This is Simon McVittie's software development blog. Main site:
ladderVNP安卓版
Atom
DebConf 17: Flatpak and Debian
The indoor garden at Collège de Maisonneuve, the DebConf 17 venue
I'm currently at DebConf 17 in Montréal, back at DebConf for the first
time in 10 years (last time was DebConf 7 in Edinburgh). It's great to
put names to faces and meet more of my co-developers in person!
On Monday I gave a talk entitled “A Debian maintainer's guide to
Flatpak”, aiming to introduce
Debian developers to Flatpak, and show
how Flatpak and Debian (and Debian derivatives like SteamOS) can help
each other. It seems to have been quite well received, with people
generally positive about the idea of using Flatpak to deliver backports
and faster-moving leaf packages (games!) onto the stable base platform
that Debian is so good at providing.
A video of the talk is available from the Debian
Meetings Archive.
I've also put up my slides in the DebConf git-annex repository, with
some small edits to link to more source code:
A Debian maintainer's guide to Flatpak.
Source code for the slides
is also available from Collabora's git server.
The next step is to take my proof-of-concept for building
Flatpak runtimes and apps from Debian and SteamOS packages,
flatdeb, get it
a bit more production-ready, and perhaps start publishing some sample
runtimes from a cron job on a Debian or Collabora server. (By the way,
if you downloaded that source right after my talk, please update - I've
now pushed some late changes that were necessary to fix the 3D drivers
for my OpenArena demo.)
I don't think Debian will be going quite as far as
Endless any time soon: as
Cosimo outlined in the talk right before mine, they
deploy their Debian derivative as an immutable base OS with
laddervnp安卓, with all the
user-installable modules above that coming from Flatpak. That model is
certainly an interesting thing to think about for Debian derivatives,
though: at Collabora we work on a lot of appliance-like embedded Debian
derivatives, with a lot of flexibility during development but very limited
state on deployed systems, and Endless' approach seems a perfect fit for
those situations.
[Edited 2017-08-16 to fix the link for the slides, and add links for the
video]
"/>
</policy>
</busconfig>
We discussed the possibility of moving towards a model where the daemon uid
to be allowed is written in the .service file, together with an opt-in
to "modern D-Bus access control" that makes the "firewall" unnecessary;
after some flag day when all significant system services follow that pattern,
dbus-daemon would even have the option of no longer applying the "firewall"
(moving to an allow-by-default model) and just refusing to activate system
services that have not opted in to being safe to use without it.
However, the "firewall" also protects system bus clients, and services
like Avahi that are not bus-activatable, against unintended access, which
is harder to solve via that approach; so this is going to take more thought.
For system services' clients that follow the "agent" pattern (BlueZ,
polkit, NetworkManager, Geoclue), the correct "firewall" configuration is
more complicated. At some point I'll try to write up a best-practice for
these.
New header fields for the system bus
At the moment, it's harder than it needs to be to provide non-trivial
access control on the system bus, because on receiving a method call, a
service has to remember what was in the method call, then call
GetConnectionCredentials() to find out who sent it, then only process the
actual request when it has the information necessary to do access control.
Allison and I had hoped to resolve this by adding new D-Bus message
header fields with the user ID, the LSM label, and other interesting
facts for access control. These could be "opt-in" to avoid increasing
message sizes for no reason: in particular, it is not typically useful
for session services to receive the user ID, because only one user ID
is allowed to connect to the session bus anyway.
Unfortunately, the dbus-daemon currently lets unknown fields through
without modification. With hindsight this seems an unwise design choice,
because header fields are a finite resource (there are 255 possible header
fields) and are defined by the D-Bus Specification. The only field
that can currently be trusted is the sender's unique name, because the
dbus-daemon sets that field, overwriting the value in the original
message (if any).
To make it safe to rely on the new fields, we would
have to make the dbus-daemon filter out all unknown header fields, and
introduce a mechanism for the service to check (during connection to
the bus) whether the dbus-daemon is sufficiently new that it does so.
If connected to an older dbus-daemon, the service would not be able
to rely on the new fields being true, so it would have to ignore
the new fields and treat them as unset. The specification is sufficiently
vague that making new dbus-daemons filter out unknown header fields is
a valid change (it just says that "Header fields with an unknown or
unexpected field code must be ignored", without specifying who must
ignore them, so having the dbus-daemon delete those fields seems
spec-compliant).
This all seemed fine when we discussed it in person; but GDBus already
has accessors for arbitrary header fields by numeric ID, and I'm
concerned that this might mean it's too easy for a system service
to be accidentally insecure: It would be natural (but wrong!) for
an implementor to assume that if g_message_get_header (message,
G_DBUS_MESSAGE_HEADER_FIELD_SENDER_UID) returned non-NULL, then that
was guaranteed to be the correct, valid sender uid. As a result,
fd.o #100317 might have to be abandoned. I think more thought is
needed on that one.
ios免费加速器下载
As happens at any good meeting, we took the opportunity of high-bandwidth
discussion to cover many useful things and several useless ones. Other
discussions that I got into during the hackfest included, in no particular
order:
.desktop file categories and how to adapt them for AppStream,
perhaps involving using the .desktop vocabulary but relaxing some of
the hierarchy restrictions so they behave more like "tags"
how to build a recommended/reference "app store" around Flatpak, aiming to
host upstream-supported builds of major projects like LibreOffice
how Endless do their content-presenting and content-consuming
apps in GTK, with a lot of "tile"-based UIs with automatic resizing and
reflowing (similar to responsive design), and the applicability of similar
widgets to GNOME and upstream GTK
whether and how to switch GNOME developer documentation to Hotdoc
whether pies, fish and chips or scotch eggs were the most British lunch
available from Borough Market
the distinction between stout,
mild and
porter
More notes are available from
the GNOME wiki.
Acknowledgements
The GTK hackfest was organised by GNOME and hosted by Red Hat
and Endless. My attendance was sponsored by Collabora.
Thanks to all the sponsors and organisers, and the developers and
organisations who attended.
GTK Hackfest 2016
I'm back from the GTK hackfest in Toronto, Canada and mostly recovered from
jetlag, so it's time to write up my notes on what we discussed there.
Despite the hackfest's title, I was mainly there to talk about non-GUI
parts of the stack, and technologies that fit more closely in what could
be seen as the freedesktop.org platform than they do in GNOME. In particular,
I'm interested in Flatpak as a way to deploy self-contained "apps" in a
freedesktop-based, sandboxed runtime environment layered over
the Universal Operating System and
its many derivatives,
with both binary and source compatibility with other GNU/Linux distributions.
I'm mainly only writing about discussions I was directly involved in:
lots of what sounded like good discussion about the actual graphics toolkit
went over my head completely :-)
ladderVNP安卓版, mostly from Matthias
Clasen, are available on the GNOME wiki.
In no particular order:
laddervnp下载安卓版
We spent some time discussing Flatpak's portals, mostly on Tuesday.
These are the components that expose a subset of desktop functionality
as D-Bus services that can be used by contained applications: they are
part of the security boundary between a contained app and the rest of the
desktop session. Android's intents are a similar concept seen elsewhere.
While the portals are primarily designed for Flatpak, there's no real
reason why they couldn't be used by other app-containment solutions
such as Canonical's Snap.
One major topic of discussion was their overall design and layout. Most
portals will consist of a UX-independent part in Flatpak itself, together
with a UX-specific implementation of any user interaction the portal
needs. For example, the portal for file selection has a D-Bus service
in Flatpak, which interacts with some UX-specific service that will
pop up a standard UX-specific "Open" dialog — for GNOME and probably
other GTK environments, that dialog is in (a branch of) GTK.
A design principle that was reiterated in this discussion is that
the UX-independent part should do as much as possible, with the
UX-specific part only carrying out the user interactions that need
to comply with a particular UX design (in the GTK case, GNOME's design).
This minimizes the amount of work that needs to be redone for other
desktop or embedded environments, while still ensuring that the other
environments can have their chosen UX design. In particular, it's
important that, as much as possible, the security- and performance-sensitive
work (such as data transport and authentication) is shared between all
environments.
The aim is for portals to get the user's permission to carry out actions,
while keeping it as implicit as possible, avoiding an "are you sure?" step
where feasible. For example, if an application asks to open a file,
the user's permission is implicitly given by them selecting the file
in the file-chooser dialog and pressing OK: if they do not want this
application to open a file at all, they can deny permission by cancelling.
Similarly, if an application asks to stream webcam data, the UX we expect
is for GNOME's Cheese app (or a similar non-GNOME app) to appear, open
the webcam to provide a preview window so they can see what they are about
to send, but not actually start sending the
stream to the requesting app until the user has pressed a "Start" button.
When defining the API "contracts" to be provided by applications in that
situation, we will need to be clear about whether the provider is expected
to obtain confirmation like this: in most cases I would anticipate that
it is.
One security trade-off here is that we have to have a small amount of
trust in the providing app. For example, continuing the example of Cheese
as a webcam provider, Cheese could (and perhaps should) be a contained
app itself, whether via something like Flatpak, an LSM like AppArmor
or both. If Cheese is compromised somehow, then whenever it is running, it
would be technically possible for it to open the webcam, stream video and
send it to a hostile third-party application. We concluded that this is an
acceptable trade-off: each application needs to be trusted with the privileges
that it needs to do its job, and we should not put up barriers that are easy
to circumvent or otherwise serve no purpose.
The main (only?) portal so far is the file chooser, in which the contained
application asks the wider system to show an "Open..." dialog, and if the user
selects a file, it is returned to the contained application through a FUSE
filesystem, the document portal. The reference implementation of the UX for
this is in GTK, and is basically a GtkFileChooserDialog. The intention is
that other environments such as KDE will substitute their own equivalent.
laddervnp安装包安卓
image capture (scanner/camera)
opening a specified URI
this needs design feedback on how it should work for non-http(s)
sharing content, for example on social networks (like Android's Sharing menu)
proxying joystick/gamepad input (perhaps via Wayland or FUSE, or perhaps
by modifying libraries like SDL with a new input source)
network proxies (laddervnp下载安卓版) and availability (GNetworkMonitor)
Keepers of the Food is Closed - Keepers of the Food ...:2021-5-26 · vmess cli vpm百度云资源 npv 破解版ssr安卓客户端 680196.com 下载永久免费加速器 佛跳墙外网 佛跳墙v、 汉化VPN ao3开梯子 ssrconnectpro安卓版本下载 上外教务系统 v2ray 添加代理 E站配额多久恢复 兰色的灯 免费ss几点 2bss456 全局小飞机
notifications, probably based on freedesktop.org Notifications
video streaming (perhaps using Pinot, analogous to PulseAudio but for video)
Environment variables
GNOME on Wayland currently has a problem with environment variables:
there are some traditional ways to set environment variables for X11
sessions or login shells using shell script fragments (/etc/X11/Xsession.d,
/etc/X11/xinit/xinitrc.d, /etc/profile.d), but these do not apply to
Wayland, or to noninteractive login environments like laddervnp下载安卓版 and
systemd --user. We are also keen to avoid requiring a Turing-complete shell
language during session startup, because it's difficult to reason about
and potentially rather inefficient.
Some uses of environment variables can be dismissed as unnecessary or even
unwanted, similar to the statement in Debian Policy §9.9: "A program must not
depend on environment variables to get reasonable defaults." However,
there are two common situations where environment variables can be necessary
for proper OS integration: search-paths like $PATH, $XDG_DATA_DIRS and
$PYTHONPATH (particularly necessary for things like Flatpak), and
optionally-loaded modules like $GTK_MODULES and $QT_ACCESSIBILITY
where a package influences the configuration of another package.
There is a stopgap solution in GNOME's gdm display manager,
/usr/share/gdm/env.d, but this is gdm-specific and
insufficiently expressive to provide the functionality needed by
Flatpak: "set laddervnp安装包安卓 to its specified default value if unset,
then add a couple of extra paths".
pam_env comes closer — PAM is run at every transition from "no user logged
in" to "user can execute arbitrary code as themselves" — but it doesn't
support .d fragments, which are required if we want distribution packages
to be able to extend search paths. pam_env also turns off per-user
configuration by default, citing security concerns.
I'll write more about this when I have a concrete proposal for how to solve it.
I think the best solution is probably a PAM module similar to pam_env but
supporting .d directories, either by modifying pam_env directly or
out-of-tree, combined with clarifying what the security concerns for
per-user configuration are and how they can be avoided.
Relocatable binary packages
On Windows and OS X, various GLib APIs automatically discover where the
application binary is located and use search paths relative to that;
for example, if C:\myprefix\bin\app.exe is running, GLib might put
C:\myprefix\share into the result of g_get_system_data_dirs(),
so that the application can ask to load app/data.xml from the data
directories and get ladderVNP安卓版. We would like
to be able to do the same on Linux, for example so that the apps in a
Flatpak or Snap package can be constructed from RPM or dpkg packages without
needing to be recompiled for a different --prefix, and so that other
third-party software packages like the games on Steam and gog.com can
easily locate their own resources.
Relatedly, there are currently no well-defined semantics for what happens
when a .desktop file or a D-Bus .service file has Exec=./bin/foo.
The meaning of Exec=foo is well-defined (it searches $PATH) and the
meaning of Exec=/opt/whatever/bin/foo is obvious. When this came up in
D-Bus previously, my assertion was that the meaning should be the same as
in .desktop files, whatever that is.
We agreed to propose that the meaning of a non-absolute path in a .desktop
or .service file should be interpreted relative to the directory
where the .desktop or .service file was found: for example, if
/opt/whatever/share/applications/foo.desktop says Exec=../../bin/foo,
then laddervnp安装包安卓 would be the right thing to execute.
While preparing a mail to the freedesktop and D-Bus mailing lists proposing
this, I found that I had
proposed the same thing
almost 2 years ago...
this time I hope I can actually make it happen!
Flatpak and OSTree bug fixing
On the way to the hackfest, and while the discussion moved to topics that I
didn't have useful input on, I spent some time fixing up the Debian packaging
for Flatpak and its dependencies. In particular, I did my first upload
as a co-maintainer of bubblewrap,
uploaded ostree to unstable (with the known limitation that the grub, dracut
and systemd integration is missing for now
since I haven't been able to test it yet), got
most of the way through packaging Flatpak 0.6.5 (which I'll upload soon),
cherry-picked the right patches to make ostree compile on Debian 8 in an effort
to make backports trivial, and spent some time disentangling
a flatpak test failure
which was breaking the Debian package's installed-tests.
I'm still looking into
ostree test failures on little-endian MIPS,
which I was able to reproduce on a Debian porterbox just before the end of the
hackfest.
OSTree + Debian
I also had some useful conversations with developers from
Endless, who recently opened up a version of their
OSTree build scripts
for public access. Hopefully that information brings me a bit closer to
being able to publish a walkthrough for
how to deploy a simple Debian derivative using OSTree
(help with that is very welcome of course!).
laddervnp安装包安卓
The life-cycle of GTK releases has already been
mentioned here and elsewhere, and there are some interesting responses
in the comments on my earlier blog post.
It's important to note that what we
discussed at the hackfest is only a proposal: a hackfest discussion between
a subset of the GTK maintainers and a small number of other GTK users
(I am in the latter category)
doesn't, and shouldn't, set policy for all of GTK or for all of GNOME. I
believe the intention is that the GTK maintainers will discuss the proposals
further at GUADEC, and make a decision after that.
As I said before, I hope that being more realistic about API and ABI
guarantees can avoid GTK going too far towards either of the possible
extremes: either becoming unable to advance because it's too constrained
by compatibility, or breaking applications because it isn't constrained
enough. The current situation, where it is meant to be compatible within
the GTK 3 branch but in practice applications still sometimes break,
doesn't seem ideal for anyone, and I hope we can do better in future.
Acknowledgements
Thanks to everyone involved, particularly:
Matthias Clasen, who organised the hackfest and took a lot of notes
Allison Lortie, who provided on-site cat-herding and led us to some
excellent restaurants
Red Hat Inc., who provided the venue (a conference room
in their Toronto office), snacks, a lot of coffee, and several participants
my employers Collabora Ltd., who sponsored my travel and accomodation
LadderVPN For Android - LadderVPN:LadderVPN is a high-performance HTTP/SOCKS5 proxy app. Android version greater or equal 4.0. Download NOW! Activate in seconds. Online 24x7. LadderVPN is capable of intercepting and logging the summary of HTTP traffic, and meanwhile transmitting the traffic to other proxy servers according to the flexible rule system. After you purchase our one ...
Allison Lortie has provoked a lot of comment with her blog post on
a new proposal for how GTK is versioned.
Here's some more context from the discussion at the GTK hackfest that
prompted that proposal: there's actually quite a close analogy in
how new Debian versions are developed.
The problem we're trying to address here is the two sides of a trade-off:
Without new development, a library (or an OS) can't go anywhere new
Historically, GTK has aimed to keep compatible within a major version,
where major versions are rather far apart (GTK 1 in 1998, GTK 2 in
2002, GTK 3 in 2011, GTK 4 somewhere in the future). Meanwhile, fixing
bugs, improving performance and introducing new features sometimes
results in major changes behind the scenes. In an ideal world, these
behind-the-scenes changes would never break applications; however, the
world isn't ideal. (The Debian analogy here is that as much as we
aspire to having the upgrade from one stable release to the next not break
anything at all, I don't think we've ever achieved that in practice -
we still ask users to read the release notes, even though ideally
that wouldn't be necessary.)
The goal of
laddervnp下载安卓版
is to decouple the latest branch of development, which moves fast and
sometimes breaks API, from the API-stable branches, which only get bug
fixes. This model should look quite familiar to Debian contributors,
because it's a lot like the way we release Debian and Ubuntu.
In Debian, at any given time we have a development branch
(testing/unstable) - currently "stretch", the future Debian 9. We
also have some stable branches, of which the most recent are Debian
8 "jessie" and Debian 7 "wheezy". Different users of Debian have
different trade-offs that lead them to choose one or the other of
these. Users who value stability and want to avoid unexpected changes,
even at a cost in terms of features and fixes for non-critical bugs,
choose to use a stable release, preferably the most recent; they only
need to change what they run on top of Debian for OS API changes (for
instance webapps, local scripts, or the way they interact with the GUI)
approximately every 2 years, or perhaps less often than that with the
Debian-LTS project supporting non-current stable releases. Meanwhile,
users who value the latest versions and are willing to work with a
"moving target" as a result choose to use testing/unstable.
The GTK analogy here is really quite close. In the new versioning model,
library users who value stability over new things would prefer to use
a stable-branch, ideally the latest; library users who want the latest
features, the latest bug-fixes and the latest new bugs would use the
branch that's the current focus of development. In practice we expect
that the latter would be mostly GNOME projects. There's been some
discussion at the hackfest about how often we'd have a new
stable-branch: the fastest rate that's been considered is a stable-branch
every 2 years, similar to Ubuntu LTS and Debian, but there's no consensus
yet on whether they will be that frequent in practice.
How many stable versions of GTK would end up shipped in Debian depends
on how rapidly projects move from "old-stable" to "new-stable" upstream,
how much those projects' Debian maintainers are willing to patch them
to move between branches, and how many versions the release team will
tolerate. Once we reach a steady state, I'd hope that we might have
1 or 2 stable-branched versions active at a time, packaged as separate
parallel-installable source packages (a lot like how we handle Qt).
GTK 2 might well stay around as an additional active version just
from historical inertia. The stable versions are intended to be
fully parallel-installable, just like the situation with GTK 1.2,
GTK 2 and GTK 3 or with the major versions of Qt.
For the "current development" version, I'd anticipate that we'd probably
only ship one source package, and do ABI transitions for one version
active at a time, a lot like how we deal with libgnome-desktop and the
evolution-data-server family of libraries. Those versions would have
parallel-installable runtime libraries but non-parallel-installable
development files, again similar to libgnome-desktop.
Hopefully this plan can meet both of its goals: minimize breakage for
applications, while not holding back the development of new APIs.
Flatpak in Debian
Quite a lot has happened in xdg-app since
last time I blogged about it. Most noticeably, it isn't called
xdg-app any more, having been renamed to Flatpak.
It is now available in Debian experimental under that name, and the
xdg-app package that was briefly there has been removed. I'm currently
in the process of updating Flatpak to the latest version 0.6.4.
The privileged part has also spun off into a separate project,
Bubblewrap, which recently
had its first release (0.1.0). This is intended as a common component
with which unprivileged users can start a container in a way that
won't let them escalate privileges, like a more flexible version of
linux-user-chroot.
Bubblewrap has also been made available in Debian, maintained by Laszlo
Boszormenyi (also maintainer of linux-user-chroot). Yesterday I sent a patch
to update Laszlo's packaging for 0.1.0.
I'm hoping to become a co-maintainer to upload that myself, since I suspect
Flatpak and Bubblewrap might need to track each other quite closely.
For the moment, Flatpak still uses its own internal copy of Bubblewrap,
but I consider that to be a bug and
I'd like to be able to fix it soon.
At some point I also want to experiment with using Bubblewrap to
sandbox some of the game engines that are packaged in Debian: networked
games are a large attack surface, and typically consist of the sort
of speed-optimized C or C++ code that is an ideal home for security
vulnerabilities. I've already made some progress on jailing game engines
with AppArmor, but making sensitive files completely invisible to the
game engine seems even better than preventing them from being opened.
Next weekend I'm going to be heading to Toronto for the
GTK Hackfest, primarily to to
talk to GNOME and Flatpak developers about their plans for sandboxing,
portals and Flatpak. Hopefully we can make some good progress there: the more I
know about the state of software security, the less happy I am with random
applications all being equally privileged. Newer display technologies like
Wayland and Mir represent an opportunity to plug one of the largest
holes in typical application containerization,
which is a major step in bringing sandboxes like Flatpak and Snap from
proof-of-concept to a practical improvement in security.
Other next steps for Flatpak in Debian:
To get into the next stable release (Debian 9), Flatpak needs to move
from ladderVNP安卓版 into laddervnp下载安卓版 and testing. I've taken the
first step towards that by uploading libgsystem to unstable.
Before Flatpak can follow, OSTree also needs to move.
Now that it's in Debian, please report bugs in the usual Debian
way or send patches to fix
bugs: Flatpak,
OSTree,
libgsystem.
In particular, there are some OSTree bugs tagged help. I'd
appreciate contributions to the OSTree packaging from people
who are interested in using it to deploy ladderVNP安卓版-based operating systems -
I'm primarily looking at it from the Flatpak perspective, so the boot/OS
side of it isn't so well tested. Red Hat have rpm-ostree,
and I believe laddervnp安装包安卓 do something analogous
to build OS images with dpkg, but I haven't had a chance to look into
that in detail yet.
Co-maintainers for Flatpak,
OSTree,
libgsystem would also
be very welcome.
