[00:11] running ubuntu server 10.04 on a couple of web production machines and decided to build a home media server [00:11] Having trouble seeting up a sound driver is there an easy way? [00:13] or should I simply install the ubuntu base distribution? [00:13] which I think will set up the sound correctly to start with [00:15] bit-flipper, have you found - https://wiki.ubuntu.com/PulseAudio [00:21] Hello all. Is there any way to check that I actually installed 'minimal' like intended? I have a sneaky suspicion I didn't. [00:24] ryan: df will show you waht sapce you've used [00:29] Thanks bit-flipper! does this look like a minimal? Used: 1984812 [00:31] is there a quick way to install php for apache2? [00:32] lampp? [00:33] no packages come up with that [00:36] CppIsWeird: Install the php5 package? [00:36] CppIsWeird: apt-get install libapache2-mod-php5 [00:36] CppIsWeird: or run 'tasksel' and choose LAMP, but that will also give you MySQL. [00:37] CppIsWeird: note that you will need to stop/start apache after that package installs. [00:37] * SpamapS realizes he is late, and disappears [00:37] lol, that would have been useful. but i've already got apache2 and php installed, so im gonna continue. :P [00:37] but thanks for trying! :-) [00:37] jdstrand: there? [00:38] Ryan: that seems smaller than a standard ubuntu dist... [00:39] hallyn: it is actually under /var/lib/eucalyptus/instances/ [00:50] has anybody used esxi to virtualize an ubuntu server? === unreal_ is now known as unreal [00:52] bit-flipper: thanks again :) === jjohansen is now known as jj-afk [01:17] encore besoin d'aide avec apache2 [01:17] j'ai installé les paquets php5, et maintenant apache2 ne veut plus se lancer [01:17] j'arrive pas à comprendre ... [01:18] sudo service apache2 start [01:18] * Starting web server apache2 [ OK ] [01:18] sudo service apache2 status [01:18] Apache is NOT running. [01:18] so ... wtf ? === nuno_ is now known as slug === TheTick is now known as presuntorj === 15SAAP7AS is now known as superbrad [02:51] has anyone used a EMC AX150 SAN with Ubuntu server? [03:03] Has anyone tried this? http://www.howtoforge.com/using-iscsi-on-ubuntu-9.04-initiator-and-target === amstan_ is now known as amstan [03:23] hggdh: right, my point was that libvirt seems to be doin the right thing and i think eucalyptus is mucking with it [03:55] I'm tinkering with software RAID on Ubuntu Server. I made a raid partition on each disk and the installer let me make a RAID 1 array from them, but only seems to want a single ext4 partition (I was thinking of putting swap on there too) [03:55] Should I keep swap outside the raid partitions? [03:57] ball: having swap inside the raid will actually make your system not crash if a harddrive crashes [03:58] amstan: That was what I was hoping for. [03:58] well.. that's the theory anyway.. [03:58] i can think of other reasons too though, it will make reads faster for the swap, if you need that sort of thing [03:58] and it'll keep the drivers more symmetric looking [03:59] i have my swap the same as my other partitions on raid 1 [03:59] For some reason I can't seem to find the option that will let me partition the array. [04:01] Do I need to configure two separate arrays, one for the ext4 and one for the swap? [04:01] That seems a bit odd. [04:02] how to configure software on ubuntu [04:02] software raid on ubuntu [04:07] wippler didn't stick around long enough for anyone to answer. [04:22] * ball gives up and makes a separate array for swap [04:39] Is there no way to turn off journaling in ubuntu ? [04:39] I see the only way I think its to boot off os x install disk and turn off journaling [04:42] chrislabeard, don't use ext3 [04:42] chrislabeard, use ext2 for the root partition [04:43] This is my secondary HDD that I used when I had os x running on this machine [04:43] chrislabeard, of course, I would probably like to know WHY you want to do that [04:43] I would think the way to turn off journalling would be to use a non-journalling filesystem [04:43] (for that part of your data) [04:43] (the part that you want to break ;-) [04:44] ball, I always answer questions, then I look back and say "why would anyone do that" [04:45] I told you dood [04:45] chrislabeard: I must have missed that. [04:46] ball, so did I [04:46] Secondary HDD for my mac I have recently installed ubuntu on the primary drive. [04:46] Aka it is still MAC OS Extended [04:47] MacOS doesn't use Linux filesystems afaik, so I'm not sure how that helps. [04:47] what ? [04:47] I wasn't even aware the Mac could run Ubuntu. [04:48] yes it can [04:48] * ball shudders at the thought of Apple firmware. [04:48] it runs great btw [04:48] thanks for asking [04:48] chrislabeard: xServe? [04:49] its powermac G5 [04:49] a( [04:49] Still a great machine [04:49] I've thought in the past about buying one of those, but it wouldn't make sense for me today. [04:50] I use it as a server and a piece of furniture just cause its so good looking [04:50] Don't lie you know its sexy [04:51] hi guys, how can I configure 2 identical ubuntu server as a cluster? [04:51] chrislabeard: "sexy" is subjective, thankfully. [04:51] hello afeijo [04:51] lol [04:53] hi ball :) you nick remind me Baal from Stargate SG1 scifi tv show :D [04:54] afeijo: I've not seen that. [04:54] I love scifi, SG1 is my favourite [04:54] aside with startrek [04:55] More of a Who man myself. [04:56] * ball waits patiently for Ubuntu to install again. [04:56] dont know that one [04:56] afeijo: Doctor Who ? [04:57] I heard but never watched [04:57] british humor is weird :) [04:57] hey guys. I'm getting reports that the tomcat 6 in the repos doesn't work properly and that I should be installing the one from the apache project site. They never go into detail about what doesn't work though. Does someone know what I'm talking about? === SeuNick-afk is now known as Andre_Gondim_ [04:58] no one uses cluster in the channel? === Andre_Gondim_ is now known as Andre_Gondim === Andre_Gondim is now known as SeuNick-afk === SeuNick-afk is now known as Andre_Gondim_ [05:00] afeijo: define "cluster" === SeuNick-afk is now known as Andre_Gondim [05:01] ball, 2 ubuntu working as 1 [05:01] I installed 2 VM to try it, to learn [05:01] a LAMP server [05:02] afeijo: Okay. Be aware that is just /one/ interpretation of the word though. === Andre_Gondim-afk is now known as Andre_Gondim [05:02] ("Cluster" is ambiguous) [05:02] I see [05:03] Sounds as though you want to strap two Ubuntu Server boxes together in hope of achieving "high availability" [05:03] I recently had an application that needed that, but I wasn't able to find a solution. [05:03] yes! [05:04] faster and failsafe [05:04] ...but I didn't hit the vm vendors hard. [05:04] oh :) [05:04] (and our budget was limited) [05:04] I don't think it is related to the VM, I installed heartbeat, but now I need to figure out how to configure it [05:05] afeijo: There are a couple of different approaches. [05:05] If it's for something important enough to warrant H.A, I suggest you consult an expert. [05:07] We couldn't afford to, so I scratched the project. [05:07] (also, we couldn't print). [05:07] thats bad [05:07] I know a few good linux guys, I will email them :) Thanks [05:07] * ball shrugs [05:08] 1 a.m., sleep time ... good night [05:08] I'll be really lucky if I get to bed by 01:00 === Andre_Gondim-afk is now known as Andre_Gondim [05:17] * ball pokes his Ubuntu Server testbed with a sharpened stick [05:57] Is dapper server still being supported? [05:57] This site says it's EOL, but the email it links to says otherwise. https://wiki.ubuntu.com/Releases [05:57] The second paragraph says the server edition goes till 2011 june. https://lists.ubuntu.com/archives/ubuntu-announce/2009-July/000123.html [05:58] !EOL [05:58] End-Of-Life is the time when security updates for an Ubuntu release stop, see https://wiki.ubuntu.com/Releases for more information. Looking to upgrade from an EOL release? See https://help.ubuntu.com/community/EOLUpgrades [06:00] I was scanning a job application, and I came across "Layer 2, 3, and 7 security required". Wouldn't that mean you're programming the application too? [06:00] That page does seem strange; maybe when Dapper was released, Canonical had not yet committed to five years of support for LTS Server packages? [06:00] Runeg: depends which model they're using; but I would guess so. === Andre_Gondim is now known as Andre_Gondim-afk === Andre_Gondim-afk is now known as Andre_Gondim [06:14] I'm pretty sure dapper server had 5 years [06:15] of course that would put us in the final year right now, so you should think about upgrading anyway === Andre_Gondim is now known as Andre_Gondim-afk [06:46] qman__: that wiki page indicated it wasn't === Andre_Gondim-afk is now known as Andre_Gondim === Andre_Gondim-afk is now known as Andre_Gondim === Andre_Gondim is now known as Andre_Gondim-afk [06:57] mornig..what's the right way to jail users? i mean creating a chroot environment [06:58] because i'm thinking of create a /jail dir where i put customers, and use the chroot option of apache and set to /jail then use fcgid and suexec to run php inside the jail.. [07:02] alex88: there's no "right" way, there are several ways to put your (web server) users into a chroot environment [07:03] alex88: you could run one httpd per user or you could just chroot the script processes for example [07:04] joschi: well, apache has the chroot option, and i can use it.. but what about php, supposed it will be runned by the user [07:04] alex88: you mean mod_chroot? [07:05] alex88: or do you mean ChrootDir of the stock apache? [07:05] ChrootDir... [07:06] or, is mod_chroot better? cause it's older that the time that option is implemented in stock apache [07:06] ah ok. so then your complete apache is running in that chroot environment and the scripting processes will inherit that environment [07:09] really? will fcgid runned inside and also the php scripts cannot access outside that also with system() function? [07:12] chroot isn't the same as a jail. [07:12] If you want a proper jail, consider LXC or OpenVZ or vserver [07:13] they're for running vps right? [07:13] They're for running jails. [07:13] so jail is a complete indipendent system? [07:13] The distinction between a heavyweight jail and a lightweight VPS is blurry [07:13] It's not independent in the sense that it has its own boot sequence and kernel. [07:14] well, right..so i want a chroot? [07:14] I don't know what you want. [07:14] http://en.wikipedia.org/wiki/Operating_system-level_virtualization discusses jails. [07:15] well, i want that users (hosted sites etc), don't exit /jail/ dir [07:15] OK, put it this way: [07:16] i mean with php scripts..they won't have shell [07:16] A VM provides virtual hardware. A jail provides virtual parts of the kernel, such as the network stack and the VFS (directory tree). [07:16] A chroot is a jail that can *only* virtualize the VFS and nothing else. [07:17] ok..so a chroot will be enough..cause the apps etc are all linked to the main apps of the system.. but they won't get out the VFS [07:17] That really depends. [07:17] Certainly it is easier to break out of a chroot than a jail. [07:18] i've tried http://olivier.sessink.nl/jailkit/ some time ago, and it chroots fine the ssh session..but i don't know about php scripts..because it changes the shell in /etc/passwd so i think it doesn't matter with php scripts.. [07:19] right..but i don't know how to build a jail without using virtualization apps.. [07:25] on the net they all talk about chroot with ssh..so it doesn't affect php scripts i think [07:27] btw, i'll try with apache chroot (that's not so much documented...) and the fcgid [07:31] this seems to be fine http://www.seaoffire.net/fcgi-faq.html but i have to check more [07:42] hey all [07:44] !hi [07:44] Hi! Welcome to #ubuntu-server! Feel free to ask questions and help people out. The channel guidelines are at https://wiki.ubuntu.com/IRC/Guidelines . Enjoy your stay! [07:47] this is nice - havent been to this room. [07:47] i have one question - has anyone here tried to install ubuntu on a dell optiplex 320? there seems to some issue with the bios, you cant install linux on that machine. I have googled the information and i couldnt really find an easy way around it [07:47] never..what's that? [07:48] is my question not clear? [07:53] what's that? a server? [07:54] that's a wiki page for that https://wiki.ubuntu.com/DellOptiplex320 [07:56] yeah, they seem to define steps on how to get past the issue, but not explain why this is happening or why we are running those commands [07:57] it is assumed that you have excellent experiance with the commands [07:58] right..and there are no info about lucid [07:58] yout've tried that? [08:01] intrepid-ab, that page says karmic works out of the box [08:01] I'd have to guess lucid would too, they share a lot in common [08:03] it also looks like the problem is grub1, which lucid does not use on new installs [08:04] i have tried it with grub2 - the issue is not resolved [08:05] i really dont understand how the bios doesnt support any linux distro [08:06] intrepid-ab1: checked for bios updates? what's wrong with grub? [08:06] Good Morning Campers! [08:06] campers? :) [08:06] i have upgraded the bios [08:07] but it still will not boot the installed system [08:07] to 1.1.12? [08:07] yep [08:09] dunno...so what's the problem with grub? [08:10] no clue - tried a lot of things - i guess the kernel fix is what is left [08:10] ok [08:10] thanks for the help [08:11] great channel - will drop by again - thank you again alex88 [08:11] i'm afraid that's nothing to do... :( [08:11] np.. === rmk_ is now known as rmk [09:29] morning [09:45] morning.. [09:45] has anyone tried to setup virtualbox on ubuntu server? [09:47] alex88, I might give this a go tonight...cuz I was asked by a client to test it... [09:47] alex88: Only on ubuntu desktop ;) [09:48] for server I'm using kvm virtualization [09:49] binBASH: easy to install? [09:49] YankDownUnder: oh..nice.. :) i'll try later [09:50] alex88: the virtualbox or the kvm? [09:50] the kvm [09:50] it's quite easy [09:51] I want to "serve" the VM's...not run a server in a VM... [09:52] binBASH: oh..there's a wiki for that..nice [09:52] sure ;) [10:10] hello to everyone, i have a few problem and need help for ubuntu server 10.04.1 LTS if possible [10:11] !ask | starslights [10:11] starslights: Please don't ask to ask a question, simply ask the question (all on ONE line and in the channel, so that others can read and follow it easily). If anyone knows the answer they will most likely reply. :-) [10:12] i have get a installed version with only "root" for user name and it seem that's make me some problem installing desktop and nx [10:12] in fact i think that i mostly need to use a non-root user to do that thing , it is right ? [10:14] i already installed my own in my life and don't has problem but now i don't know what i must do. i.e if i need create another simple user or not, sorry for my englisg between [10:14] actually i have installed ubuntu-desktop via root and NX but still say that i can't access as user root with NX [10:15] hi Jordan_U, yep, i know, thanks, just not easy to know how explain :D [10:16] starslights: What is your first language? [10:16] starslights: best practice is to minimize the amount of things you run as root. [10:16] French [10:17] !fr | starslights [10:17] starslights: Ce canal est en anglais uniquement. Si vous avez besoin d'aide ou voulez discuter en francais, merci de rejoindre #ubuntu-fr, ou #ubuntu-qc. Merci. [10:17] oh,i will try in the FR if one existe for ubuntu, Thanks anyway for your answer, nice from you [10:18] starslights: You're welcome. [10:18] having a great day guys :) [10:18] =) [10:30] hi [10:31] i'm having some trouble with apache2 on ubuntu server [10:31] anybody alive in here ? [10:36] [10:36] shelter: just ask your questions, with details [10:39] k cool i have an apache installation with the default config [10:40] running on ubuntu server 9.10 [10:41] i have a folder named 'cshelter' that contains some php files that i have written and i cannot access it, i get an internal seerver error (500) [10:41] but there is nothing about it in the apache error log file [10:42] can you test php with a file containing a simple script, like ? [10:42] that works [10:43] I don't think I have seen Apache return 500 without logging the event [10:44] i have also installed phpmyadmin and that works [10:44] i know it's really weird [10:44] RoyK: fill /var/log to 100%, and try again [10:44] twb: hehe [10:51] New bug: #623269 in php5 (main) "package libapache2-mod-php5 5.3.2-1ubuntu4.2 failed to install/upgrade: le sous-processus script post-installation installé a retourné une erreur de sortie d'état 128" [Undecided,New] https://launchpad.net/bugs/623269 [11:02] k apache is not logging anything but i still cannot access it [11:03] i get a 'cannot find server' error in internet explorer [11:03] and a 'busy server' error on firefox [11:03] the thing is that i can access simple text files in the directory [11:06] and the files all have the same permissions [11:09] also if i use lynx on the server machine it works flawlessly [11:10] could it be some kind of network error [11:10] ? [11:17] shelter: perhaps a firewall? [11:17] ufw status [11:17] telnet servername 80 - see if you can reach it [11:23] Maybe apache isn't running? Stop it, start it and look in the logs. [11:31] Ahem, anyone know any ways to slim down Ubuntu server? [11:32] krainboltgreene: Use Ubuntu JeOS? [11:34] Without installing a different version of Ubuntu ;) [11:34] twb? [11:37] ufw is disabled [11:38] anyway, i think im gonna switch to lighttpd, [11:38] it seems to work pretty nicely [11:38] cheers! === jjohansen is now known as jj-afk [11:52] krainboltgreene: dpkg -l and sort out the ones you don't need [11:52] then just apt-get remove --purge them [12:27] Hi, how do I turn by ubuntu-box into a device that allows upnp-rendering? Using the local soundcard as an output. [12:35] i've these errors http://pastebin.com/212FZxq0 running with fcgid+chrooted apache.. [12:56] hello i've got a small issue i hope, i've just compiled the xen-4.0.1-rc6-pre.gz and vmlinuz-2.6.31.14 ob ubuntu 10.04.1, It looks like that XEN will be loaded, but after that i get the following error message "mount: mounting none on /dev failed: No such device".I've got no idea where the problem is. [12:57] i did that menuentry "Ubuntu, Xen ext2c" { insmod ext2 set root=(hd0,1) multiboot /xen-4.0.1-rc6-pre.gz [12:57] module /vmlinuz-2.6.31.14 dummy=dummy root=/dev/sda1 ro quiet splash console=tty0 module /initrd.img-2.6.31.14 } [12:58] i've tried as well to use UUID of root and as well without splash console quiet or with single each time the same error and as well without dummy [12:59] anyone there who could help ? [13:01] never used that...i'm soory [13:01] *sorry [13:01] but there must be someone who has used ot ;) [13:17] New bug: #623342 in samba (main) "ntlm_auth returns invalid NT_KEY" [Undecided,New] https://launchpad.net/bugs/623342 [13:21] hi [13:21] need help xen 4.x and ubuntu 10.04 [13:21] hey guys [13:21] this rule fails: iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -j MASQUERADE [13:21] it says: iptables: No chain/target/match by that name. [13:23] kokozedman: /j #Netfilter [13:24] jumping all around [13:24] thanks [13:26] xampart do you know xen 4.x on ubuntu ? [13:26] Cuddle-Ing: nope [13:26] anyone else ? [13:26] would recommend #xen [13:26] =) [13:27] i 'm in there as well, but they directed me to ubuntu server ;) [13:27] hmm maybe it is only a grub2 problem and not a xen issue [13:27] hello i've got a small issue i hope, i've just compiled the xen-4.0.1-rc6-pre.gz and vmlinuz-2.6.31.14 ob ubuntu 10.04.1, It looks like that XEN will be loaded, but after that i get the following error message "mount: mounting none on /dev failed: No such device".I've got no idea where the problem is. [13:36] I've found information about slocate here: https://help.ubuntu.com/community/FindingFiles#locate and installed the slocate package. I've manually run its daily cron job: http://pastebin.com/fGzF6S9g ... and it does not seem to be indexing all of my filesystems: http://pastebin.com/9i8Gxmie (I have many files in my /media directory and subdirectories with "address" in them) === oubiwann is now known as oubiwann-away === oubiwann-away is now known as oubiwann [13:40] New bug: #623021 in qemu-kvm (main) "ubiquity-dm crashed with OSError in _execute_child()" [Undecided,New] https://launchpad.net/bugs/623021 [13:54] Cuddle-Ing: Try #xen. Very helpful often. [13:55] any suggestions for software to manage large number of ubuntu servers? These are rackspace cloud servers. I need to have them install default packages and do configs. They will not all be cookie cutter though. [13:55] I've been looking at cfengine type systems but was hoping for something less painful [14:18] any ideas why raid1 recovery speed is only ca. 40000K/sec? [14:21] jdstrand, ping [14:22] smoser: yes? [14:22] group eucalyptus is member of libvirtd, and runs a kvm via libvirt on qemu:///system [14:22] is that process supposed to be running as root ? or eucalyptus [14:22] (i think root, but just want to check) [14:23] smoser: which process, kvm? [14:23] yes [14:23] smoser: yes it is [14:23] k [14:23] smoser: but it is confined by apparmor [14:23] right [14:23] i'm looking at https://bugs.launchpad.net/ubuntu/+source/eucalyptus/+bug/619843 [14:23] Launchpad bug 619843 in eucalyptus "euca-get-console-output returns one single line" [High,Confirmed] [14:24] which seems like we've got some messed up permissions somewhere. i don't know how the console.log ever worked (unless eucalyptus first creates that file with its perms and kvm just appends) [14:24] * hggdh starts paying attention [14:24] but for the others, it seems like we're euca_root_wraping too many things [14:24] to me [14:25] smoser: well, libvirt uses a stacked security driver mechanism [14:25] the one that is at the bottom and on all the time is the DAC one [14:26] on top of that is a MAC one that is set via the security_driver in /etc/libvirt/qemu.conf, and defaults to AppArmor on Ubuntu [14:27] upstream has been doing a lot with the DAC part, to make it so that systems that don't have a MAC system (eg, Debian) have some sort of protection [14:27] it isn't nearly as comprehensive as MAC, but better than nothing [14:28] anyhoo, the DAC security driver fiddles with permissions of files, and I noticed with the 0.8.3 upload that it changed the owner of the disk [14:28] (this actually was part of a CVE fix too) [14:28] (from upstream) [14:28] well, this is interesting [14:28] i bet it changed console.log also [14:28] so, it is most certainly libvirt changing the permissions on you [14:28] (for disks) [14:28] and yeah, possibly the console log [14:29] the critical seems to be the console log, since we see no problems on the other files [14:30] it might be interesting to have libvirt start kvm instances as non-root (by adjusting /etc/libvirt/qemu.conf), and seeing what happens. this is untested, but should work fine (conceptually) with the MAC driver [14:31] as such, you could put the eucalyptus user in the group of the user that libvirt starts machines as, and voila [14:31] the support is already in Debian, and has been since before Lucid released, but that change didn't happen until too soon before lucid released and was deemed too risky [14:32] do we have time to do it? [14:32] sure [14:32] it isn't a feature per se [14:32] 9008-run-as-root-by-default.patch [14:32] compile it without ^ [14:33] then test the $@&% out of it [14:33] heh. This is something I have been doing a lot ;-) [14:33] smoser: well the image is kept because is not empty, so if users wants to run that image, he would just do "tesdrive -u file://name.img". However, everytime you run an ISO a disk image is create regardless there might have been a previous installation using the same ISO/win 17 [14:33] smoser: willing to try? [14:33] personally, no. :) [14:33] but that would be much more davieys' call than me. [14:33] i think its a nother moving part that i wouldn't want to add [14:34] I will try (famous last words) [14:34] u smoser dont mind me error [14:34] :) [14:34] * Daviey reads scrollback [14:34] brb [14:34] this always happens when i connect throuth my phone lol [14:34] jdstrand, so what permissions did disk have before ? [14:35] smoser: they were unchanged. so if a regular user created the disk, then they were owned by that user. I don't know about console.log [14:36] ah. ok. so that is probably what was happening. [14:36] so, jdstrand what would our options be then ? [14:36] we can a.) try running as non root [14:36] jdstrand, From a security aspect - do you care which user it runs as? [14:36] b.) something, i hopw [14:36] hope even [14:36] smoser: right. the idea is that libvirt chowns the files to be owned by the process that kvm is running as [14:37] smoser: so if it is a non-root user, then kvm only has access to those files [14:37] Daviey: well, read the top of 9008-run-as-root-by-default.patch [14:38] Daviey: it would be nice to run as non-root, but with AppArmor on by default, the security benefit is marginal [14:38] Daviey: that said, there is a real benefit if someone turns off apparmor [14:39] http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/maverick/libvirt/maverick/annotate/head%3A/debian/patches/9008-run-as-root-by-default.patch for those without a libvirt checkout [14:39] hmm.. I'm really reluctant to change more than we need to at this stage [14:39] .. but it's still common for people to disable apparmor :( [14:39] Daviey: common? do you have statistics? [14:40] Daviey: there should be no reason to turn it off. if there are problems, people need to report the bugs [14:41] jdstrand, No, the only basis i have is the amount of legacy how-to's where it was the common first step. === mathiaz_ is now known as mathiaz [14:41] Daviey: yes on howtoforge [14:41] which i think is much less common now [14:41] jdstrand, sadly, yes [14:41] Daviey, people dont' disable app armour on their eucalyptus-nc systems (i hope) [14:41] Daviey: that is a kneejerk reaction from some dolt used to selinux who didn't think at all about security or the system [14:42] in all howto's i write, i start off with "disable all security features as they just get in the way, then, 'sudo su -'" [14:42] smoser, agreed - but this is a generic libvirt thing - not limited to euca [14:42] Daviey: I went through a bunch of those howtos saying it is not required to turn off. I encourage you to do the same when you come across them [14:42] smoser: hehe [14:42] jdstrand, wilco [14:43] ok. so what are our options here ? realistically [14:43] we're going to end up fighting libvirt [14:43] but, for the record, it does appear to me that we are root-wrapping too much at the moment. [14:43] specifically, partition2disk and gen_kvm_libvirt_xml [14:44] I talked to upstream euca about all this too, and made sure that they knew that if there was a situation where they felt they needed to turn off apparmor, to talk to me personally first, and gave my email and irc [14:44] they never contacted me and assured me it worked well [14:44] that sounded weird [14:44] they assured me if worked well and didn't contact me later [14:44] s/if/it/ [14:44] smoser, chmod'ing the logs should close the console bug? [14:45] hmm [14:45] if you are root wrapping because libvirt is chowning to root because of the current default, change the default [14:45] us running as a root is a delta from Debian anyway [14:45] OK.. the logs shouldn't be world readable [14:45] they wouldn't be wordl readable [14:46] just group readable [14:46] and eucalyptus in the proper group [14:46] hmm [14:46] that is what jdstrands is suggesting [14:46] put euca' into libvirt-qemu? [14:46] I think that the devel cycle is a great time to try this out. granted it is latish for maverick, but I'll let you guys decide [14:46] smoser: yes [14:47] for this in particular, we could just change the group [14:47] to kvm [14:47] or, change group to libvirtd [14:47] as eucalyptus is a member [14:47] right, drop 9008, put euca in that group, see what happens [14:47]