Simplicity is a form of art...

While still working on a few other projects, one of the time consumers of the past half year (haven't you noticed?

After updating my workstation, I noticed that keychain reported that it could not load one of the GnuPG keys I passed it on

A few days ago a vulnerability was reported in the SELinux sandbox user space utility.

While working on the second edition of my first book, SELinux System Administration - Second Edition I had to test out a few commands on different Linux distributions to make sure that I don't create instructions that only work on Gentoo Linux.

At my work, I have the pleasure of being involved in a big data project that uses Hadoop as the primary platform for several services.

After reorganizing my salt configuration, I received the following error: [ERROR ] Template was specified incorrectly: False Enabling some debugging on the command gave me a slight pointer why this occurred: [DEBUG ] Could not find file from saltenv…

Part of a system's security is to reduce the attack surface.

Recently, I had to migrate mail boxes for a couple of users from one mail provider to another.

A short while ago I got the notification that pulling new CVE information was no longer possible.

Since 2010, I was at work responsible for the infrastructure architecture of a couple of technological domains, namely databases and scheduling/workload automation.

While developing an init script which has to switch user, I got a couple of errors from SELinux and the system itself: ~# rc-service hadoop-namenode format Authenticating root

In Gentoo, we have been supporting custom policy packages for a while now.

I administer a couple of systems which provide interactive access by end users, and for this interactive access I position OpenSSH.

A few days ago I committed a small update to policycoreutils, a SELinux related package that provides most of the management utilities for SELinux systems.

CIL is SELinux' Common Intermediate Language, which brings on a whole new set of possibilities with policy development.

Gentoo has removed its support of the older GuideXML format in favor of using the Gentoo Wiki and a new content management system for the main site (or is it static pages, I don't have the faintest idea to be honest).

With the high attention that technologies such as Docker, Rocket and the like get (I recommend to look at Bocker by Peter Wilmott as well ;-), I still find it important that technologies are well capable of supporting a multi-instance environment.

With Mike's news item on OpenSSH's deprecation of the DSA algorithm for the public key authentication, I started switching the few keys I still had using DSA to the suggested ED25519 algorithm.

It's been a few weeks that I switched my blog to Pelican, a static site generator build with Python.

I recently came across a wiki page written by Herman Brule which gives a quick benchmark on a couple of compression methods / algorithms.

If you're a bit following the SELinux development community you will know Dan Walsh, a Red Hat security engineer.

A nice twitter discussion with Erling Hellenäs caught my full attention later when I was heading home: Can SELinux substitute DAC?

Iptables (and the successor nftables) is a powerful packet filtering system in the Linux kernel, able to create advanced firewall capabilities.

It is often said, yet too often forgotten: taking backups (and verifying that they work).

With the increased attention that SELinux is getting thanks to its inclusion in recent Android releases, more and more people are understanding that SELinux is not a singular security solution.

Nothing beats a few hours of flying to get things moving on stuff.

In a previous post I used the secilc binary to load an additional test policy.

In a comment Robert asked how to use SELinux to prevent even root access to a directory.

When developing SELinux policies for new software (or existing ones whose policies I don't agree with) it is often more difficult to finish the policies so that they are broadly usable.

SELinux policy developers already have a number of file formats to work with.

In between courses, I pushed out live ebuilds for the SELinux userspace applications: libselinux, policycoreutils, libsemanage, libsepol, sepolgen, checkpolicy and secilc.

I have been running a PostgreSQL cluster for a while as the primary backend for many services.

When testing out new technologies or new setups, not having (proper) SELinux policies can be a nuisance.

Be it because of SELinux experiments, or through general audit experiments, sometimes you'll get in touch with a message similar to the following: audit: audit_backlog=321 > audit_backlog_limit=320 audit: audit_lost=44395 audit_rate_limit=0 audit_backlog_…

If you are using SELinux on production systems (with which I mean systems that you offer services with towards customers or other parties beyond you, yourself and your ego), please consider proper change management if you don't do already.

The SELinux userspace project has released version 2.4 in february this year, after release candidates have been tested for half a year.

One of the goals I've set myself to do this year (not as a new year resolution though, I *really* want to accomplish this ;-) is to move my blog from Wordpress to a statically built website.

I keep on struggling to remember this, so let's make a blog post out of it ;-) When the SELinux policy is being built, recent userspace (2.4 and higher) will convert the policy into CIL language, and then build the binary policy.

Many of my systems use DHCP for obtaining IP addresses.

If you have a very old Gentoo system that you want to upgrade, you might have some issues with too old software and Portage which can't just upgrade to a recent state.

Large companies that handle their own IT often have internal support teams for many of the technologies that they use.

Perhaps it is because of the winter holidays, but the last weeks I've noticed a lot of updates and edits on the Gentoo wiki.

While updating the SELinux policy for the Courier IMAP daemon, I noticed that it (well, the authdaemon that is part of Courier) wanted to access /etc/shadow, which is of course a big no-no.

I just finished up adding some UEFI instructions to the Gentoo handbooks for AMD64 and x86 (I don't know how many systems are still using x86 instead of the AMD64 one, and if those support UEFI, but the instructions are shared and they don't collide).

Yesterday the move of the Gentoo Wiki for the Gentoo handbooks (whose most important part are the installation instructions for the various supported architectures) has been concluded, with a last-minute addition being the one-page views so that users who…

Content-wise, the move is done.

Free software (and documentation) developers don't always have all the time they want.

I just finished updating 102 packages.

One of the new features of the 2.4 SELinux userspace is support for module priorities.

In a few moments, SELinux users which have the \~arch KEYWORDS set (either globally or for the SELinux utilities in particular) will notice that the SELinux userspace will upgrade to version 2.4 (release candidate 5 for now).