To understand the benefit of mandatory access control (MAC) over traditional discretionary access control (DAC), you need to first understand the limitations of DAC.

Under DAC, ownership of a file object provides potentially crippling or risky control over the object. A user can expose a file or directory to a security or confidentiality breach with a misconfigured chmod command and an unexpected propagation of access rights. A process started by that user, such as a CGI script, can do anything it wants to the files owned by the user. A compromised Apache HTTP server can perform any operation on files in the Web group. Malicious or broken software can have root-level access to the entire system, either by running as a root process or using setuid or setgid.

Under DAC, there are really only two major categories of users, administrators and non-administrators. In order for services and programs to run with any level of elevated privilege, the choices are few and course grained, and typically resolve to just giving full administrator access. Solutions such as ACLs (access control lists) can provide some additional security for allowing non-administrators expanded privileges, but for the most part a root account has complete discretion over the file system.

A MAC or non-discretionary access control framework allows you to define permissions for how all processes (called subjects) interact with other parts of the system such as files, devices, sockets, ports, and other processes (called objects in SELinux). This is done through an administratively-defined security policy over all processes and objects. These processes and objects are controlled through the kernel, and security decisions are made on all available information rather than just user identity. With this model, a process can be granted just the permissions it needs to be functional. This follows the principle of least privilege. Under MAC, for example, users who have exposed their data using chmod are protected by the fact that their data is a kind only associated with user home directories, and confined processes cannot touch those files without permission and purpose written into the policy.

SELinux is implemented in the Linux kernel using the LSM (Linux Security Modules) framework.

Type Enforcement involves defining a type for every subject, that is, process, and object on the system. These types are defined by the SELinux policy and are contained in security labels on the files themselves, stored in the extended attributes (xattrs) of the file. When a type is associated with a processes, the type is called a domain, as in, “httpd is in the domain of httpd_t.” This is a terminology difference leftover from other models when domains and types were handled separately.

All interactions between subjects and objects are disallowed by default on an SELinux system. The policy specifically allows certain operations. To know what to allow, TE uses a matrix of domains and object types derived from the policy. The matrix is derived from the policy rules. For example, allow httpd_t net_conf_t:file { read getattr lock ioctl }; gives the domain associated with httpd the permissions to read data out of specific network configuration files such as/etc/resolv.conf. The matrix clearly defines all the interactions of processes and the targets of their operations.

Connect to me on Facebook

A relational database stores the data in the form of tables and columns. A table is the category of data, like Employee, and the columns are information about the category, like name or address.

Some databases have minimal feature sets and only store data, while others include programming languages, facilities and utilities to support enterprise-level applications like ERP and data warehousing. Oracle is the #1 database and has the most advanced feature set.

Oracle is made up of a set of processes running in your operating system. These processes manage how data is stored and how it is accessed. I will cover these processes in detail in the future; but for now we just need to understand that Oracle is a program that is running in the background, maintaining your data for you and figuring out where it should go on your hard drive.

In almost all relational databases, data is accessed through SQL, or Structured Query Language, and Oracle is no exception. SQL allows you to SELECT your data, INSERT new records, UPDATE existing records and DELETE records you want to get rid of. SQL can be embedded in other languages or you can run scripts of SQL directly against the database.

PL/SQL is the procedural language extension to SQL. PL/SQL is a programming language like C, Java or Pascal. In the Oracle world, there is no better way to access your data from inside a program. SQL can be natively embedded in PL/SQL programs. I will be using both SQL and PL/SQL very heavily in my future articles.

PL/SQL is a feature-rich language geared toward developing database applications. PL/SQL is the procedural language of the database, but it is also the procedural language for most of Oracle’s tools. Programs that run inside the database are called stored procedures. These stored procedures are almost always PL/SQL, but can be written in Java.

Some of Oracle’s tools to access the database and create programs are:

SQL*Plus has a command line interface. With it, you can access the database and write stored procedures, you can run SQL commands to retrieve data and you can run scripts of either SQL, PL/SQL or built-in SQL*Plus commands, or a mixture of those three things.

Oracle Developer is a 4GL GUI application Builder. With Developer, you can create forms, reports, and graphics. Oracle*Forms and Oracle*Reports are two components of Oracle Developer. Earlier versions created client-server applications, but the more recent versions create web applications that run under the Oracle Application Server (OAS). OAS is a web-based application server sold by Oracle. OAS is licensed separately and is very expensive (as are its closed source competitors). The current version is OAS 10g.

HTML DB is a fairly new application builder geared toward web development (added to the DB with release 9iR2). HTML DB does not need an application server. This tool runs from the database and can be presented to the web using the Apache web server that comes with the database. Since this is not an additional license, it provides a cheaper way to develop applications. Developer is a feature-rich thick client with all of the normal GUI widgets. HTML DB is HTML-based and is very thin and limited to the HTML provided widgets.

Oracle Enterprise Manager (OEM) is the Enterprise GUI tool to manage the database. From this tool, you can perform any action in the database that is required. This tool is primarily used for administration but can also be provided to developers for application tuning and monitoring. In Oracle 10g, OEM also provides Grid control.

There are also a lot of third party tools for accessing the database. For our purposes, our primary tool for data access will be SQL*Plus. In the future, I will cover creating applications with HTML DB and accessing your data with some choice third-party tools.

How about Java? Java is the current hot language, especially on the web. I will also be covering Java in the database in future articles. Java is natively supported by Oracle. Technically, you could use Java to create your stored procedures if you chose, but I am not a proponent of that. When you are working inside the database, I believe that you should only resort to Java when you cannot accomplish a task in PL/SQL. As you’ll see, there is very little you cannot accomplish with PL/SQL.

It will be hard to learn Oracle if you can’t play with it. So where can you get access to this software? Oracle has a technical web site called OTN (Oracle Tech Net) that provides access to all of Oracle’s software and all of the documentation for that software. There are also forums and many other tools to use to help you learn Oracle. You have to register to access it, but registration is free. Go to http://otn.oracle.com/ and get an ID today. In future articles, I will be spending a lot of time accessing this web site to download software and documentation. My next article will cover downloading Oracle 10g and installing it.

As a side note, Oracle provides all of their software with a developer’s license. This license allows you to try out the software free of charge. You may not create production applications without a paid license, but development with the tools is acceptable. I am not a lawyer, so I recommend that you review the license when you download any software from OTN.

Also, a note about versioning in Oracle; all products released by Oracle have a version. The current version of the database is 10g Release 1, also written as 10gR1. In addition to this semantic release name, each release has a numeric version. The numeric release for 10gR1 is 10.0.1.3.

Connect to me on Facebook

LDAP, Lightweight Directory Access Protocol, a directory service internet protocol runs over Transmission Control Protocol/Internet Protocol (TCP/IP) that that email and other programs use to look up information from a server.

Every email program has a personal address book, but how do you look up an address for someone who’s never sent you email? How can an organization keep one centralized up-to-date phone book that everybody has access to?

That question led to development of a standard called DIRECTORY SERVICES which supports the capability to locate certain types of information easily, efficiently, and quickly.

A directory is a set of objects with attributes organized in a logical and hierarchical manner. A simple example is the telephone directory, which consists of a list of names (of either persons or organizations) organized alphabetically, with each name having an address and phone number associated with it.

For example, the entry for Peter Chan might have the following attributes:

cn: Peter Chan

mail: peter@ust.hk

telephoneNumber: 2358-1234

telephoneNumber: 2358-4321

roomNumber: 2228

Lightweight Directory - Directories are kind of like a database but not really. A directory is a specialized

database that is optimized for lookups. Unlike a traditional RDBMS, LDAP is not designed to show

complex relationships between relations. Imagine if 99% of your actions on were going to be simple

"selects", and you wanted anyone, anywhere to be able to do these selects over the Internet. This is

where LDAP excels. Examples of directories are the TVGuide, the phone book, a library card

catalog, and DNS.

"Give me the phone number of John Smith."

"Give me all the tv shows that are on tonight on the Sci-Fi channel."

Access Protocol - LDAP is an outgrowth of the x.500 standard. LDAP is an open standard,

unlike many other proprietary directory solutions. Most of the directory-like solutions that were

out on the market are now very similar to LDAP. Some of these solution providers, Sun and

 Microsoft specifically, have designed JNDI and ADSI APIs so that you can connect with any

 kind of directory service. This is kind of like ODBC or JDBC is to an RDBMS.

Cool things you can do with LDAP

-Contact Management

-Users and Security

-Image storage

-Document Management

-Store business logic - actual code or SQL statements

tements

Connect to me on Facebook

Zombie

After the zombie is removed, its process id and entry in the process table can then be reused but until its entry is in the process table that value cannot be used for other process in case the parent spawns the new process. It will allocate a new pid different from that of zombie process to the new process created.

Zombies can be identified in the output from the ps command in Linux by the presence of a “Z” in the “STAT” column.

To remove zombies from a system, the SIGCHLD signal can be sent to the parent manually, using the kill command. If the parent process still refuses to reap the zombie, the next step would be to remove the parent process. When a process loses its parent, init becomes its new parent. Init periodically executes the wait system call to reap any zombies with init as parent.

Connect to me on Facebook

Tom Werner discovered the solution and what is known as gravatar. So what is a gravatar???

Gravatar short  for GLOBALLY RECOGNIZED AVATAR is a service for providing globally-unique avatars. Gravatar, users can register an account based on their email address, and upload an avatar to be associated with the account.

To eliminate spam, e-mail addresses in gravatar are hashed with the Md5 cryptographic hash function.

Setting up an gravatar account:

It all starts when you sign up for a free account (and yes you do have to give a working email address as confirmation for your account setup is sent to it). Once you account is set up, you can upload your first avatar. Avatars can be uploaded from a hard drive, web address and even a webcam device. Once your avatar is uploaded, you will be asked to crop it (gravatar’s cropping tool is very flexible and easy to use) so it will look nice. After cropping and clicking on the “crop and finish!” button, a “select avatar rating” page will be shown. There you will be required to rate the avatar as one of the following:

rated gravatar is suitable for display on all websites with any audience type.

rated gravatars may contain rude gestures, provocatively dressed individuals, the lesser swear words, or mild violence.

rated gravatars may contain such things as harsh profanity, intense violence, nudity, or hard drug use.

rated gravatars may contain hardcore sexual imagery or extremely disturbing violence.

After selecting the rating  the following screen will appear and then click on the link “check this avatar” to get your confirmation and encrypted email-address.

For me it showed my encypted email id like this:

Address: emailid@yahoo.co.in

Hash: 2b3f0a93a608e3eb869554e46b3d71ad

http://www.gravatar.com/avatar/2b3f0a93a608e3eb869554e46b3d71ad?s=80

Why do we use gravatar????

Gravatar acts as a  personal representations (or pictures) which help to distinguish one user from the next. If every user had the same default image, chaos could result and everyone would blend into a one color oceaning softwares.

Gravatar plugins are built in most of the blogging softwares. WordPress  above 2.5 holds it and Redmine web based project management application beginning  with 8.0

have inbuilt feature for this application

For lower versions of wordpress and readmine  we manually need to download and install plugins.

We can get them from:

WordPress:download

Readmine: download