text:
From Linux-VServer
A soft partitioning concept based on Security Contexts which permits the creation of many independent Virtual Private Servers (VPS) that run simultaneously on a single physical server at full speed, efficiently sharing hardware resources.
A VPS provides an almost identical operating environment as a conventional Linux Server. All services, such as ssh, mail, Web and databases, can be started on such a VPS, without (or in special cases with only minimal) modification, just like on any real server.
Each virtual server has its own user account database and root password and is isolated from other virtual servers, except for the fact that they share the same hardware resources.
Over the years, computers have become sufficiently powerful to use virtualization to create the illusion of many smaller virtual machines, each running a separate operating system instance.
There are several kinds of Virtual Machines (VMs) which provide similar features, but differ in the degree of abstraction and the methods used for virtualization.
Most of them accomplish what they do by emulating some real or fictional hardware, which in turn requires real resources from the Host (the machine running the VMs). This approach, used by most System Emulators (like QEMU, Bochs, ...), allows the emulator to run an arbitrary Guest Operating System, even for a different Architecture (CPU and Hardware). No modifications need to be made to the Guest OS because it isn't aware of the fact that it isn't running on real hardware.
Some System Emulators require small modifications or specialized drivers to be added to Host or Guest to improve performance and minimize the overhead required for the hardware emulation. Although this significantly improves efficiency, there are still large amounts of resources being wasted in caches and mediation between Guest and Host (examples for this approach are UML and Xen).
But suppose you do not want to run many different Operating Systems simultaneously on a single box? Most applications running on a server do not require hardware access or kernel level code, and could easily share a machine with others, if they could be separated and secured...
The Concept
At a basic level, a Linux Server consists of three building blocks: Hardware, Kernel and Applications. The Hardware usually depends on the provider or system maintainer, and, while it has a big influence on the overall performance, it cannot be changed that easily, and will likely differ from one setup to another.
The main purpose of the Kernel is to build an abstraction layer on top of the hardware to allow processes (Applications) to work with and operate on resources (Data) without knowing the details of the underlying hardware. Ideally, those processes would be completely hardware agnostic, by being written in an interpreted language and therefore not requiring any hardware-specific knowledge.
Given that a system has enough resources to drive ten times the number of applications a single Linux server would usually require, why not put ten servers on that box, which will then share the available resources in an efficient manner?
Most server applications (e.g. httpd) will assume that it is the only application providing a particular service, and usually will also assume a certain filesystem layout and environment. This dictates that similar or identical services running on the same physical server, but for example, only differing in their addresses, have to be coordinated. This typically requires a great deal of administrative work which can lead to reduced system stability and security.
The basic concept of the Linux-VServer solution is to separate the user-space environment into distinct units (sometimes called Virtual Private Servers) in such a way that each VPS looks and feels like a real server to the processes contained within.
Although different Linux Distributions use (sometimes heavily) patched kernels to provide special support for unusual hardware or extra functionality, most Linux Distributions are not tied to a special kernel.
Linux-VServer uses this fact to allow several distributions, to be run simultaneously on a single, shared kernel, without direct access to the hardware, and share the resources in a very efficient way.
Existing Infrastructure
Recent Linux Kernels already provide many security features that are utilized by Linux-VServer to do its work. Especially features such as the Linux Capability System, Resource Limits, File Attributes and the Change Root Environment. The following sections will give a short overview about each of these.
Linux Capability System
In computer science, a capability is a token used by a process to prove that it is allowed to perform an operation on an object. The Linux Capability System is based on "POSIX Capabilities", a somewhat different concept, designed to split up the all powerful root privilege into a set of distinct privileges.
POSIX Capabilities
A process has three sets of bitmaps called the inheritable(I), permitted(P), and effective(E) capabilities. Each capability is implemented as a bit in each of these bitmaps that is either set or unset.
When a process tries to do a privileged operation, the operating system will check the appropriate bit in the effective set of the process (instead of checking whether the effective uid of the process is 0 as is normally done).
For example, when a process tries to set the clock, the Linux kernel will check that the process has the CAP_SYS_TIME bit (which is currently bit 25) set in its effective set.
The permitted set of the process indicates the capabilities the process can use. The process can have capabilities set in the permitted set that are not in the effective set.
This indicates that the process has temporarily disabled this capability. A process is allowed to set a bit in its effective set only if it is available in the permitted set. The distinction between effective and permitted exists so that processes can "bracket" operations that need privilege.
The inheritable capabilities are the capabilities of the current process that should be inherited by a program executed by the current process. The permitted set of a process is masked against the inheritable set during exec(). Nothing special happens during fork() or clone(). Child processes and threads are given an exact copy of the capabilities of the parent process.
The implementation in Linux stopped at this point, whereas POSIX Capabilities[U5] requires the addition of capability sets to files too, to replace the SUID flag (at least for executables). The pending Linux 2.6.24 kernel supports file POSIX capabilities. (See Serge Hallyn's git commit of Wed, 17 Oct 2007.) One userspace tool capable of changing file capabilities is the 2.X version of Andrew Morgan's libcap library and programs.
Capability Overview
The list of POSIX Capabilities used with Linux is long, and the 32 available bits are almost used up. While the detailed list of all capabilities can be found in /usr/include/linux/capability.h on most Linux systems, an overview of important capabilities is given here.
[0] CAP_CHOWN | change file ownership and group. |
[5] CAP_KILL | send a signal to a process with a different real or effective user ID |
[6] CAP_SETGID | permit setgid(2), setgroups(2), and forged gids on socket credentials passing |
[7] CAP_SETUID | permit set*uid(2), and forged uids on socket credentials passing |
[8] CAP_SETPCAP | transfer/remove any capability in permitted set to/from any pid |
[9] CAP_LINUX_IMMUTABLE | allow modification of S_IMMUTABLE and S_APPEND file attributes |
[11] CAP_NET_BROADCAST | permit broadcasting and listening to multicast |
[12] CAP_NET_ADMIN | permit interface configuration, IP firewall, masquerading, accounting, socket debugging, routing tables, bind to any address, enter promiscuous mode, multicasting, ... |
[13] CAP_NET_RAW | permit usage of RAW and PACKET sockets |
[16] CAP_SYS_MODULE | insert and remove kernel modules |
[18] CAP_SYS_CHROOT | permit chroot(2) |
[19] CAP_SYS_PTRACE | permit ptrace() of any process |
[21] CAP_SYS_ADMIN | this list would be too long, it basically allows to do everything else, not mentioned in another capability. |
[22] CAP_SYS_BOOT | permit reboot(2) |
[23] CAP_SYS_NICE | allow raising priority and setting priority on other processes, modify scheduling |
[24] CAP_SYS_RESOURCE | override resource limits, quota, reserved space on fs, ... |
[27] CAP_MKNOD | permit the privileged aspects of mknod(2) |
Resource Limits
Resources for each process can be limited by specifying a Resource Limit. Similar to the Linux Capabilities, there are two different limits, a Soft Limit and a Hard Limit.
The soft limit is the value that the kernel enforces for the corresponding resource. The hard limit acts as a ceiling for the soft limit: an unprivileged process may only set its soft limit to a value in the range from zero up to the hard limit, and (irreversibly) lower its hard limit. A privileged process may make arbitrary changes to either limit value, as long as the soft limit stays below the hard limit.
Limit-able Resource Overview
The list of all defined resource limits can be found in /usr/include/asm/resource.h on most Linux systems, an overview of relevant resource limits is given here.
[0] RLIMIT_CPU | CPU time in seconds. process is sent a SIGXCPU signal after reaching the soft limit, and SIGKILL on hard limit. |
[4] RLIMIT_CORE | maximum size of core files generated |
[5] RLIMIT_RSS | number of pages the process's resident set can consume (the number of virtual pages resident in RAM) |
[6] RLIMIT_NPROC | The maximum number of processes that can be created for the real user ID of the calling process. |
[7] RLIMIT_NOFILE | Specifies a value one greater than the maximum file descriptor number that can be opened by this process. |
[8] RLIMIT_MEMLOCK | The maximum number of virtual memory pages that may be locked into RAM using mlock() and mlockall(). |
[9] RLIMIT_AS | The maximum number of virtual memory pages available to the process (address space limit). \ |
File Attributes
Originally, this feature was only available with ext2, but now all major filesystems implement a basic set of File Attributes that permit certain properties to be changed. Here again is a short overview of the possible attributes, and what they mean.
Macro Name | Meaning | |
s | SECRM | When a file with this attribute set is deleted, its blocks are zeroed and written back to the disk. |
u | UNRM | When a file with this attribute set is deleted, its contents are saved. |
c | COMPR | Files marked with this attribute are automatically compressed on write and uncompressed on read. (not implemented yet) |
i | IMMUTABLE | A file with this attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this file and no data can be written to the file. |
a | APPEND | Files with this attribute set can only be opened in append mode for writing. |
d | NODUMP | If this flag is set, the file is not candidate for backup with the dump utility. |
S | SYNC | Updates to the file contents are done synchronously. |
A | NOATIME | Prevents updating the atime record on files when they are accessed or modified. |
t | NOTAIL | A file with the t attribute will not have a partial block fragment at the end of the file merged with other files. |
D | DIRSYNC | Changes to a directory having this attribute set will be done synchronously. |
The first column in the above table denotes command line options one might supply to lsattr respectively chattr. The below screedump gives a notion about what we are talking:
max@pc1:~$ cd /tmp/ max@pc1:/tmp$ touch my_file max@pc1:/tmp$ lsattr my_file ------------------ my_file max@pc1:/tmp$ chattr +a my_file chattr: Operation not permitted while setting flags on my_file max@pc1:/tmp$ su Password: pc1:/tmp# chattr +a my_file && lsattr my_file -----a------------ my_file pc1:/tmp# exit exit max@pc1:/tmp$
As you might have noticed, one needs to gain root permissions in the upper showcase (the underlying file system was ext3). For more information just issue man 1 chattr in your command line interface.
Information regarding file attributes can be found in the kernel source code. Every file system uses a subset of all known attributes (which are used depends on the file system).
One thing can be said for sure -- the file attributes listed in the kernel source code are defined -- those are not listed are not defined and in turn can not be used for a particular file system (e.g. ext3 (Extended File System version 3)). However, many of those file attributes defined and understood by the kernel have no effect. Most file systems define those flags in a specific (specific for a particular file system) header file found within the kernel source tree. They also define a so called User Modifiable Mask (those are the flags the user can change with the ioctls).
Those flags have partially different meaning depending on the node type (i.e. dir, inode, fifo, pipe, device) and it is not trivial to say if a filesystem makes use of any user modifiable flag -- things like immutable are easy to verify (from user space) but how to verify e.g. NOTAIL from user space? Usually only source code review will show if it is implemented and used.
For example, if that didn't change, the COMPR is defined, and well understood by ext2/3 but there is no implementation there, i.e. nothing is compressed.
The chroot(1) Command
chroot allows you to run a command with a different directory acting as the root directory. This means that all filesystem lookups are done with '/' referring to the substitute root directory and not to the original one.
While the Linux chroot implementation isn't very secure, it increases the isolation of processes with regards to the filesystem, and, if used properly, can create a filesystem "jail" for a single process or a restricted user, daemon or service.
Required Modifications
This chapter will describe the essential Kernel modifications to implement something like Linux-VServer.
Context Separation
The separation mentioned in the Concepts section requires some modifications to the kernel to allow for the notion of Contexts. The purpose of this "Context" is to hide all processes outside of its scope, and prohibit any unwanted interaction between a process inside the context and a process belonging to another context.
This separation requires the extension of some existing data structures in order for them to become aware of contexts and to differentiate between identical uids used in different virtual servers.
It also requires the definition of a default context that is used when the host system is booted, and to work around the issues resulting from some false assumptions made by some user-space tools (like pstree) that the init process has to exist and to be running under id '1'.
To simplify administration, the Host Context isn't treated any differently than any other context as far as process isolation is concerned. To allow for process overview, a special Spectator context has been defined to peek at all processes at once.
Network Separation
While the Context Separation is sufficient to isolate groups of processes, a different kind of separation, or rather a limitation, is required to confine processes to a subset of available network addresses.
Several issues have to be considered when doing so; for example, the fact that bindings to special addresses like IPADDR_ANY or the local host address have to be handled in a very special way.
Currently, Linux-VServer doesn't make use of virtual network devices (and maybe never will) to minimize the resulting overhead. Therefore socket binding and packet transmission have been adjusted.
The Chroot Barrier
One major problem of the chroot() system used in Linux lies within the fact that this information is volatile, and will be changed on the next chroot() Syscall.
One simple method to escape from a chroot-ed environment is as follows: First, create or open a file and retain the file-descriptor, then chroot into a subdirectory at equal or lower level with regards to the file. This causes the root to be moved down in the filesystem. Next, use fchdir() on the file-descriptor to escape from that new root. This will consequently escape from the old root as well, as this was lost in the last chroot() Syscall.
While early Linux-VServer versions tried to fix this by "funny" methods, recent versions use a special marking, known as the Chroot Barrier, on the parent directory of each VPS to prevent unauthorized modification and escape from confinement.
Upper Bound for Caps
Because the current Linux Capability system does not implement the filesystem related portions of POSIX Capabilities which would make setuid and setgid executables secure, and because it is much safer to have a secure upper bound for all processes within a context, an additional per-context capability mask has been added to limit all processes belonging to that context to this mask.
The meaning of the individual caps (bits) of the capability bound mask is exactly the same as with the permitted capability set.
Resource Isolation
Most resources are somewhat shared among the different contexts. Some require more additional isolation than others, either to avoid security issues or to allow for improved accounting.
Those resources are:
- shared memory, IPC
- user and process IDs
- file xid tagging
- Unix ptys
- sockets
Filesystem XID Tagging
Although it can be disabled completely, this modification is required for more robust filesystem level security and context isolation. It is also mandatory for Context Disk Limits and Per Context Quota Support on a shared partition.
The concept of adding a context id (xid) to each file to make the context ownership persistent sounds simple, but the actual implementation is non-trivial - mainly because adding this information either requires a change to the on disk representation of the filesystem or the application of some tricks.
One non-intrusive approach to avoid modification of the underlying filesystem is to use the upper bits of existing fields, like those for UID and GID to store the additional XID.
Once context information is available for each inode, it is a logical step to extend the access controls to check against context too. Currently all inode access restrictions have been extended to check for the context id, with special exceptions for the Host Context and the Spectator Context.
Untagged files belong to the Host Context and are silently treated as if they belong to the current context, which is required for Unification. If such a file is modified from inside a context, it silently migrates to the new one, changing its xid.
The following Tagging Methods are implemented:
UID32/GID32 or EXTERNAL | This format uses currently unused space within the disk inode to store the context information. As of now, this is only defined for ext2/ext3 but will be also defined for xfs, reiserfs, and jfs as soon as possible. Advantage: Full 32bit uid/gid values. |
UID32/GID16 | This format uses the upper half of the group id to store the context information. This is done transparently, except if the format is changed without prior file conversion. Advantage: works on all 32bit U/GID FSs. Drawback: GID is reduced to 16 bits. |
UID24/GID24 | This format uses the upper quarter of user and group id to store the context information, again transparently. This allows for about 16 million user and group ids, which should suffice for the majority of all applications. Advantage: works on all 32bit U/GID FSs. Drawback: UID and GID are reduced to 24 bits. |
Additional Modifications
In addition to the bare minimum, there are a number of modifications that are not mandatory, but have proven extremely useful over time.
Context Flags
It was very soon discovered that some features require a flag, a kind of switch to turn them on and off separately for each Linux-VServer, so a simple flag-word was added.
This flag-word supports quite a number of flags, a flag-word mask, which allows to tell what flags are available, and a special trigger mechanism, providing one-time flags, set on startup, that can only be cleared once, usually causing a special action or event.
Here is a list of planned and mostly implemented Context Flags, available in the development branch of Linux-VServer:
[0] VXF_INFO_LOCK | (legacy, obsoleted) |
[1] VXF_INFO_SCHED | schedule all processes in a context as if they where one. (legacy, obsoleted) |
[2] VXF_INFO_NPROC | limit the number of processes in a context to the initial NPROC value. (legacy, obsoleted) |
[3] VXF_INFO_PRIVATE | do not allow to join this context from outside. (legacy) |
[4] VXF_INFO_INIT | show the init process with pid '1' (legacy) |
[5] VXF_INFO_HIDE | (legacy, obsoleted) |
[6] VXF_INFO_ULIMIT | (legacy, obsoleted) |
[7] VXF_INFO_NSPACE | (legacy, obsoleted) |
[8] VXF_SCHED_HARD | activate the Hard CPU scheduling |
[9] VXF_SCHED_PRIO | use the context token bucket for calculating the process priorities |
[10] VXF_SCHED_PAUSE | put all processes in this context on the hold queue, not scheduling them any longer |
[16] VXF_VIRT_MEM | virtualize the memory information so that the VM and RSS limits are used for meminfo and friends |
[17] VXF_VIRT_UPTIME | virtualize the uptime, beginning with the time of context creation |
[24] VXF_HIDE_MOUNT | show empty proc/{pid}/mounts |
[25] VXF_HIDE_NETIF | hide network interfaces and addresses not permitted by the network context |
Context Capabilities
As the Linux Capabilities have almost reached the maximum number that is possible without heavy modifications to the kernel, it was a natural step to add a context-specific capability system.
The Linux-VServer context capability set acts as a mechanism to fine tune existing Linux capabilities. It is not visible to the processes within a context, as they would not know how to modify or verify it.
In general there are two ways to use those capabilities:
- Require one or a number of context capabilities to be set in addition to a given Linux capability, each one controlling a distinct part of the functionality.For example the CAP_NET_ADMIN could be split into RAW and PACKET sockets, so you could take away each of them separately by not providing the required context capability.
- Consider the context capability sufficient for a specified functionality, even if the Linux Capability says something different.For example mount() requires CAP_SYS_ADMIN which adds a dozen other things we do not want, so we define a CCAP_MOUNT to allow mounts for certain contexts.
The difference between the Context Flags and the Context Caps is more an abstract logical separation than a functional one, because they are handled very similarly.
Again, a list of the Context Capabilities and their purpose:
[0] VXC_SET_UTSNAME | allow the context to change the host and domain name with the appropriate kernel Syscall |
[1] VXC_SET_RLIMIT | allow the context to modify the resource limits (within the vserver limits). |
[8] VXC_RAW_ICMP | allow raw icmp packets in a secure way (this makes ping work from inside) |
[16] VXC_SECURE_MOUNT | permit secure mounts, which at the moment means that the nodev mount option is added. |
Context Accounting
Some properties of a context are useful to the admin, either for keeping an overview of the resources, to get a feeling for the capacity of the host, or for billing them in some way to a customer.
There are two different kinds of accountable properties, those having a current value which represents the state of the system (for example the speed of a vehicle), and those which monotonically increase over time (like the mileage).
Most of the state type of properties also qualify for applying some limits, so they are handled specially. this is described in more detail in the following section.
Good candidates for Context Accounting are:
- Amount of CPU Time spent
- Number of Forks done
- Socket Messages by Type
- Network Packets Transmitted and Received
Context Limits
Most properties related to system resources, might it be the memory consumption, the number of processes or file-handles, or the current network bandwidth, qualify for imposing limits on them.
To provide a general framework for all kinds of limits, Context Limits allow the configuration of three different values for each limit-able resource: the minimum, a soft limit and a hard limit (maximum).
At the time this is written, only the hard limits are supported and not all of them are actually enforced, but here is a list of current and planned Context Limits:
- process limits
- scheduler limits
- memory limits
- per-context disk limits
- per-context user/group quota
Additionally the context limit system keeps track of observed maxima and resource limit hits, to provide some feedback for the administrator.
One major difference between the Linux-VServer approach and Virtual Machines is that you do not have the virtualization part as a side-effect, so you have to do that by hand where it makes sense.
For example, a Virtual Machine does not need to think about uptime, because naturally the running OS was started somewhere in the past and will not have any problem to tell the time it thinks it began running.
A context can also store the time when it was created, but that will be different from the systems uptime, so in addition, there has to be some function, which adjusts the values passed from kernel to user-space depending on the context the process belongs to.
This is what for Linux-VServer is known as Virtualization (actually it's more faking some values passed to and from the kernel to make the processes think that they are on a different machine).
Currently modified for the purpose of Virtualization are:
- System Uptime
- Host and Domain Name
- Machine Type and Kernel Version
- Context Memory Availability
- Context Disk Space
Improved Security
Proc-FS Security provides a mechanism to protect dynamic entries in the proc filesystem from being seen in every context. The system consists of three flags for each Proc-FS entry: Admin, Watch and Hide.
The Hide flag enables or disables the entire feature, so any combination with the Hide flag cleared will mean total visibility. The Admin and Watch flags determine where the hidden entry remains visible; so for example if Admin and Hidden are set, the Host Context will be the only one able to see this specific entry.
Kernel Helper
For some purposes, it makes sense to have an user-space tool to act on behalf of the kernel, when a process inside a context requests something usually available on a real server, but naturally not available inside a context.
The best, and currently only example for this is the Reboot Helper, which handles the reboot() system call, invoked from inside a context on behalf of the Kernel. It is executed, in Host side user-space to take appropriate actions - either reboot or just shutdown (halt) the specified context.
While the helper is designed to be flexible and handle different things in a similar way there are no other users of this helper at the moment. It might be replaced by an event interface in near future.
Features and Bonus Material
Because one of the central objectives for Linux-VServer is to reduce the overall resource usage wherever possible, a truly great idea was born to share files between different contexts without interfering with the usual administrative tasks or reducing the level of security created by the isolation.
Files common to more than one context, which are not very likely going to change, like libraries or binaries, can be hard linked on a shared filesystem, thus reducing the amount of disk space, inode caches, and even memory mappings for shared libraries.
The only drawback is that without additional measures, a malicious context would be able to deliberately or accidentally destroy or modify such shared files, which in turn would harm the other contexts.
One step is to make the shared files immutable by using the Immutable File Attribute (and removing the Linux Capability required to modify this attribute). However an additional attribute is required to allow removal of such immutable shared files, to allow for updates of libraries or executables from inside a context.
Such hard linked, immutable but unlink-able files belonging to more than one context are called unified and the process of finding common files and preparing them in this way is called Unification.
The reason for doing this is reduced resource consumption, not simplified administration. While a typical Linux Server install will consume about 500MB of disk space, 10 unified servers will only need about 700MB and as a bonus use less memory for caching.
Private Namespaces
A recent addition to the Linux-VServer branch was the introduction of Private Namespaces. This uses the already existing Virtual Filesystem Layer of the Linux kernel to create a separate view of the filesystem for the processes belonging to a context.
The major advantage over the shared namespace used by default is that any modifications to the namespace layout (like mounts) do not affect other contexts, not even the Host Context.
Obviously the drawback of that approach is that entering such a Private Namespace isn't as trivial as changing the root directory, but with proper kernel support this will completely replace the chroot() in the future.
The Linux-VServer Proc-FS
A structured, dynamically generated subtree of the well-known Proc-FS - actually two of them - has been created to allow for inspecting the different values of Security and Network Contexts.
/proc/virtual .../info /proc/virtual/<pid> .../info .../status .../sched .../cvirt .../cacct .../limit
Token Bucket Extensions
While the basic idea of Linux-VServer is a peaceful coexistence of all contexts, sharing the common resources in a respectful way, it is sometimes useful to control the resource distribution for resource hungry processes.
The basic principle of a Token Bucket is not very new. It is given here as an example for the Hard CPU Limit. The same principle also applies to scheduler priorities, network bandwidth limitation and resource control in general.
The Hard CPU Limit uses this mechanism in the following way: consider a bucket of a certain size S which is filled with a specified amount of tokens R every interval T, until the bucket is "full" - excess tokens are spilled. At each timer tick, a running process consumes exactly one token from the bucket, unless the bucket is empty, in which case the process is put on a hold queue until the bucket has been refilled with a minimum M of tokens. The process is then rescheduled.
A major advantage of a Token Bucket is that a certain amount of tokens can be accumulated in times of quiescence, which later can be used to burst when resources are required.
Where a per-process Token Bucket would allow for a CPU resource limitation of a single process, a Context Token Bucket allows to control the CPU usage of all confined processes.
Another approach, which is also implemented, is to use the current fill level of the bucket to adjust the process priority, thus reducing the priority of processes belonging to excessive contexts.
Context Disk Limits
This Feature requires the use of XID Tagged Files, and allows for independent Disk Limits for different contexts on a shared partition. The number of inodes and blocks for each filesystem is accounted, if an XID-Hash was added for the Context-Filesystem combo.
Those values, including current usage, maximum and reserved space, will be shown for filesystem queries, creating the illusion that the shared filesystem has a different usage and size, for each context.
Per-Context Quota
Similar to the Context Disk Limits, Per-Context Quota uses separate quota hashes for different Contexts on a shared filesystem. This is not required to allow for Linux-VServer quota on separate partitions.
The VRoot Proxy Device
Quota operations (ioctls) require some access to the block device, which for security reasons is not available inside a VPS.
For some applications, for example the preparation of a honey-pot or an especially realistic imitation of a real server for educational purposes, it can make sense to make the context indistinguishable from a real server.
However, since other freely available alternatives like QEMU or UML are much better at this, and require much less effort, this is not a central issue in Linux-VServer development.
Linux-VServer Security
Now that we know what the Linux-VServer framework provides and how some features work, let's have a word on security, because you should not rely on the framework to be secure per definition. Instead, you should exactly know what you are doing.
Secure Capabilities
Currently the following Linux Capabilities are considered secure for VPS use. If others are added, it will probably open some security hole.
CAP_NET_RAW for example is not considered secure although it is often used to allow the broken ping command to work, although there are better alternatives like the userspace ping command poink[U7] or the VXC_RAW_ICMP Context Capability.
The Chroot Barrier
Ensuring that the Barrier flag is set on the parent directory of each VPS is vital if you do not want VPS root to escape from the confinement and walk your Host's root filesystem.
Secure Device Nodes
The /dev directory of a VPS should not contain more than the following devices and the one directory for the unix pts tree.
- c 1 7 full
- c 1 3 null
- c 5 2 ptmx
- c 1 8 random
- c 5 0 tty
- c 1 9 urandom
- c 1 5 zero
- d pts
Of course other device nodes like console, mem and kmem, even block and character devices can be added, but some expertise is required in order to ensure no security holes are opened.
Secure Proc-FS Entries
There has been no detailed evaluation of secure and unsecure entries in the proc filesystem, but there have been some incidents where unprotected (not protected via Linux Capabilities) writable proc entries caused mayhem.
For example, /proc/sysrq-trigger is something which should not be accessible inside a VPS without a very good reason.
Field of Application
The primary goal of this project is to create virtual servers sharing the same machine. A virtual server operates like a normal Linux server. It runs normal services such as telnet, mail servers, web servers, and SQL servers.
Administrative Separation
This allows a clever provider to sell something called Virtual Private Server, which uses less resources than other virtualization techniques, which in turn allows more units on a single machine.
The list of providers doing so is relatively long, and so this is rightfully considered the main area of application.
Service Separation
Separating different or similar services which otherwise would interfere with each other, either because they are poorly designed or because they are simply incapable of peaceful coexistence for whatever reason, can be easily done with Linux-VServer.
But even on the old-fashioned real server machines, putting some extremely exposed or untrusted, because unknown or proprietary, services into some kind of jail can improve maintainability and security a lot.
Enhancing Security
While it can be interesting to run several virtual servers in one box, there is one concept potentially more generally useful. Imagine a physical server running a single virtual server. The goal is isolate the main environment from any service, any network. You boot in the main environment, start very few services and then continue in the virtual server.
The service in the main environment would be:
- Unreachable from the network.
- Able to log messages from the virtual server in a secure way. The virtual server would be unable to change/erase the logs.\ Even a cracked virtual server would not be able the edit the log.
- Able to run intrusion detection facilities, potentially spying the state of the virtual server without being accessible or noticed.\ For example, tripwire could run there and it would be impossible to circumvent its operation or trick it.
Another option is to put the firewall in a virtual server, and pull in the DMZ, containing each service in a separate VPS. On proper configuration, this setup can reduce the number of required machines drastically, without impacting performance.
Easy Maintenance
One key feature of a virtual server is the independence from the actual hardware. Most hardware issues are irrelevant for a virtual server installation.
The main server acts as a host and takes care of all the details. The virtual server is just a client and ignores all the details. As such, the client can be moved to another physical server with very few manipulations.
For example, to move the virtual server from one physical computer to another, it is sufficient to do the following:
- shutdown the running server
- copy it over to the other machine
- copy the configuration
- start the virtual server on the new machine
No adjustments to user setup, password database or hardware configuration are required, as long as both machines are binary compatible.
Fail-over Scenarios
Pushing the limit a little further, replication technology could be used to keep an up-to-the-minute copy of the filesystem of a running Virtual Server. This would permit a very fast fail-over if the running server goes offline for whatever reason.
All the known methods to accomplish this, starting with network replication via rsync, or drbd, via network devices, or shared disk arrays, to distributed filesystems, can be utilized to reduce the down-time and improve overall efficiency.
For Testing
Consider a software tool or package which should be built for several versions of a specific distribution (Mandrake 8.2, 9.0, 9.1, 9.2, 10.0) or even for different distributions.
This is easily solved with Linux-VServer. Given plenty of disk space, the different distributions can be installed and running side by side, simplifying the task of switching from one to another.
Of course this can be accomplished by chroot() alone, but with Linux-VServer it's a much more realistic simulation.
Performance and Stability
(work in progress)
Impact of Linux-VServer on the Host
seems to be 0% ...
Overhead inside a Context
seems to be less than 2% ...
Size of the Kernel Patch
Comparison of the different patches ...
patch | hunks | + | - |
patch-2.4.24-vs1.00.diff | 178 | 1112 | 135 |
patch-2.4.24-vs1.20.diff | 216 | 2035 | 178 |
patch-2.4.24-vs1.26.diff | 225 | 2118 | 180 |
patch-2.4.25-vs1.27.diff | 252 | 2166 | 201 |
patch-2.4.26-vs1.28.diff | 254 | 2183 | 202 |
patch-2.6.6-vs1.9.0.diff | 494 | 5699 | 303 |
patch-2.6.6-vs1.9.1.diff | 497 | 5878 | 307 |
patch-2.6.7-vs1.9.2.diff | 618 | 6836 | 348 |
uml-patch-2.4.26-1.diff | 449 | 36885 | 48 |
Non Intel i386 Hardware
Linux-VServer was designed to be mostly architecture agnostic, therefore only a small part, the syscall definition itself, is architecture specific. Nevertheless some architectures have private copies of basically architecture independent code for whatever reason, and therefore small modifications are often required.
The following architectures are supported and some of them are even tested:
- alpha
- ia32 / ia64 / xbox
- x86_64 (AMD64)
- mips / mips64
- hppa / hppa64
- ppc / ppc64
- sparc / sparc64
- s390
- uml
Adding a new architecture is relatively simple although extensive testing is required to make sure that every feature is working as expected (and of course, the hardware ;).
Linux Kernel Intro
While almost all of the described features reside in the Linux Kernel, nifty Userspace Tools are required to activate and control the new functionality.
Those Userspace Tools in general communicate with the Linux Kernel via System Calls (or Syscall for short). This chapter will give a short overview how Linux Kernel and User Space is organized and how Syscalls, a simple method of communication between processes and kernel, work.
Kernel and User Space
In Linux and similar Operating Systems, User and Kernel Space is separated, and address space is divided into two parts. Kernel space is where the kernel code resides, and user space is where the user programs live. Of course, a given user program can't write to kernel memory or to another program's memory area.
Unfortunately, this is also the case for kernel code. Kernel code can't write to user space either. What does this mean? Well, when a given hardware driver wants to write data bytes to a program in user memory, it can't do it directly, but rather it must use specific kernel functions instead. Also, when parameters are passed by address to a kernel function, the kernel function can not read the parameters directly. It must use other kernel functions to read each byte of the parameters.
Of course, there are some helpers which do the transfer to and from user space.
copy_to_user(void *to, const void *from, long n); copy_from_user(void *to, const void *from, long n);
get_user() and put_user() Get or put the given byte, word, or long from or to user memory. This is a macro, and it relies on the type of the argument to determine the number of bytes to transfer.
Linux Syscalls
Most libc calls rely on system calls, which are the simplest kernel functions a user program can call.
These system calls are implemented in the kernel itself or in loadable kernel modules, which are little chunks of dynamically link-able kernel code.
Linux system calls are implemented through a multiplexor called with a given maskable interrupt. In Linux, this interrupt is int 0x80. When the 'int 0x80' instruction is executed, control is given to the kernel (or, more accurately, to the _system_call() function), and the actual demultiplexing process occurs.
How does _system_call() work ?
First, all registers are saved and the content of the %eax register is checked against the global system calls table, which enumerates all system calls and their addresses.
This table can be accessed with the extern void *sys_call_table[] variable. A given number and memory address in this table corresponds to each system call.
System call numbers can be found in /usr/include/sys/syscall.h.
They are of the form SYS_systemcallname. If the system call is not implemented, the corresponding cell in the sys_call_table is 0, and an error is returned.
Otherwise, the system call actually exists and the corresponding entry in the table is the memory address of the system call code.
Kernel Side Implementation
While this chapter is mainly of interest to kernel developers it might be fun to take a small peek behind the curtain to get a glimpse how everything really works.
The Syscall Command Switch
For a long time Linux-VServer used a few different Syscalls to accomplish different aspects of the work, but very soon the number of required commands grew large, and the Syscalls started to have magic values, selecting the desired behavior.
Not too long ago, a single syscall was reserved for Linux-VServer, and while the opinion on that might differ from developer to developer, it was generally considered a good decision not to have more than one syscall.
The advantage of different Syscalls would be simpler handling of the Syscalls on different architectures; however, this hasn't been a problem so far, as the data passed to and from the kernel has strong typed fields conforming to the C99 types.
Regardless, the availability of one system call required the creation of a multiplexor, which decides, based on some selector, what specific command is to be executed, and then passes on the remaining arguments to that command, which does the actual work.
extern asmlinkage long sys_vserver(uint32_t cmd, uint32_t id, void __user *data)
The Linux-VServer syscall is passed three arguments regardless of what actual command is specified: a command (cmd), a number (id), and a user-space data-structure of yet unknown size.
To allow for some structure for debugging purposes and some kind of command versioning, the cmd is split into three parts: the lower 12 bit contain a version number, then 4 bits are reserved, the upper 16 bits are divided into 8 bit command and 6 bit category, again reserving 2 bits for the future.
There are 64 Categories with up to 256 commands in each category, allowing for 4096 revisions of each command, which is far more than will ever be required.
Here is an overview of the categories already defined, and their numerical value:
Syscall Matrix V2.6 |VERSION|CREATE |MODIFY |MIGRATE|CONTROL|EXPERIM| |SPECIAL|SPECIAL| |STATS |DESTROY|ALTER |CHANGE |LIMIT |TEST | | | | |INFO |SETUP | |MOVE | | | | | | -------+-------+-------+-------+-------+-------+-------+ +-------+-------+ SYSTEM |VERSION|VSETUP |VHOST | | | | |DEVICES| | HOST | 00| 01| 02| 03| 04| 05| | 06| 07| -------+-------+-------+-------+-------+-------+-------+ +-------+-------+ CPU | |VPROC |PROCALT|PROCMIG|PROCTRL| | |SCHED. | | PROCESS| 08| 09| 10| 11| 12| 13| | 14| 15| -------+-------+-------+-------+-------+-------+-------+ +-------+-------+ MEMORY | | | | | | | |SWAP | | | 16| 17| 18| 19| 20| 21| | 22| 23| -------+-------+-------+-------+-------+-------+-------+ +-------+-------+ NETWORK| |VNET |NETALT |NETMIG |NETCTL | | |SERIAL | | | 24| 25| 26| 27| 28| 29| | 30| 31| -------+-------+-------+-------+-------+-------+-------+ +-------+-------+ DISK | | | | | | | |INODE | | VFS | 32| 33| 34| 35| 36| 37| | 38| 39| -------+-------+-------+-------+-------+-------+-------+ +-------+-------+ OTHER | | | | | | | |VINFO | | | 40| 41| 42| 43| 44| 45| | 46| 47| =======+=======+=======+=======+=======+=======+=======+ +=======+=======+ SPECIAL| | | | |FLAGS | | | | | | 48| 49| 50| 51| 52| 53| | 54| 55| -------+-------+-------+-------+-------+-------+-------+ +-------+-------+ SPECIAL| | | | |RLIMIT |SYSCALL| | |COMPAT | | 56| 57| 58| 59| 60|TEST 61| | 62| 63| -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
The definition of those Commands is simplified by some macros, so for example the commands to get and set the Context Flags are defined like this:
#define VCMD_get_cflags VC_CMD(FLAGS, 1, 0) #define VCMD_set_cflags VC_CMD(FLAGS, 2, 0) extern int vc_get_cflags(uint32_t, void __user *); extern int vc_set_cflags(uint32_t, void __user *);
Note that the command itself is not passed to the actual command implementation, only the id and the pointer to user-space data.
Utilized Data Structures
There are many different data structures used by different parts of the implementation; while only a few examples are given here, all utilized structures can be found in the source.
The Context Data Structure
The Context Data Structure consists of a few fields required to manage the contexts, and handle context destruction, as well as future hierarchical contexts.
Logically separated sections of that structure, like for the scheduler or the context limits are defined in separate structures, and incorporated into the main one.
struct vx_info { struct list_head vx_list; /* linked list of contexts */ xid_t vx_id; /* context id */ atomic_t vx_refcount; /* refcount */ struct vx_info *vx_parent; /* parent context */ struct namespace *vx_namespace; /* private namespace */ struct fs_struct *vx_fs; /* private namespace fs */ uint64_t vx_flags; /* context flags */ uint64_t vx_bcaps; /* bounding caps (system) */ uint64_t vx_ccaps; /* context caps (vserver) */ pid_t vx_initpid; /* PID of fake init process */ struct _vx_limit limit; /* vserver limits */ struct _vx_sched sched; /* vserver scheduler */ struct _vx_cvirt cvirt; /* virtual/bias stuff */ struct _vx_cacct cacct; /* context accounting */ char vx_name[65]; /* vserver name */ };
Here as example the Scheduler Substructure:
struct _vx_sched { spinlock_t tokens_lock; /* lock for this structure */ int fill_rate; /* Fill rate: add X tokens ... */ int interval; /* Divisor: ... each Y jiffies */ atomic_t tokens; /* current number of tokens */ int tokens_min; /* Limit: minimum for unhold */ int tokens_max; /* Limit: no more than N tokens */ uint32_t jiffies; /* bias: integral multiple of Y */ uint64_t ticks; /* token tick events */ cpumask_t cpus_allowed; /* cpu mask for context */ };
The main idea behind this separation is that each substructure belongs to a logically distinct part of the implementation which provides an init and cleanup function for this structure, thus simplifying maintainability and readability of those structures.
The Scheduler Command Data
As an example for the data structure used to control a specific part of the context from user-space, here is a scheduler command and the utilized data structure to set the properties:
#define VCMD_set_sched VC_CMD(SCHED, 1, 2) struct vcmd_set_sched_v2 { int32_t fill_rate; /* Fill rate: add X tokens ... */ int32_t interval; /* Divisor: ... each Y jiffies */ int32_t tokens; /* current number of tokens */ int32_t tokens_min; /* Limit: minimum for unhold */ int32_t tokens_max; /* Limit: no more than N tokens */ uint64_t cpu_mask; /* Mask: allowed cpus */ };
Example Accounting: Sockets
Basically all the accounting and limit stuff are defined as macros or inline functions capable of handling the different resources, hiding the underlying implementation wherever possible.
#define vx_acc_sock(v,f,p,s) \ __vx_acc_sock((v), (f), (p), (s), __FILE__, __LINE__) static inline void __vx_acc_sock(struct vx_info *vxi, int family, int pos, int size, char *file, int line) { if (vxi) { int type = vx_sock_type(family); atomic_inc(&vxi->cacct.sock[type][pos].count); atomic_add(size, &vxi->cacct.sock[type][pos].total); } } #define vx_sock_recv(sk,s) \ vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 0, (s)) #define vx_sock_send(sk,s) \ vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 1, (s)) #define vx_sock_fail(sk,s) \ vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 2, (s))
And this general definition is then used where appropriate, for example in the __sock_sendmsg() function like this:
len = sock->ops->sendmsg(iocb, sock, msg, size); if (sock->sk) { if (len == size) vx_sock_send(sock->sk, size); else vx_sock_fail(sock->sk, size); }
Example Limits: Virtual Memory
#define vx_pages_avail(m, p, r) \ __vx_pages_avail((m)->mm_vx_info, (r), (p), __FILE__, __LINE__) static inline int __vx_pages_avail(struct vx_info *vxi, int res, int pages, char *file, int line) { if (!vxi) return 1; if (vxi->limit.rlim[res] == RLIM_INFINITY) return 1; if (atomic_read(&vxi->limit.res[res]) + pages < vxi->limit.rlim[res]) return 1; return 0; } #define vx_vmpages_avail(m,p) vx_pages_avail(m, p, RLIMIT_AS) #define vx_vmlocked_avail(m,p) vx_pages_avail(m, p, RLIMIT_MEMLOCK) #define vx_rsspages_avail(m,p) vx_pages_avail(m, p, RLIMIT_RSS)
And again the test against those limits at certain places, for example here in copy_process()
/* check vserver memory */ if (p->mm && !(clone_flags & CLONE_VM)) { if (vx_vmpages_avail(p->mm, p->mm->total_vm)) vx_pages_add(p->mm->mm_vx_info, RLIMIT_AS, p->mm->total_vm); else goto bad_fork_free; }
Example Virtualization: Uptime
void vx_vsi_uptime(struct timespec *uptime) { struct vx_info *vxi = current->vx_info; set_normalized_timespec(uptime, uptime->tv_sec - vxi->cvirt.bias_tp.tv_sec, uptime->tv_nsec - vxi->cvirt.bias_tp.tv_nsec); return; } if (vx_flags(VXF_VIRT_UPTIME, 0)) vx_vsi_uptime(&uptime, &idle);
Future Directions
(work in progress)


text:
Now, here's a NYT article the observation that the White House has a boy's club atmosphere:
Does the White House feel like a frat house?
The suspicion flared in recent weeks — and not for the first time — after President Obama was criticized by women's advocates and liberal bloggers for hosting a high-level basketball game with no female players.
The president, after all, is an unabashed First Guy's Guy....
He presides over a White House rife with fist-bumping young men who call each other "dude" and testosterone-brimming personalities like Rahm Emanuel, the often-profane chief of staff; Lawrence Summers, the brash economic adviser; and Robert Gibbs, the press secretary, who habitually speaks in sports metaphors....Wow. Incredible. If there is any serious feminism left in this country — by which I mean the kind of feminism we had back before the Clinton presidency — it would ream a man who sought credit for inclusiveness toward women by referring to the fact that he had a wife and daughters in his household.
Mr. Obama, in an interview with NBC on Wednesday, called the beef over basketball "bunk"... "I don't think it sends any kind of message or signal whatsoever," said the president, who often points out that he is surrounded by strong females at home (where he is the only non-canine male).
[Senior adviser Valerie] Jarrett similarly rejected the notion that the West Wing had been overrun by Y chromosomes, saying such complaints were "a Washington perception that has nothing to do with the reality on the ground."The evidence?
She cites the prominent women Mr. Obama has appointed to top positions, including Secretary of State Hillary Rodham Clinton...Where has she been?
... and six other cabinet-level officials; Supreme Court Justice Sonia Sotomayor...She's over there in chambers, and nowhere near the Prez.
... the health care czar, Nancy-Ann DeParle...Why don't we say "czarina"? We've got these new positions and the title you get is male-specific. It's as if were were calling the Secretary of State "Mr. Secretary."
... and the domestic policy adviser, Melody Barnes. According to figures provided by the administration, there is a 50-50 gender split among White House employees.Which makes it all the more striking that the atmosphere reads as so male:
[S]ome high-profile sectors of the White House — economics and national security, for instance — are filled with men and exude an unmistakable male vibe. Mr. Obama's inner circle includes Mr. Gibbs, Mr. Emanuel and his senior adviser, David Axelrod ("The Boys," as they are known to some female staff members).Did they share the recipes?
Women in important White House jobs tend to be less visible than their colleagues, even as the administration is trying to elevate their profiles. (In the same week as the basketball game, Anita Dunn, the White House communications director, hosted a group of women reporters for an off-the-record meeting with Ms. Jarrett over chocolate chip and oatmeal cookies.)
There is so much reason to try to create the impression that women are important that the truth of the exclusion of women must be even worse than it appears.
One Democratic media strategist says that while Mr. Obama does place women in important roles, his comfort level with staff members is not always perceived as equal.This is exactly the problem feminists used to focus on.
"There is a sense that Obama has a certain jocular familiarity with the men that he doesn't have with the women," said Tracy Sefl, an adviser to Mrs. Clinton's presidential campaign who speaks regularly to some female aides in the administration.
Good for Sefl, going public like that and getting named. I would love to eavesdrop on conversations between Sefl and Hillary.
In interviews, five women who work in the White House or advised officials there described the culture with more of a collective eye-roll than any real sense of grievance or discomfort.Well, what the hell happened to real sense? When did feminism lose its critical edge? (Answer: During the Clinton administration.)
One junior aide, who like the other women spoke on the condition of anonymity because of concerns about appearing publicly critical, said that the "sports-fan thing at the White House" could become "annoying" and that her relative indifference to athletics could be mildly alienating.Annoying... mildly alienating.... The spirit of feminism is so diminished these days that women think of their own observations as insignificant and scarcely worth making any fuss about. Compare this to the times of vivid, vital feminism that followed a methodology of elevating and intensifying the importance of these seemingly small observations. Once there was conscience raising. The new methodology of dying feminism deserves to be called consciousness lowering.
And while this is not uncommon in any workplace, sports bonding can afford a point of entree with the boss.Oh, good lord. That this needs to be pointed out again — modestly suggested — shows how far we have sunk. There was once biting criticism of the sexism inherent in workplace sports bonding.
Ben Finkenbinder, a junior press aide and scratch golfer, was recently invited into a foursome with Mr. Obama. (In records kept by Mark Knoller of CBS, the president has played 23 rounds of golf since taking office, none of which have included women, though Mr. Knoller allows that the press office does not always release the names of every player. A White House spokesman, Bill Burton, said Friday that Mr. Obama planned to play this weekend with Ms. Barnes.)Ha. This NYT — NYT — article was already in the works when the White House scrambled to produce a female golfer.
[Some] women in the administration say that any discussion of White House culture should account for how politics has long been dominated by men but is now more inclusive. Ms. Dunn... rejects the notion of a boys' club. She calls the Obama administration "refreshingly un-self-conscious" about matters of equality, maybe to a point where they neglected the "optics" of the all-male basketball game.Oh?! So maybe it's a little like the post-racial America we were supposed to get — but didn't get — after Obama was elected. It's the post-gender America. No one needs to notice who's male and who's female anymore. So the inner circle is all male? You're not supposed to even see it!
Ms. Dunn said that she recently hosted a baby shower for an administration official and that no men from the office were invited. She is comfortable with that — just as she is fine with never playing basketball with the president.Consciousness lowering — it's so refreshing.
"That is just part of the culture here that I am excluded from," she said. "And I don't care."
Now, if everyone would please dial down all the criticism and let Obama get on with his un-self-conscious guy's guy agenda, it will all work out just fine.
Don't worry your pretty little head.

subset: commoncrawl


text:
Pegeen's StoryI was born in New York City and raised in New Jersey--sort of. Although my parents grew up in NYC, my father was adamant about raising his children in a house with a yard and a pool. My mother went along with the fantasy, but for her the reality was a different story. A loquacious New Yorker who didn't drive, she was stuck in the middle of nowhere with two children under the age of five. She quickly hated the suburbs and came up with a compromise. Every other morning she packed up my sister and me, and we joined the ranks of commuters climbing aboard the bus for a forty-five minute ride to the city and our busy day of socializing with family and friends. My father had the illusion his family was enjoying a country life, and my mother was happier when my father came home. It worked beautifully, until my father noticed the expense and insisted it stop. But my mother was as stubborn as she was clever and set into motion a new creative plan that I marvel at to this day. She would scan the New York Post's obituaries each morning, pick a deceased person and fabricate a fictitious friendship. Paying her final respects to a friend was a duty--not an option. As a good Irish Catholic woman, she had to help the family through this difficult time. There were times people she knew were dropping dead like crazy!My family ignited the creative spark in me. My mother and her family laid the foundation for the appreciation of a good story. Every week, relatives and other colorful characters gathered at my grandparents' apartment, laughing, singing and story telling. My father's two sisters were both painters and showered me with art books and color by number painting sets as birthday and Christmas gifts. In addition, my parents built a playroom in the garage and filled it with toys and art supplies. Although I shared it with my sister Nancy and, then three more siblings, I considered this my art studio, my sanctuary. When we were not in the city, I would spend hours creating: making drawings and paintings, once making a very convincing removable papier-mâché cast for a pretend broken arm, followed by a disastrous Plaster of Paris leg cast that began cutting off the circulation. No, Dad was not enthusiastic about art that day! Expletives were flying as he tried getting that cast off my leg. At first, my family did not understand my decision to attend Kean University in Union, New Jersey for a Bachelor of Arts degree in Theatre Arts, but it made perfect sense. Theatre married art and drama within a strong social structure that I found very fulfilling. I worked for 15 years as a lighting designer, stagehand and occasionally, an actor. However, if you are not willing to live an itinerant life-style, you are limiting your options and success. Eventually, I chose to settle down in a city. Seattle was my choice and where I began exploring the fine arts again. What it boils down to is-- I like creating around a story. I paint stories, and every one is an adventure as thrilling to me as theatre. Thank you for visiting and I hope you enjoy my work. Also, visit my website at www.pegeenshean.com and http://pegeen.imagekind.com
This shop is powered by CafePress Inc. Copyright © 1999- CafePress.com. All rights reserved. Privacy Policy | Non-US currency rates are updated daily and may fluctuate.


text:
- Habakkuk
- A prophet in Judah in the final years of the 7th cent. BCE about whom little is known. He was probably a contemporary of Jeremiah during the reign of Jehoiakim, son of Josiah, and was concerned with the duties of public worship. The OT book which bears his name clearly divides into two sections: the first two chapters (written about 625 BCE) announce the impending onslaught of the irresistible Babylonians ('Chaldeans') who will punish Jehoiakim for his evil tyranny, but in that process some of the less wicked will suffer more. Why should this be? It is the problem of theodicy that perplexed some of the Wisdom [[➝ wisdom]] writers—e.g. Job and Ecclesiastes. The answer given (Hab. 2:4) is that 'the upright will live through faithfulness' (NJB): he will live in the highest sense of the word (or, perhaps, simply he will be preserved during the invasion) by maintaining his faithfulness (to God). This verse is cited by Paul in Rom. 1:17 and Gal. 3:11 from the LXX as a scriptural proof for his teaching that a believer is made righteous with God in virtue of his 'faith'.The third chapter ('one of the noblest in the entire OT') consists of liturgical prayer and thanksgiving [[➝ thanksgiving sacrifice]]. Come what may (Hab. 3:17) the prophet refuses to be anything except joyful in the God of his salvation (Hab. 3:18–19).One of the earliest of the Dead Sea scrolls to be discovered (1947–8) turned out to be a commentary on Hab. 1 and 2, and in the accepted code it is known by the symbol IQpH.
Dictionary of the Bible.


text:
Earn money as an Airbnb host
Earn money as an Airbnb host
Why host on Airbnb?
No matter what kind of home or room you have to share, Airbnb makes it simple and secure to host travellers. You're in full control of your availability, prices, house rules, and how you interact with guests.
We have your back
To keep you, your home, and your belongings safe, we cover every booking with $1M USD in property damage protection and another $1M USD in insurance against accidents.
Hosting in 3 steps
List your space for free
Share any space without sign-up charges, from a shared living room to a second home and everything in between.
Decide how you want to host
Choose your own schedule, prices, and requirements for guests. We're there to help along the way.
Welcome your first guest
Once your listing is live, qualified guests can reach out. You can message them with any questions before their stay.
Dennis hosts in London for the flexibility it provides
Dennis hosts in London for the flexibility it provides
We've got you covered
We know it's a priority to trust the people staying in your home. Airbnb allows you to set strict requirements for who can book and to get to know guests before their stay. If something does come up, though, we have your back. With our Host Guarantee covering property damage and our Host Protection Insurance for liability, you're supported as a host throughout.
Payments made simple
Charge what you want
You always get to pick your price. Need help? We have tools to help you match demand in your area.
Pay low fees
There's no cost to sign up. Airbnb generally charges hosts a flat 3% per reservation, among the lowest fees in the industry.
Get paid quickly
Once a guest checks in, we can send your money by Paypal, direct deposit or other available methods.
Tessa hosts in London to earn extra money
Tessa hosts in London to earn extra money
About Airbnb
What is Airbnb?
Airbnb connects people with places to stay and things to do around the world. The community is powered by hosts, who provide their guests with the unique opportunity to travel like a local.
What is hosting?
If you have an extra room, entire home, or expertise, you can earn money by sharing it with anyone in the world. You can host your home, activity, or do both. When you host is up to you.
Frequently asked questions
It's easy to become an Airbnb host in most areas, and it's always free to create a listing. Entire apartments and homes, private rooms, treehouses, and castles are just a few of the properties hosts have shared on Airbnb.
For more details on what's expected of hosts, check out Airbnb's community standards, which revolve around safety, security, and reliability, and hospitality standards, which help hosts earn great guest reviews.
We ask everyone who uses Airbnb for a few pieces of information before they travel with us. Guests need to have this info completely filled out before they can make a reservation request. This info helps make sure you know who to expect, and how to contact the guest.
Airbnb's requirements for guests include: • Full name • Email address • Confirmed phone number • Introductory message • Agreement to your House Rules • Payment information
Guests are expected, but not required, to have a profile picture. You may also require guests to provide ID before booking your space.
Signing up for Airbnb and listing your home is completely free.
Once you receive a reservation, we charge an Airbnb service fee for hosts, generally 3%, to help cover the cost of running of the business.
The Airbnb Host Guarantee provides protection for up to US $1,000,000 to a host for damages to covered property in the rare event of guest damages above the security deposit or if no security deposit is in place.
The Host Guarantee programme doesn't cover cash and securities, collectables, rare artwork, jewellery, pets or personal liability. We recommend that hosts secure or remove valuables when renting their place. The programme also doesn't cover loss or damage to property due to wear and tear.
Learn more about the Host Guarantee at http://airbnb.com/guarantee
The price you charge for your listing is completely up to you. To help you decide, you can search for comparable listings in your city or neighbourhood to get an idea of market prices. Additional Fees > - Cleaning fee: You can either incorporate a cleaning fee into your nightly price or you can add a cleaning fee in your pricing settings. > - Other fees: To charge extra fees outside of your rates (like a late check-in or pet fee), you must first disclose these potential charges to guests prior to booking and then use our Resolution Centre to securely request payment for additional fees.
Airbnb's Smart Pricing tool lets you set your prices to automatically go up or down based on changes in demand for listings like yours.
You're always responsible for your price, so Smart Pricing is controlled by other pricing settings you choose, and you can adjust nightly prices any time.
Smart Pricing is based on the type and location of your listing, the season, demand, and other factors (like events in your area).


text:
- Music
- 15 Sep 04
Following the huge commercial success of Set List and 'Fake', The Frames look poised to ascend to rock's premier league with the upcoming worldwide release of the Burn The Maps album. Kim Porcelli joins the band on the day of their triumphant show at Marlay Park to discuss the pros and cons of pop-stardom, the departure of dave odlum, the abiding influence of mic christopher, and the challenge of creating their most eagerly anticipated record yet.
Saturday night, Marlay Park, Dublin. We're about a third of the way through what will go down on record as one of the parties of 2004: the Frames' largest-ever headline appearance, topping a bill that includes Supergrass, Idlewild, Bell X-1 and Halite, in front of nearly 18,000 people.
Just as the band smash euphorically into the chorus of 'God Bless Mom', the Frames' muslin-white Set List backdrop falls on cue; behind it is another, representing their upcoming album Burn The Maps – it's a stark, Basquiat-esque black-and-white image, much more darkly commanding than its predecessor, and as it is illuminated by rich peacock blues and searing white-golds, it's arrestingly beautiful: an artificial sunset in lieu of the one that hasn't happened yet, glowing electrically in the azure still-brightness of this summer night, as the crowd swoons and screams.
There's something perfect about the symbolism of this moment, of The Frames careering through a several-album-old (albeit still daisy-fresh, mind you) fuzzbox-and-jubilation-propelled pop song in front of a spanking-new, high-art backdrop: it's a snapshot not only of a band on the cusp of a new album and a new era, but a band who are very much in the process of having a play with the boundaries of what kind of band they can be.
The Frames in 2004 are so many seemingly contradictory things at once: critically lauded, yet popularly adored; handmade in their aesthetic, yet rich with electronic noise; independent, yet internationally hooked up (as of January 2005, Burn The Maps will become the first-ever Frames album to receive a proper worldwide release). As well, they're famously entertaining; but are also defiantly, unequivocally, about pop music as art.
Last but not least, on the one hand they are kin to off-centre mavericks like Sparklehorse, Dirty Three, Low, Pixies and Sonic Youth, but on the other – in light of the increasingly large stages they occupy, and in view of their darkly beautiful fifth album Burn The Maps, they appear to be currently exploring their potential to take those elements and test their massive emotional reach on a much larger scale.
Meanwhile, just to mix it up slightly more, in September of last year they made their biggest mark on the Irish singles charts since the release of 'Revelate' in 1996 with 'Fake': a clever, sweet, suckerpunching, unashamedly pop, er, pop single of such concise purpose a besneakered Cole Porter could have written it. And as of yesterday, they followed it with its complete opposite: 'Finally', a dark, self-lacerating, hope-against-hope, heartbursting gallop of a thing that, by all appearances, seems to be at least in part about the bittersweetness of, I guess, being in an independent, very successful, very beautiful, very schizophrenic Irish band you may have heard of.
Being The Frames is getting pleasantly complicated these days.
Flashback. Saturday night, Marlay Park. About 8pm. The Frames will be onstage within a half hour. A teenage boy, noticing our notebook, approaches us; he has a Framesian white fabric skull mask – as worn by Glen Hansard when performing 'Lay Me Down' from their last studio album, 2001's exquisite avant-folk masterpiece For The Birds – kerchiefed round his head beneath his upturned hoodie. He is hugely excited ("You're going to give them a good review, right?" he says, pointing a stern finger). But there's something else in his voice as well. It's the ardent, slightly proprietary nervousness of the diehard fan whose secret favourite thing very suddenly belongs to everyone.
"I don't see any other people wearing masks," he worries, scanning the crowd for fellow believers. "There's, like, one girl with one." He shakes his head. "I mean, it's great, all this is great," he says to me, in a very for-the-record tone of voice. "They fuckin' deserve this. But…" He gazes across the heads of the massive, teeming, unfamiliar throng. "Who are all these people?"
Good question. Flashback further still: we are in the graceful surrounds of the high-ceilinged, white-and-pastel-hued, wedding-cake-like Marlay House, earlier that afternoon. Glen Hansard (songwriter/singer/guitarist), Joe Doyle (bassist), Colm Mac Con Iomaire (violinist) and Rob Bochnik (guitarist) are recalling the complicated path that took them from Set List (the live album that documented the post-For The Birds period, shot into the Irish charts at number one, went platinum, and, at this writing, is still there a year later, at number eight) to here.
"We were in Australia," Glen is saying, "and I remember I was in the garden, and I was like, 'What do ya think of this, lads?' (makes strumming motion, sings) 'You're telling me I should forget you…' (in not-sure tones) 'Jaysus, lads, it's really poppy'. And Mark Stankey – our tour-manager in Australia – was like, 'You have to do something with that'. So I finished it. And so 'Fake' was, like, this weird song," says Glen, "that wasn't like any Frames song that had ever come before, and that kind of came out of nowhere. And because Set List had done so well, we were like, 'We should release this as a single'. So we did.
"And then…" Glen pauses, his tone shifting to awe. "It plugged us into a whole different audience. It was really strange. I remember we were in Galway, playing the Black Box, and also I had just done that Even Better Than The Real Thing song [a cover of Justin Timberlake's 'Cry Me A River' for a Today FM compilation]. And after the gig there were all these kids waiting outside, asking us for our autographs. And they were all like – one of them had a Kylie T-shirt, and another had a Justin T-shirt…"
"The front rows of those gigs were all, like, 16-year-old boys and girls," Joe remembers.
"That tour was a much younger audience," Glen agrees. "And we were frightened by it. We were going (whispered, slightly panicked amazement), 'Shit!' Cos all of the people who have been with us all the way, meanwhile, all of our old following, were kinda standing in the background going (sceptical, folded arms), 'Dunno, lads.' There was kind of a sense of…" He breaks into a pained grin. "It was almost like, any cool points we had earned on For The Birds were suddenly just fuckin' erased." He makes a sweeping movement with his arm. "Friends of ours, like. Going (shakes head disapprovingly), 'Lads. What's the story?'"
It's complicated, being complicated. People are much happier if you stay in your box.
"Yeah. And then," says Joe, in a voice indicating the imminent addition of insult to injury, "then of course at this stage we wanted to start playing new songs. Which, you know, I think for old Frames fans would have been great. But with these 16-year-old kids, we were just going… (whispering, we're-fucked voice) 'They're never gonna get this'."
"The other thing that made it complicated," continues Glen, "ironically, was Set List doing so well. We'd already been playing that gig for three years – not that running order, but that kind of gig – and we recorded Set List at the very end of that. And ironically, when we released it, it pulled us right back three years."
"The entire point of Set List," says Joe, "was: this'll be like a marker, for the end of this phase, and then we'll do something else. And then we went to do gigs, and it was like…"
Glen (calling out, as if he's an audience member): "'Tell the dog story!'" He shakes his head. "Fuckin… (in his own voice, addressing the punter, trying to be reasonable) 'The dog story's on the record'. (In fan voice again, only louder) 'Tell it!'"
Rob grins across at him. (Also in fan voice) "Dance, monkey!'" We all fall about laughing.
It couldn't have been easy. Indeed, we have to admit that, the popularity of the 'dog story' set notwithstanding, it was the band's noticeably more taut performances, which began to emerge late last year, that got this listener excited all over again: their brace of gigs in the Olympia in late 2003, for example, or their secret show in Whelan's in spring 2004 (for which they were billed, amusingly, as The Arnotts) following their Meteor Awards win for Best Irish Band of '03.
These shows were short, sharp shocks and, while they were by no means chat-free or emotionally remote, something had changed: they involved the maximum-intensity, minimum-fuss delivery of, crucially, new material alongside old. It was there we began to see what kind of record Burn The Maps might be: there where we first witnessed the runaway-horse pound-and-simmer of current single 'Finally', and the shattering emotional clearing-house of 'Keepsake'.
"This is kind of a difficult one for me personally," says Glen, when we ask whether this change in the Frames' approach to live shows was by accident or design. "Cos I've come under a bit of pressure from the boys about this.
"The boys were like (quiet, serious voice), 'Tighten ship. Just tighten ship'." Glen pauses. "To be honest, it was born out of us touring constantly over the last couple of years and seeing professional bands roll into town and play really fuckin' together gigs, night after night. And what it is, is, if you're playing a lot – and this is where I totally agree with the boys – you can't depend on spontaneity. If spontaneity is your magic, and you need to call upon it every night, and you're knackered," he says, "it's not there some nights. And what ended up happening with us was, we became either a very, very good band live, or… pretty average."
"Basically, it was just about relying on the music to do more of the work," Joe sums up. "Kinda going: 'This is a really good song. If we play it well, Glen doesn't have to do an inspired intro. It can speak for itself'."
"I think, as well, when you're opening for people, like we were," says Colm (they toured the US with Damien Rice and Calexico among others), "you begin to think: how can you distil what you are, and put it across in as short a time as possible? And it came from compiling Set List as well. With Set List it was very much: 'Okay, if we put another story on, it means we have one song less'."
"But even putting the story on at all was an issue," says Glen, to murmurs of agreement. "Because it got us thinking. We were like, 'What is a Frames gig? Like, for us? What's a Frames gig?' Cos I've always viewed it as…" He pauses.
"It's funny that I should end up talking about U2, about this," Glen begins again. "But I always kinda look at it like: you trust your leader. And sometimes your leader's gonna take you out and get yis all killed. Do you know what I mean? And sometimes, he's going to bring yis to victory.
"I remember watching U2 in '85," Glen says. "We were busking outside for the money to get in, myself and Colm, and we went in, and I saw a band where they totally trusted their singer, and he brought them to mad places, and talked a lot of shit. And people hated him for it, because he was talking about politics, and about whatever, and it was like, 'You're a rock band!' But the point was, he sort of brought them somewhere. And it's kind of –
"For me, I have a weird position within the Frames, in that I know that I can take it somewhere else, or I can blab on about it. So, is a Frames gig just this kind of loose… chat, hang out, have a bit of a doss with your audience? Or are we a proper rock band? As in: go onstage, heads down, amp knobs to the right? Or… what?"
Fortunately for all four of them, Burn The Maps has such immense emotional scope it will pretty much allow the Frames to be any kind of band they want to be. A sumptuous, darkly beautiful exploration of love, loss, intimacy, betrayal, bitterness and rage, leavened by a typically glittering thread of hope that shines through even the album's darkest moments, Maps sees the Frames take their familiar skewed, tactile, handmade-folk starting points, and draw them out into richly textured, fully realised epic melodramas, complete with searing, heartstoppingly beautiful string sections that sing over Hansard's wracked voice with the emotional specificity of love letters.
As usual, there's the Frames' now-patented tremendous dynamic range: the whole audible spectrum is here, from tense, barely-breathing near-silences ('Keepsake') to full-blown, cataclysmic apotheosis ('Dream Awake'). Lyrically, it's as brutally candid as Hansard has ever been, from the helplessly twisting frustration of 'Happy' to the emotional violence and sheer longing of 'Finally'.
It's full of surprises, too, moments where songs suddenly swing off their paths and go in wholly unexpected directions – as when the cautionary folktale of 'Dream Awake' bursts into swirling, cataclysmic noise; or when the handcarved simplicity of 'Suffer In Silence' gently unravels into a beguiling mirrorball slowdance, complete with Motown-worthy string-and-brass outro; or when the sticky, digitised mini-groove of 'Ship Caught In The Bay' detonates into a clanging static-jam of electronic cacophony shot through with whistling melody: a sister song to FTB's 'Santa Maria', as rendered by Kid A-period Radiohead.
This is dark, complicated, sonically fucked-up, old-souled, melodramatic pop, with The Frames' trademark irrepressible lifeforce blazing through every track like a flare in a starless sky.
Marlay Park, midday. As we sit at wooden picnic tables on the lawn outside the wedding-cake house, Colm recharges his iPod from his laptop – a battered iBook, with its hinge so exhausted he props the screen up against what looks like a heavy microphone case.
He shows me an A4 notebook with a blue plastic cover. Inside, the pages are covered in neat, dense writing: pages with instrument lists ("Violin, viola, brass") set against song titles; pages with musical notation, written out, complete with bow-direction indications; pages with arrangement-layering instructions; pages of longhand prose, written in Irish, dated and labelled things like 'Ciarraí'.
Throughout are doodles of awesome intricacy: mostly round, multi-spoked mandalas, with endless triangles and crescents and slivered shapes within them, like views seen through a kaleidoscope. The whole thing makes you think simultaneously of ancient illuminated texts, and Kurt Cobain's journals. Thinking of the density and huge feeling of the completed string parts on Burn The Maps, and then seeing the simple, organised portability of the place it all came from, is quite something. Colm smiles at my wonderment. "So, yeah. This is Burn The Maps," he says.
Of course, depending on which Frame's rucksack you rifled through, you'd probably locate other, different maps, so to speak, of Burn The Maps. Recorded mainly in Black Box Studios in France and Electrical Audio in Chicago, with ex-Frame Dave Odlum and Rob Bochnik at the desk, the band's fifth studio album, explains Joe, was very much a "band album", with different members taking control of small bits of the project based on where each musician's interests lay, and then reconvening with the results. "It really made us excited to work on it," he says. "We haven't really worked like that since as far back as Dance The Devil, I don't think."
It also meant different band members' speciality areas could come to the fore. For example, Glen says, in addition to filling the very large production shoes left by Dave Odlum (the Frames' guitarist/producer who departed to be a full-time producer in 2001), Rob is especially good as a sort of surreptitious catcher-on-the-fly of spontaneous good ideas. "We'll be soundchecking, and I'll be freaking out over something, and without me knowing it Rob'll have a Minidisc on the go. Then, weeks later, when we're working on stuff, he'll pull it out and say, 'Do you remember when we were onstage in Cincinnati and you had that idea?'"
"My relationship with Joe and Colm is brilliant," Glen will also confide later. "It's so…" He considers, then finds the word. "It's fiery. We have fights – we fight like brothers. Joe and Colm will constantly be my devil's advocate. For a long time I mistook it as resistance. And what it is, is temperance. I'll be like (zealously) 'Lads, I tell ya what, I really wanna fuckin'…' and the lads'll be like, (reasonable voice) 'Why? What's the point to that?'
"They'll go with me," Glen assures me, "but first, they'll argue with me every step of the way. And then, they'll be right behind me." He stops. "It's brilliant. It's the kind of relationship that becomes more and more important as the years go on."
What is apparent is that the four have evolved into a compact, tight-knit group who, emotionally as well as musically, are able to play the metaphorical equivalent of a four-way catch-me-when-I-fall-backward trust game – and the Frames, of all bands, have needed this kind of security. Because, for all the wonderful things that have come to them over the last several years – the location of a likeminded comrade in their manager Claire Leadbitter, the breakthrough success of For The Birds, the worldwide deal with Californian label Anti (labelmates: Nick Cave, Tom Waits), the unexpected successes of Set List and 'Fake', the repeat tours to the US and Australia and eastern Europe, yielding better reviews and slightly larger venues each time – alongside these, have been less positive events, ranging from the merely traumatising to the truly gutting.
There was Dave Odlum's departure ("He was so much more than a guitarist and producer," says Glen. "He was a kind of mother and father figure to us. His leaving forced us to grow up"), as well as the departure of drummer Dave Hingerty (Bell X1's Paul Noonan and Halite's Graham Hopkins supply drums on Maps). Worst of all by far was the awful accidental death of Mic Christopher, a longtime Frames mate and Glen's best friend, in 2001.
"There aren't any songs I worked on with him on Maps, no," says Glen, "but he's on the whole album. Believe me, he's on every single track." In fact, we're quite relieved to be reporting on the release of Burn The Maps at all, because back then, as each next hard thing happened, we remember wondering how much more of a battering this band could take.
Are any of these songs, I ask Glen, about your relationship with the Frames – not the people, but with the band itself? Or with your own creative process?
Glen: (after a pause, deciding there's no point in dissembling) "Yeah."
What is 'Finally' about?
"That's a good question," he says, extremely tentatively. "It's about a couple of things… It's a good – It's a very good question, because it was just… anger. I was just angry, when I wrote it. I was trying to write a song of encouragement, to… possibly myself, you know, and I ended up, like (mean, dark voice), 'Did you fall on your way? It's a long way down. Welcome back to your place'. As in, like, fuckin… 'I hope you know it now'. Like: stop having aspirations beyond your station. You were born to struggle. Now fuckin'… struggle.
"But yeah, definitely the first part of it is kind of about the band. It's kind of about our career – I mean, I keep on going back to it, for songs. That same thing of, like: (quietly) 'Come on, you'll be all right. Just keep your fuckin' head focused. Stay on the good road. Don't fuck up'. Do you know what I mean? Just stay on board. Stay on the surfboard, or whatever it is, that you're trying to keep up on, and you'll be alright." He stops. "The same thing that made me write 'Fitzcarraldo' is still in me."
"The phrase 'Burn The Maps' first came up when I was introducing 'Keepsake' at a gig one night," Glen is explaining. "I said, 'This song is about burning all of the maps that got you to where you are'."
So it's not about burning maps leading you into the future? It's about burning old maps?
"It's about burning everything that got you to where you are. Only existing in the present. The only thing I don't like about it, in retrospect, is the negative connotation. As in, that it could be perceived as us, The Frames, destroying our history. 'Cos it isn't. But for me, it kind of means forgetting about all of what's happened to get you here, and starting again."
I remember reading once, I venture, that in order to create great art, you have to, as it were, burn your maps: that is, you must discard all your assumptions, and all the normal cultural symbols you rely upon. The idea is to force yourself to take nothing for granted. And that it's when you get too comfortable, that you get stuck…
(Immediately) "Yeah. Absolutely. You get fat. And I've always had this thing, from when I was a kid – the one thing I never, ever, ever want to be, is comfortable. And the way I'm using the term 'getting fat' is, not getting fat in your belly: getting fat in your thoughts. I always believe that you must remain lean.
"I've always been terrified of the idea of, you know, in my own life, making music, people loving it, me kinda getting a bit of an ego about it, making slightly less good music, people buying it, me kinda… and eventually just kinda going (shrugs shortly), 'Yeah, it's good enough'. And me losing all of my editorial… you know… (laughs) where you just become this kind of… overweight, egotistical – someone who can't just go and pick up a guitar and walk out on the street. For me, that's the most important thing. If, in my life, I can always pick up my guitar, go out on Grafton Street and sing a song – if I can always do that, then somehow, that to me symbolises that I'm lean.
"Like, I was busking last week in a small town in the Czech Republic," says Glen. "I busked for two hours. I didn't make anything, I hadn't even got my case open. Someone bought me a pot of honey, and someone else bought me flowers, and it was lovely. But for me it was like, 'This is what I do'. And I had sold out the local castle – 5,000 people, in this castle courtyard – the night before."
Did anyone recognise you?
"Ah yeah. People stopped and watched. But that wasn't what my idea was. I just wanted to play my guitar." He considers. "Not to… tune into my fuckin muse, but just to… just to be what I am. And not to be like, 'Oh yeah, I played in a castle last night'.
"And it's not like I'm apologising for playing in a castle," he states. "I'm not. I just wanna always be able to plug back into what I do. Like – I sincerely said to Gerry [McDonnell, Frames soundman], is there any way we could set up a microphone in the middle of the audience at Marlay Park? Cos I wanted, at the end of the gig, to go into the middle of the audience, and sing a song, with my guitar. And he was, like, (head shaking, out-of-the-question voice), 'There's no fucking way, man…'"
What would the purpose have been?
" I dunno, man," he says, passionately. "It's something I always want to do."
So that you're getting rid of the thing where it's like – I gesture with two hands held far apart – stage… audience?
"Yeah. Stage, audience," he gestures as well, sweeping both away. "Burn the stage. Burn the fuckin'…" He bursts out laughing. "Just go into the middle of the audience," he says, "and play the tune. And just be like, Alright. We're all here. Come on!"


text:
All over print tribal style abstract geometric pattern in black and gray colors.Tackle winter in style with this fully customizable long sleeve t-shirt. Have your own unique designs printed on the front and back and all the way down to the sleeves and neckline. Alternate patterns, create quirky prints, go crazy with colors! Whatever you do, you can be sure that this top will be uniquely your own. The front, back, sleeves and neckline can be fully customized to your personal preference. Your designs will be printed using high performance digital printing technology to ensure vibrant and long-lasting results. Made with 90% Cotton, 10% Spandex Fully Customizable Standard Fit Machine Washable Attention: For all waistbands, handcuffs and drawstring, please use either plain colors or patterns only and NOT text messages. Due to bleeding and fabric stretch, the previewed image is only an approximated display of the final product.
If you order more than 50 pcs items (can be combined), please click here to contact us for whole price quotation, please include the SKU# and the quantity you want for each of them. For order less than 50 pcs, please order directly from our website.


text:
how gangsta am i? i've blogged quite frequently lately!
*claps to myself*
anyway, i've had time to make a video the other day.
yes, dah nampak video kat bawah terus click play pastu tak baca kan mende i tulis ni kaaannnnn!!!
ha, tengok la. pastu baca sikit apa i tulis kat bawah yaaaa! ada cerita di sebalik bideo. thanks! =)
ok here are the reasons why i made this video:
1. because i get tweets about how to handle haters
2. because i get messages about how to handle haters
3. because i feel like i owe haters an apology and give them my thanks
ok? so yeah. i've been receiving messages about this and please peeps, i tak sedih sebab haters!
i'm not sad, depressed nor hurt by the haters! if i looked sad, it's probably coz i was sad at myself (for personal reasons which i wont story mory here la. heeee..)
i wrote in the description of this video too about how these 'haters' are actually my saviours, but i guess people don't read that bit. hahaha! oh well. my bad gak la sebab i didnt mention it myself. i was talking spontaneously kan. takde script mende pun. buahahaha! =p
i can't believe though, how many people asked me about this. and i macam "kamaaannn, takkan la ramai sangat orang ada haters neeehhhhh?"
like i said in the video too, there are 2 types of 'haters'.
one species just wanna troll.
one species just dont know how to give their honest brutal opinions nicely, but they mean well.
my mom used to slap me when i did something wrong and scolded me, but i love her more for that. if she hadn't done that, i'll probably be some messed up person now. before you say things about my mom, i totally deserved all that coz i was a very stubborn child.
same applies to these 'haters'.
they might be very angry or something at you, but there must be a reason why they're like that. probably you did something wrong but you're just too proud to see it.
chill and learn je.
i memang la ada terasa sometimes, i am human after all. a girl, with feelings, with harry potter bantal and cats. and dresses and flowers. motip? ok, you get the gist. =p
but oh well. we can't win over all hearts.
okie dokie?
milo ais? teh tarik? neslo?
pergi mamak, cakap hello. sekian pantun dua kerat.
so dah dah la k nak down down coz of 'haters'. if you happen to have haters yang jealous of you or whatever, then stay away from that person la. if the person cari pasal ngan you, you just bagi dia jumpa pasal yang baik about you. how's that for an awesome advice? you just have to trust me, coz i'm an engineer. hahahahaah!! (sorry ter-9gag jap)
chill k?
the world needs us to keep on improving. and to my 'haters' who happen to read this, you need to improve too =)
thank you all!


text:
Tripwire is a leading Irish distributor and installer of a wide range of security solutions, automation and parking systems.
Whether you're looking for a simple access control solution for a door or if you want to secure and monitor staff, vehicle and pedestrian access across your whole site or across your network of sites, we can provide you with a professional, reliable and cost effective solution.
With a nationwide presence and a strong support and maintenance service you can have the peace of mind that your site is secure at all times.