Andrea Veri's Blog
Table of Contents Introduction The vulnerability Analyzing the shellcode Setting up the lab Setting up rootless Podman Running the exploit inside a container Tracing the exploit mechanism Why rootless containers stopped the escalation Catching the kernel in the act with eBPF The uid_map proof Conclusions Introduction In the previous post about SELinux MCS and GitLab runners, I briefly mentioned…
Table of Contents Introduction The MCS problem The test script GitLab’s official suggestion and why it falls short How GNOME currently handles this Exploring libkrun Firecracker and the custom executor path What comes next Introduction GNOME’s GitLab runners use Podman as the container runtime with SELinux in Enforcing mode on Fedora. The GitLab Runner Docker/Podman executor spawns…
Table of Contents Introduction The problem Architecture overview The VCL layer The POST-to-GET conversion Protecting private repositories The Lua layer Debugging the rollout How we got here Conclusions Introduction One of the most visible signs that GNOME’s infrastructure has grown over the years is the amount of CI traffic that flows through gitlab.gnome.org on any given day. Hundreds of…
Table of Contents Introduction MVP The learning resources Preliminary steps Configuration on ovn-control-plane Configuration on sweetrevenge Configuration on flumina Connectivity test Libvirt Rust The code A quick peek at the web UI License The future Introduction One of those things that make Red Hat a special place are the so called “Learning days”, working days where you can…
Table of Contents 1. Introduction 2. Achievements 2.1. Major achievements 2.2. Minor achievements 2.3 Minor annoyances/bugs that were also fixed in 2024 2.3. Our brand new and renewed partnerships Expressing my gratitude 1. Introduction Time is passing by very quickly and another year will go as we approach the end of 2024. This year has been fundamental in shaping the present and the future of…
1. Some historical background The GNOME Infrastructure has been hosted as part of one of Red Hat’s datacenters for over 15 years now. The “community cage”, which is how we usually define the hosting platform that backs up multiple Open Source projects including OSCI , is made of a set of racks living within the RAL3 (located in Raleigh) datacenter. Red Hat has not only been…
1. Introduction 2. Achievements 2.1. Major achievements 2.2. Minor achievements 2.3. Our brand new and renewed partnerships 3. Highlights 3.1. Openshift 4: architecture 3.2. Openshift 4: virtualization networking 3.3. Openshift 4: image builds 3.4. Openshift 4: cluster backups 3.5. GitLab on Openshift 4: setup 3.6. GitLab on Openshift 4: early days 3.7. GitLab on Openshift 4: logging Future plans…
As you may have noticed from outage and maintenance notes we sent out last week the GNOME Infrastructure has been undergoing a major redesign due to the need of moving to a different datacenter. It’s probably a good time to update the Foundation membership, contributors and generally anyone consuming the multitude of services we maintain of what we’ve been up to during these past…
During GUADEC 2018 we announced one of the core plans of this and the coming year: it being moving as many GNOME web applications as possible to the GNOME Openshift instance we architected, deployed and configured back in July. Moving to Openshift will allow us to: Save up on resources as we’re deprecating and decommissioning VMs only running a single service Allow app maintainers to use the…
Been a while since GUADEC 2018 has ended but subsequent travels and tasks reduced the time to write up a quick summary of what happened during this year’s GNOME conference. The topics I’d like to emphasize mainly are: We’re hiring another Infrastructure Team member We’ve successfully finalized the cgit to GitLab migration Future plans including the migration to Openshift…
As a follow-up to the reCAPTCHA v1 post published back in 2014 here it comes an updated version for migrating your Mailman instance off from version 1 (being decommissioned on the 31th of March 2018) to version 2. The original python-recaptcha library was forked into https://github.com/redhat-infosec/python-recaptcha and made compatible with reCAPTCHA version 2. The relevant changes against the…
Six months since my latest blog post is definitely a lot and reminds me how difficult this year has been for me in many ways. Back in June 2015 I received a job proposal as a Systems and Network Engineer from a company located in Padova, a city in the north-east part of Italy which is around 150km (around 93 miles) away from my home-town. The offer looked very interesting and I went for it. The…
It’s been a while since my last “what’s been happening behind the scenes” e-mail so I’m here to report on what has been happening within the GNOME Infrastructure, its future plans and my personal sensations about a challenge that started around three (3) years ago when Sriram Ramkrishna and Jeff Schroeder proposed my name as a possible candidate for coordinating the team that runs the systems…
Many times it happened seeing someone joining the #sysadmin IRC channel requesting participation to the team after having spent around 5 minutes trying to explain what the skills and the knowledge were and why this person felt it was the right figure for the position. And it was always very disappointing for me having to reject all these requests as we just didn’t have the infrastructure in place…
One of the benefits I originally wanted to bring with the FreeIPA move to GNOME contributors was the introduction of an additional authentication system to connect to to the services hosted on the GNOME Infrastructure. The authentication system that comes with the FreeIPA bundle that I had in mind was Kerberos. Users willing to use Kerberos as their preferred authentication system would just be…
A few days ago I wrote about the GNOME Infrastructure moving to FreeIPA , the post was mainly an announcement to the relevant involved parties with many informative details for contributors to properly migrate their account details off from the old authentication system to the new one. Today’s post is a follow-up to that announcement but it’s going to take into account the reasons about our choice…
As preannounced here the GNOME Infrastructure switched to a new Account Management System which is reachable at https://account.gnome.org . All the details will follow. Introduction It’s been a while since someone actually touched the underlying authentication infrastructure that powers the GNOME machines. The very first setup was originally configured by Jonathan Blandford (jrb) who configured an…
Coming back from GUADEC has never been easy, so much fun, so much great people to speak with and amazing talks to watch but this year has definitely been harder as I totally felt in love with the city that was hosting the event. Honestly speaking I’ve been amazed by how Strasbourg looks like: alsace houses and buildings are just delightful, the cathedral is stunning and people have been so…
The GNOME and many other infrastructures have been recently attacked by an huge amount of subscription-based spam against their Mailman istances. What the attackers were doing was simply launching a GET call against a specific REST API URL passing all the parameters it needed for a subscription request (and confirmation) to be sent out. Understanding it becomes very easy when you look at the…
I wanted to give Fedy a try yesterday, specifically to install the **Brackets **code editor designed for web developers. I’m pretty lazy when it comes to install external packages (from the Brackets.io’s homepage it looked like only a DEB file was available) and after asking a few friends who made heavy use of Fedy in the past about its stability and credibility I went ahead and followed the…
It’s been a while now since the very first time I posed my hands on this shiny new Samsung Chronos Series 7 laptop and oh dear… how much pain did my metallic-grey fellow take me in order to figure out how properly have every single piece of the hardware working as expected? What I did right after unboxing it was dropping Windows 8 with a copy of Fedora 20 (yeah, stupid me, I could have booted…
Fighting with passwords have always been one of my favorite battles in the past and unfortunately the former always won. I never liked using the root user that much for administering a machine and made a massive use of sudo, I won’t list all the benefits of using sudo, but the following wiki page has a pretty nice overview of them. Said that, when using sudo it’s definitely ideal to combine a…
Today I’ll be working out how to properly configure DNSSEC on a BIND9 installation, I’ll also make sure to give you all the needed instructions to properly verify if a specific domain is being correctly covered by DNSSEC itself. In addition to that a few more details will be provided about adding the relevant SSHFP ‘s entries on your DNS zone files to be able to automatically verify the…
I wanna be really honest, getting back home from this year’s GUADEC has been very painful for me but not because of the trip back home. I had such a very good time at Brno that I actually wanted to stay there for way more days! I must admit that I’ve been missing the italian food for a while until Mattias Bengtsson suggested me to try having a dinner at the “ Flavours ” indian restaurant. The…
It’s been two years since my latest blog post about my Linux desktop and many things have changed since then. I completely moved all my machines to GNOME 3 , switched my main editor from nano to vim and my terminal multiplexer from screen to tmux . What didn’t change at all except for a tweaks on the theme is my Irssi setup. Switching from nano to vim has been a pain at first, nano is really a…
I haven’t been blogging so much in the past months as I actually promised myself I would have but given the fact a lot has been done on the GNOME Infrastructure lately it’s time for me to announce all the updates we did since my latest blog post . So here we come with all the items we’ve been looking at recently: Our main LDAP istance was moved from a very ancient machine (which unfortunately died…
I’ve recently spent some time setting up TLS/SSL encryption ( SSSD won’t send a password in clear text when an user will try to authenticate against your LDAP server) on an OpenLDAP istance and as you may know the only way for doing that on a RHEL / CentOS environment is dealing with a Mozilla NSS database (which is, in fact, a SQLite database). I’ve been reading all the man pages of the relevant…
It’s been more than a month now since I started looking into the many outstanding items we had waiting on our To Do list here at the GNOME Infrastructure . A lot has been done and a lot has yet to come during the next months, but I would like to share with you some of the things I managed to look at during these weeks. As you may understand many Sysadmin’s tasks are not perceived at all by users…
I’ve been looking around for a possible way to connect to the IPv6 internet for some time now and given the fact my provider didn’t allow me to run IPv6 natively I had to find an alternative solution. Hurricane Electrics (HE) provides (for free) five configurable IPv4-to-IPv6 tunnels together with a free DNS service and an interesting certification program . Willing to test the latest revision of…
Have you ever heard someone talking extensively about Cloud Computing or generally Clouds ? and have you ever noticed the fact many people (even the ones who present themselves as experts) don’t really understand what a Cloud is at all? That happened to me multiple times and one of the most common misunderstandings is many see the Cloud as something being on the internet . Many companies add a…
I live in a little village close to the city and one of the houses close to my property is for rent since more than ten years. A lot of families and people succeeded in that house and every time someone new joined my Linux evangelist hat jumped in my head. I’ve always presented myself as a Linux geek to my neighbours and it has been nice seeing how the Linux word evolved (with funny and surprising…
Exactly one week ago I was attending the Fedora Activity Day organized in Milan in concomitance with the Linux Day event being organized in several italian cities. Meeting the Fedora italian team has been simply great, we’ve been collaborating remotely since more than an year now and finding out all them being so friendly and pleasant has been a great pleasure. Each of us presented a specific…
Logging in into a Linux machine and executing the hundreds commands available is just one of the most common usages of OpenSSH . Another interesting and very useful usage is tunneling some specific (or even all) traffic from your local machine to an external machine you have access to. Today we’ll analyze how to access a certain virtual machine’s console by tunneling the relevant VNC port locally…
I’m an Italian Red Hatter who lives in New York City. While my primary education field has been Law, my passion and dedication for the FOSS world have brought me to volunteer and keep up many activities for GNOME and Fedora for several years. What I am doing now: GNOME: Being the GNOME Infrastructure Team Coordinator Being the GNOME Foundation Membership Committee ‘s Chairman. What I have done in…
È con piacere che annuncio la mia presenza al Fedora Activity Day di Milano in data 27 Ottobre 2012 e con altrettanto piacere ringrazio gli organizzatori per avermi dedicato uno spazio di trenta minuti in cui discutere ed approfondire le tematiche derivanti dall’amministrazione di sistemi Linux, nello specifico, dell’amministrazione degli stessi computer che ospitano e rendono disponibili numerosi…
Today I’ll be telling you about an interesting way to build your Debian packages using Deb-o-Matic , a tool developed and maintained by Luca Falavigna . Some more details about this tool from the package’s description: Deb-o-Matic is an easy to use build machine for Debian source packages based on pbuilder, written in Python. It provides a simple tool to automate build of source packages with…
Ever wondered how you can update your website (in our case a static website with a bunch of HTML and PHP files) by committing to a Git repository hosted on a different server ? if the answer to the previous question is yes , then you are in the right place. The scenario : Website hosted on server A . Git repository hosted on server B . and a few details about why would you opt for maintaining your…
Lately (as I earlier pointed out on my blog ) I’ve been working on improving GNOME’s infrastructure monitoring services. After configuring XMPP it was time to find out a good way for sending out relevant notifications to our IRC channel hosted on GIMPNET. I achieved that with a nice combo: supybot + supybot-notify , all that mixed up with a few grains of Nagios command definitions. But here we go…
As per Wikipedia: Puppet is a tool for managing the configuration of Unix-like systems, declaratively. The developer provides puppet templates for describing parts of the system, and, when these templates are deployed, the runtime puts the managed systems into the declared state. Puppet consists of a custom declarative language to describe system configuration, distributed using the client-server…
A few days ago I blogged about my main computer’s configuration files and desktop’s appearance and today I managed to add a few little tweaks to those, they are: Google’s contacts list integrated into Mutt a cleaner and nicer Login screen Curious to know how you can easily integrate your Google’s contacts into Mutt? Well, you should be able to achieve that within a few minutes after reading this…
I bought a new PC a few weeks ago and I then decided to renew a bit my Desktop , my Mutt and my Irssi setup. I’ve been spending several hours cleaning up old scripts, logs and configuration files but the result definitely seems to reward me the right way. But here they come a few screenshots : Desktop Irssi Mutt If you liked all the above and would like to reproduce everything yourself, you should…
I’ve actually spent a few hours searching around for a good backup solution for my mailbox until I decided to stick with getmail . What you’ll be able to achieve after reading this HowTo and deploying the following setup is: A full backup of your e-mail DATA in the Mbox format. (yes, Gmail’s labels / folders as well) Prevent getmail to mark all mails as read after delivering them. (this was a…
Since some time I’ve been thinking about a possible way to delete my Gmail’s Trash & Spam folders content automatically without having to bother doing it manually every single time I wanted to check my mail and clean it up. (I love keeping everything in place and having my Trash&Spam folders empty as they should be makes me pretty happy ) A few years ago when Mutt was my main mail client I had the…
Today we had a great Town Hall meeting kindly hosted and moderated by Kevin Fenzi (nirik) . We received a lot of interesting and nice questions by the contributors and developers that were attending: What do you feel needs to be improved in the Fedora Community? How can you’re being on the Board improve the Community? Do you think that too many issues in Fedora are referred directly to the Board,…
If you are not subscribed to the fedora-announce mailing list but you are still interested in having a look at my responses about community-asked questions , here they are: What will you be able to accomplish by being elected, that you would not otherwise be able to do as a contributor? (As you will notice by reading the list right down here) Being a single contributor makes achieving these points…
Today I had the possibility to announce a new tool for the Fedora Project, a sub-planet called Edited mainly focused on Fedora-related posts and announcements. The scenario we gonna have when Edited will become a known tool by the whole project can be resumed as it follows: team leaders or whoever will be appointed to, will send out their team s status and any relevant announcement such as…
Debian maintainer: Some days ago I had the great announcement that my Debian Maintainer ‘s application was accepted and thanks to Jonathan McDowell my key is finally into the debian-maintainers keyring. (which is now part of the debian-keyring itself thanks to the ftp-masters / keyring maintainer work that made the changes on both DAK and keyring) I applied on the 22th of August, and thanks to…
Pochi giorni fa ho avuto l’onore di essere intervistato da BehindMOTU, vi riporto l’intera intervista (ovviamente in inglese) augurandovi ,inoltre, una buona lettura! Potete trovare il post originale qua . Today we are interviewing Andrea Veri , fresh MOTU and eager Ubuntu volunteer. Age: 18 Location: Udine, Italy IRC Nick : bluekuja How long have you used Linux and what was your first distro? I…
Questo pomeriggio ho eseguito il primo upload nell’archivio di Ubuntu e devo dire che ricevere poco dopo la mail di conferma e di successo dell’operazione è qualcosa di veramente speciale! Mi trovavo in una delle tante cartelle della mia Home e dopo aver controllato innumerevoli volte che tutto fosse corretto, ho lanciato dput e eseguito l’upload del pacchetto in questione, che, dopo il solito…
Dopo ben 3 mesi dalla mia presentazione al MOTU Council per la candidatura ufficiale a Master of the Universe è giunta ieri la lieta mail di Matt Zimmerman, chairman della tech board di Ubuntu e responsabile di ogni decisione finale per ogni candidatura presentata al consiglio. La mail che potete trovare nella mailing list di ubuntu-devel annuncia il mio ingresso come developer ufficiale di…