Thread: [Devil-Linux-discuss] How to switch on blacklisting in new udev?

Dears,

Anyone know, how to use blacklist with new udev?
Before was sufficient to append to file /etc/modprobe.d/modprobe.conf:

> root@VoIP:/etc/modprobe.d # cat /etc/modprobe.d/modprobe.conf|grep blacklist
> blacklist wct4xxp
> blacklist wcte12xp
> blacklist wct1xxp
> blacklist wcte11xp
> blacklist wctdm24xxp
> blacklist wcfxo
> blacklist wctdm
> blacklist wctc4xxp
> blacklist wcb4xxp

but with new udev it is not woorking. I tried with other filenames, i.e. 
blacklist.conf or dahdi.blacklist.conf but it is not working too. So drivers 
are loaded in improper sequence and the only solution is unload and load 
again. But this is not completely safe.

Probably udev should call /sbin/modprobe with option --use-blacklist but I 
can't find palce, where this should be configured. Maybe in 
/etc/udev/udev.conf but how?

Anyone know? I would like to avoid reading sources.

Best regards

-- 
Andrzej Odyniec

Andrzej,

the new udev doesn't use the module-init-tools anymore.
They have switch to kmod, which is a library.

Maybe the kmod sources have some information.

Heiko

Quoting Andrzej Odyniec <an...@ma...>:

> Dears,
>
> Anyone know, how to use blacklist with new udev?
> Before was sufficient to append to file /etc/modprobe.d/modprobe.conf:
>
>> root@VoIP:/etc/modprobe.d # cat /etc/modprobe.d/modprobe.conf|grep blacklist
>> blacklist wct4xxp
>> blacklist wcte12xp
>> blacklist wct1xxp
>> blacklist wcte11xp
>> blacklist wctdm24xxp
>> blacklist wcfxo
>> blacklist wctdm
>> blacklist wctc4xxp
>> blacklist wcb4xxp
>
> but with new udev it is not woorking. I tried with other filenames, i.e.
> blacklist.conf or dahdi.blacklist.conf but it is not working too. So drivers
> are loaded in improper sequence and the only solution is unload and load
> again. But this is not completely safe.
>
> Probably udev should call /sbin/modprobe with option --use-blacklist but I
> can't find palce, where this should be configured. Maybe in
> /etc/udev/udev.conf but how?
>
> Anyone know? I would like to avoid reading sources.
>
> Best regards
>
> --
> Andrzej Odyniec
>
>
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> Devil-linux-discuss mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-discuss

-- 

Regards
   Heiko Zuerker
   http://www.devil-linux.org

Heiko Zuerker wrote:
> the new udev doesn't use the module-init-tools anymore.
> They have switch to kmod, which is a library.
> 
> Maybe the kmod sources have some information.

Heiko,

I apologize for the delay - I was sick. Thanks for suggestions. Indeed, I read 
that from the version 171 of udev does not use the m-i-t but kmod library 
directly. But the preliminary analysis of the sources shows that blacklist is 
treated differently in m-i-t and in kmod, and that it is rather a political 
decision. It seems that for kmod dependencies are stronger than the blacklist. 
So the whole philosophy of loading dahdi drivers modules for Asterisk 
telephony cards out the window.

Since each telephony card typically provides a number of channels and these 
are numbered, it is not irrelevant, in what order we load the cards drivers. 
Therefore, the Asterisk developers recommend that all drivers should be on the 
modprobe blacklist and then loaded on demand by init.d script in the desired 
order. This worked with old udev and m-i-t correctly.

Meanwhile, the presence of telephony card is treated as a dependency and 
udev/kmod loads drivers regardless of their presence on a blacklist in 
/etc/modprobe.d/modprobe.conf. Loads them automatcally in the order of cards 
on the bus and not in the order desired because of the numbers of telephone 
channels. The behavior of udev/kmod is relatively young and not present in 
many distribution.

This is strange kmod blacklist policy, where the blacklist is not a blacklist, 
but the discussion shows that the kmod authors rather insist on his own.

Of course we can patch the kmod, but it has a little sense because it is the 
political behavior so patch would be branch from main line of development. We 
need wait for further decisions: whether Digium becomes independent on the 
order of loading drivers or kmod team will change the blacklisting policy. So 
now is the easiest way to get around the problem by modifying the script 
/etc/init.d/dahdi to mandatory unload all telephony cards drivers before 
loading they in desired order. And drivers would be loaded, unloaded and 
loaded again.

Best Regards

-- 
Andrzej Odyniec

On 28/03/2012 13:54, Andrzej Odyniec wrote:
> ... So now is the easiest way to get around the problem by modifying 
> the script /etc/init.d/dahdi to mandatory unload all telephony cards 
> drivers before loading they in desired order. And drivers would be 
> loaded, unloaded and loaded again.

Sorry to hear you were ill, now it's my turn (but I can still type...)

I guess this is your bespoke build of DL for asterisk because I don't 
see /etc/init.d/dahdi in my DL? How hard is it to add asterisk to the 
main release? Or is this outwith DL's remit?

Dominic

Hey,

Quoting Dominic Raferd <dl...@ed...>:
> On 28/03/2012 13:54, Andrzej Odyniec wrote:
>> ... So now is the easiest way to get around the problem by modifying
>> the script /etc/init.d/dahdi to mandatory unload all telephony cards
>> drivers before loading they in desired order. And drivers would be
>> loaded, unloaded and loaded again.
>
> Sorry to hear you were ill, now it's my turn (but I can still type...)
>
> I guess this is your bespoke build of DL for asterisk because I don't
> see /etc/init.d/dahdi in my DL? How hard is it to add asterisk to the
> main release? Or is this outwith DL's remit?

We can add anything to the build system, we may just not include it in  
the official build.
In order to add it, I would request that somebody would volunteer to  
own this piece. It is a little bit of work to keep the code and  
sources updated.

-- 

Regards
   Heiko Zuerker
   http://www.devil-linux.org

On 28/03/2012 17:06, Heiko Zuerker wrote:
> Hey,
>
> Quoting Dominic Raferd<dl...@ed...>:
>> On 28/03/2012 13:54, Andrzej Odyniec wrote:
>>> ... So now is the easiest way to get around the problem by modifying
>>> the script /etc/init.d/dahdi to mandatory unload all telephony cards
>>> drivers before loading they in desired order. And drivers would be
>>> loaded, unloaded and loaded again.
>> Sorry to hear you were ill, now it's my turn (but I can still type...)
>>
>> I guess this is your bespoke build of DL for asterisk because I don't
>> see /etc/init.d/dahdi in my DL? How hard is it to add asterisk to the
>> main release? Or is this outwith DL's remit?
> We can add anything to the build system, we may just not include it in
> the official build.
> In order to add it, I would request that somebody would volunteer to
> own this piece. It is a little bit of work to keep the code and
> sources updated.
>

I would volunteer but I think it would be beyond me. I have never built 
DL, just used the official builds...

Dominic Raferd wrote:
> I guess this is your bespoke build of DL for asterisk because I don't 
> see /etc/init.d/dahdi in my DL? How hard is it to add asterisk to the 
> main release? Or is this outwith DL's remit?
[...]
> I would volunteer but I think it would be beyond me. I have never built 
> DL, just used the official builds...

Dominic,

There is no problem to add. There is problem to maintain. Asterisk needs over 
40 additional packages. Official distribution should be tested, but as for now 
there is not many users interested with Asterisk on DL. So my private tests 
needs from one to two months after Heiko/Serge/Bruce work is finished. I'm 
running with Asterisk on DL because of security philosophy: for new versions 
there is small number of exploits. Additionally: R/O OS is not so vulnerable 
for attacks. But attackers trying to log into my Voip server i.e. using brute 
force dozens everyday. But this is not popular philosophy and there is many 
dedicated Asterisk distributions. So probably connecting Asterisk to main line 
of DL is premature, as for now.

But You can use Asterisk on DL in my way, compiling it from my scripts. And, 
if You prefer, it is possible to use my compilation. I can give You link to 
images on my servers. ISO image is 700MB long but squash image is only 500MB 
long. I have free g729 codecs included too, but this is not legal in US. Now 
I'm using on my production VoIP server Asterisk 1.8.8.1. On this machine (on 
PC platform) is working about 200 users generating about 500 calls everyday. 
And VoIP traffic is growing. Remember, please: Asterisk in not working under 
grsecurity hardened kernel.

You can be First Independent Tester ;-)

So...?

-- 
Andrzej Odyniec

On 28/03/2012 18:24, Andrzej Odyniec wrote:
> Dominic Raferd wrote:
>> I guess this is your bespoke build of DL for asterisk because I don't
>> see /etc/init.d/dahdi in my DL? How hard is it to add asterisk to the
>> main release? Or is this outwith DL's remit?
> [...]
>> I would volunteer but I think it would be beyond me. I have never built
>> DL, just used the official builds...
> Dominic,
>
> There is no problem to add. There is problem to maintain. Asterisk needs over
> 40 additional packages. Official distribution should be tested, but as for now
> there is not many users interested with Asterisk on DL. So my private tests
> needs from one to two months after Heiko/Serge/Bruce work is finished. I'm
> running with Asterisk on DL because of security philosophy: for new versions
> there is small number of exploits. Additionally: R/O OS is not so vulnerable
> for attacks. But attackers trying to log into my Voip server i.e. using brute
> force dozens everyday. But this is not popular philosophy and there is many
> dedicated Asterisk distributions. So probably connecting Asterisk to main line
> of DL is premature, as for now.

OK I understand

> But You can use Asterisk on DL in my way, compiling it from my scripts. And,
> if You prefer, it is possible to use my compilation. I can give You link to
> images on my servers. ISO image is 700MB long but squash image is only 500MB
> long. I have free g729 codecs included too, but this is not legal in US. Now
> I'm using on my production VoIP server Asterisk 1.8.8.1. On this machine (on
> PC platform) is working about 200 users generating about 500 calls everyday.
> And VoIP traffic is growing. Remember, please: Asterisk in not working under
> grsecurity hardened kernel.
>
> You can be First Independent Tester ;-)
>
> So...?

Thank you Andrzej - I am downloading your build now (and I am not in US)...

Dominic