xf86-input-keyboard ports.

DBus and HAL

Installing DBus and HAL allow X Server to guess hardware configuration and work without any configuration file.

If your console get flooded by messages like this after enabling HAL:

acd0: FAILURE - unknown CMD (0x03) ILLEGAL REQUEST asc=0x20 ascq=0x00

disable CD-ROM polling in HAL with command:

# hal-disable-polling --device /dev/acd0

Automatically configured X-Window starts in resolution as small as 800×600.

Configuring X

Create xorg.conf.new skeleton with:

# X -configure

Tweak xorg.conf.new

Add those settings to get more then 800×600:

Section "Monitor"
HorizSync 31.5 - 48.5
VertRefresh 50.0 - 90.0
Option "DPMS"
EndSection

Section "Device"
Driver "cirrus"
EndSection

If you want to set specific resolution (1024×768 in this example) use:

Section "Screen"
DefaultDepth 16
SubSection "Display"
Depth 16
Modes "1024x768"
EndSubSection
EndSection

Testing X.Org setup

To test your setup run:

# X -config xorg.conf.new

Finally move xorg.conf.new to xorg.conf:

# mv xorg.conf.new /etc/X11/xorg.conf

Now X.Org is configured. Login as plain user and run startx to start X-Window session.

Sptrace 1.4.2 released

Krzysztof Burghardt — Sat, 14 Mar 2009 09:00:06 +0000

New version of sptrace was released today. Sptrace is a secure ptrace() Linux Kernel Module (LKM). It limits users’ access to the ptrace() call. Module was updated to reflect changes in new kernel releases and tested with 2.6.26.

When someone not allowed to trace processes uses program that call ptrace() (like strace, ltrace or gdb) current and parent processes names, pids, uids and euids are logged, e.g.:

Mar 13 08:51:11 ghost kernel: [ 8086.730499] sptrace: ptrace() DENIED for (gdb:6810) UID(1000) EUID(1000), parent (gdb:6785) UID(1000) EUID(1000)
Mar 13 08:51:11 ghost kernel: [ 8086.984694] sptrace: ptrace() DENIED for (gdb:6785) UID(1000) EUID(1000), parent (tcsh:32216) UID(1000) EUID(1000)
Mar 13 08:51:44 ghost kernel: [ 8119.928920] sptrace: ptrace() DENIED for (gdb:6923) UID(1000) EUID(1000), parent (tcsh:32216) UID(1000) EUID(1000)

Program that call ptrace() will get EPERM error:

$ strace ls
strace: ptrace(PTRACE_TRACEME, ...): Operation not permitted
$ ltrace ls
PTRACE_TRACEME: Operation not permitted
PTRACE_SETOPTIONS: Operation not permitted
$ gdb -p 32215
GNU gdb 6.8-debian
[...]
This GDB was configured as "i486-linux-gnu".
Attaching to process 32215
ptrace: Operation not permitted.

Module log both allowed and denied ptrace() calls. Allowed traces as logged as:

Mar 11 19:14:48 ghost kernel: [ 6445.524669] sptrace: ptrace() by (ltrace:27558) UID(1000) EUID(1000), parent (ltrace:27557) UID(1000) EUID(1000)
Mar 11 19:14:48 ghost kernel: [ 6445.525460] sptrace: ptrace() by (ltrace:27557) UID(1000) EUID(1000), parent (tcsh:26606) UID(1000) EUID(1000)

By default sptrace deny access to ptrace() to all non root users (GID != 0). Root group (or wheel) is allowed to use this call. To disable tracing for all users, including those in root group pass parameter ptrace_group=-1, e.g.:

$ insmod ./sptrace.ko ptrace_group=-1

Download: sptrace-1.4.2.tar.gz (.asc)

md5sum: 9a23198cbdcd256b11e2b0dc2c03b331
sha1sum: 458f9b15e9a5b02cd18759b6b09a4b41d062d7cd

Keep Doxyfile in sync with Autoconf

Krzysztof Burghardt — Wed, 04 Mar 2009 19:37:16 +0000

Generating Doxygen configuration file – Doxyfile from Autoconf is simple and helps to avoid duplication of version numbers, input and output directories and packages names. Doxyfile can be generated like Makefiles from Doxyfile.in by configure script.

First generate Doxyfile skeleton like usual:

$ doxygen -g Doxyfile.in

Then open Doxyfile.in in $EDITOR and set following variables:

PROJECT_NAME = @PACKAGE_NAME@
PROJECT_NUMBER = @VERSION@

INPUT = @top_srcdir@
OUTPUT_DIRECTORY = @top_builddir@/doc

RECURSIVE = YES

Finally add Doxyfile to configure.ac (or .in if you prefer .in convention):

AC_CONFIG_FILES([Makefile
...
Doxyfile
])
AC_OUTPUT

Recreate configure script and run it (just run “make” and it will do all the magic for you).

Next time you change version, package name or anything else in Autoconf Doxyfile will be recreated with updated values.

ClamFS 1.0.0 has been released

Krzysztof Burghardt — Sun, 08 Feb 2009 14:18:45 +0000

ClamFS 1.0.0 has been released yesterday. It contains some new features that might be quite interesting for its users.

Completed clamd results caching

This was a long waiting feature. Version 0.9.1 cache only information about clean files. Infected files was scanned on every access. Starting from version 1.0.0 information about both clean and infected files are kept in cache while files that cannot be scanned (mostly because of permission problems) are discarded from cache.

Starting without clamd available

A new “check” option was added to allow you to mount a ClamFS file system when clamd is not available, such as during an early stage of the boot process. To disable ClamAV Daemon (clamd) check on ClamFS startup set option check to no:

socket="/var/run/clamav/clamd.ctl" check="no" />

Mounting file systems from /etc/fstab

With “check=no” mounting ClamFS file systems form /etc/fstab is possible using fuse mount helper (/sbin/mount.fuse). ClamFS will be started on boot with configuration file defined here provided as its argument. Simple definition of ClamFS mount point in /etc/fstab looks like:

clamfs#/etc/clamfs/share.xml /clamfs/share fuse defaults 0 0

Read-only mounts

The “readonly” option was added to the filesystem options allowing you to create a read-only protected file system. Just extend filesystem definition in config file with readonly option set to yes:

root="/share" mountpoint="/clamfs/share" readonly="yes" />

File system and cache statistics

ClamFS has file system statistics that allow you to monitor and tune its performance. Statistics module keep track of file system usage and cache hits. Stats module is configured with “stats” tag. It can dump statistics periodically and on ClamFS dismount:

atexit="yes" every="3600" />

Statistics are dumped to configured logging target. Here is an example of such statistics dumped to syslog:

Feb  8 14:52:51 ghost clamfs: --- begin of statistics ---
Feb  8 14:52:51 ghost clamfs: Early cache hit: 1038
Feb  8 14:52:51 ghost clamfs: Early cache miss: 1030
Feb  8 14:52:51 ghost clamfs: Late cache hit: 1038
Feb  8 14:52:51 ghost clamfs: Late cache miss: 0
Feb  8 14:52:51 ghost clamfs: Whitelist hit: 10
Feb  8 14:52:51 ghost clamfs: Blacklist hit: 108
Feb  8 14:52:51 ghost clamfs: Files bigger than maximal-size: 3
Feb  8 14:52:51 ghost clamfs: open() function called 2081 times (allowed: 1803, denied: 278)
Feb  8 14:52:51 ghost clamfs: Scan failed 278 times
Feb  8 14:52:51 ghost clamfs: --- end of statistics ---

Better default extension blacklist

Default blacklist in configuration file was extended. I advise all users to incorporate blacklist from version 1.0.0 into their configuration files.

Multiple FreeBSD jails sharing one IP address

Krzysztof Burghardt — Sat, 10 Jan 2009 22:19:35 +0000

If you want to use multiple jails on FreeBSD with only one external IP addresses you may set up all jails on private addressed with little help of loopback interface, NAT and PF.

Networking

Each jail requires one IP address. First create lo1 loopback interface and assign IPs to it:

# ifconfig lo1 create
# ifconfig lo1 inet 10.0.0.1 netmask 255.255.255.0 alias
# ifconfig lo1 inet 10.0.0.2 netmask 255.255.255.0 alias
...

To make this permanent add following lines to /etc/rc.conf:

cloned_interfaces="lo1"
ifconfig_lo1="inet 10.0.0.254 netmask 255.255.255.0"
ifconfig_lo1_alias0="inet 10.0.0.1 netmask 255.255.255.0"
...

Now configure port redirection (forwarding) from your IP to your jails’s IPs. Here is my PF line (add it to /etc/pf.conf):

rdr on re0 proto tcp from any to ext._ip port http -> 10.0.0.1 port http
rdr on re0 proto tcp from any to ext._ip port ircd -> 10.0.0.2 port ircd
...

If jails need network access (e.g. to download ports) create NAT on your external network interface:

nat on re0 from lo1:network to any -> (re0)

Finally reload PF rules:

# pfctl -d
# pfctl -e -f /etc/pf.conf

Ezjail

Install ezjail from /usr/ports/sysutils/ezjail:

# cd /usr/ports/sysutils/ezjail
# make install clean

After ezjail installation create base jail. This jail is used as skeleton of all jails. Before creating base jail you need to have current FreeBSD sources in /usr/src. If you have built them add -i option to update command to prevent (re)building them:

# ezjail-admin update

Creating jails

When basejail is installed we are ready to create jails:

# ezjail-admin create -f default apachejail 10.0.0.1
# ezjail-admin create -f default ircjail 10.0.0.2