13:03:01 #startmeeting weekly meeting 13:03:01 Meeting started Mon May 23 13:03:01 2016 UTC. The chair is mvollmer. Information about MeetBot at http://wiki.debian.org/MeetBot. 13:03:01 Useful Commands: #action #agreed #halp #info #idea #link #topic. 13:03:01 The meeting name has been set to 'weekly_meeting' 13:03:09 .hello mvo 13:03:10 mvollmer: mvo 'Marius Vollmer' 13:03:20 .hello dperpeet 13:03:20 dperpeet: dperpeet 'None' 13:04:16 .hello andreasn 13:04:18 andreasn: andreasn 'Andreas Nilsson' 13:04:34 sorry for being a tad late. I was picking up UX books at a library here 13:05:37 that's a good reason! :-) 13:05:55 but you will have to show proof, of course. 13:06:03 #topic Agenda 13:06:10 * gsoc 13:06:18 * selinux 13:08:14 alright 13:08:26 #topic gsoc 13:08:54 the official coding period has started 13:09:02 welcome to week #1, harish__ 13:09:47 welcome! 13:09:48 it looks like we will be doing this without major systemd changes :) 13:10:18 unless harish__ has anything to add, that's it from my side 13:10:36 i think he missed most of that 13:10:42 probably 13:10:45 too many underscores now for me 13:11:13 harish___, anything you'd like to add to starting the first official week of coding? gsoc 2016 13:11:54 yea 13:12:33 i think of completing the playground app soon 13:12:39 stefw: console logon screen -- meaning from the main console after boot completes. I posted, here: https://github.com/cockpit-project/cockpit/commit/e97eec6c487636e00a0af53d26106e81ac8d070d 13:13:12 ok, sounds good 13:13:19 and then we can integrate that into cockpit 13:13:32 I think it would be nice to aim for a work-in-progress pull request 13:13:40 that's a branch of the cockpit code 13:13:58 oh i get it. 13:14:07 i will do that 13:14:14 great, thanks! 13:14:29 dperpeet most of the work left now is 13:14:48 [cockpit] mvollmer pushed 1 new commit to master: https://git.io/vrVGv 13:14:48 cockpit/master 46ff687 Stef Walter: test: Fix check-storage-mdraid race with broad selector... 13:15:17 developing the section beneath the repeat part 13:15:21 in https://trello.com/c/1B2lZViZ/74-timers-and-cron 13:15:51 I think it would be nice to show general functionality first 13:16:01 so maybe just one line, et cetera 13:16:20 but we can discuss that in more detail later 13:16:28 okay. u mean to see if it sets timers right? 13:16:55 yes 13:17:07 yea fine 13:17:49 mvollmer, I think we've reached end of topic 13:17:59 yea. thats it from me 13:18:18 ok! 13:18:24 #topic selinux 13:18:37 hi! 13:18:43 isn't selinux fun! :-) 13:19:16 yes it is! that's we have a pull request with some new fun stuff 13:19:17 https://github.com/cockpit-project/cockpit/pull/4431 13:19:20 e.g. delete alerts 13:19:33 setroubleshoot has extended its api, and this pr makes use of most of that 13:19:43 there are a few issues to discuss 13:20:04 I have a mockup for setting permissive vs enforced mode https://raw.githubusercontent.com/cockpit-project/cockpit-design/master/selinux-troubleshooting/selinux-v5.png 13:20:38 one: it uses dbus introspection to figure out if it's dealing with an older api version, this is temporary and should go away once all the systems we support are new enough 13:20:51 thanks andreasn 13:21:07 that's the second issue: we've put some thought into visualizing the selinux operating mode 13:21:16 and even toggling between enforcing / permissive 13:21:32 it won't allow a switch between enabled / disabled, since that requires a reboot to take effect 13:21:44 and shouldn't be too accessible, in my opinion... 13:22:10 the goal here is to make selinux a bit less mysterious to some, and more accessible for everyone :) 13:22:25 third and last issue is the fact that we depend on setroubleshoot for this 13:22:45 if we want to work with selinux on debian for example, this won't work right now 13:22:57 there were a few discussions in #selinux about this 13:23:06 debian doesn't have setrobleshootd? 13:23:15 no 13:23:24 and one option would be to split out the audit plugin from setroubleshootd 13:23:38 so let me know if anyone has a vested interest in this 13:23:44 for now I'm happy with leaving things as they are 13:24:05 since the setroubleshoot team did a nice job of making all this consumable in cockpit 13:24:25 is packaging setroubleshootd an option? 13:24:28 from what I understand, the other paths to the same data rely a lot on system configuration 13:24:35 not sure, probably not 13:24:54 it'd require some effort and would probably feel wrong ideologically to some 13:24:56 :) 13:25:00 is there anything fundamental that prevents settroubleshootd from being in debian? 13:25:01 does it degenerate nicley? how does the selinux page look on debian? 13:25:23 most arguments I heard were that setroubleshootd is very fedora/rhel/centos specific 13:25:30 regarding selinux policies 13:25:41 andreasn, it won't be installed 13:26:08 ah, ok 13:26:22 mvollmer, it would probably make the most sense to separate viewing events from solving issues 13:26:30 but I see that outside of Cockpit's scope right now 13:26:37 yep 13:26:50 the mechanisms are all in place 13:27:00 so if anyone wants to add another data source, I'm happy to review pull requests 13:27:16 end of topic from my end 13:28:28 alright 13:28:41 #topic other stuff 13:28:53 FYI 13:29:05 your guide specifically says it covers this ("TCP Port and Address") but then doesn't mention exactly *how* for the address. It just skips it--ref: http://cockpit-project.org/guide/latest/listen.html 13:29:23 and 13:29:40 My console prompt says "Admin Console: https://MyPublicIP:9090 or https://MyPublicIPv4:9090" and I need to change it to 192.168.1.1 (because it's displaying the wrong nic detail/address) 13:30:12 SpaceInvaders, could you file an issue for this? 13:30:37 You want to change the listen address of the cockpit webserver, right? 13:31:12 Or do you want to change the console prompt? 13:31:16 I reported it here - https://github.com/cockpit-project/cockpit/commit/e97eec6c487636e00a0af53d26106e81ac8d070d 13:31:51 i think we are a little unclear on what text you are expecting to change 13:31:51 Docs are missing "LiveStream=address:port" and console display prompt (for logon) does not appear to update 13:32:04 could you include a screen shot 13:33:03 console display logon prompt? Where it says "Admin Console: https://yourip:9090 or https:yourIPv6:9090/ 13:33:09 and let me check on a screenshot 13:34:33 I want to briefly discuss the toggle button, once this topic is through 13:35:13 Yes. thank you! 13:35:17 SpaceInvaders, I added a comment: https://github.com/cockpit-project/cockpit/commit/e97eec6c487636e00a0af53d26106e81ac8d070d#commitcomment-17579201 13:35:27 hopefully that helps 13:35:45 but /etc/issue doesn't pay attention to the cockpit config at all, unfortunately. 13:36:04 it's only correct with the default config 13:36:07 That looks like it. Thanks, mvollmer 13:36:09 good point, though 13:36:18 I was wondering about exactly that 13:36:56 maybe the pragmatic thing would be to add documentation to tell people to also update /etc/issue 13:37:08 It was painfully obvious as the result of building firewall under Fedora when it kept showing the external LAN as the Admin Console interface 13:37:27 mvollmer, sounds reasonable 13:37:38 mvollmer can you also add the "LiveStream=address:port" format-info to the docs? 13:37:45 IMHO it's clearly missing 13:37:59 it says "Address" in the title but then never actually addresses "Address" 13:38:10 referring to: http://cockpit-project.org/guide/latest/listen.html 13:38:23 SpaceInvaders, a mergable pull request goes a long way to help us with this... :-) 13:38:49 I'm happy to help! What's a mergable pull request? :D 13:39:08 I see pull request on the site 13:39:13 well, let's say a pull request is enough. :-) 13:39:27 SpaceInvaders, yes 13:39:34 ah ok I'll fill out a pull request (and search 1st to see if there's a dup) 13:39:53 alright, dperpeet and the toggle button 13:40:04 topic done thank you very much!!!! 13:40:16 so, andreas posted on in his mockup, https://raw.githubusercontent.com/cockpit-project/cockpit-design/master/selinux-troubleshooting/selinux-v5.png 13:40:37 maybe it's just me, but I find such binary switches a bit confusing 13:40:45 because I never know which state is on, which is off 13:40:59 I saw a slightly different styling here: http://www.bootstrap-switch.org/ 13:41:15 basically only show the "current state" as text 13:41:49 I was wondering if this is something we should consider for cockpit / I should start discussing on patternfly 13:42:00 if I'm the only one, I won't care enough to change it :) 13:42:22 I think this makes it a bit clearer indeed 13:42:41 the ones in GNOME works like this too 13:42:59 I'm not sure if any other patternfly projects use on/off 13:42:59 with a toggle button, there is also the complication that the switching might fail 13:43:35 hm 13:43:36 i like what android does: it moves the knob into the "on" position (say) but it stays gray until the machine has actually been switched on 13:43:41 and then it goes blue or something 13:43:48 I just noticed 13:43:53 oh, it does exist in Patternfly https://www.patternfly.org/widgets/#bootstrap-switch 13:43:55 https://www.patternfly.org/widgets/#button-groups "Bootstrap Switch" 13:43:58 must have been added recently 13:44:06 andreasn, exactly 13:44:13 they made it nice now 13:44:26 well, I'm for adopting that soon :) 13:44:31 does this depend on a massive javascript library? 13:44:38 I certainly hope not 13:44:53 we can probably adapt it to work in a similar way if that is the case 13:45:04 I think the only difference is to hide the inactive state text 13:45:13 and the animation 13:45:24 but that should be simple with some css 13:45:25 sure, but we don't need that necessarily 13:45:31 I need to learn that anyway 13:45:43 at some point I feel 13:45:49 I think it would be better to think about the point marius raised 13:45:56 what if switching can block 13:46:12 or fail 13:46:17 should probably be disabled with a spinner 13:46:40 * larsu always thought switches are problematic for operations that might fail 13:46:42 if the switching fails, it feels natural that it goes back to it's original state and produce an error message 13:46:53 I agree with larsu on that one 13:47:02 if an action can fail, it might be better as a button 13:47:13 flipping a switch should be simple 13:47:31 why not a button "Always enforce Policy" / "Only log actions" ? 13:47:43 oh, in the actual selinux case? why a button? 13:47:49 as a button group? 13:48:03 I'd say just a button that changes text based on the current state 13:48:05 for selinux I like the toggle 13:48:05 i think the selinux button can not fail 13:48:08 and inline the info text 13:48:18 but we have on/off for network interfaces, for example 13:48:22 that seems horrible, larsu 13:48:24 there are some different variants for it https://raw.githubusercontent.com/cockpit-project/cockpit-design/master/selinux-troubleshooting/modes.png 13:48:30 dperpeet: why? 13:48:31 a magic button with an unknown number of "states" 13:48:40 the toggle is more discoverable 13:48:43 here are your options 13:48:44 but the nice thing about the On/Off state is that it can express a recommendation 13:48:46 err? Magic? 13:48:50 it has a label.. 13:48:52 and a little box to explain the options 13:49:00 andreasn: ah that's a good point 13:49:21 larsu, with the button, where would you put the current state? 13:49:45 andreasn, a button can do that, too: "turn off security", "remain secure" 13:50:12 dperpeet: there's a lot of space for something like "SELinux is only logging actions right now, not preventing them" and then a button "Enforce Policy" 13:50:24 no need for the info text 13:50:35 but yeah, not a designer, just 2 cents 13:50:45 but that still wouldn't tell me how many states there are 13:50:53 or if I can switch back afterwards 13:50:54 there's two?! 13:51:07 how would someone new know that, from just seeing the button? 13:51:08 the text and button change depending on the current state 13:51:18 yeah, but you have to try that to know 13:51:28 with the switch you know right away 13:51:35 and the toggle implies that you can go back 13:51:41 a button doesn't imply that 13:51:50 to be honest, I don't know how anyone could be confused by that 13:52:05 I could, when I was new to selinux 13:52:13 how would I know if I can turn it back on without a reboot? 13:52:17 I would like to try this implementation in action and see how people react to it, and then it should be easy to switch to another variant of it if it doesn't work out 13:52:29 yeah, we can offer both 13:52:31 see what people like 13:52:48 the book with the Duck on it is excellent for deciding on these kinds of things 13:52:49 it is a real action, so that speaks for a button 13:52:50 ya, we should just try it out 13:52:59 :) 13:53:18 ok, thanks for the feedback 13:53:21 sorry, it also has a name http://designinginterfaces.com/ 13:53:35 second book reference today, andreasn 13:53:37 "The duck book" 13:54:29 this is the one I borrowed today. It seems really, really fun http://www.formsthatwork.com/ 13:54:33 I wonder how the duck relates to designing interfaces :) 13:55:26 this one is pretty good 13:55:28 http://ecx.images-amazon.com/images/I/81lEFz6urvL.jpg 13:55:32 it's like it's their names 13:55:41 haha :) 13:55:58 awwww look up there, an awk in the tree! 13:56:45 oh my https://lh3.googleusercontent.com/-QwpC6MChyXc/Ts7DiPGd3ZI/AAAAAAAADzI/18R2L3AgCsgcnUf6wbTgEC6zxOtAfTQKgCCo/fake%2Bsocial.jpg 13:57:19 I think we've reached end of topic :) 13:57:28 yes 13:57:30 sorry 13:57:40 :) 13:58:04 okay! 13:58:07 thanks everyone! 13:58:10 #endmeeting