Removing Suspend and Hibernate from the gnome menu on RHEL-6

I wrote about how to get rid of the “Suspend” option from gnome’s system menu on RHEL/SL/CentOS-5 in my earlier blog. On RHEL-6, “Suspend” and “Hibernate” are now found under “Shutdown” in the “System” menu in gnome.

To remove these options from the list of available actions, create a PolicyKit file named 10-disable-suspend-hibernate.pkla (for example) with the following contents:

[Disable suspend]
Identity=unix-group:*
Action=org.freedesktop.devicekit.power.suspend;org.freedesktop.devicekit.power.hibernate
ResultAny=no
ResultInactive=no
ResultActive=no

and save it in the /var/lib/polkit-1/localauthority/50-local.d directory.

VMware Workstation and RHEL 6.1 and vmmon and trouble

If you have VMware Workstation and are thinking of upgrading your OS to RHEL (or its clone) 6.1, be prepare to go through some extra steps. VMware WS and EL6.1 won’t work together. :-( See, for example, this VMware community forum post: the vmmon.ko module won’t load. Technical details of this issue can be found in this Red Hat bugzilla entry. Apparently, a patch introduced in the EL 6.1 kernel (2.6.32-131.0.15.el6) changed the smp_ops symbol and that prevents the vmmon kernel module from loading.

In VMWare Workstation 7.1.4 build-385536, I see this info with the modinfo command:

vermagic:       2.6.32-71.el6.x86_64 SMP mod_unload modversions

A workaround is to compile the vmmon module on EL 6.1.
Make sure you have kernel-devel installed that matches the running kernel.
Start as a user (not root):

(1) mkdir ~/vmsrc ; cd ~/vmsrc
(2) tar xvf /usr/lib/vmware/modules/source/vmmon.tar
(3) cd vmmon-only
(4) make [Note: this builds vmmon.ko]
(5) strip --strip-debug vmmon.ko [This is optional. Note the two dashes]
(6) su -
(7) cd /lib/modules/`uname -r`/misc
(8) mv vmmon.o vmmon.o.dist [Note: save the original just in case]
(9) cp /(path to user's home)/vmsrc/vmmon-only/vmmon.ko vmmon.o

That should do it!

A Kernel Too Far

The ELRepo Project offers the stable mainline kernel built for RHEL/SL/CentOS 5. It is named kernel-ml. I must emphasize that these kernels are not meant for production use but rather for hardware testing.

There are two versions currently being maintained: the long-term kernel 2.6.35 and the latest stable line (2.6.37 as of this writing). Is the newer version better? Not really so. The first alarming sign came from Dag and the maintainer of kernel-ml, Alan. The Gnome power management did not operate correctly for their laptops with kernel-ml-2.6.36.

Alan recently noted that, the further away the LKA (Linux kernel archive) kernel becomes from the 2.6.18 kernel (which is the basis of EL5), the less likely a stable LKA kernel will be usable. In fact, on certain hardware, kernel-ml 2.6.35 runs fine whereas 2.6.37 does not [1,2].

Quoting Phil, “I see more “value” in the kernel-ml-2.6.35 offering. I agree that sooner or later you are likely to hit a point of diminishing returns, and perhaps you’ve already reached that point with the current kernel-ml-2.6.37.”

So, is this kernel too far ?

[1] http://lists.elrepo.org/pipermail/elrepo/2011-February/000473.html
[2] http://lists.elrepo.org/pipermail/elrepo/2011-March/000542.html

SELinux and FreeNX

[Note added in August 2011: Be sure to read the comment by Dan Walsh. There is a simpler solution]

When you attempt to connect to a remote machine using freenx, you might encounter this message:

The NX service is not available or the NX access was disabled on host XXX.

This is likely due to SELinux blocking the connection. If you are using QtNX, it just hangs without any message.  Here is how to solve the issue.

(1) Disable auditd.

service auditd stop

(2) Rename /var/log/audit/audit.log or move it somewhere else.

(3) Enable auditd

service auditd start

(4) Try connection from the client. It will fail. This writes the audit.log file.

(5) Generate SELinux policy rules from the log file and install it.

cat /var/log/audit/audit.log | audit2allow -M freenx
semodule -i freenx.pp

(6) You can see the policy by reading the .te file.

cat freenx.te

module freenx 1.0;

require {
type nx_server_var_lib_t;
type sshd_t;
class file read;
}

#============= sshd_t ==============
allow sshd_t nx_server_var_lib_t:file read;

(7) Now, try connecting from the client again. It will fail again. Repeat the steps (1) to (5) using ‘freenx2′ instead of ‘freenx’.

(8) You will most likely need to repeat the process yet one more time until the connection finally succeeds. So, once again repeat the steps (1) to (5) but this time using ‘freenx3′ instead of ‘freenx’.

If you look at the policy files generated, you will find what was added by each action.

ELRepo project

It all started in the CentOS forums.

CentOS, being an Enterprise Class Linux distro, may not have support for new hardware, especially those found in desktops and laptops. CentOS forums get many postings from users who are looking for drivers that are needed for their network device, webcam, etc. In fact, googling for “driver” and “centos” yields much more hits from the forums than the mailing list as shown in my earlier blog.

Alan Bartlett who has been actively helping in the forum has strong background in the kernel and its modules and has been building, whenever possible, a driver module each time he sees a cry for help. In a fairly short period of time, quite an impressive number of such kernel modules were built this way and it was growing.

Because these drivers were designed to be independent of the kernel version (kABI-tracking, kABI = kernel application binary interface), they survive kernel updates. Also, they can be used in RHEL and all its rebuilds, not just CentOS. So, it was a good idea to make them available to wider communities. NedSlider proposed to establish a repository for that purpose. The ELRepo project was thus started by five members of the CentOS / Scientific Linux community.

A little more details of ELRepo can be found in the Ned’s recent blog.

Getting rid of Suspend on a desktop machine

For some reason, my desktop gnome menu had a “Suspend” option.  It was right under the “Log out …” option in the System dropdown menu.  One day, when I meant to click on the “Log out” option, my mouse went too far and I ended up selecting this “Suspend” option.

After struggling for the next few minutes, I gave up and rebooted the machine to come out of the suspended state.

The Suspend option should not have been there to begin with.  Anyway, it was time to remove it.  Fortunately, that was as easy as typing [1]:

gconftool-2 --type boolean --set /apps/gnome-power-manager/can_suspend false

Likewise, if you want to get rid of the Hybernate option,

gconftool-2 --type boolean --set /apps/gnome-power-manager/can_hibernate false

[1] http://magazine.redhat.com/2008/05/30/tips-and-tricks-how-do-i-remove-the-suspendhibernate-entries-from-the-system-menu-in-the-gnome-panel/

Clean that Inbox

Like many other people, I use Linux as a backup server.  The other day, I noticed that daily incremental backup of one of the Windows machines was well over 1 GB even on the day the user was mostly idle.  The only thing the user was doing was … e-mailing.  Aha! (heard the bell?)  It must be that inflated Inbox.

Mozilla-based mail clients like Thunderbird and Seamonkey mail do not physically remove messages that user deletes.  Instead they are only tagged “deleted”.  This is true even after the Trash folder is emptied.  The [supposedly] deleted mails get [really] deleted when Inbox (or any folder for that matter) is compacted.

I went to the blasted machine and did just that and the Inbox went from > 1 GB to a fraction of its original size.

Of course, this is not just Windows.  Huge mail folders can potentially cause trouble and also degrade the performance of the client.  The best strategy to prevent this is to set up an automatic clean up.  In Thunderbird, go to Edit -> Preferences -> Advanced -> Network & Disk Space and then enable the “Compact folders when it will save over…KB” option.

Socks proxy with auto-config

OpenSSH has built-in support to act as a SOCKS proxy. In my case, there are web sites I can access only from work computers and I need to get to them from home. So, I issue the command from my home computer:

ssh -D 1080 my work IP

However, I do not want to redirect all traffic through work.  Fortunately, you can redirect only selected URLs fairly easily by using a proxy auto-config file.

In firefox, Go to Edit -> Preferences -> Advanced -> Network -> Settings

In the Connection Settings box, select “Automatic proxy configuration URL:” and enter:
file:///path/to/proxylist.pac
The proxylist.pac file may look like this:

function FindProxyForURL(url, host)
{
// Proxy direct connections to these hosts
if (
shExpMatch(url, "http://www.jbc.com/*") ||
shExpMatch(url, "*.sgmjournals.org/*") ||
shExpMatch(url, "http://www.ncbi.nih.gov/*")
) {
return "SOCKS localhost:1080; DIRECT";
}
// Otherwise go directly
else return "DIRECT";
}

For more details on the pac file and auto config, see
http://en.wikipedia.org/wiki/Proxy_auto-config

sshfs – Remote filesystem access made easy

If you often need to access files on a remote machine and do it by ssh login, there is a handy way – sshfs. Here is a simplified howto that works.

(1) Set up the rpmforge repository if not done yet (see Installing RPMForge )
(2) Either use the dkms-fuse with the stock RHEL/CentOS kernel or use the centosplus kernel that contains the fuse kernel module. [Note added: fuse is included in the kernel as of RHEL/CentOS 5.4]

[root@mybox ~]# yum install dkms-fuse && modprobe fuse

(3) Also install the fuse libraries:

[root@mybox ~]# yum install fuse

(4) Then install the fuse-ssh filesystem:

[root@mybox ~]# yum install fuse-sshfs

(5) Add yourself to the group ‘fuse’:

[root@mybox ~]# usermod -a -G fuse user1

(6) Re-logon to your account
(7) Create a local directory:

[user1@mybox ~]$ mkdir remotedir/

(8) To mount (remote username=usr2):

[user1@mybox ~]$ sshfs user2@machine.example.com: remotedir/

(9) To unmount:

[user1@mybox ~]$ fusermount -u remotedir