Paul's Blog Entries for May 2006

Monday 1st May 2006

Local Packages

Wrestled with proftpd quite a bit. I noticed that Matthias' packages in Fedora Extras used the new DSO mechanism to split off modules that introduced significant additional dependencies into their own subpackages. Following this lead, I enabled just about all of the bundled modules, split off separate packages for ldap, mysql, postgresql, and tls, and then stuffed all the other non-default modules into an extras subpackage. The one that caused the most trouble was mod_facl, which prevented anonymous logins on my firewall box when enabled, and won't actually build on most older distributions because of broken libacl packages. The new version also includes a new ftpdctl tool (rather like rndc for named), so more SELinux policy updates will be needed for this.

Tuesday 2nd May 2006

Local Packages

Fedora Extras

Mail Server

Started doing server-side mail filtering using procmail in conjunction with the dovecot IMAP server.

In my main .procmailrc, I have a line near the top: 

# Try out server-side filtering for mailing lists
INCLUDERC=filter-mailing-lists

And the filter-mailing-list file contains a bunch of recipes like this: 

# Server-side filter for Paul's mailing lists

# Save MAILDIR
OLDMAILDIR=$MAILDIR

# Folders are relative to here
MAILDIR=$HOME/mail/inbox

# fedora-list
:0
* ^List-Id:.*fedora-list\.redhat\.com
.Linux.fedora-list/

# fedora-devel-list
:0
* ^List-Id:.*fedora-devel-list\.redhat\.com
.Linux.fedora-devel-list/

# ... more of the same ...

# Restore MAILDIR
MAILDIR=$OLDMAILDIR

Works very nicely, and means that I can turn off all client-side filtering so that:

  1. I get to read my mail sooner, and
  2. I don't need to set up a bunch of new filters every time I try a new mail client (e.g. when visiting my brother-in-law last month and using his computer).

Wednesday 3rdh May 2006

Car Repair

Last week the driver's side window on the Micra became detached from the regulator mechanism - again. The same problem had happened last September, and was repaired at Westway Nissan Manchester. Took it back there this morning and they repaired it for free this time.

Local Packages

There's a new version (2.0601) of perl-Devel-Symdump available upstream but a diff from the previous version shows only the addition of license text to the code, so I'm not bothering packaging an upgrade. Another reason is the issue rpm is likely to have with the numbering scheme when version 0.27 is released (rpm considers 2.0601 to be more recent than 0.27).

SELinux

Raised Bug #190561 on not being able to build SELinux policy modules in mock.

Thursday 4th May 2006

Local Packages

Tuesday 9th May 2006

Local Packages

Fedora Extras

Wednesday 10th May 2006

Fedora Extras

Local Packages

Thursday 11th May 2006

Wiki

Local Packages

Friday 12th May 2006

Local Packages

Fedora Extras

Saturday 12th May 2006

Bereavement

My grandma (dad's side) died shortly before midnight. She was 92.

Sunday 14th May 2006

Wiki

Monday 15th May 2006

Fedora Extras

Local Packages

Wiki

Tuesday 16th May 2006

Local Packages

Wiki

Wednesday 17th May 2006

Local Packages

Thursday 18th May 2006

Local Packages

Monday 22nd May 2006

Local Packages

Fedora Extras

Tuesday 23rd May 2006

Local Packages

Fedora Extras

Wednesday 24th May 2006

Wiki Breakage

Noticed this morning that the wiki wasn't working (Internal Server Error for every page). The web server error log just had this: 

[Wed May 24 09:05:05 2006] [notice] mod_fcgid: server /var/www/tips/cgi-bin/moin.fcgi(12213) started
[Wed May 24 09:05:05 2006] [error] [client 212.56.100.58] Premature end of script headers: moin.fcgi
[Wed May 24 09:05:11 2006] [notice] mod_fcgid: process /var/www/tips/cgi-bin/moin.fcgi(12213) exit(communication error), terminated by calling exit(), return code: 255

Spent half an hour or so trying to figure out what had broken mod_fcgid before settling for a temporary workaround of reinstating mod_fastcgi and running the wiki as an external FastCGI application (which worked). About ten minutes later it dawned on me what had gone wrong. Yesterday afternoon I remounted /tmp and /var with the noexec and nodev mount options. So I no longer was able to run CGI applications from /var/www. D'oh! I've now moved the web server directory from the default /var/www to /srv/www where it belongs, and have reinstated mod_fcgid.

Thursday 25th May 2006

Fedora Extras

Local Packages

Friday 26th May 2006

Local packages

Wiki

Made a new SELinux policy for the wiki running under mod_fcgid. It runs in a new domain, httpd_fastcgi_script_t, which is allowed to use unix-domain sockets, unlike httpd_sys_script_t:

apache.te: 

policy_module(apache, 0.2.1)

require {
        type devpts_t;
        type httpd_t;
        type httpd_log_t;
        type httpd_sys_script_exec_t;
        type restorecon_t;
        type var_t;
        type var_run_t;
        type webalizer_t;
};

# Allow httpd to read /var/www -> /srv/www symlink
allow httpd_t var_t:lnk_file { getattr read };

# Allow restorecon to restore file contexts via the /var/www -> /srv/www symlink
allow restorecon_t var_t:lnk_file read;

# Allow webalizer to read the routing table
allow webalizer_t self:netlink_route_socket { r_netlink_socket_perms };

# ==========================================================
# Create and use httpd_fastcgi_script_t for mod_fcgid apps
# ==========================================================

apache_content_template(fastcgi)
kernel_read_kernel_sysctls(httpd_fastcgi_script_t)

# Allow FastCGI applications to live alongside regular CGI apps
allow httpd_fastcgi_script_t httpd_sys_script_exec_t:dir { search_dir_perms };

# Allow FastCGI applications to listen for FastCGI requests on their
# sockets and respond to them
allow httpd_fastcgi_script_t httpd_t:unix_stream_socket { rw_stream_socket_perms };

# FastCGI application doing something to the httpd error log
dontaudit httpd_fastcgi_script_t httpd_log_t:file ioctl;

# Not sure what this is doing (happens when fastcgi scripts start)
dontaudit httpd_t devpts_t:chr_file ioctl;

# mod_fcgid setting attr of its socket dir
allow httpd_t var_run_t:dir setattr;

apache.fc: 

/srv/www/tips/cgi-bin/moin.fcgi --      gen_context(system_u:object_r:httpd_fastcgi_script_exec_t,s0)
/var/www/tips/cgi-bin/moin.fcgi --      gen_context(system_u:object_r:httpd_fastcgi_script_exec_t,s0)

Sunday 28th May 2006

Local Packages

Fedora Extras

Garden

Monday 29th May 2006

Fedora Extras

Having gone through my own packages looking for additional needed build requirements, I've now turned my attention to other people's packages that are failing to build in the new minimal mock environment. Raised bugs (with fixes) for gtkhtml36 and libqalculate, which are both packages whose submissions I reviewed.

Allotment

Local Packages

Tuesday 30th May 2006

Local Packages

Fedora Extras

Fedora Core

There are more packages with no bugs raised in the QA/FixBuildRequires effort than I thought. So I did my bit by raising bugs (with fixes) on policycoreutils, pkgconfig. and pump.

Wednesday 31st May 2006

Fedora Extras

Local Packages

Previous Month: April 2006
Next Month: June 2006