Finding Rootkits By Monitoring For ‘Black Sheep’

Blacksheep compares memory dumps from each monitored system, first creating lists of kernel memory modules that are then sorted and compared, calculating the distance that each list of modules is from the others. The system then compares each byte of a modules’ code with other systems to find differences that could indicate changes inserted by a rootkit. Blacksheep also conduct memory crawling to catch changes to kernel data and checks five different kernel entry points for signs of changes.

via Finding Rootkits By Monitoring For ‘Black Sheep’ – Dark Reading.

Hadoop Corona

Hadoop Corona is the next version of Map-Reduce. The current Map-Reduce has a single Job Tracker that reached its limits at Facebook. The Job Tracker manages the cluster resource and tracks the state of each job. In Hadoop Corona, the cluster resources are tracked by a central Cluster Manager. Each job gets its own Corona Job Tracker which tracks just that one job. The design provides some key improvements:

via hadoop-20/src/contrib/corona at master · facebook/hadoop-20 · GitHub.

Valve: Linux More Viable Than Windows 8 for Gaming

In a presentation at Ubuntu Developer Summit currently going on in Denmark, Drew Bliss from Valve said that Linux is more viable than Windows 8 for gaming. Windows 8 ships with its own app store and it is moving away from an open platform model.

via Valve: Linux More Viable Than Windows 8 for Gaming ~ Ubuntu Vibes | Daily Ubuntu Linux Updates.

Ubuntu is preferred platform as it has a large user base and good community support with a strong company like Canonical behind it.

EXT4 Data Corruption Bug Hits Stable Linux Kernels

As a warning for those who are normally quick to upgrade to the latest stable vanilla kernel releases, a serious EXT4 data corruption bug worked its way into the stable Linux 3.4, 3.5, and 3.6 kernel series.

via [Phoronix] EXT4 Data Corruption Bug Hits Stable Linux Kernels.

The reason why the problem happens rarely is that the effect of the buggy commit is that if the journal’s starting block is zero, we fail to truncate the journal when we unmount the file system. This can happen if we mount and then unmount the file system fairly quickly, before the log has a chance to wrap. After the first time this has happened, it’s not a disaster, since when we replay the journal, we’ll just replay some extra transactions. But if this happens twice, the oldest valid transaction will still not have gotten updated, but some of the newer transactions from the last mount session will have gotten written by the very latest transacitons, and when we then try to do the extra transaction replays, the metadata blocks can end up getting very scrambled indeed.

Wayland 1.0 Officially Released

In terms of actual Wayland adoption, Ubuntu developers may try again to have Wayland become the Ubuntu System Compositor for Ubuntu 13.04 in April, but I wouldn’t be surprised at all to see that delayed until Ubuntu 13.10 one year from now. Wayland is making nice progress and it’s becoming likely that it will succeed the X.Org Server on the modern Linux desktop, but there’s still much work ahead. Even the Wayland adoption within Fedora and the other more experimental / bleeding-edge Linux distributions has been slow.

via [Phoronix] Wayland 1.0 Officially Released.

20 Iptables Examples For New SysAdmins

This Linux based firewall is controlled by the program called iptables to handles filtering for IPv4, and ip6tables handles filtering for IPv6. I strongly recommend that you first read our quick tutorial that explains how to configure a host-based firewall called Netfilter (iptables) under CentOS / RHEL / Fedora / Redhat Enterprise Linux. This post list most common iptables solutions required by a new Linux user to secure his or her Linux operating system from intruders.

Via Linux: 20 Iptables Examples For New SysAdmins.

Next Linux kernel release supports more ARMs with less code

A new coding effort recently folded into the next version of the Linux kernel may finally resolve the long-running problems associated with Linux on ARM processors. While devices like the Raspberry Pi have shown what can be done with Linux on the low-cost, low-power ARM processor, the burden of developing Linux on the growing number of ARM-derivative processors on the market has been, as Linus Torvalds himself has described it, “a fucking pain in the ass.”

via Next Linux kernel release supports more ARMs with less code | Ars Technica.

Until now, each implementation of ARM by manufacturers has had its own associated kernel code tree, creating a code management nightmare.

f2fs: introduce flash-friendly file system

F2FS is a new file system carefully designed for the NAND flash memory-based storage devices. We chose a log structure file system approach, but we tried to adapt it to the new form of storage. Also we remedy some known issues of the very old log structured file system, such as snowball effect of wandering tree and high cleaning overhead.

via LKML: =?utf-8?B?6rmA7J6s6re5?=: [PATCH 00/16] f2fs: introduce flash-friendly file system.

Trace the Process and See What It is Doing with strace

strace is a useful diagnostic, instructional, and debugging tool. It can save lots of headache. System administrators, diagnosticians and trouble-shooters will find it invaluable for solving problems with programs for which the source is not readily available since they do not need to be recompiled in order to trace them. This is also useful to submit bug reports to open source developers.

via Debugging Tip: Trace the Process and See What It is Doing with strace.

Run strace against /bin/foo and capture its output to a text file in output.txt:
$ strace -o output.txt /bin/foo