Este trabalho apresenta um modelo de mecanismo para o controle de integridade de arquivos em sistemas operacionais, com a capacidade de bloquear o acesso à arquivos inválidos de forma a conter os danos causados por possíveis ataques. O modelo foi inicialmente formulado a partir do estudo detalhado do processo de controle de integridade, revelando diversos pontos críticos de segurança nele existentes, e da avaliação dos mecanismos atualmente implementados nos sistemas operacionais que oferecem, mesmo que indiretamente, algum tipo de garantia de integridade dos arquivos do sistema. Durante o seu desenvolvimento, a segurança do próprio modelo foi detalhadamente analisada de forma a enumerar os seus pontos críticos e possíveis soluções a serem empregadas, resultando na definição dos requisitos mínimos de segurança que devem ser encontrados nesse tipo de mecanismo. Em seguida, visando a validação do modelo especificado e decorrente disponibilização do mecanismo para uso prático e em estudos futuros, um protótipo foi implementado no sistema operacional GNU/Linux. Procurando confirmar a sua viabilidade, foram realizadas análises do impacto causado sobre o desempenho do sistema. Por fim, foi confirmada a importância e viabilidade do emprego do modelo apresentado como mecanismo adicional de segurança em sistemas operacionais. Além disso, foi colocado em evidência um campo de pesquisa ainda pouco explorado e portanto atrativo para a realização de novos estudos.

Este trabalho apresenta um modelo de mecanismo para o controle de integridade de arquivos em sistemas operacionais, com a capacidade de bloquear o acesso à arquivos inválidos de forma a conter os danos causados por possíveis ataques. O modelo foi inicialmente formulado a partir do estudo detalhado do processo de controle de integridade, revelando diversos pontos críticos de segurança nele existentes, e da avaliação dos mecanismos atualmente implementados nos sistemas operacionais que oferecem, mesmo que indiretamente, algum tipo de garantia de integridade dos arquivos do sistema. Durante o seu desenvolvimento, a segurança do próprio modelo foi detalhadamente analisada de forma a enumerar os seus pontos críticos e possíveis soluções a serem empregadas, resultando na definição dos requisitos mínimos de segurança que devem ser encontrados nesse tipo de mecanismo. Em seguida, visando a validação do modelo especificado e decorrente disponibilização do mecanismo para uso prático e em estudos futuros, um protótipo foi implementado no sistema operacional GNU/Linux. Procurando confirmar a sua viabilidade, foram realizadas análises do impacto causado sobre o desempenho do sistema. Por fim, foi confirmada a importância e viabilidade do emprego do modelo apresentado como mecanismo adicional de segurança em sistemas operacionais. Além disso, foi colocado em evidência um campo de pesquisa ainda pouco explorado e portanto atrativo para a realização de novos estudos.

The thesis is focused on use and implement High Availability cluster in the productive environment, where is needed to concentrate on business critical application. The main aim of this thesis is to create the environment for callback system, which consist from many software products, for example database, web, java and etc. A company has to consolidate every application in an flexible environment resistent to hardware failure, human error in order to be running 24/7.

This thesis is focused on collecting data from commercial geolocation databases and its analysis. The theoretical part discusses techniques of IP geolocation, briefly describes commercial geolocation databases and mechanisms for accessing their geolocation services. The practical part of this thesis involves implementation of scripts for collecting and modification data retrieved from commercial geolocation databases for further analysis. First script collects the data and store them in output files in specified format. Second script modifies gathered data to achieve better accuracy. Detailed analysis is performed afterwards. Analysis is performed at several levels. This includes country, region and city accuracy as well as accuracy on latitude and longitude parameters. Output of this analysis will be conclusive, and will also display accuracy of tested geolocation services. The aim of this thesis is to analyze currently available commercial geolocation services and to prove their accuracy. Used scripts are implemented in Python programming language in version 3 using modules urllib, re and json. Scripts are test on commodity hardware with Linux operating system.

Aus der Vision, Computertechnik für den schmalen Geldbeutel technisch interessierten Jugendlichen verfügbar zu machen entstand ein kreditkartengroßer Einplatinencomputer, der Raspberry Pi. Wir möchten den Raspi im Vortrag etwas näher vorstellen und in einer kleinen Demonstration Anregungen für eigene Projekte geben. Gespannt sind wir auch auf Projekte, welche die Zuhörer bereits mit dem Raspberry Pi umgesetzt haben.

Includes index. / Also issued online.

Linux is a growing operating system in embedded systems. Today, Linux is not only in heavy servers but also in cell phones, PDAs, cameras and other devices running on battery power. While current technology is more energy efficient, more and more technologies are implemented into a single unit resulting in an overall increase of power consumption. Low power consumption is an increasingly important feature of a system today. Lower power consumption means lower costs, less environmental impact, and longer life for applications that runs on batteries. This work compiles methods to reduce power consumption of Linux systems. The work includes examining whether the available opportunities are platform-specific or of a more general nature. The evaluations of methods for efficacy, has been performed on three different platforms. Testing consists of different types of stress tests and turning the units on-and-off. The results show that many of the features for power management that are available in a Linux system are of a general nature and that the Linux kernel has good support for implementation of new power management functions. Through the power reduction tests it has been proven that reducing the frequency of the processor and bit rate of the Ethernet controller provides the highest efficiency gain at different load levels. This work also investigates whether implementation of dynamic frequency scaling on a new processor is a complex task or not. Implementations in the Linux kernel provide general code that means that only the processor-specific part needs to be implemented. The implementation was carried out without major complications. / Linux är ett växande operativsystem inom inbyggda system som finner allt fler tillämpningar i elektroniska produkter. Idag finns Linux inte enbart i tunga servrar utan även i mobiltelefoner, handdatorer, kameror och andra enheter som går på batteridrift. Samtidigt som dagens teknik är allt mer energieffektiv så implementeras allt fler tekniker i en och samma enhet vilket medför en total ökning av effektförbrukning. En låg effektförbrukning är en allt mer betydande egenskap hos ett system idag. En lägre effektförbrukning innebär lägre kostnader, mindre miljöpåverkan, och längre drifttid för applikationer som drivs på batteri. Arbetet sammanställer metoder för att reducera effektförbrukningen hos system med Linux. Arbetet innefattar även att undersöka huruvida de möjligheter som finns är plattformsspecifika eller av generell karaktär. Vid utvärdering av metoders effektpåverkan har tester utförts på tre olika plattformar. Testerna består av på- och avslag av enheter samt olika typer utav belastningstester. Resultatet visar att många utav de energisparfunktioner som finns tillgängliga i Linuxsystem är av generell karaktär och att Linuxkärnan har bra stöd för vidare implementering av energisparfunktioner. Vid försöken till effektreducering har det visat sig att minskning av hastigheten på processor och ethernet-controller ger störst vinst vid olika belastningsgrader. Arbetetet undersöker även huruvida implementationen utav dynamisk frekvensskalning på en ny processor är en komplicerad process eller inte. Resultatet visar att implementationen av funktionen för en ny processor inte är allt för komplicerad. Detta mycket på grund av att Linuxkärnans infrastruktur är uppbyggd i lager där många utav dessa lager är av generell karaktär och kan återanvändas. Detta medför att endast den hårdvaruspecifika delen behöver implementeras.

Nous cherchons à améliorer l'état de l'art des implémentations de contrôle de flux d'information dans les systèmes Linux. Le contrôle de flux d'information vise à surveiller la façon dont l'information se dissémine dans le système une fois hors de son conteneur d'origine, contrairement au contrôle d'accès qui ne peut permettre d'appliquer des règles que sur la manière dont les conteneurs sont accédés. Plusieurs défis scientifiques et techniques se sont présentés. Premièrement, la base de code Linux est particulièrement grande, avec quinze millions de lignes de code réparties dans trente-mille fichiers. La première contribution de cette thèse a été un plugin pour le compilateur GCC permettant d'extraire et visualiser aisément les graphes de flot de contrôle des fonctions du noyau. Ensuite, le framework des Linux Security Modules qui est utilisé pour implémenter les moniteurs de flux d'information que nous avons étudiés (Laminar [1], KBlare [2] et Weir [3]) a été conçu en premier lieu pour le contrôle d'accès, et non de flux. La question se pose donc de savoir si le framework est implémenté de telle sorte à permettre la capture de tous les flux produits par les appels système. Nous avons créé et implémenté une analyse statique permettant de répondre à ce problème. Cette analyse statique est implémenté en tant que plugin GCC et nous a permis d'améliorer le framework LSM pour capturer tous les flux. Enfin, nous avons constaté que les moniteurs de flux actuels n'étaient pas résistants aux conditions de concurrence entre les flux et ne pouvaient pas traiter certains canaux ouverts tels que les projections de fichiers en mémoire et les segments de mémoire partagée entre processus. Nous avons implémenté Rfblare, un nouvel algorithme de suivi de flux, pour KBlare, dont nous avons prouvé la correction avec Coq. Nous avons ainsi montré que LSM pouvait être utilisé avec succès pour implémenter le contrôle de flux d'information, et que seules les méthodes formelles, permettant la mise en œuvre de méthodologie, d'analyses ou d'outils réutilisables, permettaient de s'attaquer à la complexité et aux rapides évolutions du noyau Linux. / We look forward to improving the implementations of information flow control mechanisms in Linux Operating Systems. Information Flow Control aims at monitoring how information disseminates in a system once it is out of its original container, unlike access control which can merely apply rule on how the containers are accessed. We met several scientific and technical challenges. First of all, the Linux codebase is big, over fifteen millions lines of code spread over thirty three thousand files. The first contribution of this thesis is a plugin for the GCC compiler able to extract and let a user easily visualize the control flow graphs of the Linux kernel functions. Secondly, the Linux Security Modules framework which is used to implement the information flow trackers we have reviewed (Laminar, KBlare, and Weir) was designed in the first place to implement access control, rather than information flow control. One issue is thus left open: is the framework implemented in such a way that all flows generated by system calls can be captured? We have created and implemented static analysis to address this problem and proved its correction with the Coq proof assistant system. This analysis is implemented as a GCC plugin and have allowed us to improve the LSM framework in order to capture all flows. Finally, we have noted that current information flow trackers are vulnerable to race conditions between flows and are unable to cover some overt channels of information such as files mapping to memory and shared memory segments between processes. We have implemented Rfblare, a new algorithm of flow tracking, for KBlare. The correction of this algorithm has been proved with Coq. We have showed that LSM can be used successfully to implement information flow control, and that only formal methods, leading to reusable methodology, analysis, tools, etc., are a match for the complexity and the fast-paced evolution of the Linux kernel.

Aus der Vision, Computertechnik für den schmalen Geldbeutel technisch interessierten Jugendlichen verfügbar zu machen entstand ein kreditkartengroßer Einplatinencomputer, der Raspberry Pi. Wir möchten den Raspi im Vortrag etwas näher vorstellen und in einer kleinen Demonstration Anregungen für eigene Projekte geben. Gespannt sind wir auch auf Projekte, welche die Zuhörer bereits mit dem Raspberry Pi umgesetzt haben.

International Telemetering Conference Proceedings / October 23-26, 2000 / Town & Country Hotel and Conference Center, San Diego, California / The Range Instrumentation and Control System (RICS) is the twenty-first century replacement for an aging time-space-position information (TSPI) distribution and collection system used by the 46th Test Wing at Eglin AFB, Florida. The purpose of the RICS is to collect TSPI and distribute it across a wide area network in real-time. It will utilize a multi-threaded C++ program on VxWorks (a real-time operating system by Wind River Systems) to acquire TSPI from a radar system. The acquired data will be multicast to several local area networks where the data will be recorded and displayed in real-time using a Java program on the Linux operating system. This paper describes the design process and design rationale for developing a distributed, real-time, heterogeneous system.