Uwe Hermann | A slightly paranoid Debian developer

Yes, just when you thought the spamming of Planet Debian with "Lenny released" blog posts had finally stopped, here comes another one :-)

Let me join the crowd by saying a great "thank you!" to all the people who made this release possible, especially so the release team who organized everything, as well as the thousands of contributors (in one form or another) who helped shape the new release!

Personally, I'm eager to try out the new Linux 2.6.28 kernel package in unstable now (which have been uploaded today or so, but haven't yet reached my mirror), since they contain mainline wireless drivers for my One A110 netbook, among many other things.

Also, in the next few days I'll probably re-install my NSLU2 ARM box using the latest Lenny installer, following the HOWTOs by Martin Michlmayr (I'll probably write about the experience later). This re-install is long overdue, as I'm currently running the box from an 1GB thumb drive, which works ok, but I'm slowly running out of space. So I'll re-install on a 4 GB (or bigger) thumb drive.

Yay, finally! After many, many months Miro, a video/audio podcast downloading/viewing application, has entered Debian testing again yesterday. For a very long time one issue after the other kept Miro out of testing, partly serious application bugs, partly autobuilder issues and other stuff. I had almost given up hope, but luckily my 1.2.3-2 upload has now finally entered testing, just in time for the freeze...

To say it with the words of Andreas Barth (one of the Debian release managers):

Etch is now frozen! Wheeeeeee!!!

Update: "Testing stuff with QEMU"-articles published so far:

• Part 3: Debian GNU/kFreeBSD
• Part 2: MenuetOS, a tiny OS written in 100% assembly language
• Part 1: SELinux support in Debian unstable

Here's a quick HOWTO to get you started with the QEMU emulator, the Debian installer (etch beta 3), and SELinux. If you execute the following steps you'll be left with an SELinux-enabled Debian unstable QEMU image, but not with a complete working and perfectly configured SELinux system. A more detailed article about SELinux will probably follow...

Basic Debian unstable install in QEMU:

1. Install QEMU:
   apt-get install qemu
2. Download the latest Debian etch installer ISO image (etch beta 3, currently):
   wget http://cdimage.debian.org/cdimage/etch_di_beta3/i386/iso-cd/debian-testing-i386-binary-1.iso
3. Create a QEMU image which will hold the Debian installation:
   qemu-img create -f qcow /path/to/debian.img 5000M
4. Boot directly from the ISO image and install Debian into the QEMU image (I won't go into the details of the installation itself; Wolfang Lonien has nice HOWTOs for that: part 1, part 2, video):
   qemu -hda /path/to/debian.img -boot d -cdrom debian-testing-i386-binary-1.iso
5. After the installation is done, configure the system, tweak /etc/apt/sources.list if needed, and then dist-upgrade to the latest stuff:
   apt-get update && apt-get dist-upgrade
6. That's about it for the basic Debian install, you can now shutdown the OS and QEMU (type "halt" in the emulated Debian, wait for the shutdown to complete, press CTRL+ALT+2 to switch to the QEMU console, and type "quit").

Creating a QEMU overlay image:

QEMU has a nice feature called overlay images which allows you to "clone" an image, where the new (overlay) image will only store the "diffs" to the original one, thus saving lots of space. This also allows you to remove the overlay image at any time and restart from the original image (which is nice for testing stuff which may break).

1. Create an overlay image based on the previously installed Debian image:
   qemu-img create -b /path/to/debian.img -f qcow /path/to/debian_selinux_overlay.img
2. Now boot into the new overlay image:
   qemu -hda /path/to/debian_selinux_overlay.img

Basic SELinux setup:

1. SELinux wants to label all the files on your system (all inodes actually), so your filesystem(s) need the so-called extended attributes (xattr) and "security labels" (both are kernel options) which most modern file systems now support. For ext3 (for example) you need these config options:
CONFIG_EXT3_FS=y
CONFIG_EXT3_FS_XATTR=y
CONFIG_EXT3_FS_SECURITY=y
Luckily the Debian kernels are xattr-enabled by default so we don't have to do anything at all here.

2. Install the basic SELinux packages and the source package of the SELinux reference policy:
   apt-get install checkpolicy policycoreutils selinux-policy-refpolicy-src
3. I noticed a bug in the current Debian packages (the setfiles utility is in the wrong place, see #384850), but there's a simple workaround:
   ln -s /sbin/setfiles /usr/sbin/setfiles
4. Now we can (re-)label the file system:
   cd /etc/selinux/refpolicy/src/policy
make relabel
   This will build the reference policy from source and relabel your file system (this will take a while).
   There might be some warnings (and maybe you'll notice further bugs), but they seem not to be critical.
5. We can now (almost) enable SELinux, but before we can reboot we need to work around another bug (#384852), otherwise SELinux will not be enabled when we reboot:
   ln -s /etc/selinux/refpolicy/src /etc/selinux/targeted
6. Now reboot the emulated Debian system, and at the GRUB console add the kernel option selinux=1 to enable SELinux in the kernel (press "e" to edit the boot options).
7. You'll get tons of SELinux log messages while the system boots, that's normal at this point, don't worry.
   Then you can type "sestatus", which should print some information on the running SELinux system. If it says "SELinux status: disabled" something went wrong.

Congratulations! You now have a QEMU image with minimal SELinux support and you can start playing with it, tweaking the policy, finding and reporting bugs, reading tons of documentation on how SELinux actually works etc. etc.

As SELinux is (half?) a release-goal for Debian etch, it would be nice if many people could test it before the release, and this is one method to do so without breaking your production systems.

Update 2006-08-28: You don't really need user_xattr support for SELinux, only xattr support (for security.selinux xattrs) for the filesystem you use, which is available per default in Debian kernels (thanks Russell Coker).

Upon popular request (my post was even featured on Debian Weekly News), I re-ran my previous query on the changelog files in Debian packages. This time, however, I didn't only retrieve 40 random package release names, but "all" of them, for unknown values of "all". I didn't analyze some of the files (missing permissions), and maybe I missed one or two because my query sucked, but I think I've got most of them.

I ran a slightly more complicated query than last time, using the data from gluck:/org/lintian.debian.org/laboratory/. I have not the slightest idea how old the files in that archive are, but there's ca. 10.000 packages in there — more than enough, if you ask me.

The results (78 KB) this time are in alphabetical order, and include the package names where the strings were found. There's a total of 1408 strings.

Here are 20 randomly chosen strings, for some more fun:

gdb: * The "Ahhhhhhhhhhhhhhhhhh!" Release.
glibc: * The "Fuck Me Harder" release.
abiword: * The "Foolin' Myself" release.
opensc: * The "RTFM" release.
directory-administrator: * The "On Train" release
xchat: * The "Merry Christmas, mine beloved Xchat users!" release.
apache: * The "Yes, we know there is a new upstream release" upload.
mmm-mode: * The "But I'm Not Dead Yet!" Release
mozilla-firefox: * The "becoming more and more an iceweasel" release.
nano: * The "Marbella, ciudad hermanada con Benidorm" release.
thy: * The `Empty Spaces' release.
glibc: * The "Chainsaw Psycho" release.
sam: * The `Minime' release.
xchat: * The "Binary only" release.
tellico: * The "pbuider and buildds are not the same" package release
pingus: * The "All you pingus are belong to blendi" release
xchat: * The "Ok, wrong patch, excuse me guys :)" release.
cappuccino: * The "It's time for the upload" release
abiword: * The "Got A Good Thing Goin'" release.
firefox: * The "what he taketh, he giveth back" release.

I also created a small statistic this time. Here's the Top-20 packages (the ones with the most release names):

64 abiword
62 thy
41 xchat
35 glibc
31 shadow
31 abcde
28 menu
18 reportbug
18 firefox
17 fetchmail
15 ccze
14 tama
14 mozilla-firefox
12 nano
12 apache2
11 gaim
10 debconf
9 mailutils
9 lirc
9 geneweb

Feel free to grab the whole results file for more reading fun during boring hours of the day.
If you do any further processing or analysis of any kind with the data, please post a comment and let us all know ;-)

Update 2006-05-23: Enrico Zini has done some interesting things with the data...