My Green Life Things I love, things I hate, and things I just don’t understand

If you don’t know what “sudo” is, then this isn’t the post for you… it’s going to get technical and Linuxy. Let’s start with the summary, as it’s the most important part of this post:

If you use /etc/sudoers.d/ don’t create files in the directory – create them elsewhere, ‘chmod’ them, and only then copy them in

Now for the story about how I came to this discovery…

For reasons that I’ll describe in a future post, I have a need to be able to trigger the “chvt” command from a keyboard shortcut. More specifically I want to run “gksudo chvt 1″, as using chvt to switch from a graphical screen to a console requires superuser privileges on my Ubuntu box. This prompts for my password, which seems a little redundant as I can use CTRL-ALT-F1 to the same effect without having to enter a password. So I decided to add an entry to the sudoers file in order to grant myself passwordless access to the chvt command.

I went wandering over to /etc and found not only the expected “sudoers” file, but also a “sudoers.d” directory. This directory contained a single README file, as follows:

#
# As of Debian version 1.7.2p1-1, the default /etc/sudoers file created on
# installation of the package now includes the directive:
#
# #includedir /etc/sudoers.d
#
# This will cause sudo to read and parse any files in the /etc/sudoers.d
# directory that do not end in ‘~’ or contain a ‘.’ character.
#
# Note that there must be at least one file in the sudoers.d directory (this
# one will do), and all files in this directory should be mode 0440.
#
# Note also, that because the sudoers file is not a ‘conffile’ in the Debian
# sense, and sudoers contents can vary widely, no attempt is made to add this
# directive to existing sudoers files on upgrade. Feel free to add the above
# directive to the end of your /etc/sudoers file to enable this functionality
# for existing installations if you wish!
#

That seemed like just what I wanted. I could create my sudoers command in a file of its own, safe in the knowledge that it wouldn’t get trampled by any future upgrades that affect the sudoers file itself. I copied and pasted the #includedir line into my sudoers file (using “sudo visudo”), then set about adding my sudoers directive in a file I named “chvt”:


> cd /etc/sudoers.d/
> sudo touch chvt
> sudo chmod 0440 chvt


BANG!

My terminal was filled with a lengthy backtrace, but scrolling back up to the top, I found this little nugget:

sudo: /etc/sudoers.d/chvt is mode 0644, should be 0440

Well thanks for that marvellous insight – I was just trying to set it to 0440 when you stopped me, you stupid machine.

Because I committed the heinous crime of creating an empty file in /etc/sudoers.d/ “sudo” won’t work at all. I can’t correct the permissions, I can’t delete or move the file: in short, I’ve lost administrator access to my machine. All for the sake of an empty file.

Now I can understand sudo throwing a wobbly and quitting if it can’t parse the sudoers file – blindly proceeding to read a malformed file could be a quick route to a buffer overflow attack or similar. But dying completely because an empty file has the wrong permissions seems a little draconian. Yes, that README did say “…and all files in this directory should be mode 0440″ – but “should be” isn’t quite the same as “…MUST be 0440, or I’ll DIE!!!”. Here’s an idea: if you don’t like the permissions, just don’t read the file – there’s no need to get all suicidal about it.

It seems that the only way to recover from this situation is to reboot the machine: either booting from a Live CD, or selecting the recovery console during the GRUB boot sequence. You can then remove or change the permissions of the offending file and everything will be back to normal after you restart the machine. It does seem like a lot of hassle caused by a zero length file though – thank goodness I didn’t do this on a production server!

All of which leads back to the summary at the top of this post: Don’t create files directly in /etc/sudoers.d/ If you do use the #includedir directive in your sudoers file, make sure you create your files elsewhere, set the permissions to 0440, and only then copy them into place.

As I mentioned in this post, the migration of Ubuntu’s window controls from the top right to the top-left were a precursor to other changes which would make use of the now-empty corner of the title bar. I’m still not sure why the controls had to move before any of these new widgets even exist, but at least now we have a little more information about the plans for the top-right corner of Ubuntu windows, as Mark Shuttleworth has posted a blog entry about the so-called “windicators” that they plan to put there.

On the whole I approve of the idea of adding more functionality to the title bar – it’s largely wasted space at the moment. But there’s one thing about this proposal which concerns me: the user has no choice about the position of the windicators. From the proposal it appears that the user can either accept the window controls at the top-left and the windicators at the top-right, or they will have to live without the windicators completely.

When you look at this suggestion in the context of the plans for the Ubuntu Netbook Remix it makes a lot of sense. By positioning the windicators at the top right they appear alongside the main panel indicators in the planned version of UNR which combines the window titlebar with the menu and the top panel into one composite element. But just because this positioning makes sense for UNR, that doesn’t necessarily mean it makes sense for normal desktop installations.

My personal preference would be to retain the close button in the top-right, but move the minimise and maximise buttons (which I rarely use) to the top-left. Windicators would appear in the top-right, but to the left of the close button. Of course this layout wouldn’t suit everyone. Perhaps you would rather have the windicators in the centre of the title bar, with the application name to the left and the window controls to the right? Perhaps you would prefer not to have windicators at all, or perhaps you could live without the maximise button if you’re one of those people who religiously use a double-click on the title bar for the same purpose.

The point is that a single layout arrangement, dictated from above, doesn’t suit everybody. So why not make it configurable? Why not turn the title bar into a container-like element, with the ability to host various widgets that are aligned to the left, right or center. The close button would be a widget. The minimise and maximise buttons would be widgets. Even the window title would be a widget. Windicators would probably be treated as one composite widget, rather than making the user deal with each one individually.

In this scenario the window title bar is more akin to the existing Gnome panels in Ubuntu. If you want to rearrange your window widgets you could just drag them around, much like you can with objects in a panel. If you want to remove a widget entirely you could do that too – although a sanity check would probably prevent you removing the only close button. All this configurability would be hidden away in a tab on the “Appearence” preferences panel, making it easy to get to when needed, but not so obvious that it distracts the average user who wants to stick with the defaults.

I suspect that the basics of this scheme are already in place. The fact that there are instructions floating around for using gconf-editor to switch the window controls back to the right would certainly suggest that title bars are already treated as simple containers for other widgets. So why not expose the functionality in a nice user-friendly way? Why can’t I tailor the title bar to my needs as easily as I can the Gnome panel?

But I can’t seem to find any porridge that is just right. Except that for “porridge” you should read “software”, and for “too hot” read “too expensive”.

For years now it’s been possible to request CDs of Ubuntu releases, which were delivered completely free of charge – as mentioned a couple of times before on this blog. Alas! That is now set to stop.

More specifically it’s set to stop for people like me, who have had free CDs in the past, and who seemingly don’t contribute to Ubuntu. If you’re a new user who has never requested any CDs before, you can still have one. If you’re a developer or artist who has made significant contributions to Ubuntu then you can become a Ubuntu Member in order to continue receiving free CDs.

Other than a few bug reports, I don’t really contribute much to Ubuntu itself – certainly not enough to become a Ubuntu Member. But that doesn’t mean that I do nothing. I’m one of the many users round the world who know enough about computers to be the local go-to guy when things go wrong. As such I’ve used Ubuntu CDs for proving that hardware is (or isn’t) working, even on a Windows machine. I’ve used Ubuntu CDs to recover data from otherwise non-functional systems which won’t boot from the resident OS. I’ve used them as sandboxed environments for examining potentially dangerous files. I’ve installed several virtual machines from them. And of course I’ve installed a full copy of Ubuntu onto several real machines – converting a few Windows users in the process.

Many of these tasks are made a bit easier by having a properly pressed CD in a sleeve which explicitly states that it can be installed on more than one machine. It gives an air of legitimacy. If fixing a machine appears to involve an OS burned onto a CD-R, with a hand scribbled label, some people might wonder what makes that OS better than the dodgy copy of Windows that their friend got off eBay.

I understand why Canonical has taken this step – but it does seem like a step too far to me. I’d be more than happy to pay the delivery costs for my Ubuntu CD, they don’t have to send it to me for free. I’d be happy to pay for the CD and sleeve itself, so that they’re not out of pocket. I’d even be happy to pay a little over the odds so that they can make a small profit, or to subsidise those CDs that are still sent out for free.

But I don’t want five CDs. I particularly don’t want five CDs at a cost of £5 + VAT + carriage. Yet that’s the smallest quantity I can order from the Canonical shop. Sure, £5+ isn’t hideously expensive for a fully-featured OS, but compared to downloading it for free it feels that way, given that four of them will probably join my pile of prospective drinks coasters. Here’s an idea: if you really want a fiver off me, then send me a variety pack – a Ubuntu CD, a Kubuntu CD, a Xubuntu CD and a Ubuntu Server CD. That’s one less CD for you to send, but a better value prospect for me.

So the CD’s have gone from being too cold, to being too hot. They’re too cheap for Canonical to continue sending out, but too expensive for me to want to buy five at a time.

With the imminent release of Ubuntu 9.10 (“Karmic Koala”) Canonical are integrating support for “Ubuntu One” – a storage facility hosted on their servers. You can get 2GB of storage space for free, which is a pretty good deal by anyone’s standards. Need more space? Perhaps you want 5GB or maybe 10GB. Sorry, you’re out of luck – the next step from “2GB for free” is “50GB for $10 per month”. That’s $120 per year, or just shy of £75 at the current exchange rate.

For £75 I could buy a 1TB external hard drive, and still have change. For £80 I could get a 500GB NAS if I want to put my backups a little further away. Even 64GB USB flash drives have dropped down to about £80 now, if I want to be able to access the data wherever I go. None of these options offers quite the same facilities as a cloud-based storage service, but if all you want is somewhere to back-up some important files you might find they’re good enough.

2GB for free is great. 50GB for £75 per year is too much space for too much money for a lot of people. Where’s the middle tier option of 15GB for £25 per year?

My girlfriend’s company has a Linux server. On that server is a copy of VMWare Server, running two Windows virtual machines. She’s a partner in a small design and print business, working mostly with Macs. They have one Windows VM to run Sage (accounting software), and one to run MS Office (for those annoying customers who come in with their “artwork” prepared in Publisher or Word). Apart from her business partner, there is one employee and an occasional part-time worker. That’s three-and-a-bit members of staff in total – it’s not exactly a big business.

VMWare Server is great except for a couple of things. Firstly it has a dreadful web interface to manage it (replacing the stand-alone application, which worked quite well, from earlier versions). Secondly the web interface doesn’t work on Macs. The latter point is a real problem, as it means that any use of the virtual machines takes place via a Linux box they’ve got in the office. One Linux box to manage two VMs means inevitable time-sharing.

An obvious solution would be to switch from VMWare Server to VirtualBox, which does at least have a Mac client. But whereas VMWare Server is free of charge, VirtualBox is only free if you use the Open Source edition – which lacks support for USB devices and RDP connections, both of which would be invaluable. The commercial version, however, starts at $50 per user. That’s $200 (or $150 if they never let the part-timer anywhere near it). Compared with free-of-charge, that’s a lot of money.

So they make do with the porridge that’s too cold, because despite the annoying time-sharing, they can’t really justify spending that much money just to open a few Publisher documents. Sun’s porridge is just too hot.

I work for a small company with about a dozen employees. We have a copy of the Open Source version of SugarCRM which we use for our minimal CRM requirements. Our requirements are so minimal that the CRM software only gets accessed once or twice a day, and only then by three members of staff.

But the Open Source version of SugarCRM isn’t perfect, even for our modest requirements. There are some features of the commercial version that we’d really like to have. But the cheapest commercial version costs $360 per user, per year – with a minimum of five users. So that’s at least $1800 per year! We’ll make do with the Open Source version, thanks. Sure, the cold porridge might lack some flavour, but at least it won’t scald us.

What all these situations have in common is that they involve Open Source software which is available free of charge, or for too much money. Where is the middle ground? The £2 Ubuntu CD? The £20 per year storage solution? The £20 VirtualBox licence? The £200 SugarCRM licence?

Note to software vendors: if you offer your wares for free, make sure the step up to the first tier of your paid offerings isn’t too steep, or you might end up getting burned by your own porridge.