grep vsftpd /var/log/audit/audit.log | \
audit2allow -M vsftpd
semodule -i vsftpd.pp
vi vsftpd.te
checkmodule -M -m -o vsftpd.mod vsftpd.te
semodule_package -o vsftpd.pp -m vsftpd.mod
semodule -i vsftpd.pp More information that is accurate is better than less. Clearly there are many paths to rule generation and maintenance. The takeaway remains: Use, and do not disable, SELinux
Thanks for the feedback
"The pen is mightier than the sword"I posted a bit earlier today about the forgotten religion of Monetarism in the context of my weekend at a conference in Chicago. I had not heard mention of the faith, nor seen anyone but myself doing analysis using the old tools for a long, long time
I blogged a bit back about Jim Chanos' critique on CNBC of the new Mark to Market 'requirements' and the artificiality of the Basel II reserve requirement target value, Chanos suggesting a relaxation to a transition value of say 1.5 percent to 'conform' to Basel II in the short term. Two weeks ago, I had mentioned 'A Monetary History of the United States' (Friedman, Schwartz) to a friend wanting to understand how we got where we are; yesterday evening, I was discussing the Nixonian repudiation of Bretton Woods and the need to revisit Basel II, as I saw a clear demonstration that Basel II is defective at the conference. I do not have my notes at hand, the slide decks are not up yet, but I believe it was in the mixed currency risk analysis (Austrian, Swiss, and back to Central Europe as to residential property loans), which I believe Rheinberger gave entitled: 'VEC and GVAR Models using R' which exposed quite clearly that the 'experts' are using simple additive risk summing in Basel II, seemingly oblivious of the concept of the non-linear nature of correlated risks
The afternoon's email brings a report that Anna Schwartz is still out there as well
The old craft will live so long as a single practitioner remembers them
"Hokey religions and ancient weapons are no match for a good blaster at your side, kid."The good fight continues; I'll keep swinging with the tools I know, thanks
p.s.: I do know the regular titles for the third and sixth released Star Wars films
There is a good reason lawyers should not give, and are really uncomfortable having a client publicly discuss advice they have given in a public forumThis crossed a mailing list today:
Subject: fedora-d-rh] Re: question about patent
Without reading or looking at the patent at all, it is almost always really bad to discuss patents in public, especially on email.
Patents & patent trolls are so pervasive that you can help feed patent trolls by bringing up the possibility of infringement in these forums (even when they are marginal claims).
I have always been given guidance that engineers should never, ever do patent searches and never discuss the specifics of IP issues in email.
Amazing takeaway. The poster missed the obvious extension that really NOTHING in the way of litigation awareness and preparations should be discussed
A quick Google search using: willful ignorance of a patent yields this in a pull quote:
Courts have used terms such as *intentional blindness,[15] *blind disregard of the peril it faced[16] and *willful ignorance[17] to describe the accused infringer who did not conduct a search prior to adopting a mark
[later] ... With the ease of accessing information, it is likely that courts will increasingly find that an accused infringer's failure to conduct an appropriate search before adopting its proposed mark is a clear indicator of bad faith.
The article's author 'threads the needle' nicely, between providing general information, and not giving express advice. But he DOES assume the reader recipient will CONSIDER the implications of what is being said. Silly lawyer
Down at the bottom of that information article, we find:
The information contained in this alert is provided for informational purposes only and does not represent legal advice. Neither the APLF nor the author intends to create an attorney client relationship by providing this information to you through this message.
Time to stretch the legs, and walk down to Stauff's for a coffee
The British born, formerly American investment manager, Sir John Templeton, is attributed the following as to his craft:
The four most dangerous words in investing are 'This time it's different.'
At last night's COLUG meeting, the presenter addressed the emergence of the latest round of internet based 'social networking' applications: twitter, facebook, blogging, multi-features personal information devices (cell phones, Blackberries, iTouchs, digital cameras and the like). I say latest round, because the assertion was made that: "Terrorists have never used photo reconnaissance" and contrarian I suggested that the people of Dresden might have a different point of view
The takeaway from the matter had to be a thoughtful person needs to be mindful of the obvious and non-obvious implications of these new technologies
The ability to build a 'mosaic' image of a person, from their public 'internet persona' is only getting easier, and more accessible to a wider audience of potential prying eyes. What once required the resources of a government or major multi-national corporation to 'dig out' are perhaps thoughtlessly revealed with all good intention. See, e.g., the 'Sarah' PSA: ("Online Sexual Exploitation - Everyone Knows Your Name"), which ends with the outline: "... so think before you post"
But the information leakage is much broader than that already, and at this point not controllable by any individual. When a member of a 'private' or 'backwater' mailing list uses GMail to subscribe, every poster suddenly is added to Google's indexing corpus; when someone at a local meeting snaps a cell phone picture and posts it publicly, it feeds the automated identification algorithms publicly known (Google's Photo), and otherwise (Think: the Tampa Bay Super Bowl photo identification effort of the crowd). Note the date of the Register article just cited: 7th February 2001. This was no Bush-ian crypto facist over-reaction to the 9/11 hijackings
During the presentation last night, the first advert link offered was for anti-aging patent drugs, along side the meeting photo (full of several grey haired and bald male persons; the second link was of 'Valerie Bertinelli -- Bikini Babe!' and had a weight loss advert in the 'doubleclick' advert box on the top right; but our presenter is interested in and follows a television show 'The Biggest Loser' and is browsing weight control related sites and mailing lists. A third, rather personal example from the presenter's prior experience completed the circle to make it clear that Google's advert engine is reading every word we read or write
The first time is an occurence; the second a co-incidence; after the third, one has to stop shaving with Occam's razor as the blade has gone dull
I took a screenshot (full-size image) of what I am offered as to Valerie, and you'll notice that the upper right panel is blank. This is because some years ago, I amended the DNS records which computers using my DNS servers are provided, to return '127.0.0.2' for all of 'doubleclick.net'
[root@xps400 conf]# grep -i doubleclick *.conf
NULLROUTE.conf:127.0.0.2 ad.doubleclick.net.
[root@xps400 conf]# 
Adding that value (which causes the request for an advert to never reach the central advert monitoring and image feeding servers), and several more was part of a campaign for a corporate client I was consulting for at the time. The Windows 98 desktop computers which were issued to the staff did not have effective software installation access controls, to preventing addition of random malware and time wasters. Memos and meetings had not stopped the practice of a staffer downloading, say, Yahoo! Instant Messenger, and showing all her friends in that department how to do the same. Bandwidth exhaustion was becoming an issue; I assume that management also had some thoughts about lost productivity
As a technical fix the IS department was asked to remove it when found (done, but not persistent without effective access controls), and asked again. I was escalated in, and went to work with tcpdump
It turns out that the software designers at Yahoo knew their craft well. From memory, it first tried the universal Firewall Transversal Protocol (http), and then secure http and FTP
I blocked each new approach in turn. It fell back to nntp, and as I recall ntp. I do not recall that it tried to use dns content tunneling, but I certainly would have. The eventual solution had both port blocking and domain blacklisting
There is nothing new, nor indeed to my thinking, wrong for the owner of an asset to seek to profit maximize with it. But I think my thoughts and my words are my property, and on occasion on a 'think piece', I'll add the copyright reminder tag
.-- -... ---.. ... -.- -.--
Copyright (C) 2009 R P Herrold
herrold@owlriver.com
My words are not deathless prose,
but they are mine.
I also hold to the quaint notion that I am not a number, but an individual and the property of no one but my God. Silly, I know, but there you are
When I started this blog, it was in response to a desire to make the CentOS internals a little more transparent to interested observers. We at the project do get the questions, and I think a thoughtful reader can pull connections from the little stories and examples I choose from the full breadth of the blog. While I might 'tag' something specifically 'CentOS', real life has no such natural boundaries, and these are just guide markers in the channel of life.
I added the blog into the CentOS aggregator at planet.centos.org, and set to writing. I cribbed the configs from an example of another CentOS member. I tried then to restrict the feed to the 'CentOS' label, but following the documentation just did not work. I settled for the default full feed, and resolved to solve the revisit the matter later
My friend toracat gently reminded me of the need to finish the job, this morning. Sigh ... back to wrestling markup
The example follows [there are annoying line breaks in the blog layout as rendered, and indeed in the doco upstream that need to be pasted back together, mentally]. Can you spot the error?
Full site feed: |
There is the obvious need to s/comments/posts/g, but more is needed. I am accustomed to 'magic CGI directories' that accept variables. I use them myself. See, e.g., the expanded URL to the thumbnail of Mothra which is not just an image, but the filename, and a link to the full size one. No express CGI script is called out, as the index file for that directory is actually a smart CGI script
Enough clues, and on to the answer. I put bit of text around the answer so your eyes do not pick it out. The text at the fourth bullet above is malformed ... the part following: alt=rss needed to precede the question mark marker that identified the start of variables to the CGI script. We move before it the part: /-/labelname and add the desired label. Now a custom subfeed chosen by label is properly specified
But there are no road signs on the Blogger provided doco page to permit easily reporting errors, so that they might have be fixed
Nuts
| Separated at birth? We get questions, asking about the use of the 'orc' moniker, in IRC and at this blog.
|
 |  | This is a bit of housekeeping about this blog -- the boilerplate so to speak. I mentioned the need to do it, so here it is |
---------------start disclaimer-------------------
I_A_AL, but not your lawyer. I offer legal advice and formal
opinion only within the confines of a previously established
and explicit attorney-client relationship where privilege may
be had; and NEVER on a public list server.
----------------end disclaimers ------------------
"This publication is designed to provide accurate and authoritative information in regard to the subject matter covered. It is sold with the understanding that the publisher is not engaged in rendering legal, tax, accounting, or other professional service. If legal advice or other expert assistance is required, the services of a competent professional person should be sought."Generally, the appearance of trademarks or registered trademarks
-- from a Declaration of Principles jointly adopted by
a Committee of the American Bar Association and a
Committee of Publishers and Associations.
Perhaps I should have thought through what I was saying in preparing a posting a bit more to avoid getting bitten This should look better in the CentOS consolidator: |  |
 |  | Stuck between a rock and a hard place here, it seems. Notice the ocean of whitespace to the left of the picture of the pregnant lady on the left image | |  |
<td> <img src="http://www.herrold.com/images/blog/spacer.gif" width="0" height="0"> </td>| Where did my coffee cup get to? |  |
 |
 |
