March 2015 - gsoc - lists.centos.org

Xen in a Box Proposal
by Gautam Malu 16 Apr '15

16 Apr '15

Hi everyone, I am a masters student at IIIT- Hyderabad, India. I have submitted my GSOC proposal for Xen in a Box. I would be great to have some suggestions especially about the porting of xapi on CentOS Abstract: My project goal is to deliver set of scripts preferrably in bash, along with all necessay packages to convert standared installers ISOs into customized ISOs which install CentOS 6 + xen + libvirt + 2 pv VMs running + network configuration. I also plan to deliver xapi rpms which can be used to build a custom installer ISO to install CentOS 6 + xen + xapi. Full proposal: http://www.google-melange.com/gsoc/proposal/public/google/gsoc2015/gautam_m… Best regards, Gautam Malu

1 3

xapi on CentOS 6
by Gautam Malu 31 Mar '15

31 Mar '15

Hi, I am a masters student at IIIT Hyderabad. I have applied for gsoc 2015, for xen in a box proposal. As a part of my proposal,I want to deliver xapi repo which can be used to build a custom installer ISO to install CentOS 6 + xen + xapi. Here is my full proposal http://www.google-melange.com/gsoc/proposal/public/google/gsoc2015/gautam_m… About building xapi packages for CentOS; I was able to build all xenserver packages with xenserver build root. (https://github.com/xenserver/buildroot) on CentOS 6.6 . This buildroot uses Xen4CentOS repo for xen packages, but it uses custom repo for Ocaml(4.01). The Base repo for CentOS 6.6 have ocaml 3.11. This buildroot required Ocaml 4.x. The gsoc would start in May end, if Ocaml 4.x packages are ready by then, Those could be used to build xapi. Is there any plan to have xapi as part of virt SIG. Is there any time-line for having ocaml 4.x packages in CentOS offical repo. Best regards, Gautam Malu

2 1

kpatch irc log 2015-03-30
by Corey Henderson 31 Mar '15

31 Mar '15

Some more musings this evening. kragniz cormander: evening cormander howdy kragniz how was your weekend? cormander great cormander opening weekend at the local amusement park kragniz nice kragniz I was at a hackathon making horrible sounding music cormander can't say i'v ever done that kragniz it was a fun 24 hours, but I don't think I'd want to listen to the output for a long period of time! cormander any more Q's on what to do for kpatch? any actual implementation done? kragniz no implementation done yet - where would you suggest I start? kragniz I was a little hesitant to start writing code before I'd received some acks from more people in terms of the overall design cormander not sure if others around have a vested technical interest in the details cormander I'd say, start withing making the /proc/version patch into an rpm cormander for fun, append "-kpatch-foo" to the current version kragniz that sounds like a great idea kragniz building that rpm by hand? kragniz also, a related question - is it okay to do development work on fedora? cormander go for it cormander as long as the end result works on EL7 kragniz yup kragniz I don't see any potential problems with it, other than maybe different library versions cormander kragniz: one thing you can mull over in your free time cormander is a naming schema for the patches cormander things get a little dicey when a single module contains multiple patches

1 0

Reminder - initial proposal deadline (27 March 19:00 UTC)
by Karsten Wade 27 Mar '15

27 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We just rolled under the 24 hour mark for you to get your initial proposals in. The main thing is to get even a rough draft in to the system. For the next few weeks mentors will continue to work with you on refining your proposal. But it has to be in the system by the deadline. Working on the proposals this way is an important part of how the mentors will see you and your potential. Remember that this is open source development -- we have ways of doing things that may be new to you, such as turning in unfinished proposals and working openly on mailing lists/in Melange to improve your proposals. All of this is part of how open source projects work. Regards, - - Karsten - -- Karsten 'quaid' Wade .^\ CentOS Doer of Stuff http://TheOpenSourceWay.org \ http://community.redhat.com @quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iEYEARECAAYFAlUUWP0ACgkQ2ZIOBq0ODEEqeACfWQVGvccHuYZs57bYKW9F1ZGC eJUAoJmGXg6kQhli1GnqIN3YOojzdopc =7RL2 -----END PGP SIGNATURE-----

1 0

Hello!
by Mark Murnane 26 Mar '15

26 Mar '15

My name is Mark Murnane, I am a Computer Engineering major at the University of Maryland, Baltimore County, in my Junior year. I have been working for three years now as a system administrator for our Com Sci department, where I provide Redhat desktops and server infrastructure. I've been working for a while now moving our legacy server environment from Solaris zones to Linux containers(under Docker), and am extremely interested in the project to create a yum plugin to manage containers. I am now very familiar with the current container tools and workflows, and know that distribution is something of a weak spot with current solutions. I also have a few questions about the project: The project description on the ideas page mentions that a 'yum upgrade container' command would be unnecessary. We rely heavily on container versioning, and generally prefer the encapsulation provided by replacing containers wholesale. Would a solution that supports updates be undesirable? The description only mentions Docker, but other systems for managing containers are available. Would a solution that supports multiple systems be allowed? I know that since version 218 systemd has supported using docker images directly. I don't believe it would be difficult to allow multiple systems to be configured. Thanks! -Mark

1 0

Feedback for GSOC2015 proposal
by Saket Sinha 25 Mar '15

25 Mar '15

Hi, I would like to participate to Google Summer of Code 2015 by contributing to Rootfs build factory implementation under the guidance of Jim Perrin. This is to seek feedback from the development community for the same. My proposal can be found at the below link - http://www.google-melange.com/gsoc/proposal/public/google/gsoc2015/disdi/58… Regards, Saket Sinha

1 0

kpatch delivery proposal
by Louis Taylor 25 Mar '15

25 Mar '15

Hi all, I'm a student at Aberystwyth University in Wales, United Kingdom. I've been working on a proposal for kpatch delivery, which you can read here: https://kragniz.eu/kpatch.txt I'd love it if you could have a read through and point out any potential problems with it. Cheers, Louis

1 0

Re: [CentOS-gsoc] Self Introduction & Interested in Implement and create new documentation toolchain
by Lei Yang 24 Mar '15

24 Mar '15

Karsten Wade: Thank you very much for your reply! I have improved the proposal following the mentors' advice, and I will join the centos-docs mailing list and take part in the discussion. Also, I have a question. Should I add my personal coding experience and information to the proposal? Best regards, Lei Yang

1 0

GSoC - Xen based Hypervisor in a Box
by Emil Condrea 24 Mar '15

24 Mar '15

Hello, I am Emil Condrea, student in 4h year at Faculty of Computer Science in Iasi, Romania. I am an enthusiastic developer fascinated by low level programming. Since two years ago I started to do research about kernel programming. For the final thesis I wanted to improve the existing code in open source community rather than reinventing the wheel so I combined security with virtualization and kernel programming. I am developing new features to Xen virtual TPMs. Also, I am going to send patches to tpm library trousers so others can use the new features I implemented at kernel level. I wrote this in C. I can give you more details about it if you are interested. I am writing this email because I want to write a proposal for Xen based Hypervisor in a box <http://wiki.centos.org/GSoC/2015/Ideas#head-ecb615be72e53950f08df9280902072…> . I want to be a part of this project because I am very focused on virtualization and security and this is what I want to work in the future. Regarding my experience: I am working since 3 years ago at Bitdefender as Antispam Engines Developer (C/C++). Also, I have 6 years of experience on web development. You can see more details on my website: http://emilcondrea.com I am really looking forward for your reply in order to know if you think I am the right person for this project. From your point of view is it ok to write proposal right now or should I contact the mentor first? Thank you, Emil Condrea.

2 2

Self Introduction & Interested in Implement and create new documentation toolchain
by 杨垒 24 Mar '15

24 Mar '15

Hi everyone! I am a student from School of EECS, Peking University, Beijing, China. I am interested in contributing to the Implement and create new documentation toolchain. I’ve done some small Python projects with my friend, and I am quite familiar with Git and GitHub. Previously I contributed to Ghost by translating the documentation to Chinese and found out GitHub is an excellent place to store, version and distribute docs. I myself is using GitHub Pages to build my personal site. Also, I am a MarkDown lover, so it will be great if I could take part in this project and use MarkDown as the main writing format. When using CentOS and other Linux distributions, I search for solutions of google and get most answers on StackOverflow and personal blogs. It would be great if everyone can contribute docs to a centralized place, using some fixed format, so users can look for answers quickly and easily. Thanks Lei Yang

2 1

kpatch irc log 2015-03-18
by Corey Henderson 24 Mar '15

24 Mar '15

Mentor's note; hopefully fewer questions means we're getting closer to proposal writing ;) cormander howdy kragniz cormander: hi there! kragniz how goes with you? cormander good kragniz cormander: cool! kragniz I've been thinking a little about the tooling to create the patch packages cormander great kragniz so assuming we're doing the one rpm per patch route, we need to create an rpm for each supported kernel, right? cormander that will get very messy cormander I would put all versions that applies to in it [ERROR] The command “path/to/kpatch/repo/<kernel” is not known to the server. cormander like so; /path/to/kpatch/repo/<kernel version>/patch-name/module.ko cormander or maybe the reverse; /path/patch-name/<kernel-version>/module.ko --- up to you kragniz olay, so contain builds of the patch against all supported kernels cormander right cormander in the %post script of the rpm, the userspace script you write will determine if an update to the package actually changed the checksum of the module for the current running version cormander and only remove / reinsert it if so cormander when you generate the rpm, what your patching is in newer kernels, so you won't have to "add" more versions later cormander unless you have a future patch touch the same thing that a previous patch does - cormander and you'll have a list of newer modules that are smaller, and and bunch of updated files for older kernel versions kragniz that sounds good kragniz is there a drawback to reloading current patches anyway? cormander you run the risk of hitting a function that's on the kernel stack kragniz other than the risk of breaking something cormander and failing to re-insert it cormander so, best to only remove/re-insert stuff when you have to kragniz okay, that sounds reasonable kragniz so the input for this build system would be a source patch, and it would build kpatch modules for all kernels it applies cleanly against, or would we provide some version limitation? kragniz ie, something.patch is for kernels 3.14 - 3.16 only cormander version limitation. more specifically, release limitation cormander we're only doing EL7 kernels kragniz okay, cool kragniz I need to run for about half an hour, sorry! cormander no problem, just say my name when you're back kragniz will do cormander also - just because a patch cleanly applies doesn't mean it's correct. It can even be dangerous. Patch selection is a painfully manual process. Hard to automate cormander also, patches often don't cleanly go into kernels that need it cormander you can assume that patch selection is out of scope. The real meal of the deal here is the build and release automation |<-- imcleod_ has left freenode (Ping timeout: 244 seconds) cormander kragniz: going to sign off shortly, unless you're still around

2 1

GSoC 2015 Draft of Proposal on On premise vagrant hosting system
by Hanok 24 Mar '15

24 Mar '15

Greeting, I wrote a proposal on "On premise Varant Hosting System".I hoping to get feedback on this,so that i may make some changes. Regards,Hanok KodavatikantiNIT rourkela.

2 1

GSOC 2015- Rootfs build factory implementation
by Saket Sinha 24 Mar '15

24 Mar '15

Hi, I am looking forward to participate in GSOC 2015 With CentOS community in Rootfs build factory implementation for ARM and other platforms. This is to discuss the idea further in order to build my understanding of the project. ARM is now supported by most of Linux distors. To discuss a few we have Debian, Fedora, Gentoo Linux, Arch Linux etc. Debain has something called debootstrap for creating an architecture specific rootfs. Fedora uses fedora remix for supporting different non-x86 boards(or platforms). >From http://fedoraproject.org/wiki/Architectures/ARM/Creating_Remixes what I could find that you can create your own fedora remix by using a tool called appliance-tools over a fedora disk image. So here are we trying to implement a similar implementation for CentOS ? Please let me know if my understanding of the project is right. Regards, Saket Sinha

2 1

Application deadline 27 Mar
by Karsten Wade 24 Mar '15

24 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Reminder that students need to get their application in to the Melange tool by 27 March 19:00 UTC. https://www.google-melange.com/gsoc/homepage/google/gsoc2015 Once the application is in the system you will have a few weeks to work with mentors to improve your proposal. But it absolutely *must* be turned in by 27 March 19:00 UTC, we cannot add your proposal to the system after that date. That is 3 days and 20 hours from now. How are things going? Any questions on the process? Regards, - - Karsten - -- Karsten 'quaid' Wade .^\ CentOS Doer of Stuff http://TheOpenSourceWay.org \ http://community.redhat.com @quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iEUEARECAAYFAlUQjx0ACgkQ2ZIOBq0ODEHregCYjqTeGXcu1MBIDf+yhM5pFJbz gQCg5hOZR8s29vLcvVS6Eh7XVWoBQ8A= =5EfD -----END PGP SIGNATURE-----

1 0

Develop a kpatch delivery mechanism
by vladiksonic＠mail.ru 23 Mar '15

23 Mar '15

Hello! I have written the second proposal (well, first draft), this one is for kpatch delivery mechanism. Link: https://github.com/hotab/CentOS-application/blob/master/Proposal-2.md (also found on google melange for organisation members). Same as the last time - I am open for criticism. Good luck, Vladislav Babkin

1 0

RootFS Build Factory Proposal
by Mandar Joshi 21 Mar '15

21 Mar '15

Hello, I've uploaded my proposal for RootFS Build Factory to github. You can view it here https://github.com/mndar/gsoc2015 I welcome any suggestions. Regards Mandar Joshi

1 0

Rootfs Build Factory Idea. About CentOS for ARM not being available yet
by Mandar Joshi 18 Mar '15

18 Mar '15

Hello, I am working on a proposal for the Rootfs build factory idea http://wiki.centos.org/GSoC/2015/Ideas#rootfs-build-factory Right now, I am working out the details, they are not yet ready for presentation. They are just in the form of notes right now. I discussed this project a bit on centos-gsoc on freenode last week. I think we should use Python and Bash scripts for this project. We have 2 months before the GSoC coding period starts. Since the CentOS ARM images are not ready yet (at least not yet publicly available), should we include the development of CentOS for ARM in the GSoC Project? I would like to contribute to the CentOS ARM project. About me: My primary area of interest is Linux and my programming languages of choice are C and Python. As part of my academics I have studied C, C++, Data Structures, Computer Networks, Software Engineering, Object Oriented Analysis and Design, Microcontrollers, Image Processing, Operating Systems and Database Systems to name a few. I am presently in my third year of college. I have work experience as a software developer and as a system admin. As a software developer I worked on a wide range of projects ranging from development of system services using Microsoft .NET, Networking services to Embedded Linux and Point-Of-Sale terminals along with Smart Cards. I have used numerous open source libraries under Linux including GTK+, Clutter, Qt, Curl, BlueZ, FLTK, Gstreamer and worked with few databases (MySQL, MS SQL, Oracle, SQLite). I've also done development using Python(Twisted) and some web development using Django, PHP, Ruby, Javascript. I have vast experience in installing and configuring various Linux distributions including Gentoo,Fedora,Cent OS, Debian,Knoppix,Ubuntu. I have also contributed couple of patches to the Linux kernel (ALSA Project) to add support for a volume knob and LED for a USB sound card . Details of the projects I've worked on are here http://mndar.phpnet.us/resume or http://mndar.github.io/resume/ In my free time I like to drive, listen to music and enjoy configuring/fixing computers. I am subscribed to the centos-devel list as well. I look forward to your feedback. Regards Mandar Joshi

1 0

kpatch irc log 2015-03-17
by Corey Henderson 18 Mar '15

18 Mar '15

Hotab Hello kragniz cormander: \o cormander howdy kragniz Hotab: hello there! kragniz cormander: can we talk a little about what would be user facing on kpatch delivery? kragniz (I'm rather short on time this evening, sadly) cormander ideally just an rpm with a simple userspace application cormander python is fine if you prefer cormander that ties yum and kpatch together Hotab BTW, I thought about QA. How do we face bugs where patches iterfere with each other, even though they patch different functions? kragniz okay, and this would do the listing and other stuff? Hotab interfere* cormander can you give a specific example of patches affecting different functions, yet interfering? cormander basically, this userspace script would do anything we need in usersapce that kpatch tools or yum doesn't do cormander I'm not sure what that is yet. It's implementation details Hotab I do not have an example at hand, but it can be there if one function uses another, and gets unexpected result, for example. Or are these situations impossible/extremely rare? cormander extremely rare because we never change the ABI with these patches cormander function return type and argument lists are off-limits cormander QA is important, and yes we need to somehow test each function that's patched, though I would say testing patch integration is out of scope, so long as different modules don't touch the same functions cormander all we need to test is that each patch can go in with the rest, and all insert into the kernel w/o error Hotab Well, that makes it more straightforward. Like - apply everything and test. Or one by one. cormander yes cormander probably should do both, just because it isn't that much hader; insert, test, insert, test, then after they are all in, run all the tests again kragniz cormander: good point! I'm currently thinking about yum metapackages, where the user would install a single package which manages the patches currently installed kragniz cormander: grr irc over dodgy 3g connection at the moment cormander I've never dealt with yum metepackages. If you think it'll do the job, great cormander the next step, after I answer all of both of your questions, is to write up the project proposals Hotab What should a proposal include? I have looked through boost template (https://svn.boost.org/trac/boost/wiki/SoCSubmissionTemplate) Is it good enough? (well, obviously we change background information a bit, and centos does not have programming competency tests) cormander there was an email from Karsten Wade about 5 hours ago on the centos-gsoc mailling list giving some examples cormander http://lists.centos.org/pipermail/centos-gsoc/2015-March/000044.html Hotab Hmm... took a quick look at proposals for projects sent to Fedora. Seems that this template works. cormander Hotab: kragniz: 20 minute warningwill head to bed after that Hotab ok Hotab Should we autoinstall patches (well, compatible ones) present on kernel updates? And how should it work if the kernel is updated, but the patches repo is not (yet)? cormander no, and doesn't matter cormander updates to the kernel require a reboot, so nothing kpatch side needs to change cormander I can see this situation where they update to the latest kernel, but don't reboot for some time, and there are kpatch modules available at that time, cormander when they finally do reboot, cormander and those kpatches would get applied at boot time, assuming they keep the kpatch packages up to date cormander Hotab: did that answer your question? Hotab So it will require manual command to install them after the kernel, or some autoupdate? cormander if they specifically update just the kernel with yum, for example cormander then yes, they would also need to manually update kpatch too cormander but if they just do a "yum update" cormander yum should pull down the latest kernel and any updated kpatches cormander but that's all done for you by yum anyway, so no need to worry about it Hotab Well, that answers it cormander yesterday in the chat (I emailed the log of it to the centos-gsoc list) I mentioned each kpatch module being its own rpm cormander another approach would be to just roll all the kpatches into one rpm, and still apply them all individually cormander both have their pros and cons, and it's just about deciding how you want all the other parts to work cormander under this one-rpm method, you'd have a package named something like; kernel-kpatch-modules. it would contain each patch for each applicable kernel version. Upon install / update, the userspace script I mentioned earlier this evening would determine what is already inserted, what needs to be removed / reinserted, and what is new and needs to be inserted cormander easier time with yum, but need custom %pre and %post scripts cormander if each module is its own rpm, you have more to manage with yum, but the updates / installs handle themselves cormander other ideas are surely welcomeall goes into your proposal Hotab Both seem sound. Another con against all-in-one approach - we will redownload all the patches, even though we updated only some of them. And the package might grow in side with time, and rather dramatically. Hotab size* cormander true, but depending on how you slice it, cormander you'll have that problem with individual rpms anyway cormander because in each update, you have to provide new patches for the older kernel versions cormander it just won't all be lumped together into one rpm Hotab Then again, I think that the user is not likely to have all the rmps installed at once (or am I mistaken?) cormander they'd have to, unless we write some yum plugin that had some logic to only download stuff for their running kernel cormander but like I said earlier, if they update their kernel then wait a few months to reboot, without doing another update cormander they'll boot an old kernel with no patches for it cormander IMHO it's safest to just give them everything and let the userspace scripts decide what is needed cormander but, I could be wrong cormander okay so I have to get up for work in less than 7 hours ... but I'm starting my day from home. So I'll be online in IRC for an hour or two at that time Hotab I probably will be in university at that time (for me it will be 2 PM). So I am not likely to be here. cormander okay. well email the list if you have any questions. want to stray away from individual emails cormander g'night / g'day!

1 0

What proposals might look like
by Karsten Wade 18 Mar '15

18 Mar '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 One of the mentors asked me today what an accepted proposal might look like. There are a few resources out there, this one is considered to be canonical by many and well-referenced: http://en.flossmanuals.net/GSoCStudentGuide/ch008_writing-a-proposal/ I don't think any past proposals are viewable, but if someone finds a link to a set of accepted proposals, that would be great. Here is a set of proposals that came in for the Fedora Summer Coding 2010 that I ran independently of GSoC (the year Fedora Project didn't get in to GSoC.) https://fedoraproject.org/wiki/Category:Summer_Coding_2010_proposals ... and here is the list of accepted projects: https://fedoraproject.org/wiki/Summer_Coding_2010_projects Many of the mentors who worked with those students and/or helped write the proposals were GSoC mentors in previous years. Regards, - - Karsten - -- Karsten 'quaid' Wade .^\ CentOS Doer of Stuff http://TheOpenSourceWay.org \ http://community.redhat.com @quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlUItSIACgkQ2ZIOBq0ODEFNcQCgqt+oCpO9hnczhrdK6IBuK+iD jiwAnA9RogKfW4Xeb9LG2523W68VrWOu =Ovio -----END PGP SIGNATURE-----

2 1

GSoC 2015 self hosting vagrant boxes
by Hanok 18 Mar '15

18 Mar '15

Greetings, My name is Hanok.I am currently in my last semester studying CSE in NIT Rourkela.I am interested to work on the self hosted vagrant images across a group.As of my past experience,i contributed to the OVPL(One VM Per Lab) which is basically creating the vagrant boxes to deploy a lab application in the server automatically through a web interface.I have good python,C,C++ and web designing skills.My contributions and projects can be found at https://github.com/Hanokk. I want to extend my knowledge in the same through the gsoc project.I haven't participated in any of the previous GSoC programs.So,please do reply how to proceed with the furthur. Thank You Regards,Hanok Kodavatikanti,NIT Rourkela.(mob):+919692257021

2 1

yum plugins for docker
by Jim Perrin 17 Mar '15

17 Mar '15

I've been asked a couple times privately for information about this, so here's my current thinking on the project goals. must-have: 1. be able to exec (or otherwise connect to a container) and perform a 'yum update' of the container, commiting the results upon successful completion. eg - yum dockerupdate -y centos # run yum -y update in the centos:latest container. 2. Traditional yum interaction is expected (prompting for 'y/n', or accepting options like -y) 3. Passing exit values from the container to the host. 4. Exit with message on unsupported containers. 4. documentation and invalid-command syntax fails to usage/help. nice-to-have: 1. tab complete support for commands as well as available containers. 2. support for non-rpm based updates (support apt for debian/ubuntu based containers) questionable: glob/regex support to perform update on every matching container Comments/Questions? -- Jim Perrin The CentOS Project | http://www.centos.org twitter: @BitIntegrity | GPG Key: FA09AD77

2 1

kpatch irc log 2015-03-16
by Corey Henderson 17 Mar '15

17 Mar '15

Here's to hoping the copy/paste out of ChatZilla doesn't get screwed up in email :) cormander huzzah, I haven't been on IRC in years... kragniz cormander: \o cormander howdy kragniz cormander: you should spend more time here! cormander let's just say, I have a hard enough time managing distractions and social anxiety without being in a chat room all day long kragniz maybe I will learn something similar one day kragniz anyway, kpatch stuff! cormander pardon my ignorance - but do I mentor one student, or many? cormander and if you don't know the answer, that's fine kragniz just the one is what people say cormander well so far it's you and one other person that's contacted me directly cormander though someone who is closer to my timezone is probably better suited kragniz you'll need to pick one, I'm pretty sure - the actual selection takes place in a few weeks, though cormander okay so remind me - was kpatch your first choice? one of you said it wasn't your first choice ... kragniz you should talk with the centos gsoc admins, though cormander yeppers will do kragniz now you ask that question, I guess it is cormander so I have some recommended reading for you regarding kernel patching kragniz I was weighing it and tinykdump equally in my head previously cormander which is, in some ways, a shameless self promotion... kragniz fire away! cormander er, I would have sworn I posted about kpatch on my blog cormander okay plan B, my older post about ksplice kragniz heh cormander holy crap that was 4 years ago. I feel old now. cormander http://cormander.com/2011/08/how-to-use-the-ksplice-raw-utilities/ kragniz I'm guessing this one? http://cormander.com/2011/08/how-to-use-the-ksplice-raw-utilities/ kragniz hehe cormander not to be a copycat or anything, but that's roughly the same kind of process I'd like to work with cormander the kpatch utilities (as of about 6 months ago - haven't looked at them since) worked similar to it kragniz yup, they do cormander each tree needs to be treated like it's own line of code, because not all patches are applicable to the older ones, and not all fixes go into each version exactly the same way kragniz (as of last week) cormander and by tree, I mean version/release of the kernel cormander so one patch may go into 4 different versions exactly the same way, but there will come a point where it needs to be modified to work with a newer version cormander and vice versa cormander originally I wanted to maintain one big patch for each version and just update it each time a new version came out cormander but, as I started actually working on it, I discovered that until kpatch solves some technical problems with kernel functions that are always on the stack cormander the bigger the patch, the more risky it is that once you remove it, it becomes difficult to re-insert it again kragniz okay, that's interesting cormander we don't want to hit a patch with a heavy kernel thread and fight the battle of yanking it / re-probing it every time cormander because most patches don't run that risk cormander but that creates a different techincal problem - tracking which functions are being touched cormander not a hard problem to solve if you stay consistent, but then you run into issues with being incompatible with other kpatch efforts, should there ever be any, if everyone doesn't agree on an API for it kragniz couldn't that be solved by adding that to upstream kpatch-build? cormander ie; my project tpe-lkm modifies live kernel code, and does it outside of kpatch cormander https://github.com/cormander/tpe-lkm/ kragniz clicks cormander tpe-lkm is better at supporting a wide range of kernel versions, but it's not as fine-grained as kpatch cormander and thus, is limited in what kinds of patching it can do kragniz as an aside, that project is really cool! cormander thanks cormander now, we're not going to be able to solve compatibility issues with non-kpatch projects like that cormander but it's worth thinking about kragniz but getting something that keeps in mind other systems would be good? cormander yeah kragniz okay cormander as an aside, my primary motivation into learning kpatch was to apply portions of grsecurity via kpatch cormander just like how I apply some of them via tpe-lkm, cormander but kpatch can do many more of them kragniz interesting cormander the bump I hit was, which derailed my efforts, that problem with functions in heavy use cormander it's probably solvable, but let's just say I only have so much motivation to solve certain problems kragniz hehe kragniz have you played with the livepatching in linux 4.0? cormander no cormander I've barely scratched the surface with kpatch on EL7 kragniz (just changing the topic slightly) kragniz okay cormander I went hardcore into the kpatch code and submitted patches and all that to https://github.com/dynup/kpatch cormander for a few weeks cormander then life happened again and knocked me off the wagon kragniz yeah, I had a look at them kragniz life is a sad thing cormander have you read this? cormander https://github.com/dynup/kpatch#limitations kragniz yup cormander we need a strategy to handle patches that touch those limitations cormander which may just end up being "sorry folks, you actually have to reboot now" cormander but I'm leaving that as a last resort cormander for example, kpatch uses something called shodows cormander and then you can redirect the use of statically allocated data and use the shadows instead cormander *shadows kragniz shadows being new copies of the old data? cormander yes cormander one very important thing we need, moreso than the API to marry all our different patches together (so they don't stomp on each other) cormander is some kind of automated QA testing kragniz CI on each patch? cormander yes kragniz okay! cormander something that boots a VM, applies each patch in sequence, and runs some sort of kernel test suite to make sure it doesn't go kablooey cormander and then do it for each kernel version we support kragniz doing that in a VM is okay? cormander yes kragniz cool kragniz that sort of thing is fun kragniz although, setting that up may be a project in itself cormander the good news is, the "kernel test suite" would only need to be limited to calling the functions that are patched cormander so initially, the test suite is small, and we simply write more tests as patches touch more symbols cormander I agree, and I need to specifically talk to kbsingh about that kragniz yup, so you could collect the functions being patched an automatically build a test suite? cormander if you think that could be done, go for it cormander I was thinking along the lines of just small c code a.out executables that make certain syscalls kragniz that sounds good, also kragniz simple is better, most of the time cormander occam's razor cormander so, do you think this stuff is up your alley? kragniz totally! cormander full disclosure: I'm not as skilled with kernel C code as you might think, considering I've written quote a lot of kernel module code myself cormander I shoot myself in the foot more than I care to admit kragniz I warn you, though, I'm still learning kernel level stuff kragniz we can learn together! cormander great! we're both good enough to be dangerous kragniz I've done a fair amount of userland C, though python is my pet cormander perl here kragniz shakes his fist cormander alright so - what timezone are you in? I hope this isn't too late in the evening for you kragniz normally utc, but I'm in est at the moment cormander ahh! 5am utc cormander too early? kragniz I work on openstack, so I'm used to late night irc meetings! kragniz so, more about the general scope of the project: cormander I'll be as accommodating as I can - although I do get up at 4am from time to time myself kragniz should this be a system which is only designed to run on centos? anything rpm based? anything running linux? cormander good questions, cormander for now, only designed for EL7 cormander yes RPM based cormander needs to be compatible with yum cormander the API of what function(s) each of our kpatches use could be as simple as cormander making an rpm "virtual" dependancy cormander kernel-kpatch-function-X cormander where X is the functions it touches kragniz hmm, that would be interesting cormander I forget what I'm thinking of is called cormander where you specify this is the only package that can touch this cormander installing another with it will get rejected kragniz conflicts? cormander yes! cormander wow it's been a while kragniz hehe cormander there will be situations where two patches touch the same functions cormander they need to get rolled together into an update for that particular patch cormander so, occationally, an already released kpatch rpm will get an update cormander but mostly, it's just installing new kpatch rpms kragniz okay, so when that new package comes along, the other patches will be removed cormander updated cormander and by being updated, the old one will get rmmod'd, and re-insmod with the new one cormander or however kpatch handles that kragniz if it conflicts, shouldn't the whole conflicting package be uninstalled? cormander if it conflicts, and it's from our repository, that means we didn't do a good QA job cormander I'll explain it like this; cormander we have patches A B C D E F G cormander all touching different things cormander patch H comes out, and touches what A does cormander instead of releasing H as a new rpm cormander we update A to include H kragniz right, I get you now! cormander then, patch J comes out, it touches what D and G do kragniz I thought you meant bundle As patch with H and remove A cormander we update D to include G and J, and have it "depricate" G cormander or whatever term rpm uses for depricate ... where it uninstalls it upon install kragniz yup, that makes sense cormander and this, my friend, is where the QA matters most kragniz indeed! cormander like I said, if an rpm conflicts, we f***ed up kragniz yup cormander so, chew on that for now. I actually have to get up early tomorrow cormander see you tomorrow around this time? kragniz alrighty kragniz sounds good! kragniz thanks for the thoughts! cormander goes "away" - if there is such a thing in IRC kragniz goes to bed

1 0

Corey's GSoC "office hours"
by Corey Henderson 17 Mar '15

17 Mar '15

Hi all, I'm mentoring the kpatch delivery for this year's GSoC. My apologies if I'm a little late to the party. My availability during my work day is limited to email from my mobile device. As such, I've decided to set a time each weekday evening that I can consistently be online and available for chat and other live conversation. 10pm to 11pm US Mountain time on weekdays I'll be online. I plan on putting in about 2 hours each night, so I'll be online before 10pm sometimes, and sometimes after 11pm based on my schedule - but from 10 to 11 I can certainly commit to. If you don't see me, send an email to this list or me directly with what medium you're online at, and I should see it pretty quick. Thanks, -- Corey

2 1

GSOC Proposal discussion for Extendable system hardening tool
by Aneesh Dogra 13 Mar '15

13 Mar '15

Hello, My name is Aneesh Dogra. I am studying computer science in IIIT Delhi. I have been involved in a few open source projects (primarly libav and sugarlabs) since 2-3 years. I have won GCI twice [1] [2] and mentored in GSoC for Sugarlabs (2 years ago) and been a GSOC student last year. I have a fairly active/updated github [3] and linkedin [4] profile. I have experience in security pentesting, C, python and shell. Extendable System hardening tool: Here's what I understand of the idea: Create a tool to enforce some secure habits on the server depending on the inputs (modes/recipes). The trick here is the make this very general. Here's my proposed solution, after thinking over it for a while: 1) There will be 2 components of the tool, recipe and modes. - A recipe will be provided through a cdn to users for different modes. - Each mode's recipe will have data so as to what to do to strengthen the system. 2) The tool would parse the recipe file and execute the instructions listed in the file, now either we could demand some bash scripts in the recipe file, but this won't be neat. I was thinking of making predefined functions in the tool and using some macros to represent them in the recipe file. I'll need some help on this. Can we discuss this? Is having bash code written in the recipes a bad idea? [1] : http://google-opensource.blogspot.in/2012/02/google-code-in-2011-grand-priz… [2] : http://google-opensource.blogspot.in/2013/02/google-code-in-2012-grand-priz… [3] : https://github.com/lionaneesh [4] : linkedin.com/in/aneeshdogra [5] : https://github.com/lionaneesh/jsonDB -- Regardless, I hope you're well and happy - Aneesh

2 1

GSOC 2015 Implement and create new documentation toolchain
by kunaal jain 13 Mar '15

13 Mar '15

Hello, I am interested in working on this idea. Can anyone please connect to the mentor, so I can discuss details, requirements and other stuff. Thanks, Kunaal Jain kunaalus(a)gmail.com

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

gsoc March 2015