August 2017 - wlug - list.wlug.org.nz

Spyware backdoor prompts Google to pull 500 apps with >100m downloads
by Peter Reutemann 23 Aug '17

23 Aug '17

'At least 500 apps collectively downloaded more than 100 million times from Google's official Play Market contained a secret backdoor that allowed developers to install a range of spyware at any time, researchers said Monday. The apps contained a software development kit called Igexin, which makes it easier for apps to connect to ad networks and deliver ads that are targeted to the specific interests of end users. Once an app using a malicious version of Igexin was installed on a phone, the developer kit could update the app to include spyware at any time, with no warning. The most serious spyware installed on phones were packages that stole call histories, including the time a call was made, the number that placed the call, and whether the call went through. Other stolen data included GPS locations, lists of nearby Wi-Fi networks, and lists of installed apps.' -- source: https://arstechnica.com/information-technology/2017/08/500-google-play-apps… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Sky Versus The Newspapers
by Lawrence D'Oliveiro 22 Aug '17

22 Aug '17

Sky TV, in its latest annual report, is blaming its poor performance on “piracy”, specifically “the newspaper industry”. [CEO John] Fellet, in the company's annual report, said media outlets were taking clips from "the best parts" of Sky sport content and placing them on their websites without permission. Fair Dealing provisions in the Copyright Act allow news outlets to use a copyrighted work in the context of reporting current events. <http://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=11908731>

1 0

Moreutils – A Collection Of More Useful Unix Utilities
by Peter Reutemann 22 Aug '17

22 Aug '17

'We all know about GNU core utilities that comes pre-installed with all Unix-like operating systems. These are the basic file, shell and text manipulation utilities of the GNU operating system. The GNU core utilities contains the commands, such as cat, ls, rm, mkdir, rmdir, touch, tail, wc and many more, for doing the day-to-day operations. Since these commands are part of Core Utilities, you don’t have to manually install them. Among these utilities, there are also some other useful collection of Unix utilities which are not included in any Unix-like operating systems. Meet moreutilis, a growing collection of the unix tools. The moreutils can be installed on GNU/Linux, and various Unix flavours such as FreeBSD, openBSD and Mac OS.' -- source: https://www.ostechnix.com/moreutils-collection-useful-unix-utilities/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Solus 3 Released
by Peter Reutemann 21 Aug '17

21 Aug '17

'The Solus Project is proud to announce the availability of Solus 3, the latest release of its Linux-based operating system, which builds on its curated rolling release model. Solus offers users a free and modern alternative to commercial operating systems and provides users a safe and reliable vehicle to guide, guard and enable the user's journey through a shifting tech world to their destination and beyond.' -- source: http://www.linuxandubuntu.com/home/solus-3-released-here-is-whats-new-in-so… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

TheSSS (The Smallest Server Suite) 22.2 Debuts
by Peter Reutemann 21 Aug '17

21 Aug '17

'4MLinux developer Zbigniew Konojacki informs Softpedia on Sunday about the release and general availability of TheSSS (The Smallest Server Suite) 22.2 independently-developed, 4MLinux-based server-oriented GNU/Linux distribution. [...] Those unfamiliar with TheSSS (The Smallest Server Suite) will be glad to learn that the project provides them with a live server suite that lets them run a full-featured Linux server without installing any package on their computer, directly from the bootable medium. TheSSS is a lightweight and fast server solution, and it's free.' -- source: http://news.softpedia.com/news/thesss-the-smallest-server-suite-22-2-debuts… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

fdisk Versus parted
by Lawrence D'Oliveiro 21 Aug '17

21 Aug '17

When the first hard drives appeared that were bigger than the 2TiB limit that the MBR partition format could cope with, it seemed like the only tool available that could manage partitions in the new GPT format was GNU parted. So you had to say goodbye to the old fdisk and sfdisk utilities, and learn a new way of setting things up. Well, it turns out that the old programs have been updated with new features, and they can now cope with setting up and using GPT-partitioned disks just fine. I particularly like the “sfdisk -d” command, which dumps out the partition table in a detailed format that can be backed up and then used for restoration later, if the disk’s partition table should somehow get corrupted. As far as I could see, parted never gave the exact numbers, down to the sector, that were necessary for this. Also, in the past day, two problems with parted have manifested themselves acutely to me: * All partitioning changes are made immediately, unlike fdisk. * Also unlike fdisk, it didn’t seem to notice if you were clobbering existing partitions, and would happily overwrite them. Each of these (mis)features might seem bad enough on its own, but putting them together is a recipe for woe. So in future, I think I am going to abandon parted and go back to fdisk and sfdisk.

2 3

postmarketOS Pursues A Linux-Based, LTS OS For Android Phones
by Peter Reutemann 20 Aug '17

20 Aug '17

'Buy an iPhone and you might get 4-5 years of official software updates. Android phones typically get 1-3 years of updates... if they get any updates at all. But there are ways to breathe new life into some older Android phones. If you can unlock the bootloader, you may be able to install a custom ROM like LineageOS and get unofficial software updates for a few more years. The folks behind postmarketOS want to go even further: they're developing a Linux-based alternative to Android with the goal of providing up to 10 years of support for old smartphones... Right now postmarketOS is a touch-friendly operating system based on Alpine Linux that runs on a handful of devices including the Samsung Galaxy Nexus, Google Nexus 4, 5, and 7 (2012), and several other Samsung, HTC, LG, Motorola, and Sony smartphones. There are also ports for some non-Android phones such as the Nokia N900 and work-in-progress builds for the BlackBerry Bolt Touch 9900 and Jolla Phone. Note that when I say the operating system runs on those devices, I basically mean it boots. Some phones only have network access via a USB cable, for instance. None of the devices can actually be used to make phone calls. But here's the cool thing: the developers are hoping to create a single kernel that works with all supported devices, which means that postmarketOS would work a lot like a desktop operating system, allowing you to install the same OS on any smartphone with the proper hardware. One postmarketOS developer complains that Android's architecture "is based on forking (one might as well say copy-pasting) the entire code-base for each and every device and Android version. And then working on that independent, basically instantly incompatible version. Especially adding device-specific drivers plays an important role... Here is the solution: Bend an existing Linux distribution to run on smartphones. Apply all necessary changes as small patches and upstream them, where it makes sense."' -- source: https://linux.slashdot.org/story/17/08/19/2359258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Intro To SELinux
by Lawrence D'Oliveiro 18 Aug '17

18 Aug '17

Came across this video recently <https://www.youtube.com/watch?v=cNoVgDqqJmM> from the Red Hat Summit a couple of years ago, which gives a simplified intro to Security-Enhanced Linux (SELinux), which is a set of high-security “mandatory access control” features added to the Linux kernel. There are still some people who get conniptions when they hear that SELinux was originally created by the US National Security Agency. But the code has been through a lot of independent peer review in the time (close to two decades) since then, so rest assured you can have high confidence in it. But it can be a very complex and intimidating piece of software: particularly if you get something wrong and then some service gets denied access to some file or other for mysterious reasons that you cannot fathom. Luckily, there are tools available to help you diagnose such problems. The video talks only about RHEL, but I think those tools are not distro-specific. For a start, SELinux can be set in one of three operating modes: “enabled” (actively blocking/enabling access according to set policy); “disabled” (not active), and “permissive” (where it logs only the actions it would take, without actually blocking any access). The last one is particularly useful for seeing what you would need to fix before you actually enable SELinux, before anything actually breaks. Related to this, each system log message denying access to something also shows a command that you can use to get more detailed information about why that access was blocked, and various things you might do to enable it if that’s what you want. RHEL itself allows you to set two levels of operation of SELinux: “targeted” mode (where a particular critical set of services is controlled by SELinux, while every thing else operates as though it were not there) and “multi-level/multi-category” mode, which is the one that probably justifies the reputation of SELinux for being complex and intimidating, and which is likely only of interest to certain Government employees who don’t like to talk about their job. And which is not addressed in the talk: it only describes “targeted” operation. The video goes step-by-step through a couple of scenarios with using SELinux to control the behaviour of Apache: granting users the ability to set up their own “public_html” directories, and moving a web page created by a staffer into the server area. It shows the mistakes you might make, how they manifest themselves in the logs, and how you correct them. He makes it seem so simple, you feel tempted to actually try SELinux for yourself. Go watch the video.

1 0

Intro To systemd
by Lawrence D'Oliveiro 18 Aug '17

18 Aug '17

Came across this YouTube video recently <https://www.youtube.com/watch?v=S9YmaNuvw5U> from the Red Hat Summit a couple of years ago, which gives a good intro to systemd, with Lennart Poettering as co-presenter. The video explains what a “service” is, and compares how much simpler it is to define a service (usually just a few lines of declarative config) versus the hundreds of lines of shell script it typically takes to set things up under the ancient sysvinit system. Not only that, but it is possible to customize the standard service definitions without having to copy and paste the entire existing definition file: you just create a few lines of additional/overriding definition in a “drop-in” file that you place in /etc, that matches the name of the original service definition. There is even a command, “systemd-delta”, which lets you immediately see all the places where your entire systemwide configuration has been so customized. Lennart mentions that speeding up boot was never a specific design goal, it just naturally came out of the parallelization of service startup. Because systemd lets you think in terms of “services” rather than “processes”, it achieves something that was difficult to ensure before, namely reliable shutdown of a service. Consider Apache, which typically spawns a whole lot of processes, and then if you run CGI scripts, they require additional processes. Nevertheless, shutting down httpd.service with systemd will ensure that all those processes are terminated. Another important feature of systemd is the logging. Here again systemd had a goal of achieving something that was difficult before, namely capturing all log messages from the earliest possible stages of the boot process, including the initrd stage. And also because the systemd journal mechanism has access to kernel information about the processes doing the logging, it can include information in the log entries that those processes cannot forge. Me, I like the fact that the log timestamps are stored in UTC, so you can display them in whatever timezone you wish. There is more, of course: “slices” are how systemd is able to strictly limit the resource usage of services (important to the RHEL-using, Java-suffering audience), and “sockets” are how the functionality of inetd/xinetd is carried over to the systemd world, so that services can be started on demand, instead of having to run all the time. Watch the video to learn more.

1 0

Do not rely on journald to continue logging after a stop+start
by Bryan Baldwin 18 Aug '17

18 Aug '17

Whilst investigating a problem where services logging to sterr go silent after journald is stopped and started, but not when "restarted", Evgeny Vereshchagin suggests not relying on journald. In spite of its man page, it seems that "restart" isn't quite the same thing as stop+start to journald. Vereshchagin also confirms that is isn't currently possible to prevent a manual stop without also preventing a "restart", and that these shortcomings in using journald should get added to the documentation. https://github.com/systemd/systemd/issues/6620#issuecomment-322718725

1 0