text:
Hawks win coin toss. We defer untill 2nd half.
Crowd is going NUTS. LOUD, like playoffs LOUD.
We kick the ball and the Pats kneel down.
1st play is Brady in shot gun. Then Brady motions to undercenter. Snaps the ball and play action fake to Edelman for a 12 yard gain.
2nd play is a kinda hurry up offense. Once he gets to his center. Brady leans over his gaurd and center and points out what he sees. Lets the clock run down to 10 almost then snaps the ball and hands off to Bolden. No gain on the play
3rd play is a screen pass to Branch for 2 yards. Browner makes the tackle
4th play is 3rd an 8. Brady is in shot gun with 2 wide and two TE's spilt. Bready takes the snap and drops back 3 steps. Gets hit by Irvin and Thomas picks off Brady's pass and returns it for a TD!
Then after that. The Seahawks and the 12th man rain a S@!T all over the Pats.
Hawks won 30 to 13


text:
New Book Helps You Embrace Collaboration, Increase Profits
Do your customers talk about optimizing team performance? Do they struggle with new ways to increase their competitive edge? Are they looking for ways to scale their most precious resources? Then it's time for you to step up as your customers' collaboration expert.
Collaboration will be the business opportunity of the decade, and partners who can help move their customers through this transition will see their revenue grow. But you have to be able to speak the language of collaboration and understand its true meaning in a connected world.
But how do you learn and embrace this new language?
A new book provides the lowdown you need to share how improved collaboration represents the best opportunity for business leaders to tap the full range of talents of their people, move with greater speed and flexibility, and compete to win over the next decade.
That new book is called, The Collaboration Imperative: Executive Strategies for Unlocking Your Organization's True Potential. Cisco's very own Carl Wiese, SVP Global Collaboration Sales, and Ron Ricci, VP Corporate Positioning, wrote this book for business leaders in all industries around the world and to help our partners have a new conversation with customers.
Find out more about what's inside the book and how you can buy it for a special partner discounted rate.
Inside you'll find insights from organizations like Best Buy, Duke University, and GE—and interviews with some of the leading collaboration thought leaders in the world today.
As a Cisco partner, you can purchase copies of The Collaboration Imperative at a discounted rate of just US$10 for hard copy books, plus shipping and handling. (NOTE: This link is for Cisco partners only and should not be posted or distributed without permission. Contact firstname.lastname@example.com for more info.)
So take advantage of this discounted pricing to read the book and hand it out to customers. You'll help build your business—and drive awareness about the potential of collaboration.
Order as many books as needed! You'll be glad you did. Did I mention I'm listed in the dedication? Just kidding.
In an effort to keep conversations fresh, Cisco Blogs closes comments after 60 days. Please visit the Cisco Blogs hub page for the latest content.
4 Comments
Viktor Szekeres
Just to inform you: link does not work.
looks interesting book on business opportunity, performance and strategy.

subset: commoncrawl


text:
CAPITOL JOURNAL provides daily coverage of the Alabama Legislature with a studio inside the Alabama State House. Don Dailey hosts the half-hour nightly report, examining key issues and interviewing newsmakers. Reporters Karen Brown and Randy Scott follow action in the House and Senate.
There are no upcoming air times for this episode.
Funding for Capitol Journal 2018 (30 Minutes) is provided in part by:


text:
It's not about reaching more people, it's about reaching the right people, and for local
businesses, it's the Power of Local Connections.
The power of your brand relies on your ability to focus and craft a marketing message that will convert prospects into customers.
At Adcorp Media Group all of our marketing efforts are centered around the supermarket where your local prospects go. You know your target audience, and we have them! (Unless they don't have to eat and feed their family!)
Our suite of out-of-home in-store supermarket programs include:
We are a private company owned by key employees. Over the years, our team has built one of the most successful and customer driven organizations of its kind in the United States. Our growth from a start up business to where we are today offers testimony to our commitment to excellence.Take the Tour


text:
By Julie van der Poel Jul 16, 2012 0
Making the Most of Vacation
What makes a vacation a vacation? For me it's all about doing nothing. It's about soaking up as much sun as SPF 30 and my umbrella will allow. It's about being on the beach and spending the entire day absorbed in a good book. And most importantly, it's about being with family without the day-to-day stresses of work and school and appointments and getting to various places on time. I love it when my only logistical requirement for the day is arriving on time for my dinner reservation. I have very vivid memories of going on vacation as a child, and being just as excited the night before we departed as I was on Christmas Eve. I LOVE vacation in that way today, and never look forward to returning to the routine of being at home.
I can't imagine anyone not feeling the same way as I do about vacation. Much less, that my own offspring don't feel the same way. I find it ironic that my children are saying the same things to me that my parents used to say to me: "Turn down that music," or "It's time to go back inside, we've been out here long enough." And my response to my children is the same as it was to my parents: the sigh and the rolling of the eyes as I turn down the radio, or "Just five more minutes" in response to the pleas to go inside.
Despite the fact that the love of the beach has apparently skipped a generation in my household, I really want my children to enjoy and appreciate their time away from the routine of home. I take heart in the fact that Cameron genuinely looks forward to being with his extended family. He's always asking about who will be at the beach when we are there. He checks to make sure that my sister and her family will be there, and asks how many days they will be with us. By far, the most important aspect of any trip to the beach for Cameron is spending time with his "PePop." My father has the good fortune of living at the beach year round, and Cameron loves to spend time with him. With PePop, Cameron can escape the demands of being Cameron. There's no requirement to reciprocate conversation. There's no monitoring of his diet. No little sister around, whose sole intent seems to be to annoy him. So, I guess for Cameron, being at PePop's house is like being on the beach for me. No worries, no hurries, just a sense of calm and freedom.
As we see this year's summer vacation draw to a close, I feel we are all very satisfied in that it was a vacation well spent. We've all survived the nine-hour car ride that really takes 11 hours in traffic, and are actually excited to be home again. I have spent enough time beachside, and Cameron has spent enough time with his grandfather, and everyone's batteries are fully recharged. It seems even though we have very different ideas on how to spend a perfect vacation, we've both spent a perfectly wonderful time together and gotten exactly what we needed from the break.


text:
Reviewed by Damian R. (age 6)
I really liked this book because the sheep shared. That was the most important thing because her friends were beginning to get mad at her. She did not let them down. She showed them she cared about them. This reminds me of when me and my sister do not want to share with each other. We both start to get a little upset but then everything is okay when we share. I really liked the illustrations. The funniest illustration was the pig at the door. Everytime I see it I laugh.
I recommend this book to everyone. I think everyone will like it because it is funny and it has a nice ending.


text:
Pocket Scribble - Part II
Desktop-as-a-Service Designed for Any Cloud ? Nutanix Frame
In part one, I showed you how to install and configure Microsoft Embedded Visual C++ and porting the Scribble MFC tutorial to Pocket Windows. We ended up with an application that worked, but with several flaws. The source code was pretty standard MFC code using the document/view architecture, and did not really exercise any Pocket Windows specifics.
In this part I will fix the problems, and discuss some of the Pocket Windows specific classes and API's that you should use.
- Why is everything I have drawn gone when the main window has been covered?
- How can I save the files with the '.scb' extension so I can open existing files?
- Is the file format compatible with the PC version of Scribble?
- How do I save my work? There is no OK button in the corner of the window. I can only choose 'Save As'
So fire up your Embedded Visual C++ IDE, and go get a cup of coffee while it loads.
- Before we begin
- Redrawing the view.
- How do I save files with the right extension?
- Is the file format compatible with the PC/Windows version of Scribble?
- How do I close Pocket Scribble?
- Conclusion
Before we beginDuring the steps in this article you will often recompile the Pocket Scribble to try out new versions. You may experience that you cannot upload new versions of Pocket Scribble to the device, because the file is in use. This is because the application is open and there is no way to close it. Later in this article I will look at adding functionality to the application so it is possible to shut it down gracefully. Until then, just close the application the hard way using either the Memory applet in the Settings folder - or if you're working in the emulator, you can close PocketScribble by using the task manager.
In some circumstances you may experience that the emulator hangs. You cannot restart it by closing it normally, and there is no way out but using the task manager. When doing that, you should kill the process named shell32.exe. You may need to restart Embedded Visual C++ too.
If you want to use the ClassWizard for adding event handlers to the document (scribdoc.*) and the view (scribvw.*) you may need to rebuild the ClassWizard file. In Embedded Visual C++ this file has a .VCC extension. To recreate the ClassWizard information delete the file PocketScribble.vcc and then open the ClassWizard. When asked if you want to build a new one from your source files answer yes, and click the "Add All" in the following dialog before clicking OK.
Redrawing the viewWhen I got the first build of Scribble running in the Pocket Windows environment it seemed like it actually worked "out of the box". But after playing around with it for a while the problems began to appear.
One problem is, that when you do something that obscures the Pocket Scribble main window, everything you have drawn disappears - or to be correct: it is not redrawn -the data is still there!
When something is not redrawn after being obscured, it is typically something that can be found in the OnDraw() override of the view class.
Before the actually drawing takes place, the device context is prepared with some calls to the API function LPtoDP(). If you take a look at the documentation for this function in MSDN, you will se that they state that this API-function is not available on Pocket Windows, and that it actually does nothing with the data transferred to it.
This is a problem because the Scribble application assumes that the drawing coordinates are prepared with the call and not just left untouched.
Therefore I will remove all references to LPtoDP() from the OnDraw() handler. Doing this will have the unfortunate side effect, that the drawing optimisation done in the original application is lost, and the result is slower screen updates. I will not go into optimising the drawing behaviour here, because it is beyond the scope of this article.
Below is shown how the code for the revised OnDraw() handler.
void CScribbleView::OnDraw(CDC* pDC) { CScribbleDoc* pDoc = GetDocument(); ASSERT_VALID(pDoc); // Get the invalidated rectangle of the view, or in the case // of printing, the clipping region of the printer dc. CRect rectClip; CRect rectStroke; //pDC->GetClipBox(&rectClip); //pDC->LPtoDP(&rectClip); //rectClip.InflateRect(1, 1); // avoid rounding to nothing // Note: CScrollView::OnPaint() will have already adjusted the // viewport origin before calling OnDraw(), to reflect the // currently scrolled position. // The view delegates the drawing of individual strokes to // CStroke::DrawStroke(). CTypedPtrList<CObList,CStroke*>&strokeList = pDoc->m_strokeList; POSITION pos = strokeList.GetHeadPosition(); while (pos != NULL) { CStroke* pStroke = strokeList.GetNext(pos); rectStroke = pStroke->GetBoundingRect(); //pDC->LPtoDP(&rectStroke); //rectStroke.InflateRect(1, 1); //avoid rounding to nothing //if (!rectStroke.IntersectRect(&rectStroke, &rectClip)) // continue; pStroke->DrawStroke(pDC); } }
The lines shown in bold are the lines modified to make the drawing behaviour work.
Now try to compile the application and try it out in the emulator. Make sure that the build settings are correct - that is the 'Win32 (WCE x86em) Debug' target and 'Pocket PC Emulation' are chosen.
To test that it works choose Tools -> About Pocket Scribble to show the about box and obscure the main window. When the aboutbox has been closed your artwork should still be visible.
How do I save files with the right extension?If you have played around with Pocket Scribble you may have noticed that it is possible to save your work in a disk file, but the file type is not listed in the Save As dialog. Instead you are presented with the option of saving your work with the type "All Files (*.*)". This is not very intuitive.
It would be desirable, if a file name with the right extension was suggested, and the file type was listed as Scribble document.
The reason that there is not provided a file extension to the filename and a file type, is that the resource identifier IDR_MAINFRAME is not complete. In the application wizard for Visual C++ for PC/Windows, you are presented with the option of customizing you data file properties. This option is missing from Embedded Visual C++, which I consider a serious bug.
The only thing we need to do is to change the string resource entry IDR_MAINFRAME. Go to the string table in your resource file and change the string
PocketScribble\ndefault.scb\nPocketScribble\nScribble Files (*.scb)\n*.scb\nPocketScribble.Document\nPocketScribble Document
Now try to compile everything, load the application into the emulation environment, create a new file and choose Tools->Save As. Now the dialog behaves as expected.
Is the file format compatible with the PC/Windows version of Scribble?
The short answer is yes!
The file formats are compatible because it is the same code that is used for serializing the document. Scribble document files does not need to be converted before they are used in a PC/Windows environment.
How do I close Pocket Scribble?It is rather inconvenient exiting Pocket Scribble. If you want to close the program you will have to do it from the Memory applet in the Settings folder. The official Pocket Windows way to do it is to add an OK button in the upper right corner of the main window.
The behaviour is not added in the source files that we copied from the original Scribble project in the last article. If you choose to create a project from the scratch by using the project wizard, this behaviour is enabled by default. We will add it manually.
Using the ClassWizard add a WM_CREATE handler to you CScribbleView class. In the implemented function OnCreate() you should add the following code:
That's all. Compile and run the program to verify that everything went OK.
Your Pocket Scribble should now look something like this. Notice that the clicking the OK button will not save your work. I'm not sure I think this is very smart default behaviour.
ConclusionThese two articles should be enough to get you started porting your existing application to Pocket Windows. I have focused on Pocket Windows development using MFC, knowing that MFC does inflict a certain overhead that might not be desirable.
However the speed and memory penalty from using MFC is not really significant on a device with tens of megabytes of memory and 100 to 200 MHz CPU's.
It is a lot simpler creating and porting software to Pocket Windows that one might expect, and I think the future is bright for these small and cool devices running full blown 32 bit operating systems.
If you have comments to the article, please don't hesitate to contact me at firstname.lastname@example.com. Take a look at another article about Pocket Windows development I've written at http://codeguru.earthweb.com/ce/PocketWine.shtml.


text:
Hope Springs
Now Available
About Hope Springs
Kay (Meryl Streep) and Arnold (Tommy Lee Jones) are a devoted couple, but decades of marriage have left Kay wanting to spice things up and reconnect with her husband. When she hears of a renowned couple's specialist (Steve Carell) in the small town of Great Hope Springs, she attempts to persuade her skeptical husband, a steadfast man of routine, to get on a plane for a week of marriage therapy. Just convincing the stubborn Arnold to go on the retreat is hard enough - the real challenge for both of them comes as they try to re-ignite the spark that caused them to fall for each other in the first place.
Brian Bell, Lawrence Grey, Kelli Konop
Vanessa Taylor
Executive Producer
Jessie Nelson, Jason Blumenthal, Nathan Kahane, Steve Tisch
Todd Black, Guymon Casady
David Frankel
Steve Carell, Tommy Lee Jones, Mimi Rogers, Elisabeth Shue, Jean Smart, Meryl Streep, Damian Young, Brett Rice


text:
Aurora Church needed a new stationery design and created a contest on 99designs.
A winner was selected from 87 designs submitted by 26 freelance designers.
Aurora Church of the Nazarene
We are a growing church in Seattle, WA.
We are reaching young families in our community.
We are creative in the ways we communicate and brand and are looking for something that speaks to that.
We are a mix of young and old, urban and sub.
This is mainly for business purposes but we still want it to have a young, hip look and feel.
We are of course in the backyard of some great tech companies: Amazon, Adobe, Microsoft. We are a progressive, creative church looking for some great collateral.
The final design needs to be in Illustrator or eps format.
Use our logo. Our new logo is pretty colorful so it'd be cool to see some designs that can complement that. It can be downloaded from here (ignore the old website):


text:
Find the perfect hotel in Elizabeth using our hotel guide provided below. Find cheap and discounted hotel/motel rates in or nearby Elizabeth, IN for your upcoming individual or group travel. Discover the best Elizabeth Indiana hotel rooms. Review the Elizabeth hotel list below to find the perfect lodging. We also have a map of the Elizabeth hotels. Coordinating a group? Get Elizabeth Group Hotel Discounts
The Elizabeth center point is around 4 miles southwest of Horseshoe Casino and 5 miles west of Native American Heritage Musm.
How should we direct your call?


text:
Your browser does not support iframes.
Lancaster Super Speedway is hosting the Christmas Show Down Mud Bog on Dec. 12.
The Saturday event starts at 10:30 a.m. The divisions running include ATVs with a two-lap endurance race for the best time average for two laps. The payout for the ATVs is $100 for first place and $25 for second.
In the truck/jeep event for the 30-35 tire size class, the payout is $75 for first place and $25 for second. In the 35-40 tire size class, first is $100 and $25 for second.
In the 41-46 tire size class, the payout is $150 for first place and $25 for second.
The opening of the Lancaster Super Speedway Mud Madness Mud Bog and two ATV courses Nov. 21 was a big success, said LSS owner Doug McManus.
Lancaster Super Speedway will host the grand opening of the LSS's new Mud Bog track Nov. 21.
The opening includes the new Lancaster Super Speedway ATV endurance and obstacle 8.8 acre complex and the Lancaster Super Speedway 280-foot Mud Bog competition pit.
The official opening of the ATV Complex is at 10 a.m.
The charge is $25 for all-day passes, 10 a.m. to 6 p.m.
The mud bog registration begins at 11 a.m.
The mud bog area is open to the tire sizes 33- 35, 36-38, 40-42 and 44-46.
Lancaster Super Speedway will celebrate its 61st season with the annual LSS awards night Saturday, Nov. 14.
Recognition and awards will be presented to the top five finishers in each division. The awards presentation begins at 2 p.m. in the pits on victory lane stage.
The entry is through the pit gate ticket booth area. The grandstands are closed. Admission is free.
Drivers are invited to bring their car for pictures, if they choose.
Sumter Speedway in Sumter will host the the Topless Turkey Day race Saturday night, Nov. 14.
This popular race has become one of the biggest draws in South Carolina racing.
Drivers, from across the state, including Lancaster campaigners, look forward to attending and competing in this race each season.
Divisions running include the Outlaw Late Models, paying $1,000 to win (Limiteds, 525 and Crates combined).
Sumter Speedway is presenting The Battle Of The South on Saturday, Nov. 7.
The night's headliner will be the $1,000-to-win Mid-Atlantic Street Stock Series, paying $800 to win in the Stock 4 Division.
Other divisions running will be SECA Crate Late Models, Super Street, Street Stock, Stock V8 and Extreme 4. Pits admission is $25 and $15 for the grandstands.
In the stands, all active military, retired military and children, age 11 and under, are free.
The USCS Winged Outlaw Sprint Cars will be highlighting two area Carolinas race tracks Friday and Saturday night this weekend, Oct. 30 and 31.
Tonight, Friday, the USCS Winged Outlaw Sprint Cars will highlight racing action at Carolina Speedway in Gastonia, N.C., along with Limited Late Models $1,500 to win, SECA Crate Sportsman $500, Street Stock $500, Renegades $500 and USCS 600 Mini Sprints.
Gates open at 5 p.m. with hot laps at 7:20. Heat races are set for 8. Admission prices are $20 for the grandstands and $30 for the pits.
The 2015 racing season was one to dream about for "The Rock Hill Bad Boy," Ben Watkins.
Watkins started the racing season in a Super Late Model for the Carolina Clash Super Late Model Series for the first time.
This season was Watkins first full year racing a Super Late Model car. In previous seasons, Watkins had raced Lancaster Super Speedway, I-77 Speedway and Carolina Speedway in the Crate Sportsman and the Cherokee Speedway in Limited Late Models.
Early on, Watkins enjoyed success with some finishes up front.
Cherokee Speedway in Gaffney will host the 25th annual Blue Gray 100 this weekend.
Action begins tonight, Oct. 23 and continues Saturday, Oct. 24.
The racing event is highlighted by the $12,000-to-win Carolina Clash Super Late Model Series main event Saturday night.
The racing order tonight is the Thunder Bombers, Extreme 4 and Young Guns 4-Cylinders will qualify and run main events. The Stock 4 will qualify and run heat races, and an open practice for all other divisions is slated.
Lancaster Super Speedway drivers ventured across the state line over the weekend for the King of The Carolina's Races at Carolina Speedway in Gastonia, N.C.
Lancaster Super Speedway drivers had a strong showing throughout the weekend, with Ben Watkins posting a seventh-place finish in the Carolina Clash Super Late Model Series main event.
Josh Langley was 17th in the Clash Super Late Model Series main after getting caught up in a wreck on the front straight away.
Copyright © 2019
The Lancaster News is your source for local news, sports, events, and information in Lancaster County and Lancaster, South Carolina, and the surrounding area..


text:
premierfinelinens necesitaba un nuevo diseño de logotipo y lanzó un concurso de diseño en 99designs.
Un ganador ha sido elegido entre 448 diseños de 111 diseñadores freelance.
Brand name - Blue Dahlia Tag line : Take luxury to bed
Premier Fine Linens (http://www.premierfinelinens.com/) is an Indian Textile company that primarily exports high quality bed linen to countries around the globe. A part of the Premier Group of companies located in Coimbatore, India, Premier Fine Linens specializes in high quality bed lined that is exported around the globe to customers in retail and hospitality such as Pottery Barn, Croscill and Calvin Klein. We are now considering venturing into the domestic (Indian) retail market, by launching a new brand for our products. The products will not be retailed through the company's own stores, but via life-style department stores, retail outlets and high end boutiques. The logo we require will specifically be for the new product line launched in the domestic Indian market.
Our primary products are: bed sheets, pillow covers, fitted sheets, quilts, duvet covers, shams and decorative bed-top products. You can find a sample of some of our products attached to the bottom of this brief.
Thank you in advance, we will be watching progress on the page closely. Successful designs may also land further contracts for branding and corporate identity in the near future.
Our target audience primarily belongs to the upper and middle income segment households in India, and our branding must reflect a modern and trendy look to cater to these segments. Approximately 80% of our consumers would be women between the ages of 25 and 55 years.
Here are two of our competitors in the same market space:
The logo will be used extensively in corporate branding and in our upcoming online store. We plan to use social media to promote our product as well, so the logo should be something that blends in well with all of the above. We do not want to emphasize a connection to Premier Fine Linens in the logo itself, Blue Dahlia should suffice as the brand name.
The tag line "Take luxury to bed" should be incorporated in our logo
The logo should convey: clean, modern, high quality, creative.
The logo should be suitable to light and dark backgrounds, and can be abstract.
We need a trendy, appealing and fresh logo that will stand out from the crowd and catch the consumer's eye
The logo must reflect the high quality of the products as well as convey modernity with a tinge of sophistication (though we do not want to emphasize too much on the latter).
We would prefer that the logo embodied a clean look where the name and motif can be identified easily
Ideally blue would be one of the primary colors in the design. A touch of green and / yellow is also welcome
We do not want to use Indian specific motifs or retain any of the existing branding for this new product line - we would prefer new concepts. Final files should be in vector based formats (.ai etc) as well as a .psd
We will be more than happy to provide extra feedback along the design process and are willing to look at concept sketches
Descubre cómo funciona un concurso de diseño u obtén más información sobre nuestros servicios de diseño de logo.


text:
Building on yesterday's story of Apple announcing they wouldn't be releasing the white iPhone 4 until Spring 2011 comes new rumors that they've cancelled the phantom shade indefinitely, and will not be making it available whatsoever. BGR reports:
According to a previous source of ours, we have been told that Apple in fact has no plans to release the white model iPhone 4.
With all of the mixed reports we've been seeing on the white iPhone lately, we don't know what to believe anymore. It's possible that, due to the timeline and events played out so far, Apple may just wait until the iPhone 5 is released in summer 2011 before officially bringing the white iPhone to the table.
What do you think? Will we ever see it? Do you even care anymore? Sound off in the comments below!
by Andrew Wray


text:
The Marlins got what should have been a feel-good win for a rookie pitcher making his first major league start Saturday at Marlins Park.
The 14-3 victory against the Reds was overshadowed by the painful blow of losing their second All-Star to a hand injury.
Dee Gordon, voted as the starter for the National League at second base, dislocated his left thumb when he dove safely into first base with an infield single in the seventh inning against the Reds. He immediately headed for the dugout and slammed his helmet down as he exited.
X-rays revealed no fracture, and the preliminary indication was no ligament damage. Gordon said the injury is not nearly as severe as when he...


text:
By Jen Wieczner
In exchange for lower health premiums under Obamacare, some experts say shoppers could pay higher prices on everything from printer paper to French fries.
Complying with the Affordable Care Act will cost as much as $420 million annually, McDonald's CFO Peter Bensen said during a conference call Monday, according to CFO Journal. And when the new law goes fully into effect in 2014, it's possible menu prices will be raised to cover the health costs.
Analysts say businesses with a large number of hourly wage workers, who traditionally had minimal or no health insurance—from fast food joints to retailers—may have to adopt a similar strategy. "I would expect prices at McDonald's (MCD) to go up," says Les Funtleyder, who manages a health care fund at Poliwogg, a hedge and venture capital firm. (A McDonald's spokeswoman says the company doesn't set prices for its franchised restaurants, which represent about 90% of its 14,000 U.S. outposts, and that "it would be premature and inaccurate to speculate on raising menu prices to offset these costs.")
But experts say the price hikes could extend beyond chicken McNuggets. Some analysts believe companies may use health care as an excuse to raise prices, even if the added costs don't warrant the increase. Peter Saleh, a restaurant analyst at Telsey Advisory Group, expects sit-down diners at restaurants like The Olive Garden, owned by Darden Restaurants (DRI), and The Cheesecake Factory (CAKE), which own a greater proportion of their locations than some fast food chains, to eventually pay at least 2% more to eat there. But Saleh says it's too soon to know how the companies will cope with the new mandates: "A lot of them at this point aren't willing to give us estimates about it."
Also See:
- 10 Things Food Trucks Won't Say
- Is McDonald's Blending Into Starbucks?
- 10 Things Presidential Candidates Won't Say
Businesses bracing for additional costs as a result of the health-care law tend to be those that previously provided barebones coverage, or so-called "mini-med plans," which charge low premiums but provide limited benefits, according to a spokesman for the Department of Health and Human Services. These companies represent less than 2% of the market, according to the spokesman. Starbucks, on the other hand, doesn't anticipate additional expenses to insure its employees because its benefits already meet the standards of theAffordable Care Act, CFO Journal reports.
Even if companies haven't publicly discussed whether their increased health-care costs will trickle down to their price tags, executives have floated the possibility in meetings with investment pros. Nicholas Olesen, a financial planner with The Philadelphia Group, says his clients at large pharmaceutical and software companies have suggested that they may raise prices 2 or 3% while their employees pay up to 7% more in insurance premiums.
Still, says Funtleyder, it's in consumers' best interest for companies to keep their wage workers insured because they typically represent the young, healthy portion of the insurance market — and therefore their premiums subsidize the cost of care throughout the system. "If you have to pay more for your happy meal, you might have to pay less elsewhere," Funtleyder says.


text:
During the recent construction boom, nowhere was the trend of converting older properties into new condominiums more prevalent than in Miami. As prices for multi-family properties skyrocketed in 2004 and 2005, developers rushed in and snatched up old class-B and class-C office buildings to convert into sparkling new condominiums fetching up to $400,000 per unit.
During a 12-month span from September 2005 to September 2006, 6,600 new condo units were delivered to the market — nearly matching the total number of condos that opened in Miami during the previous 10 years combined.
But that was just the beginning. As of October 2006, another 22,254 units were under construction, according to the city's planning department. Currently, developers have plans to build 60,232 multi-family units — mostly condos — with roughly 25,000 of those slated to come online in the next 15 months, according to Housing Predictor, a market research firm.
And all of it could't be happening at a worse time.
The flood of new projects is coming in as prices for housing in the Miami area are crashing. The glut of new space, in fact, is just exacerbating the problem, drowning the market in new supply that it does't need (and spreading speculation that some of that supply will be scrapped before becoming a reality). It is because of this that Housing Predictor ranks Miami as the worst housing market in the entire country. It anticipates that the wash of new supply will send prices down 12.7 percent this year alone. (Currently, the median housing price in Miami is $348,000.)
Meanwhile, Forbes magazine named Miami the riskiest real estate market in the country. Most ominously, in late July, Mark Zandi, chief economist at West Chester, Pa.-based Moody's Economy.com, predicted that the rash of condos — the largest supply to hit the city in 30 years — will send prices down as much as 30 percent. Zandi predicts the impact could be so widespread as to send the entire state of Florida into recession as early as October.
The retail sector would not be spared in the potential bloodbath.
Already projections call for retail sales growth in the city to fall to 4.7 percent in 2007, down from 8 percent in 2006, according to a report from Marcus & Millichap Real Estate Investment Services. That is a direct consequence of the housing fallout, according to Kirk Olsen, a member of the national retail group with the firm.
"You drive around here and you'll see a lot of high-rises that haven't been finished yet and a lot of those still haven't sold their units," he says. "It's hard to know right now what the end result will be."
However, there are reasons to believe the impact on retail real estate will be muted. For one, Miami remains a popular tourist destination, both for domestic and international travelers, many of whom come to shop the city's collection of luxury retailers. On that front, the city is still drawing new chains. In just the past few months, Danish furniture store Bo Concept and Brazilian Artefacto, as well as Spanish apparel chain Custo Barcelona and French Lollipops have secured storefronts in and around Miami.
"The amount of retail space per capita is much lower here than in other parts of Florida, so with tourism, you get a recipe for healthy retail," says Rod L. Castan, vice president with Courtelis Co., a Miami-based developer with a 2.5-million-square-foot retail portfolio.
Moreover, the wave of overbuilding sweeping the multi-family sector is not being replicated on the retail side. Developers will add 1.7 million square feet of retail space to the market this year, which is a bit less than the 2 million square feet of space that was delivered in 2006. Because of this, Marcus & Millichap predicts retail rents will actually increase this year by 5.6 percent to $22.48 per square foot (though this year to date, rents have risen only 1.1 percent). Meanwhile, vacancies are expected to rise a modest 20 basis points to 4.8 percent.
On the investment sales side, however, activity has slowed a bit. The price per square foot on retail properties has fallen to $232 this year, a 5-percent decrease from $245 per square foot in 2006, reports Real Capital Analytics. Anecdotally, Olsen says that while in 2006 every property Marcus & Millichap marketed would get six to eight offers, this year they are only getting two or three.
Getting off on the ground floor
Making matters worse is the fact that many of the high rises being erected include ground-floor retail. But because a lot of those spaces feature the wrong configurations and ceiling heights for retail uses, owners will be challenged in finding tenants eager to take them, according to Paco Diaz, senior vice president of retail properties with CB Richard Ellis Group, Inc. "They'll get leased, everything gets leased with time, but it will take a little longer [than usual]," he says.
But brokers in the market do think that retail real estate will be buffered somewhat by the fact, that unlike the multi-family sector, it is not being overbuilt, in part because large sites are hard to come by in Miami. The lack of developable land means that new construction is expensive. It encourages vertical development. That, in effect, limits how much new retail can be built, because only the first three floors of a tall project would ever be considered for retail uses.
"There are not a lot of [sites] for new development and the entitlement [process] is challenging, so what you do is redevelopment given the density in the area," says Paul Maxwell, vice president of investments with Regency Centers.
An example is the Shops at Midtown Miami, a 633,001-square-foot property being built by Beachwood, Ohio-based Developers Diversified Realty Corp. on North Miami Avenue. The project is integral to the redevelopment of the 55-acre Buena Vista Rail Yard site near the city's downtown and will be surrounded by performing arts venues and office buildings. The redevelopment does, however, also include construction of 3,000 new condo units.
Another mega-project currently in the works is Metropolitan Miami, a $1 billion mixed-use property downtown being developed by Miami-based MDM Development Group. Metropolitan Miami will boast a 120,000-square-foot Met Square lifestyle center, 120,000 square feet of additional retail, 750,000 square feet of class-A office space and a 386-room luxury hotel, as well as 1,144 condominium units. It is scheduled for completion in the third quarter of 2009.
Meanwhile, Regency Centers is undergoing the entitlement process for a traditional 400,000-square-foot shopping center in West Miami that will include big-box retailers, smaller shops, banks and restaurants. The development is set to come online in 2010.
Cuts both ways
In a bit of good news, 2007 has brought a respite from hurricane-related insurance rate increases and the labor shortages that have plagued the Sunshine State over the past few years. In the wake of Hurricanes Rita and Wilma, insurance rates in Florida skyrocketed by as much as 600 percent. However, in the last month, brokers including Diaz have noticed a 10-percent decline. Rod Castan notes the rates have flatlined.
With the housing market cooling off, industry observers note at least one positive. It's been easier for developers to find qualified construction professionals, a task that had been a challenge during the white-hot construction boom of 2006.
Building in Miami, however, is still not cheap. Overall, construction costs have gone up 8.9 percent between January 2006 and January 2007, according to Reed Construction Data. The city currently ranks as number 35 on Reed's list of the most expensive markets to build in, behind New York, Las Vegas and Washington, but ahead of Orlando and Atlanta. Last year, Miami ranked as number 41.
"We've seen labor costs ease a little bit, but steel and concrete prices remain pretty high," says Castan. "The good news is that there is more availability of contractors, so you can get more competitive bidding on your projects, but there hasn't been a huge change in [overall construction] costs."
Population in 2000: 5,007,564
Population in 2007: 5,503,911
Percent Change 2000-2007: 9.9%
Miami Metropolitan Area: 3.1%
Florida: 3.4% U.S.: 4.5%
Broward County $44,680
Miami-Dade County $41,983
Palm Beach County $47,665
Source: Pitney Bowes MapInfo, July 2007.


text: The Orange Bowl cost $340,000 when construction was completed in 1937. It was originally named Burdine Stadium and renamed for the Orange Bowl Classic in 1959. The original capacity was 23,330. It is currently 74,476 with potential to reach 82,000 for concerts and other events. The original playing surface was grass. Poly-Turf was installed in 1970. It was replaced in 1972 and replaced with Prescription Athletic Turf in 1976. The Orange Bowl, located between N.W. 3rd and 7th Streets and N.W. 14th and 16th Avenues in Miami, has 4,000 parking spaces with an estimated 20,000 available in surrounding areas. The City of Miami plans to demolish the Orange Bowl in 2008, but the memories will remain part of the South Florida's sports fabric. Many memorable games were played at the Orange Bowl. Super Bowl II (Green Bay 33, Oakland 14), Super Bowl III (New York Jets 16, Baltimore 7), Super Bowl V (Baltimore 16, Dallas 13), Super Bowl X (Pittsburgh 21, Dallas 17) and Super Bowl XIII (Pittsburgh 35, Dallas 31). The FedEx Orange Bowl Classic was played there from 1937 until 1995, and it produced 13 national champions. The University of Miami Hurricanes made it their home for 70 years and won three national championships (1983, 1988 and 1991) there. They played mostly on Friday nights from the 1950s through the early 1970s. The team had a 318-143-7 (.679) record there and a 58-game home winning streak, longest in college football history. The Dolphins joined the American Football League in 1966 and played their home games in the Orange Bowl through the 1986 season. Florida International University played home games there in 2007. The Golden Panthers played the final college football game in the Orange Bowl on Dec. 1, 2007 against North Texas. The Miami Marlins minor league baseball team played occasionally games there from 1956-1960. On Aug. 7, 1956, 50-year-old Satchel Paige, pitching for the Marlins, beat Columbus of the International League before 57,000 fans, the largest crowd to see a minor league game. The U.S. men's and women's national soccer teams played matches there. On July 25, 1996, the women played a scoreless tie with China in an Olympic qualifying match before 43,525 fans, the largest crowd to see a women's match. The men beat Haiti 3-0 in Gold Cup competition before 49,513 fans on Feb. 12, 2000. The Miami Seahawks of the All-American Football Conference played there in 1946. The Miami Toros of the North American Soccer League (1972-76) and the Miami Freedom of the American Soccer League/American Professional Soccer League (1988-1992) played there.


text:
Frederik Wellmann
A. MS. notebook
Perceptual judgments as involving generality and as being beyond the power of logic to criticize, as referring to singular objects, and as relating to continuous change (time, continuity, infinity). The nature of logical goodness and the end of argumentation. Logic and metaphysics. Pragmatism: the genealogy of a born pragmatist pragmatism and realism the ultimate meaning of a symbol. CSP's acceptance of the term "meaning" as a technical term of logic (as referring to the total intended interpretant of a symbol). The meaning of an argument and of a proposition (rhema) the meanings of such difficult abstractions as Pure Being, Quality, Relation. Definitions, it is stated, should be "in terms of the conceptions of everyday life." CSP raises one possible objection to his formulation of the maxim of pragmatism, and ends this draft with some disparaging remarks about the state of logical studies at Harvard. The objection raised is this: If meaning consists in doing (or the intention to do), is there not a conflict with the view (to which CSP subscribes) that the meaning of an argument is its conclusion, since a conclusion is an intellectual phenomenon different from doing and presumably without relation to it?
Argument, pure Being, Continuity, Definition, Generality, Harvard, Infinity, Logic (modal see Modality), Meaning, Metaphysics, Harvard Lectures on Pragmatism, and judgment, Pragmatism and Pragmaticism, Proposition, Quality (see also Feeling Firstness Possibility Predicate), Realism, Relation, Rhema (see also Proposition), Symbol, Time
pp 1-31


text:
Pacific Soul Tattoo was first established in 2004 in Waikiki, under the name Primitive Black Tattoo. Since its inception, there have been many talented artists, local and international that have worked there.
With its combination of artistic talent and influence from different artists and their travels, Pacific Soul Tattoo has been given a reputation to take on any creation or idea brought to its artists. With their diverse background and experiences in their careers in the industry, the shop has been given the opportunity to give our clients these qualities in our artwork that Pacific Soul Tattoo has to offer.
Each of our artists work by appointment but will take on any walk-ins upon availability. All tattoos are custom made and are a direct reflection of our clients personalities and their beliefs.
On another note, we would like to give thanks to all the artists and clients that have come through our shop and help make it what it is today.
• All artists work by appointment
• Walk-ins are welcomed if an artist is available
• No phone appointments
• No estimates or prices will be given online or by telephone
• You must come into the shop for a quote
• A deposit is required to secure an appoinment for a tattoo
• All deposits are non-refundable, and are credited towards a tattoo upon completion
Tattoo Stories by Smart Imagination is the premier book in a series dedicated to a five-year documentary on the stories behind tattoos while progressively raising funds for children in need through the Starlight Children's Foundation.
The art of tattoos has intrigued many people in various cultures around the world. Tattoo Stories will not only address taboos plaguing the art form, but will draw readers in for an intimate look at journeys, experiences and cultures, through spoken word paired with stunning photography by Marvin Malzahn.
A beautiful luxurious anthology of 80 U.S. go-getter artists welling up in a tattoo boom. This book is the one of the eternal standing matters. Tattoo art is ultimate art to shake instinct hidden in a human being. And this is the art expression that "only a genuine engraver" has! Book is softcover, well bound, appx. 8.5" x 11" and 256 pages!!


text:
Bed and Breakfast Rieu du Moulin (Saint sauveur Hainaut)
Environ 19 km de Maubray
You will find the Bed and Breakfast"Rieu du Moulin" in the heart of " Pays desCollines ... Read more
Bed and breakfasts of charm Maubray and the vicinity
Popular cities
Select the services
Bed and Breakfast Rieu du Moulin (Saint sauveur Hainaut)
Bed and Breakfast Easy Tempo (Frasnes lez anvaing Hainaut)
Environ 21 km de Maubray
5 Review
Bed and Breakfast (3 stars) charming and quiet in the village of Oeudeghein in the beautiful Natural Park of "Pays des Collines." All rooms with air conditioned and wifi.
Bed and Breakfast Entre Monts et Collines (Mont de l enclus Hainaut)
Environ 21 km de Maubray
Descriptive text in
Bed and Breakfast Dans Tes Reves (Angre Hainaut)
Environ 25 km de Maubray
Descriptive text in
Bed and Breakfast Les Ecuries de la Marque (Villeneuve d ascq Nord)
Environ 26 km de Maubray
6 Review
"country in the town". Anne Borrin is happy to welcome you in her farm completely renovated to receive you as a privileged guest. At 10 minutes from Lille center, you'll find ... Read more
Bed and Breakfast Les Peupliers (Erbisoeul Hainaut)
Environ 27 km de Maubray
4 Review
Descriptive text in
Bed and Breakfast Le Pavillon de Beaumont (Croix Nord)
Environ 27 km de Maubray
20 Review
An exceptional setting! Pavillon de Beaumont located at Croix, right in the heart of Lille. Bordered by gardens, and totally independent, our guest rooms of charm will bring you peace and ... Read more
Bed and Breakfast La Maison d'Adam (Hellemmes lille Nord)
Environ 28 km de Maubray
12 Review
Near the center of Lille by subway (station lezennes in 300 m ), in a big garden in flowers, the Adam's house offers to you comfort, quiet and charm as in ... Read more


text:
The phone that works like your PC
Meet the Lumia 950. It's the Lumia you've been waiting for.LEARN MORE
The most productive devices on the planet.
Lumia 950 XL Dual Sim
Big on power and performance, with a display to matchLEARN MORE
Lumia 950
The phone that works like your PCLEARN MORE
Lumia 650
The new Microsoft Lumia 650 with Windows 10LEARN MORE
One Experience. Everywhere.
Office for Lumia
With Windows 10, your important Office documents are in sync across all your devices.1LEARN MORE
Your own personal assistant
Cortana gets to know you and gives you a personalized snapshot of your entire day. 2LEARN MORE
Superior performance
The Lumia 950 and 950 XL have a powerful processor and excellent battery life.LEARN MORE
Advanced imaging
Take fantastic pictures with the 20 MP camera sensor on the Lumia 950 and 950 XL.LEARN MORE
Discover Windows Continuum
Plug your Lumia 950 or 950 XL into a Microsoft Display Dock and use Continuum to enjoy a smooth PC-like experience that's powered by your phone.LEARN MORE
More information on Microsoft and Lumia phones
Welcome to Lumia
Discover a more personal smartphone experienceWELCOME TO LUMIA
Windows 10
Do great things with the latest Windows experience on Lumia.WINDOWS 10
Looking for Nokia phones?
Learn more about the latest Nokia phones on the Nokia websiteLOOKING FOR NOKIA PHONES
1 Features vary by device. Office license sold separately on some PCs and Tablets.
2 Cortana available in select markets at launch; experience may vary by region and device.


text:
by Hugh Gilmore
After some hesitation, I missed a writing deadline for the first time this week. I did give my editor a week's notice, so I wasn't entirely remiss, and he encouraged me to keep "plugging away." The next deadline comes at the end of August, but right now September feels like tomorrow to me.
The editor's name is Jock Richardson, and he lives in Scotland. He spends as much of the year as possible in Spain, an almost necessary condition, since he edits La Divisa, the most influential English-language bullfighting journal in the world. It is published by Club Taurino of London. I've never met Jock, but his letters to me sound gravelly voiced and gruff, and quite strict – in an avuncular way. He sounds as though he's encouraging a young, stupid person. He does not know that I'm not young.
I've mentioned in previous columns this year that I'm writing a novel based on George Bizet's opera "Carmen." With a twist. The bullfighter character, Escamillo, who was originally portrayed as a charismatic celebrity dolt, appears in my book as a real, flesh-and-blood man who has hopes and dreams beyond the bullfighting arena. Most notably, he deeply loves Carmen, the gypsy dancer and singer. She loves him, too. Only, her ex-boyfriend stalks her and murders her one day. Escamillo is bereft, inconsolable, set adrift in the world to make sense of the senseless.
While his wounds are still raw, the deadly "Seville Love Triangle" becomes the daily stuff of the newspapers and magazines of the day. The story goes international. Within two years Georges Bizet, the French composer, together with his producers, has created and mounted for the Paris Opera-Comique an opera that defiles Escamillo's love of Carmen. Bizet's opera portrays her as a free-loving slut, her ex-boyfriend, Don Jose, as a victim of her wiles, and Escamillo as a smug dunce.
Escamillo is enraged. He interrupts his bullfighting schedule to go to Paris, intending to confront the opera company presenting "Carmen" and demand that they stop.
Part of his plan, at one point, includes trying to seduce every female principle of the cast. He soon discovers the truth of the old adage about the horrors of "answered prayers."
I can't tell you more just now. I must return to my theme for today: Escamillo is a matador; how do I learn enough about torero (the techniques and art of bullfighting) to make my character convincing?
The technique part is fairly easily answered by reading, watching movies, and talking to people who know tauromachy (the study of bulls and bullfighting). And, oh yes, I know, I should spend the next 20 years in Spain. (I will, just as soon as I clear my calendar. By the way, an important 20th-century matador/writer/artist, John Fulton Short, grew up originally in Philadelphia.)
The harder part of the quest, knowing the mind of a matador, is not as accessible. I'm reading biographies, memoirs, autobiographies and interviews as fast as I can. I'd like to know, for example, if there's a way that matadors carry themselves so that you'd know one if you saw him in street clothes. Would you notice grace? His confidence? Or arrogance? Does the image projected in the arena carry over into civilian life?
Are all bullfighters alike in their mental makeup? They must be in many ways, but how would each one differ? Not so much in performance style, but, let's say, when he pauses before a mirror, or lies awake at light unable to sleep, or meets a woman he's attracted to.
The best novel on this subject that I've read so far has been Vicente Ibasco Ibanez' "Blood and Sand" (1919). The best non-fiction book has been Juan Luis Belmonte's "Belmonte: Killer of Bulls – The Autobiography of a Matador" (1935). I've read it twice. The high quality of the writing and the author's honest insights prompted me to want to write a re-appreciation of it for a new generation. The editor of La Divisa liked the pitch and gave me the go-ahead.
I began rereading, this time taking notes. Before long I knew too much to write the simple article I'd intended and not enough to write the complicated one that seemed necessary. Anyone who writes about a subject he enjoys must face this problem.
Here's an example: Belmonte's book is published "as told to" Manuel Chaves Nogales. Chaves Nogales was an award-winning, reform-minded, left wing Republican antifascist. The book was written on the even of the Spanish Civil War (1936-1939). Where does Belmonte end, and Chaves Nogales begin, in a book like this? Furthermore, the book appeared first in Spanish. The only English translation available is that of Leslie Charteris, the English mystery writer ("The Saint" series), published in 1937.
In order to state what was unique about Belmonte, I need to sift through Belmonte-Nogales-Charteris to intuit who is really speaking at any given point. And I can't limit my portrait to this one book, so I've sought to read other matadors' autobiographies.
Unfortunately, matadors (and athletes in general – worldwide) prior to recent times seem not to have felt that their lives deserved autobiographies. The few I've found were written in Spanish and haven't been translated. Why, oh why, did I let my high school counselor steer me into studying German? (Boys' high schools back then saw German as the language of science and engineering.)
There's a sentence I'd like to write for the La Divisa article – if it is true: "Belmonte is impressively honest when he writes about such matters as being unable to confess ignorance of a subject in conversation, or when he writes about a mid-career spell of boredom with bulls and bullfighting, even while in the arena."
But I don't know whether his honesty was unusual among toreros or not. I must read more autobiographies, biographies, memoirs, and interviews.
I explained all this to Mister Jock Richardson, the editor, and he's given me several good leads to help me learn what I need to. Here's hoping I make that end-of-summer deadline and get published in La Divisa, my first international writing credit.
In the meantime, my novel "Escamillo's Song," slowly but steadily grows.
See: enemiesofreading.blogspot.com for more of Hugh Gilmore's writings.


text:
Difference between revisions of "SELinux"
m (Shortened intro)
m (→Checking PAM)
|Line 333:
|Line 333:
# pam_selinux.so open should only be followed by sessions to be executed in the user context
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open
session required pam_selinux.so open
==Reference policy==
==Reference policy==
Revision as of 15:58, 24 May 2013
Security-Enhanced Linux (SELinux) is a Linux feature that provides a variety of security policies, including U.S. Department of Defense style mandatory access controls (MAC), through the use of Linux Security Modules (LSM) in the Linux kernel. It is not a Linux distribution, but rather a set of modifications that can be applied to Unix-like operating systems, such as Linux and BSD.
Running SELinux under a Linux distribution requires three things: An SELinux enabled kernel, SELinux Userspace tools and libraries, and SELinux Policies (mostly based on the Reference Policy). Some common Linux programs will also need to be patched/compiled with SELinux features.
- 1 Concepts: Mandatory Access Controls
- 2 Prerequisites
- 3 Installing SELinux
- 4 Configuration
- 5 Reference policy
- 6 SELinux Security Context
- 7 Post-installation steps
- 8 Useful tools
- 9 References
- 10 See also
Concepts: Mandatory Access Controls
Before you enable SELinux, it is worth understanding what it does. Simply and succinctly, SELinux enforces Mandatory Access Controls (MACs) on Linux. In contrast to SELinux, the traditional user/group/rwx permissions are a form of Discretionary Access Control (DAC). MACs are different from DACs because security policy and its execution are completely separated.
An example would be the use of the sudo command. When DACs are enforced, sudo allows temporary privilege escalation to root, giving the process so spawned unrestricted systemwide access. However, when using MACs, if the security administrator deems the process to have access only to a certain set of files, then no matter what the kind of privilege escalation used, unless the security policy itself is changed, the process will remain constrained to simply that set of files. So if sudo is tried on a machine with SELinux running in order for a process to gain access to files its policy does not allow, it will fail.
Another set of examples are the traditional (-rwxr-xr-x) type permissions given to files. When under DAC, these are user-modifiable. However, under MAC, a security administrator can choose to freeze the permissions of a certain file by which it would become impossible for any user to change these permissions until the policy regarding that file is changed.
As you may imagine, this is particularly useful for processes which have the potential to be compromised, i.e. web servers and the like. If DACs are used, then there is a particularly good chance of havoc being wrecked by a compromised program which has access to privilege escalation.
For further information, do visit the MAC Wikipedia page.
This information was originally sourced from the Debian Wiki.
Only ext2, ext3, ext4, JFS, XFS and BtrFS filesystems are supported to use SELinux. Some filesystems have a few quirks which you should be aware of before migration, though:
- BtrFS: Currently an autorelabel operation won't cover subvolumes on btrfs. You need to manually relabel the subvolume. Once it's labelled everything will work correctly.
- XFS: XFS users should use 512 byte inodes (the default is 256). SELinux uses extended attributes for storing security labels in files. XFS stores this in the inode, and if the inode is too small, an extra block has to be used, which wastes a lot of space and incurs performance penalties.
# mkfs.xfs -i size=512 /dev/sda1 (for example)
- SquashFS: SquashFS supports xattr (which is required for SELinux file labeling) since kernel version 2.6.30.
- ReiserFS: ReiserFS has partial support for SELinux as it supports extended attributes but not atomic labelling meaning that newly created files will not have a SELinux context. This makes using SELinux under ReiserFS quite painful. ReiserFS is therefore not supported by utilities like
fixfiles, so you should first migrate to one of the above listed filesystems if you intend to use SELinux.
Also, please do make sure that Xattr (Extended Attributes) are enabled for your filesystems. To do that, you can issue the following command:
$zcat /proc/config.gz | grep -i <filesystem name>
<filesystem name> can be reiser, xfs, etc. Somewhere among the output should be something like:
If you just want to see what filesystems have extended attributes enabled, just issue:
$zcat /proc/config.gz | grep -i xattr
If the output says that your filesystems do not have xattrs enabled, you need to recompile the kernel to enable them. Also, if you wish to use ReiserFS despite the warnings given, also make sure that it has security labels enabled as a separate option.
Preparing the Kernel
By default, the Arch Kernel does not have the SELinux LSM enabled. To check, you can issue the command:
$ zcat /proc/config.gz | grep -i selinux
To which your output should be something of the sort:
# CONFIG_SECURITY_SELINUX is not set
if you have a stock kernel running. If you are in the mind to build a custom kernel, the following options should be enabled for maximum security, performance and effectiveness:
CONFIG_SECURITY_SELINUX=y CONFIG_SECURITY_SELINUX_BOOTPARAM=y CONFIG_SECURITY_SELINUX_DISABLE=y CONFIG_SECURITY_SELINUX_DEVELOP=y CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=1 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1 CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT=y CONFIG_SECURITY_SELINUX_AVC_STATS=y CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX=n CONFIG_LSM_MMAP_MIN_ADDR=65536 CONFIG_DEFAULT_SECURITY_SELINUX=y CONFIG_EXT2_FS=y CONFIG_EXT2_FS_XATTR=y CONFIG_EXT2_FS_POSIX_ACL=y CONFIG_EXT2_FS_SECURITY=y CONFIG_EXT2_FS_XIP=y CONFIG_EXT4_FS=y CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y CONFIG_EXT4_DEBUG=y CONFIG_EXT3_FS=m CONFIG_EXT3_DEFAULTS_TO_ORDERED=y CONFIG_EXT3_FS_XATTR=y CONFIG_EXT3_FS_POSIX_ACL=y CONFIG_EXT3_FS_SECURITY=y CONFIG_REISERFS_FS=y CONFIG_REISERFS_CHECK=y CONFIG_REISERFS_PROC_INFO=y CONFIG_REISERFS_FS_XATTR=y CONFIG_REISERFS_FS_POSIX_ACL=y CONFIG_REISERFS_FS_SECURITY=y CONFIG_XFS_FS=y CONFIG_XFS_QUOTA=y CONFIG_XFS_POSIX_ACL=y CONFIG_XFS_RT=y CONFIG_XFS_DEBUG=y CONFIG_JFS_FS=m CONFIG_JFS_POSIX_ACL=y CONFIG_JFS_SECURITY=y CONFIG_JFS_DEBUG=y CONFIG_JFS_STATISTICS=y CONFIG_REISERFS_FS=y CONFIG_REISERFS_CHECK=y CONFIG_REISERFS_PROC_INFO=y CONFIG_REISERFS_FS_XATTR=y CONFIG_REISERFS_FS_POSIX_ACL=y CONFIG_REISERFS_FS_SECURITY=y CONFIG_BTRFS_FS=y CONFIG_BTRFS_FS_POSIX_ACL=y
Save the file in the directory you're building the kernel and then modify the PKGBUILD such that it goes from this:
if [ "${CARCH}" = "x86_64" ]; then cat "${srcdir}/config.x86_64" > ./.config else cat "${srcdir}/config" > ./.config fi
to this:
if [ "${CARCH}" = "x86_64" ]; then cat "${srcdir}/config.x86_64" > ./.config else cat "${srcdir}/config" > ./.config fi cat /absolute/path/to/config.selinux-custom >> ./.config
If you know what you're doing, then you can remove anything relating to filesystems you do not plan to use.
For those of you who do not wish to be bothered by kernel configuration or anything else regarding PKGBUILDs, simply install the package linux-selinuxAUR from the AUR.
Installing SELinux
Package description
All SELinux related packages belong to the selinux group. The group selinux-system-utilities is a group of modified packages from the
[core] repository. The group selinux-userspace contains packages from the SELinux Userspace project. Security policies belong to the selinux-policies group. Other packages are in the selinux-extras group. All the packages mentioned below are present in the AUR.
SELinux aware system utilities
- linux-selinuxAUR
- SELinux enabled kernel. It's not really needed, however, installing it comes recommended if you aren't a kernel tweaker.
- selinux-coreutilsAUR
- Modified coreutils package compiled with SELinux support enabled. It replaces the coreutils package
- selinux-flexAUR
- Flex version needed only to build checkpolicy. The normal flex package causes a failure in the checkmodule command. It replaces the flex package.
- selinux-pamAUR and selinux-pambaseAUR
- PAM package with pam_selinux.so. and the underlying base package. They replace the pam and pambase packages respectively.
- selinux-systemdAUR
- An SELinux aware version of Systemd. It replaces the systemd package.
- selinux-util-linuxAUR
- Modified util-linux package compiled with SELinux support enabled. It replaces the util-linux package.
- selinux-findutilsAUR
- Patched findutils package compiled with SELinux support to make searching of files with specified security context possible. It replaces the findutils package.
- selinux-sudoAUR
- Modified sudo package compiled with SELinux support which sets the security context correctly. It replaces the sudo package.
- selinux-psmiscAUR
- Psmisc package compiled with SELinux support; for example, it adds the
-Zoption to
killall. It replaces the psmisc package.
- selinux-shadowAUR
- Shadow package compiled with SELinux support; contains a modified
/etc/pam.d/loginfile to set correct security context for user after login. It replaces the shadow package.
- selinux-cronieAUR
- Fedora fork of Vixie cron with SELinux enabled. It replaces the cronie package.
- selinux-logrotateAUR
- Logrotate package compiled with SELinux support. It replaces the logrotate package.
- selinux-opensshAUR
- OpenSSH package compiled with SELinux support to set security context for user sessions. It replaces the openssh package.
SELinux userspace utilities
- selinux-usr-checkpolicyAUR
- Tools to build SELinux policy
- selinux-usr-libselinuxAUR
- Library for security-aware applications. Python bindings needed for semanage and setools now included.
- selinux-usr-libsemanageAUR
- Library for policy management. Python bindings needed for semanage and setools now included.
- selinux-usr-libsepolAUR
- Library for binary policy manipulation.
- selinux-usr-policycoreutilsAUR
- SELinux core utils such as newrole, setfiles, etc.
- selinux-usr-sepolgenAUR
- A Python library for parsing and modifying policy source.
SELinux policy packages
- selinux-refpolicyAUR
- Precompiled modular-otherways-vanilla Reference policy with headers and documentation but without sources.
- selinux-refpolicy-srcAUR
- Reference policy sources
- selinux-refpolicy-archAUR
- Precompiled modular Reference policy with headers and documentation but without sources. Development Arch Linux Refpolicy patch included, but for now [February 2011] it only fixes some issues with
Other SELinux tools
- selinux-setoolsAUR
- CLI and GUI tools to manage SELinux
- auditAUR
- This is the only package mentioned here which is available in the official repos. These are the user space utilities for storing and searching the audit records generated by the audit subsystem in the Linux kernel. SELinux (AVC) will log all denials using audit. Very useful in troubleshooting SELinux. Also
audit2allowuses logs from this program.
The credit for this section must go to jamesthebard for his outstanding work and documentation.
The first install needs to be of selinux-pambaseAUR and selinux-pamAUR. However, do not use
yaourt -S selinux-pam selinux-pambase or use
sudo after building to install the package. This is because pam is what handles authentication. Hence, it is best if the packages are built as an ordinary user using
makepkg and installed by root using a simple
pacman -U <packagename>.
Next, you need to build and install selinux-coreutilsAUR, selinux-usr-libsemanageAUR, selinux-shadowAUR, libcgroupAUR, selinux-usr-policycoreutilsAUR, selinux-cronieAUR, selinux-findutilsAUR, selinux-flexAUR, selinux-logrotateAUR, selinux-opensshAUR and selinux-psmiscAUR.
Next, the swig package needs to be downgraded to version 2.0.4-3, else the package selinux-setoolsAUR gives an error. The Arch Rollback machine may be used for the same.
Now comes the selinux-setoolsAUR package. For this, do make sure that you have the jdk7-openjdk package installed, in order for the
JAVA_HOME variable to be set properly. Also, you need to edit the PKGBUILD in order for it to compile properly. Change the PKGBUILD around line 14 so that it looks as follows:
optdepends=('glib2' 'gtk2>=2.8' 'bwidget>=1.8')
Next, backup your
/etc/sudoers file. Install selinux-sudoAUR, selinux-systemdAUR, selinux-usr-checkpolicyAUR, selinux-util-linuxAUR, audit and selinux-refpolicyAUR. The installation of selinux-refpolicy takes a considerable time subject to the number of files you have, the speed of your processor, etc.
After the installation of needed packages, you have to set up a few things so that SELinux can be used.
Changing boot loader configuration
If you've installed a new kernel, make sure that you update your bootloader accordingly
Run the following command:
# grub-mkconfig -o /boot/grub/grub.cfg
Change your syslinux.cfg file by adding:
LABEL arch-selinux LINUX ../vmlinuz-linux-selinux APPEND root=/dev/sda2 ro INITRD ../initramfs-linux-selinux.img
at the end. Change "linux-selinux" to whatever kernel you are using.
Editing fstab
Add following to
# SELinuxFS none /sys/fs/selinux selinuxfs noauto 0 0 # For /run tmpfs /run tmpfs mode=0755,nosuid,nodev,rootcontext=system_u:object_r:var_run_t 0 0
Do not forget to create the mount point:
# mkdir -p /sys/fs/selinux
If your /tmp is a tmpfs mounted location, then add the following:
# For a tmpfs type /tmp: tmpfs /tmp tmpfs defaults,noexec,nosuid,rootcontext=system_u:object_r:tmp_t 0 0
This is required because it is labelled as
system_u:object_r:tmpfs_t by SELinux, but most processes are configured to believe that the /tmp directory is labelled as
Starting the Audit Daemon
Issue the following command to start the Audit Daemon:
# systemctl start auditd.service
For enabling it permanently at boot, issue:
# systemctl enable auditd.service
Checking the main SELinux configuration file
The main SELinux configuration file (
/etc/selinux/config) is a part of the selinux-refpolicyAUR package currently in the AUR. Its default contents are as follows:
# This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings # instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=permissive # SELINUXTYPE= takes the name of SELinux policy to # be used. Current options are: # refpolicy (vanilla reference policy) # refpolicy-arch (reference policy with # Arch Linux patch) SELINUXTYPE=refpolicy
It is recommended to test your policies using the "SELINUX" parameter set to permissive. This does not actually enforce the policy but still logs everything to
/var/log/audit/audit.log. You can check error messages here, and once you're convinced that everything is moving along smoothly, you can change the value of "SELINUX" to enforcing
Checking PAM
A correctly set-up PAM is important to get the proper security context after login. Check for the presence of the following lines in
# pam_selinux.so close should be the first session rule session required pam_selinux.so close # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open
Now restart your machine to boot into an SELinux enabled environment.
Reference policy
The Reference Policy is now the standard policy source used to build SELinux policies. This provides a single source tree with supporting documentation that can be used to build policies for different purposes such as: confining important daemons, supporting MLS / MCS type policies and locking down systems so that all processes are under SELinux control.
There are currently two possible ways of installing reference policies: From a pre-compiled package (selinux-refpolicyAUR) or from the source package (selinux-refpolicy-srcAUR).
build.conf to avoid overwriting of the selinux-refpolicy package files.
Installing a precompiled refpolicy
Install selinux-refpolicyAUR from AUR. This is a the vanilla SELinux reference policy. This package includes policy headers (you can therefore compile your own modules), policy documentation and an install script which will load the policy for you and relabel your filesystem (which will likely take some time). It does not include any sources.
This package also includes the main SELinux configuration file (
/etc/selinux/config) defaulting to refpolicy and permissive SELinux enforcement for testing purposes.
You should verify that the policy was correctly loaded, i.e.
/etc/selinux/refpolicy/policy/policy.26 has non-zero size. If so and if you have installed selinux-systemdAUR and other needed packages, you are ready to reboot and make sure that everything works.
In case the policy was not correctly loaded you can issue the following commands:
<nowki># cd /usr/share/selinux/refpolicy # /bin/ls *.pp
To manually relabel your filesystem you can issue:
# /sbin/restorecon -r /
SELinux Security Context
SELinux defines security using a different mechanism than traditional Unix access controls. The best way to understand it is by example. For example, the SELinux security context of the apache homepage looks like the following:
$ls -Z /var/www/html/index.html -rw-r--r-- username username system_u:object_r:httpd_sys_content_t /var/www/html/index.html
The first three and the last columns should be familiar to any (Arch) Linux user. The fourth column is new and has the format:
To explain:
- User: The SELinux user identity. This can be associated to one or more roles that the SELinux user is allowed to use.
- Role: The SELinux role. This can be associated to one or more types the SELinux user is allowed to access.
- Type: When a type is associated with a process, it defines what processes (or domains) the SELinux user (the subject) can access. When a type is associated with an object, it defines what access permissions the SELinux user has to that object.
- Level: This optional field can also be know as a range and is only present if the policy supports MCS or MLS.
Post-installation steps
/sys/fs/selinux will not be mounted.
You can check that SELinux is working with
sestatus. You should get something like:
SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: refpolicy Current mode: permissive Mode from config file: permissive Policy MLS status: disabled Policy deny_unknown status: allowed Max kernel policy version: 28
To maintain correct context, you can use restorecond:
# systemctl enable restorecond
To switch to enforcing mode without reboot, you can use:
# echo 1 >/selinux/enforce
Useful tools
There are some tools/commands that can greatly help with SELinux.
- restorecon
- Restores the context of a file/directory (or recursively with
-R) based on any policy rules
- rlpkg
- Relabels any files belonging to that Gentoo package to their proper security context (if they have one)
- chcon
- Change the context on a specific file
- audit2allow
- Reads in log messages from the AVC log file and tells you what rules would fix the error. Do not just add these rules without looking at them though, they cannot detect errors in other places (e.g. the application is running in the wrong context in the first place), or sometimes things will generate error messages but may maintain functionality so it would be better to add dontaudit to just ignore the access attempts.
- Security Enhanced Linux
- Gentoo SELinux Handbook
- Fedora Project's SELinux Wiki
- NSA's Official SELinux Homepage
- Reference Policy Homepage
- SELinux Userspace Homepage
- SETools Homepage
See also
- AppArmor (Similar to SELinux, much easier to configure, less features.)


text:
The following crimes are from the week of July 21 to July 27, 2013.
July 21. 400 block W. Willow Grove Avenue. Complainant states that an unknown person broke the passenger side window of a 2004 Chevy Tahoe and stole a Kate Spade wallet containing money, Chanel sunglasses, pearl necklace, J. Crew leather pocketbook, credit cards and identification. Reported at 12 p.m.
July 22. 100 block Rex Avenue. A black male, Trevor Jones-Parker, residing in the unit block of E. Slocum Street, was arrested for theft of a gray K2 Zed mountain bike.
July 24. 8700 block Germantown Avenue. Complainant states that at approximately 4:45 p.m., an unknown black male walked into store and stole a bottle of Bacardi, pineapple flavored. Male, 5'9" tall, wearing a polo shirt.
July 26. 500 block W. Willow Grove Avenue. Complainant states that a black male stole change from vehicle and fled scene on bicycle going westbound. Male, 40's, unshaven, wearing a white t-shirt and black pants.
Summary – Four crimes for week: two thefts from vehicles and two other thefts.
Town Watch.
If you have been the victim of a crime and would like information, service or support, call Northwest Victim Services, 6301 Germantown Ave., Second Floor, Suite One, 215-438-4410. The service is free.