Deploying a bare-metal Kubernetes cluster is very much a build-your-own adventure: kubeadm will create a cluster for you, but fundamental building blocks like the load-balancer, persistent storage, and ingress you need to setup yourself. In addition, what if you are running in an air-gapped environment? No incoming or outgoing internet connections, at best you get to SSH in. 1 Since you can't…
Yes. The official instructions for kubeadm say to disable SELinux before doing the installation and give a big fat warning that: Setting SELinux in permissive mode by running setenforce 0 and sed ... effectively disables it. This is required to allow containers to access the host filesystem; for example, some cluster network plugins require that. You have to do this until SELinux support is…
There’s a joke that goes around my office: if corporate ever tries to lock down root access on our workstations, we’ll just use the latest sudo vulnerability to get it back. This is not an idle threat. CVE-2025-32463 has just been announced, and it allows arbitrary unprivileged users to acquire root privileges on most Linux systems out-of-the-box. This is an all-too-common story: a bug in an SUID…
I was recently interested in getting an e-reader, and there are two main options: a Kindle, or a Kobo. The Kindle only supports their proprietary file format and is difficult to jailbreak . The Kobo on the other hand supports the open EPUB standard and is extremely hackable . The choice was thus obvious, and I popped down to the store to get a Clara BW . I had originally hoped to replace the stock…
I recently released my first open source project and had to choose a license. Being an advocate of free software principles, my first choice was the GPL3 . However, I decided out of curiosity to read the license first—I think it’s reasonable that if I’m going to use a license I should understand what it requires. A good forty-five minutes later, I had a single conclusion: the GPL3 is…
These days I usually use Meson for building C and C++ code, but for small projects the simplicity and ubiquity of a Makefile can't be beat. In the past I'd write custom Makefile rules to compile each file individually, but with the power of wildcards we can write a generic Makefile that drops in to any project. Simply set the executable name, customize your compiler options, and off you…
It is now the final week of GSoC, and it is time for me to write my final blog post. Over the past summer I have worked on fixing the Coverity scan issues in coreboot, with the goal of making the code base “Coverity clean”. This has involved writing a substantial number of patches, the vast majority of which are in coreboot, with a sprinkling in a few other projects: 146 patches in coreboot 6…
Hello again! For the past two weeks I have been working on Coverity issues in various third party repositories, notably flashrom and vboot . The majority of issues in both repositories are now fixed, with the remaining ones mostly being memory leaks. Also, support for OpenSBI (a RISC-V supervisor binary interface) was recently added to coreboot, and Coverity picked up several issues in that. With…
Hello everyone! Coverity has come back online again after its long upgrade, and with it a pile of new scan issues (over 100). I put aside a week to fix all the new issues in parts of the code base I had already worked through, and then spent the next two weeks finishing soc and the Cavium vendorcode. Referring to the overview page , there are now 300 scan issues left in the code base. While a…
Hello again! It’s been three weeks since my last post (well, one of those weeks I was on vacation, so more like two weeks), so there are many many updates to write about. If you recall from my last post, Coverity has been down for maintenance, so I started looking around for other things to do. Here is a list of some of the highlights: Coverity isn’t the only static analyzer we use—coreboot also…
Hello again! If you recall from my last post, the schedule this week is to fix the issues in northbridge/via and southbridge . However, Coverity is going through a major internal upgrade, and so the issue tracker has been offline all week. Luckily though I was able to fix most of these issues last week, so assuming the upgrade finishes soon I won’t be behind schedule. In the mean time, I…
Hello again! This is a continuation of my posts about fixing the Coverity issues in coreboot. This week’s plan was to tackle the 28 issues in northbridge/intel , which turned out to be much easier than I expected, since I’m already done! With that out of the way, I’m going to begin working on northbridge/via and southbridge . For the curious, here is the project timeline for entire…
Hello everyone! My name is Jacob Garber, and I am a student in this year’s GSoC 2019! My project is on making coreboot Coverity clean. Coverity is a free static-analysis tool for open source projects that searches for common coding mistakes and errors, such as buffer overruns, null pointer dereferences, and integer overflow. Coverity automatically analyzes the coreboot codebase and flags issues it…
When writing high performance code, there are pretty well two options: C and C++. C is essentially a portable wrapper around assembly. You can tell exactly how much every action costs, where memory is allocated, and where it is freed. Nothing is hidden. However, because of this direct control, writing C code is very tedious and error prone. C++ is a bit higher level. You give up some control in…