8/6/2019 1731 Desktop on the Linux Slides
1/168
Desktop on the Linux (and *BSD of course). . .youre doing it confused? weird? strange? wrong?
Wolfgang datenwolf Draxinger
27c3, 2010-12-27
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 1 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
2/168
DISCLAIMER
This talk is:
highly opinionated
biased
born out of frustration
. . . and anger
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 2 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
3/168
DISCLAIMER II
Linux is not Unix.
Nevertheless Ill mix the terms because Im just tolazy to distiguish everytime.
I hope youre okay with that.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 3 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
4/168
DISCLAIMER II
Linux is not Unix.
Nevertheless Ill mix the terms because Im just tolazy to distiguish everytime.
I hope youre okay with that.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 3 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
5/168
8/6/2019 1731 Desktop on the Linux Slides
6/168
The situation
I work as a systems administrator:
Universitys physics student computers.
3500 users!
Im the problem solver there.
My pleasure hacking projects are about:
realtime graphics
realtime simulationsystems programming
a.k.a. game engines. highly optimized, resource aware code.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 4 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
7/168
The situation
I work as a systems administrator:
Universitys physics student computers.
3500 users!
Im the problem solver there.
My pleasure hacking projects are about:
realtime graphics
realtime simulationsystems programming
a.k.a. game engines. highly optimized, resource aware code.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 4 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
8/168
The situation
I work as a systems administrator:
Universitys physics student computers.
3500 users!
Im the problem solver there.
My pleasure hacking projects are about:
realtime graphics
realtime simulationsystems programming
a.k.a. game engines. highly optimized, resource aware code.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 4 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
9/168
8/6/2019 1731 Desktop on the Linux Slides
10/168
The situation
I work as a systems administrator:
Universitys physics student computers.
3500 users!
Im the problem solver there.
My pleasure hacking projects are about:
realtime graphics
realtime simulationsystems programming
a.k.a. game engines. highly optimized, resource aware code.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 4 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
11/168
Linux desktop distributions have become evil!
With each and every new version of OpenSuSE, Ubuntu, Fedora
problems got worse.
Most of the problems we encounter are attributed to automatisms.
Its no longer set and forget.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 5 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
12/168
Linux desktop distributions have become evil!
With each and every new version of OpenSuSE, Ubuntu, Fedora
problems got worse.
Most of the problems we encounter are attributed to automatisms.
Its no longer set and forget.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 5 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
13/168
Linux desktop distributions have become evil!
With each and every new version of OpenSuSE, Ubuntu, Fedora
problems got worse.
Most of the problems we encounter are attributed to automatisms.
Its no longer set and forget.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 5 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
14/168
Modern Desktops have
Multimedia!
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 6 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
15/168
Your typical Multimedia Framework
Playback Module Graph
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 7 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
16/168
Provides huge number of modules.
"Fire and Forget" graph generator included.
unfortunately not quite stable.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 8 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
17/168
Provides huge number of modules.
"Fire and Forget" graph generator included.
unfortunately not quite stable.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 8 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
18/168
PhononMultimedia-Meta-API abstraction layer to access different
multimedia frameworks through a single API.
Has its own filter graph generator.
Designed to allow switching the backend in mid-operation (why?)Available backends (Linux) Xine VLC GStreamer (unmantained)
Filter graph building logic must be provided for every backend!
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 9 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
19/168
PhononMultimedia-Meta-API abstraction layer to access different
multimedia frameworks through a single API.
Has its own filter graph generator.
Designed to allow switching the backend in mid-operation (why?)Available backends (Linux) Xine VLC GStreamer (unmantained)
Filter graph building logic must be provided for every backend!
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 9 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
20/168
PhononMultimedia-Meta-API abstraction layer to access different
multimedia frameworks through a single API.
Has its own filter graph generator.
Designed to allow switching the backend in mid-operation (why?)Available backends (Linux) Xine VLC GStreamer (unmantained)
Filter graph building logic must be provided for every backend!
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 9 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
21/168
PhononMultimedia-Meta-API abstraction layer to access different
multimedia frameworks through a single API.
Has its own filter graph generator.
Designed to allow switching the backend in mid-operation (why?)Available backends (Linux) Xine VLC GStreamer (unmantained)
Filter graph building logic must be provided for every backend!
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 9 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
22/168
PhononMultimedia-Meta-API abstraction layer to access different
multimedia frameworks through a single API.
Has its own filter graph generator.
Designed to allow switching the backend in mid-operation (why?)Available backends (Linux) Xine VLC GStreamer (unmantained)
Filter graph building logic must be provided for every backend!
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 9 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
23/168
Designed as a better ESD: mix sound provide audio capture to multiple clients simultanously sound over network (e.g. alongside remote X11)
Became sort of a media framework of its own:Things like transferring the audio to a different
machine, changing the sample format or channel
count and mixing several sounds into one are easily
achieved using a sound server.
[PulseAudio homepage]
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 10 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
24/168
Designed as a better ESD: mix sound provide audio capture to multiple clients simultanously sound over network (e.g. alongside remote X11)
Became sort of a media framework of its own:Things like transferring the audio to a different
machine, changing the sample format or channel
count and mixing several sounds into one are easily
achieved using a sound server.
[PulseAudio homepage]
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 10 / 77
Functionality Matrix
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
25/168
Functionality Matrix
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 11 / 77
Lets hear some music
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
26/168
Let s hear some music
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 12 / 77
Hey Phonon! and GStreamer
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
27/168
Hey Phonon! . . . and GStreamer
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 13 / 77
PulseAudio is my destiny
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
28/168
PulseAudio is my destiny
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 14 / 77
and beyond.
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
29/168
. . . and beyond.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 15 / 77
How can those matched?
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
30/168
How can those matched?
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 16 / 77
Thats what theyd accept!
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
31/168
That s what they d accept!
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 17 / 77
. . . among other things.
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
32/168
g g
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 18 / 77
But, well.
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
33/168
,
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 19 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
34/168
Logins Complicated
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 20 / 77
Tasks of a X Display Manager
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
35/168
p y g
Start X11 server, setup MIT-Cookie (XAUTHORITY)
Show Greeter, Login Dialog
(optional) Allow for choosing desktop environment and localizationoptions
(historically) provide XDMCP dont use this nowadays (insecure)
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 21 / 77
Tasks of a X Display Manager
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
36/168
Start X11 server, setup MIT-Cookie (XAUTHORITY)
Show Greeter, Login Dialog
(optional) Allow for choosing desktop environment and localizationoptions
(historically) provide XDMCP dont use this nowadays (insecure)
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 21 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
37/168
User Interaction
8/6/2019 1731 Desktop on the Linux Slides
38/168
enter username
enter password
maybe set session type and localizationAll in all a very short experience.
The less interaction, the better.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 22 / 77
User Interaction
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
39/168
enter username
enter password
maybe set session type and localizationAll in all a very short experience.
The less interaction, the better.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 22 / 77
User Interaction
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
40/168
enter username
enter password
maybe set session type and localizationAll in all a very short experience.
The less interaction, the better.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 22 / 77
GDM 2.21
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
41/168
Its modal (users tend to mistake it for a screen lock).
Starts a full blown Gnome session for a simple login.
Offers less configuration options than older versions.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 23 / 77
GDM 2.21
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
42/168
Its modal (users tend to mistake it for a screen lock).
Starts a full blown Gnome session for a simple login.
Offers less configuration options than older versions.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 23 / 77
GDM 2.21
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
43/168
Its modal (users tend to mistake it for a screen lock).
Starts a full blown Gnome session for a simple login.
Offers less configuration options than older versions.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 23 / 77
GDM 2.21
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
44/168
Its modal (users tend to mistake it for a screen lock).
Starts a full blown Gnome session for a simple login.
Offers less configuration options than older versions.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 23 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
45/168
GDM 2.21 A Gnome session highlighted
8/6/2019 1731 Desktop on the Linux Slides
46/168
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 25 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
47/168
GDM 2.21 Why a Gnome session?
8/6/2019 1731 Desktop on the Linux Slides
48/168
By default, GDM is shipped with files which will autostart
the gdm-simple-greeter login GUI greeter itself, the
gnome-power-manager application, the
gnome-settings-daemon, and the metacity window manager.These programs are needed for thegreeter programto work.
[GDM documentation]
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 27 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
49/168
8/6/2019 1731 Desktop on the Linux Slides
50/168
Why do we need it?
8/6/2019 1731 Desktop on the Linux Slides
51/168
Defining the ProblemTo be written.
Relevant artTo be written.
[ConsoleKit documentation (2010-12-25)]
http://www.freedesktop.org/software/
ConsoleKit/doc/ConsoleKit.html
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 30 / 77
So what does it do?
http://www.freedesktop.org/software/ConsoleKit/doc/ConsoleKit.htmlhttp://www.freedesktop.org/software/ConsoleKit/doc/ConsoleKit.htmlhttp://www.freedesktop.org/software/ConsoleKit/doc/ConsoleKit.htmlhttp://www.freedesktop.org/software/ConsoleKit/doc/ConsoleKit.htmlhttp://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
52/168
Its a Seat aware session manager.
A Seat: Input Devices Output Devices
Permissions per User (Alice may play music, Bob may burn DVDs)Tracks the user
Grants permissions dynamically
It uses D-Bus!
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 31 / 77
So what does it do?
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
53/168
Its a Seat aware session manager.
A Seat: Input Devices Output Devices
Permissions per User (Alice may play music, Bob may burn DVDs)Tracks the user
Grants permissions dynamically
It uses D-Bus!
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 31 / 77
So what does it do?
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
54/168
Its a Seat aware session manager.
A Seat: Input Devices Output Devices
Permissions per User (Alice may play music, Bob may burn DVDs)Tracks the user
Grants permissions dynamically
It uses D-Bus!
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 31 / 77
So what does it do?
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
55/168
Its a Seat aware session manager.
A Seat: Input Devices Output Devices
Permissions per User (Alice may play music, Bob may burn DVDs)Tracks the user
Grants permissions dynamically
It uses D-Bus!
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 31 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
56/168
8/6/2019 1731 Desktop on the Linux Slides
57/168
8/6/2019 1731 Desktop on the Linux Slides
58/168
8/6/2019 1731 Desktop on the Linux Slides
59/168
8/6/2019 1731 Desktop on the Linux Slides
60/168
Im sorry to tell you, but its broken!
8/6/2019 1731 Desktop on the Linux Slides
61/168
Unix Philosophy: Somethings either a process, or a file.
File permissions and ACLs only applied upon open.
Once you got an FD, permissions and ACL dont apply anymore.
ConsoleKit is easily circumvented
Oh, and when it fails, youre borked.
(Live Demo)
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 32 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
62/168
8/6/2019 1731 Desktop on the Linux Slides
63/168
D-Bus
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 34 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
64/168
8/6/2019 1731 Desktop on the Linux Slides
65/168
A unified IPC mechanism
8/6/2019 1731 Desktop on the Linux Slides
66/168
D-Bus was originally intended to serve as a unified Desktop IPC.
Was soon expanded to serve as a system wide message passing
system.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 36 / 77
A unified IPC mechanism
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
67/168
D-Bus was originally intended to serve as a unified Desktop IPC.
Was soon expanded to serve as a system wide message passing
system.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 36 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
68/168
So, everything is fine, rainbows and unicorns, right?!
To me, the whole thing doesnt look right.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 37 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
69/168
Java-esque naming
8/6/2019 1731 Desktop on the Linux Slides
70/168
D-Bus uses names like
org.freedesktop.Hal.Manager
/com/mycompany/TextFileManager recommended to use domain name.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 38 / 77
Narcistic Namespacing
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
71/168
Names dont reveal the functionWithout functional grouping each servicehas its very own
interface
What if a Name gets changed? Ethereal Wireshark wxWindows wxWidgets
Just take a short look at Linux SysFSfor an example of usefull
namespacing.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 39 / 77
Narcistic Namespacing
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
72/168
Names dont reveal the functionWithout functional grouping each servicehas its very own
interface
What if a Name gets changed? Ethereal Wireshark wxWindows wxWidgets
Just take a short look at Linux SysFSfor an example of usefull
namespacing.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 39 / 77
Narcistic Namespacing
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
73/168
Names dont reveal the functionWithout functional grouping each servicehas its very own
interface
What if a Name gets changed? Ethereal Wireshark wxWindows wxWidgets
Just take a short look at Linux SysFSfor an example of usefull
namespacing.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 39 / 77
Narcistic Namespacing
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
74/168
Names dont reveal the functionWithout functional grouping each servicehas its very own
interface
What if a Name gets changed? Ethereal Wireshark wxWindows wxWidgets
Just take a short look at Linux SysFSfor an example of usefull
namespacing.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 39 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
75/168
8/6/2019 1731 Desktop on the Linux Slides
76/168
8/6/2019 1731 Desktop on the Linux Slides
77/168
8/6/2019 1731 Desktop on the Linux Slides
78/168
Must be setup additionall to X11
8/6/2019 1731 Desktop on the Linux Slides
79/168
session bus is independent from X11
every GUI program has to do multiple bookkeeping X11 D-Bus
ssh -X. . .
, what about that?
Nothing impossible to implement, but this adds complexity, for only little
gain.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course) 27c3 41 / 77
Must be setup additionall to X11
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
80/168
session bus is independent from X11
every GUI program has to do multiple bookkeeping X11 D-Bus
ssh -X. . .
, what about that?
Nothing impossible to implement, but this adds complexity, for only little
gain.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course) 27c3 41 / 77
Must be setup additionall to X11
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
81/168
session bus is independent from X11
every GUI program has to do multiple bookkeeping X11 D-Bus
ssh -X. . .
, what about that?
Nothing impossible to implement, but this adds complexity, for only little
gain.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course) 27c3 41 / 77
Must be setup additionall to X11
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
82/168
session bus is independent from X11
every GUI program has to do multiple bookkeeping X11 D-Bus
ssh -X. . .
, what about that?
Nothing impossible to implement, but this adds complexity, for only little
gain.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course) 27c3 41 / 77
D-Bus is FreeDesktops Hammer
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
83/168
Each and everything done by FreeDesktop is tied to D-Bus somehow.
Even things where D-Bus makes no sense if you think about it.
Case in Point: Status Notifier ItemsYou know, SysTray.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course) 27c3 42 / 77
D-Bus is FreeDesktops Hammer
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
84/168
Each and everything done by FreeDesktop is tied to D-Bus somehow.
Even things where D-Bus makes no sense if you think about it.
Case in Point: Status Notifier ItemsYou know, SysTray.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course) 27c3 42 / 77
D-Bus is FreeDesktops Hammer
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
85/168
Each and everything done by FreeDesktop is tied to D-Bus somehow.
Even things where D-Bus makes no sense if you think about it.
Case in Point: Status Notifier ItemsYou know, SysTray.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course) 27c3 42 / 77
D-Bus is FreeDesktops Hammer
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
86/168
Each and everything done by FreeDesktop is tied to D-Bus somehow.
Even things where D-Bus makes no sense if you think about it.
Case in Point: Status Notifier ItemsYou know, SysTray.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course) 27c3 42 / 77
System Tray
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
87/168
Old method: SysTray is a special kind of sub-window manager.
Each item a own X11 window one could use everything X11
provides to draw it serverside. (GPU acceleration FTW)
It works for every X11 client, independent of host, transport andconnection.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course) 27c3 43 / 77
Status Notifier
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
88/168
Status Notifier uses D-Bus for transport, items are transported as
uncompressed pixmaps. (Dynamic Updates?)
Status Notifier only available to programs having access to the
D-Bus (remember, remote X11 vs. D-Bus).
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course) 27c3 44 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
89/168
If you care about common look and feel: Define user interface
guidelies, provide a common library.
Thats actually done by GTK+ and Qt (the library thing).
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course) 27c3 45 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
90/168
If you care about common look and feel: Define user interface
guidelies, provide a common library.
Thats actually done by GTK+ and Qt (the library thing).
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 45 / 77
That horse can carry only so much.
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
91/168
D-Bus doesnt scale!
Theres actually been made the suggestion to give Linux a new special
D-Bus socket type, to overcome routing bottlenecks.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 46 / 77
That horse can carry only so much.
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
92/168
D-Bus doesnt scale!
Theres actually been made the suggestion to give Linux a new special
D-Bus socket type, to overcome routing bottlenecks.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 46 / 77
There are better tools
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
93/168
Instead of D-Bus we could use IPv6 Node Local Multicast.
scales well
can be versatilely routed (address rewriting)
cryptographic batteries included (IPv6 mandates IPSec)
no single point of failure (D-Bus daemon) well, the kernel maycrash, but then youve got other problems.
This idea courtesy by Fefe.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 47 / 77
There are better tools
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
94/168
Instead of D-Bus we could use IPv6 Node Local Multicast.
scales well
can be versatilely routed (address rewriting)
cryptographic batteries included (IPv6 mandates IPSec)
no single point of failure (D-Bus daemon) well, the kernel maycrash, but then youve got other problems.
This idea courtesy by Fefe.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 47 / 77
There are better tools
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
95/168
Instead of D-Bus we could use IPv6 Node Local Multicast.
scales well
can be versatilely routed (address rewriting)
cryptographic batteries included (IPv6 mandates IPSec)
no single point of failure (D-Bus daemon) well, the kernel maycrash, but then youve got other problems.
This idea courtesy by Fefe.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 47 / 77
There are better tools
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
96/168
Instead of D-Bus we could use IPv6 Node Local Multicast.
scales well
can be versatilely routed (address rewriting)
cryptographic batteries included (IPv6 mandates IPSec)
no single point of failure (D-Bus daemon) well, the kernel maycrash, but then youve got other problems.
This idea courtesy by Fefe.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 47 / 77
There are better tools
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
97/168
Instead of D-Bus we could use IPv6 Node Local Multicast.
scales well
can be versatilely routed (address rewriting)
cryptographic batteries included (IPv6 mandates IPSec)
no single point of failure (D-Bus daemon) well, the kernel maycrash, but then youve got other problems.
This idea courtesy by Fefe.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . .
27c3 47 / 77
There are better tools
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
98/168
Instead of D-Bus we could use IPv6 Node Local Multicast.
scales well
can be versatilely routed (address rewriting)
cryptographic batteries included (IPv6 mandates IPSec)
no single point of failure (D-Bus daemon) well, the kernel maycrash, but then youve got other problems.
This idea courtesy by Fefe.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 47 / 77
There are better tools
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
99/168
Instead of D-Bus we could use IPv6 Node Local Multicast.
scales well
can be versatilely routed (address rewriting)
cryptographic batteries included (IPv6 mandates IPSec)
no single point of failure (D-Bus daemon) well, the kernel maycrash, but then youve got other problems.
This idea courtesy by Fefe.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 47 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
100/168
PolicyKit
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 48 / 77
What is PolicyKit
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
101/168
PolicyKit is an application-level toolkit for defining andhandling the policy that allows unprivileged processes to
speak to privileged processes: It is a framework for
centralizing the decision making process with respect to
granting access to privileged operations for unprivileged
applications. PolicyKit is specifically targeting applications inrich desktop environments on multi-user UNIX-like operating
systems.
[PolicyKit homepage]
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 49 / 77
PolicyKit
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
102/168
Oftenly compared to sudo sudoescalates PolicyKitauthorizes
Uses D-Bus. . .
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 50 / 77
PolicyKit
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
103/168
Oftenly compared to sudo sudoescalates PolicyKitauthorizes
Uses D-Bus. . .
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 50 / 77
Authorizing means
A program capable of privileged action is commaned to perform a
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
104/168
A program capable of privileged action is commaned to perform a
task.
Before this task is performed, PolicyKit is used to ask the user forpermission If the user itself has no permission Deny
The privileged programm is running all the time, or started bypkexec
To me this sounds prone to logic errors on the privileges programm
side.
Could we attack the privileged program through the action request?
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 51 / 77
Authorizing means
A program capable of privileged action is commaned to perform a
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
105/168
A program capable of privileged action is commaned to perform a
task.
Before this task is performed, PolicyKit is used to ask the user forpermission If the user itself has no permission Deny
The privileged programm is running all the time, or started bypkexec
To me this sounds prone to logic errors on the privileges programm
side.
Could we attack the privileged program through the action request?
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 51 / 77
Authorizing means
A program capable of privileged action is commaned to perform a
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
106/168
A program capable of privileged action is commaned to perform a
task.
Before this task is performed, PolicyKit is used to ask the user forpermission If the user itself has no permission Deny
The privileged programm is running all the time, or started bypkexec
To me this sounds prone to logic errors on the privileges programm
side.
Could we attack the privileged program through the action request?
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 51 / 77
Authorizing means
A program capable of privileged action is commaned to perform a
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
107/168
A program capable of privileged action is commaned to perform a
task.
Before this task is performed, PolicyKit is used to ask the user forpermission If the user itself has no permission Deny
The privileged programm is running all the time, or started bypkexec
To me this sounds prone to logic errors on the privileges programm
side.
Could we attack the privileged program through the action request?
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 51 / 77
Authorizing means
A program capable of privileged action is commaned to perform a
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
108/168
A program capable of privileged action is commaned to perform a
task.
Before this task is performed, PolicyKit is used to ask the user forpermission If the user itself has no permission Deny
The privileged programm is running all the time, or started bypkexec
To me this sounds prone to logic errors on the privileges programm
side.
Could we attack the privileged program through the action request?
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 51 / 77
Authorizing means
A program capable of privileged action is commaned to perform a
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
109/168
A program capable of privileged action is commaned to perform a
task.
Before this task is performed, PolicyKit is used to ask the user forpermission If the user itself has no permission Deny
The privileged programm is running all the time, or started bypkexec
To me this sounds prone to logic errors on the privileges programm
side.
Could we attack the privileged program through the action request?
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 51 / 77
Authorizing means
A program capable of privileged action is commaned to perform a
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
110/168
p g p p g p
task.Before this task is performed, PolicyKit is used to ask the user forpermission If the user itself has no permission Deny
The privileged programm is running all the time, or started bypkexec
To me this sounds prone to logic errors on the privileges programm
side.
Could we attack the privileged program through the action request?
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 51 / 77
Asking per task is a bad idea anyway
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
111/168
The whole thing is much like Windows UAC: The user gets nagged
about authorizing this and that everytime.
Entering privileged realms itself should be protected.
Privileged stuff should not be required to be set so oftenly, that a
convenient way to ask the user is required at all.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 52 / 77
Asking per task is a bad idea anyway
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
112/168
The whole thing is much like Windows UAC: The user gets nagged
about authorizing this and that everytime.
Entering privileged realms itself should be protected.
Privileged stuff should not be required to be set so oftenly, that a
convenient way to ask the user is required at all.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 52 / 77
Asking per task is a bad idea anyway
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
113/168
The whole thing is much like Windows UAC: The user gets nagged
about authorizing this and that everytime.
Entering privileged realms itself should be protected.
Privileged stuff should not be required to be set so oftenly, that a
convenient way to ask the user is required at all.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 52 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
114/168
Automatisms=
Things Just Work
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 53 / 77
NetworkManagerI think I invented it, or at least came up with that idea:
http://forums.gentoo.org/
viewtopic-t-163808-highlight-.html
http://find/http://goback/http://forums.gentoo.org/viewtopic-t-163808-highlight-.htmlhttp://forums.gentoo.org/viewtopic-t-163808-highlight-.htmlhttp://forums.gentoo.org/viewtopic-t-163808-highlight-.htmlhttp://forums.gentoo.org/viewtopic-t-163808-highlight-.html8/6/2019 1731 Desktop on the Linux Slides
115/168
Looking for program. . . . . .
that is automatically settingthe network interfaces, depending on the devices connected
to. E.g. Id like to configure my eth0 connection to either
DHCP if it finds a certain host via MAC or to a static IP if it
detects another host. Also I need something similair for
WLAN, depending on the found ESSID and/or the strongest
signal.
Also it should work as a daemon, so that it a physical
connection gets lost automatically the route tables and
resolv.conf are adjusted, and vice versa.Is there some program which can do so?
[I in Gentoo forums 2004-04-20]
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 54 / 77
Sorry about that
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
116/168
Todays situationEither youre constantly roaming networks, then the network
should provide the configuration and you dont care.
Or your system is statically bound to a certain network, but then a
user must not change anything.GSM/UMTS/LTE? Similary: About every 3G modem can be
configured to act as a network interface. The rest, see above.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 55 / 77
Sorry about that
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
117/168
Todays situationEither youre constantly roaming networks, then the network
should provide the configuration and you dont care.
Or your system is statically bound to a certain network, but then a
user must not change anything.GSM/UMTS/LTE? Similary: About every 3G modem can be
configured to act as a network interface. The rest, see above.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 55 / 77
Sorry about that
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
118/168
Todays situationEither youre constantly roaming networks, then the network
should provide the configuration and you dont care.
Or your system is statically bound to a certain network, but then a
user must not change anything.GSM/UMTS/LTE? Similary: About every 3G modem can be
configured to act as a network interface. The rest, see above.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 55 / 77
Sorry about that
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
119/168
Todays situationEither youre constantly roaming networks, then the network
should provide the configuration and you dont care.
Or your system is statically bound to a certain network, but then a
user must not change anything.GSM/UMTS/LTE? Similary: About every 3G modem can be
configured to act as a network interface. The rest, see above.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 55 / 77
Ubuntu Desktop + NetworkManager
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
120/168
Your network connection will only come up, after you log on. WTF?!
This doesnt just work.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 56 / 77
Ubuntu Desktop + NetworkManager
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
121/168
Your network connection will only come up, after you log on. WTF?!
This doesnt just work.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 56 / 77
Removeable Storage Media
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
122/168
Many methods so far:automounters (until ca. 2002)
fstab adjusters (I still prefer this)
ivman (ca. 2004)
pmounthal-mount
Currently: UDisks
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 57 / 77
None of these tackles the problem itself
It boils down to:
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
123/168
A storage medium must be mounted to be accessible (easy)
After its use it must be cleanly synched and unmounted before
disconnecting, otherwise data is lost (hard).
Users dont really understand about the need for synching/unmounting,
they did click the Save button, so whyd not saved yet?I understand my audience, or at least the majority understand the
problem though.
mount -o sync not such a good solution, too.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 58 / 77
None of these tackles the problem itself
It boils down to:
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
124/168
A storage medium must be mounted to be accessible (easy)
After its use it must be cleanly synched and unmounted before
disconnecting, otherwise data is lost (hard).
Users dont really understand about the need for synching/unmounting,
they did click the Save button, so whyd not saved yet?I understand my audience, or at least the majority understand the
problem though.
mount -o sync not such a good solution, too.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 58 / 77
None of these tackles the problem itself
It boils down to:
A di b d b ibl ( )
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
125/168
A storage medium must be mounted to be accessible (easy)
After its use it must be cleanly synched and unmounted before
disconnecting, otherwise data is lost (hard).
Users dont really understand about the need for synching/unmounting,
they did click the Save button, so whyd not saved yet?I understand my audience, or at least the majority understand the
problem though.
mount -o sync not such a good solution, too.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 58 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
126/168
I dont know of any good solution either.
But just providing nicer looking buttons wont help.
Maybe this problem will silently go away? Everything stored in the net.
. . . has its own wealth of problems. Discussed on this congress.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 59 / 77
f
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
127/168
I dont know of any good solution either.
But just providing nicer looking buttons wont help.
Maybe this problem will silently go away? Everything stored in the net.
. . . has its own wealth of problems. Discussed on this congress.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 59 / 77
I d t k f d l ti ith
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
128/168
I dont know of any good solution either.
But just providing nicer looking buttons wont help.
Maybe this problem will silently go away? Everything stored in the net.
. . . has its own wealth of problems. Discussed on this congress.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 59 / 77
I d t k f d l ti ith
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
129/168
I dont know of any good solution either.
But just providing nicer looking buttons wont help.
Maybe this problem will silently go away? Everything stored in the net.
. . . has its own wealth of problems. Discussed on this congress.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 59 / 77
I d t k f d l ti ith
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
130/168
I dont know of any good solution either.
But just providing nicer looking buttons wont help.
Maybe this problem will silently go away? Everything stored in the net.
. . . has its own wealth of problems. Discussed on this congress.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 59 / 77
O API t fi th
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
131/168
One API to configure themall. . .
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 60 / 77
GConf
Daemon and library providing unified interface to configurationd t
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
132/168
Daemon and library providing unified interface to configurationdata.
Hierachical, key structured database
Much like the Windows registry
Open to various storage backends, but so far keys structured by directories values in XML files (may also contain keys)
Single point of failure
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 61 / 77
GConf
Daemon and library providing unified interface to configuration
data
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
133/168
data.
Hierachical, key structured database
Much like the Windows registry
Open to various storage backends, but so far keys structured by directories values in XML files (may also contain keys)
Single point of failure
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 61 / 77
XSettings
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
134/168
X11 centric configuration system
Colours, Mouse Pointers
Input devices bahaviour
. . .
eh, dont we have Xrm for that?
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 62 / 77
XSettings
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
135/168
X11 centric configuration system
Colours, Mouse Pointers
Input devices bahaviour
. . .
eh, dont we have Xrm for that?
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 62 / 77
What are the claimed problems of Xrm?
All i i i l f h i d
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
136/168
All settings in one single property of the root window.
No fine grained access to settings
Changes to settings not easily detectible
Large amount of data to process just to retrieve a very smallsubset from it.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 63 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
137/168
Proposal of XSettings
Settings managed by a XSettings daemon, providing a (invisible)tti i d ( b i l i t f f il )
8/6/2019 1731 Desktop on the Linux Slides
138/168
Settings managed by a XSettings daemon, providing a (invisible)settings window (remember, single point of failure).
Serial numbers to identify changed settings
Data stored in binary format, with no endianess enforced lolwut?Sounds like fun: Integer overflows Buffer overruns Shellcode injection
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 64 / 77
Proposal of XSettings
Settings managed by a XSettings daemon, providing a (invisible)settings window (remember single point of failure)
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
139/168
g g y g , p g ( )settings window (remember, single point of failure).
Serial numbers to identify changed settings
Data stored in binary format, with no endianess enforced lolwut?Sounds like fun: Integer overflows Buffer overruns Shellcode injection
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 64 / 77
Proposal of XSettings
Settings managed by a XSettings daemon, providing a (invisible)settings window (remember single point of failure)
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
140/168
g g y g , p g ( )settings window (remember, single point of failure).
Serial numbers to identify changed settings
Data stored in binary format, with no endianess enforced lolwut?Sounds like fun: Integer overflows Buffer overruns Shellcode injection
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 64 / 77
Proposal of XSettings
Settings managed by a XSettings daemon, providing a (invisible)settings window (remember single point of failure)
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
141/168
g g y g , p g ( )settings window (remember, single point of failure).
Serial numbers to identify changed settings
Data stored in binary format, with no endianess enforced lolwut?Sounds like fun: Integer overflows Buffer overruns Shellcode injection
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 64 / 77
Do these people suffer from schizophrenia?
The Xrm database stores all information in a single text
property on the root window. This makes it difficult to
determine what settings have changed; it is necessary to
parse the property and do string comparisons.
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
142/168
parse the property and do string comparisons.
And later on in the very same document:
Why use a single property for all settings?
Using a single property has several advantages. First,retrieving all settings takes only a single round-trip to the
server instead of a round-trip for each settings. Second, it
means that when multiple settings can be changed at once,
only a single notification is received by clients, and clients will
see interrelated properties changed in an atomic fashion.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 65 / 77
Do these people suffer from schizophrenia?
The Xrm database stores all information in a single text
property on the root window. This makes it difficult to
determine what settings have changed; it is necessary to
parse the property and do string comparisons.
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
143/168
parse the property and do string comparisons.
And later on in the very same document:
Why use a single property for all settings?
Using a single property has several advantages. First,retrieving all settings takes only a single round-trip to the
server instead of a round-trip for each settings. Second, it
means that when multiple settings can be changed at once,
only a single notification is received by clients, and clients will
see interrelated properties changed in an atomic fashion.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 65 / 77
Z bi
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
144/168
Zombies. . . aim for the head.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 66 / 77
HAL
Hardware Abstraction LayerA b b k ld b H d A i Lib
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
145/168
A better backronym would be Hardware Annotation Library.
Huge crapload of unreadable and unmaintainable XML files.
Officially deprecated!
Though still in use by some Distros (aim for the. . .
, well, youknow what to do).
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 67 / 77
HAL
Hardware Abstraction LayerA b tt b k ld b H d A t ti Lib
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
146/168
A better backronym would be Hardware Annotation Library.
Huge crapload of unreadable and unmaintainable XML files.
Officially deprecated!
Though still in use by some Distros (aim for the. . .
, well, youknow what to do).
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 67 / 77
HAL
Hardware Abstraction LayerA b tt b k ld b H d A t ti Lib
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
147/168
A better backronym would be Hardware Annotation Library.
Huge crapload of unreadable and unmaintainable XML files.
Officially deprecated!
Though still in use by some Distros (aim for the. . .
, well, youknow what to do).
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 67 / 77
HAL
Hardware Abstraction LayerA better backron m o ld be Hard are Annotation Librar
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
148/168
A better backronym would be Hardware Annotation Library.
Huge crapload of unreadable and unmaintainable XML files.
Officially deprecated!
Though still in use by some Distros (aim for the. . .
, well, youknow what to do).
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 67 / 77
HAL
Hardware Abstraction LayerA better backronym would be Hardware Annotation Library
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
149/168
A better backronym would be Hardware Annotation Library.
Huge crapload of unreadable and unmaintainable XML files.
Officially deprecated!
Though still in use by some Distros (aim for the. . .
, well, youknow what to do).
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 67 / 77
HAL
Hardware Abstraction LayerA better backronym would be Hardware Annotation Library
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
150/168
A better backronym would be Hardware Annotation Library.
Huge crapload of unreadable and unmaintainable XML files.
Officially deprecated!
Though still in use by some Distros (aim for the. . .
, well, youknow what to do).
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 67 / 77
I dont want all this crap
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
151/168
I don t want all this crap
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 68 / 77
In a organizations network
central software distribution
t l fi ti
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
152/168
central configuration
users have no privileges at all
custom terminal access solutions (provide access to localy
mounted media on remotely accessed machine)
I, as an administrator, want the full control over my stuff.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 69 / 77
In a organizations network
central software distribution
central config ration
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
153/168
central configuration
users have no privileges at all
custom terminal access solutions (provide access to localy
mounted media on remotely accessed machine)
I, as an administrator, want the full control over my stuff.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 69 / 77
Youll end up creating your own distribution or use
Gentoo
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
154/168
Customly compiled Desktops
Alternate package sources, patched packages
Also requires maintaining a custom configuration system
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 70 / 77
See your carefully crafted configurations break
So we were testing Ubuntu 9.04. . .
University maintains a central authentication database for all
students and employees User Database accessed by LDAP/Active Directory
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
155/168
Kerberos-5 for authentication
A carefully maintained set of Kerberos-5, LDAP nsswitch and PAM
config files is provided
Some of our older maintenance tools require SSH root access bypublic key, and only if from our IP range yes, we know, you dont
do this, but this is like using Duct Tape, it somehow works and
then lasts.
The system passes all automated security tests.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 71 / 77
See your carefully crafted configurations break
So we were testing Ubuntu 9.04. . .
University maintains a central authentication database for all
students and employees User Database accessed by LDAP/Active Directory
K b 5 f h i i
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
156/168
Kerberos-5 for authentication
A carefully maintained set of Kerberos-5, LDAP nsswitch and PAM
config files is provided
Some of our older maintenance tools require SSH root access bypublic key, and only if from our IP range yes, we know, you dont
do this, but this is like using Duct Tape, it somehow works and
then lasts.
The system passes all automated security tests.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 71 / 77
See your carefully crafted configurations break
So we were testing Ubuntu 9.04. . .
University maintains a central authentication database for all
students and employees User Database accessed by LDAP/Active Directory
K b 5 f th ti ti
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
157/168
Kerberos-5 for authentication
A carefully maintained set of Kerberos-5, LDAP nsswitch and PAM
config files is provided
Some of our older maintenance tools require SSH root access bypublic key, and only if from our IP range yes, we know, you dont
do this, but this is like using Duct Tape, it somehow works and
then lasts.
The system passes all automated security tests.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 71 / 77
So whats the problem, then?
Well,
ConsoleKit + PolicyKit have a set of own PAM rules installed
Th l l h f K b h l h fi f
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
158/168
These rules plus those of our Kerberos-5 auth plus the config for
root-SSH were a bit unlucky
root could SSH into those boxes without requiring a password, or a
public key, but only if not from our IP range.Only good thing was: root doesnt get Kerberos tokens in our system,
so no harm outside those test machines.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 72 / 77
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
159/168
So whats the problem, then?
Well,
ConsoleKit + PolicyKit have a set of own PAM rules installed
Th l l th f K b 5 th l th fi f
8/6/2019 1731 Desktop on the Linux Slides
160/168
These rules plus those of our Kerberos-5 auth plus the config for
root-SSH were a bit unlucky
root could SSH into those boxes without requiring a password, or a
public key, but only if not from our IP range.Only good thing was: root doesnt get Kerberos tokens in our system,
so no harm outside those test machines.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 72 / 77
So whats the problem, then?
Well,
ConsoleKit + PolicyKit have a set of own PAM rules installed
These r les pl s those of o r Kerberos 5 a th pl s the config for
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
161/168
These rules plus those of our Kerberos-5 auth plus the config for
root-SSH were a bit unlucky
root could SSH into those boxes without requiring a password, or a
public key, but only if not from our IP range.Only good thing was: root doesnt get Kerberos tokens in our system,
so no harm outside those test machines.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 72 / 77
Morale
Yes, it was a configuration error.But to set proper configurations one needs good documentation
(f S Ad i )
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
162/168
(for Sys Admins).
Distributions dont properly document their inner workings. This
must change.
Those convoluted interdependencies of desktop systems do no
good.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 73 / 77
Morale
Yes, it was a configuration error.But to set proper configurations one needs good documentation
(f S Ad i )
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
163/168
(for Sys Admins).
Distributions dont properly document their inner workings. This
must change.
Those convoluted interdependencies of desktop systems do no
good.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 73 / 77
Weve seen only the tip of the iceberg so far. Theres more to consider:
Modern Unix Desktops depend on a number of system level
services
Some of these services aim at replacing core functionality, noteven related to Desktops
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
164/168
even related to Desktops systemd (replaces SysV init, upstart, the like) RealtimeKit (a whole story of its own).
The more direct dependencies are created down to the systemlevel, the harder it gets to install alternatives there.
Eventually the whole development process may be only about
fixing issues probably by adding complexity instead of removing
and come to a standstill.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 74 / 77
Weve seen only the tip of the iceberg so far. Theres more to consider:
Modern Unix Desktops depend on a number of system level
services
Some of these services aim at replacing core functionality, noteven related to Desktops
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
165/168
even related to Desktops systemd (replaces SysV init, upstart, the like) RealtimeKit (a whole story of its own).
The more direct dependencies are created down to the systemlevel, the harder it gets to install alternatives there.
Eventually the whole development process may be only about
fixing issues probably by adding complexity instead of removing
and come to a standstill.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 74 / 77
Conclusion
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
166/168
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 75 / 77
Conclusion
The development of contemporary Unix Desktop Environments is
marked by the errection of largely complex structures
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
167/168
y g y p
Features oftenly given more weight than simplicity and stability
Oftenly problems are not properly identified
Problems are tackled by throwing even more code at them.
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 76 / 77
Simplicity is the highest form of sophistication.
unattributed
Complexity has nothing to do with intelligence, simplicity
does.
http://find/http://goback/8/6/2019 1731 Desktop on the Linux Slides
168/168
Larry Bossidy
Those who dont understand Linux are doomed to reinvent it,
poorly.
unattributed
Wolfgang datenwolf Draxinger () Desktop on the Linux (and *BSD of course). . . 27c3 77 / 77
http://find/http://goback/