apparmor

过去十年间的Linux内核的贡献对比

会有一股神秘感。 提交于 2020-03-05 11:55:51
本文我们将会了解到全球顶级 Linux 发行版厂商 Red Hat、SUSE 和 Canonical 在过去十年里对 Linux 内核的贡献对比情况,主要是通过各自公司域名邮件地址的 git commits 数量进行统计。 先来看一下这几家公司每年被统计到的为 Linux 内核贡献代码的唯一电子邮件地址数量(主要是粗略了解此群体的开发者人数)。 可以看到,Red Hat 在过去三年里拥有超过 160 名开发者为 Linux 内核贡献代码。其中 2010 年恰好是十年来的巅峰,当时它拥有 185 名开发者为内核贡献代码。虽然在次年 Red Hat 贡献者的数量就成了十年里最低的一年,不过自此之后,它的数量一直保持着正常且稳定的增长。 相比之下,SUSE 和 Canonical 为内核贡献代码的开发者则少了许多,Canonical 每年大约有 24 个以 Canonical.com 为后缀的邮件地址留下了为 Linux 内核贡献代码的痕迹。与之相应的 SUSE 则每年大约有 60 名这样的开发者。 了解完为内核贡献代码的开发者人数后,再来看看根据公司域名而统计出的每年总提交(git commits)数量。Red Hat 每年大约有 4000 次提交;其次是 SUSE,每年约 2000 次提交;最少的则是 Canonical,前几年都是大约 200 次提交,它也曾因对 Linux

如何优雅的使用GDB调试Go

故事扮演 提交于 2020-02-27 07:31:58
今天聊聊如何优雅的使用GDB调试Go程序。 GDB有啥用? 想了解代码底层的话,它是一大利器,更别说定位问题啥的。 具体骚操作见曹大的使用 debugger 学习 golang 但GDB从安装到可用,可能有一大堆问题要解决(尤其在Mac上),我们怎么能优雅的使用它,避免陷入问题中,是本文的重点。 (涉及Docker和Mac两个平台上运行) 先来看比较推荐的Docker方式 Docker篇:3步即可调试 docker加持的话,非常方便,随用随起 先上效果:戳 gdb-debug-go-in-docker 可下载命令 具体步骤如下:(完全回归工具本质,换台机器也能调试) // 1. 已当前目录映射启动gdb docker run --rm -it --security-opt="apparmor=unconfined" \ --security-opt="seccomp=unconfined" \ --cap-add=SYS_PTRACE -v "$(pwd):/go/src/app" \ newbmiao/gdb-go1.14rc1:latest bash // 2. 编译go,不使用compressdwarf 、inline and escape go build -ldflags=-compressdwarf=false -gcflags=all="-N -l" -o test

How to limit the size of subprocess stdout and stderr in python

限于喜欢 提交于 2020-01-02 05:57:46
问题 I need to run applications submitted by users. My code looks like: def run_app(app_path): inp = open("app.in", "r") otp = open("app.out", "w") return subprocess.call(app_path, stdout=otp, stdin=inp) Now since I have no control over what users will submit, I want to restrict the size of the output of the application. Other things like trying to access unauthorized system resources and abusing of CPU cycles are being restricted by apparmor rule enforcement. The maximum time allowed to run is

How to limit the size of subprocess stdout and stderr in python

霸气de小男生 提交于 2020-01-02 05:57:12
问题 I need to run applications submitted by users. My code looks like: def run_app(app_path): inp = open("app.in", "r") otp = open("app.out", "w") return subprocess.call(app_path, stdout=otp, stdin=inp) Now since I have no control over what users will submit, I want to restrict the size of the output of the application. Other things like trying to access unauthorized system resources and abusing of CPU cycles are being restricted by apparmor rule enforcement. The maximum time allowed to run is

mysql wont start Ubuntu 16.04.2 x64

北城余情 提交于 2019-12-13 04:08:29
问题 So MySQL won't restart/start after a server reboot. No configuration files have been edited / any changes made. I have the same problem as this question where apparmor is causing these log entries: Sep 27 11:18:53 staging audit[2986]: AVC apparmor="DENIED" operation="open" profile="/usr/sbin/mysqld" name="/proc/2986/status" pid=2986 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=112 ouid=112 Sep 27 11:18:53 staging audit[2986]: AVC apparmor="DENIED" operation="open" profile="/usr/sbin

mysql terminated with status 1?

久未见 提交于 2019-12-11 23:25:13
问题 This morning I noticed that my mysql server was not running. A look at the logs and I found the information below. While it is troubling that the mysqld service ran out of memory and was killed, it is more troubling that mysql could not restart. Any ideas on why mysql could not respawn? How can I test to make sure that if the process is killed it will respawn? Thank you. 387 Oct 10 06:37:09 ip-xxx-xxx-xxx-xxx kernel: [12218775.475042] Out of memory: Kill process 810 (mysqld) score 232 or

Using IVSHMEM with libvirt virt-manager

不问归期 提交于 2019-12-11 06:36:31
问题 Using ivshmem in qemu requires the following steps. Start ivshmem server in host ./ivshmem_server which will create a unix domain socket /tmp/ivshmem_socket Start qemu with the following command line options- -chardev socket,path=/tmp/ivshmem_socket,id=ivshmem_socket -device ivshmem,chardev=ivshmem_socket,size=1m Now if we do lspci in guest, the ivshmem pci device is shown in it. How can I do the same in virt-manager? Specifically, I want to do 2 things. Pass the above command line option to

Rmpi, OpenCPU, and Apparmor: DENIED request for “/”

你。 提交于 2019-12-11 05:15:43
问题 I have an R package that sends out a job to the OpenMPI cluster I have running by means of the Rmpi package. All works as expected within an R session run from the console. However, when I try to execute the relevant function with from my OpenCPU server like this (details changed to protect the innocent): curl -XPOST http://99.999.999.99/ocpu/library/MyPackage/R/my_cluster_function I get this error: R call failed: process died. (Other, non-cluster calling functions within the package work as

How does AppArmor do “Environment Scrubbing”?

孤者浪人 提交于 2019-12-10 12:50:00
问题 The AppArmor documentation mentions giving applications the ability to execute other programs with or without enviroment scrubbing. Apparently a scrubbed environment is more secure, but the documentation doesn't seem to specify exactly how environment scrubbing happens. What is environment scrubbing and what does AppArmor do to scrub the environment? 回答1: "Environment scrubbing" is the removal of various "dangerous" environment variables which may be used to affect the behaviour of a binary -

How to stop running Container, if error response from daemon is: Cannot Kill Container […] permission denied?

耗尽温柔 提交于 2019-12-09 09:47:53
问题 Tough task: Everytime I try to stop or kill a running container, I get permission denied as an error response from Daemon. I just started learning how to use docker by using a Ubuntu18.04 VM. I was running a container for the first time. I was not able to stop it but at least it was running. Now, after I tried to run another image "furtuas/daisitory:image_available_first_ms", everything got worse. Two containers are running, I can't stop non of them. I tried to restart docker but the