CAPABILITIES
Section: Linux Programmer's Manual (7)
Updated: 2014-08-19
Index
Return to Main Contents
NAME
capabilities - overview of Linux capabilities
DESCRIPTION
For the purpose of performing permission checks,
traditional UNIX implementations distinguish two categories of processes:
privileged
processes (whose effective user ID is 0, referred to as superuser or root),
and
unprivileged
processes (whose effective UID is nonzero).
Privileged processes bypass all kernel permission checks,
while unprivileged processes are subject to full permission
checking based on the process's credentials
(usually: effective UID, effective GID, and supplementary group list).
Starting with kernel 2.2, Linux divides the privileges traditionally
associated with superuser into distinct units, known as
capabilities,
which can be independently enabled and disabled.
Capabilities are a per-thread attribute.
Capabilities list
The following list shows the capabilities implemented on Linux,
and the operations or behaviors that each capability permits:
- CAP_AUDIT_CONTROL (since Linux 2.6.11)
-
Enable and disable kernel auditing; change auditing filter rules;
retrieve auditing status and filtering rules.
- CAP_AUDIT_READ (since Linux 3.16)
-
Allow reading the audit log via a multicast netlink socket.
- CAP_AUDIT_WRITE (since Linux 2.6.11)
-
Write records to kernel auditing log.
- CAP_BLOCK_SUSPEND (since Linux 3.5)
-
Employ features that can block system suspend
(epoll(7)
EPOLLWAKEUP,
/proc/sys/wake_lock).
- CAP_CHOWN
-
Make arbitrary changes to file UIDs and GIDs (see
chown(2)).
- CAP_DAC_OVERRIDE
-
Bypass file read, write, and execute permission checks.
(DAC is an abbreviation of "discretionary access control".)
- CAP_DAC_READ_SEARCH
-
-
- *
-
Bypass file read permission checks and
directory read and execute permission checks;
- *
-
Invoke
open_by_handle_at(2).
- CAP_FOWNER
-
-
- *
-
Bypass permission checks on operations that normally
require the filesystem UID of the process to match the UID of
the file (e.g.,
chmod(2),
utime(2)),
excluding those operations covered by
CAP_DAC_OVERRIDE
and
CAP_DAC_READ_SEARCH;
- *
-
set extended file attributes (see
chattr(1))
on arbitrary files;
- *
-
set Access Control Lists (ACLs) on arbitrary files;
- *
-
ignore directory sticky bit on file deletion;
- *
-
specify
O_NOATIME
for arbitrary files in
open(2)
and
fcntl(2).
- CAP_FSETID
-
Don't clear set-user-ID and set-group-ID permission
bits when a file is modified;
set the set-group-ID bit for a file whose GID does not match
the filesystem or any of the supplementary GIDs of the calling process.
- CAP_IPC_LOCK
-
Lock memory
(mlock(2),
mlockall(2),
mmap(2),
shmctl(2)).
- CAP_IPC_OWNER
-
Bypass permission checks for operations on System V IPC objects.
- CAP_KILL
-
Bypass permission checks for sending signals (see
kill(2)).
This includes use of the
ioctl(2)
KDSIGACCEPT
operation.
- CAP_LEASE (since Linux 2.4)
-
Establish leases on arbitrary files (see
fcntl(2)).
- CAP_LINUX_IMMUTABLE
-
Set the
FS_APPEND_FL
and
FS_IMMUTABLE_FL
i-node flags (see
chattr(1)).
- CAP_MAC_ADMIN (since Linux 2.6.25)
-
Override Mandatory Access Control (MAC).
Implemented for the Smack Linux Security Module (LSM).
- CAP_MAC_OVERRIDE (since Linux 2.6.25)
-
Allow MAC configuration or state changes.
Implemented for the Smack LSM.
- CAP_MKNOD (since Linux 2.4)
-
Create special files using
mknod(2).
- CAP_NET_ADMIN
-
Perform various network-related operations:
-
- *
-
interface configuration;
- *
-
administration of IP firewall, masquerading, and accounting;
- *
-
modify routing tables;
- *
-
bind to any address for transparent proxying;
- *
-
set type-of-service (TOS)
- *
-
clear driver statistics;
- *
-
set promiscuous mode;
- *
-
enabling multicasting;
- *
-
use
setsockopt(2)
to set the following socket options:
SO_DEBUG,
SO_MARK,
SO_PRIORITY
(for a priority outside the range 0 to 6),
SO_RCVBUFFORCE,
and
SO_SNDBUFFORCE.
- CAP_NET_BIND_SERVICE
-
Bind a socket to Internet domain privileged ports
(port numbers less than 1024).
- CAP_NET_BROADCAST
-
(Unused) Make socket broadcasts, and listen to multicasts.
- CAP_NET_RAW
-
-
- *
-
use RAW and PACKET sockets;
- *
-
bind to any address for transparent proxying.
- CAP_SETGID
-
Make arbitrary manipulations of process GIDs and supplementary GID list;
forge GID when passing socket credentials via UNIX domain sockets.
- CAP_SETFCAP (since Linux 2.6.24)
-
Set file capabilities.
- CAP_SETPCAP
-
If file capabilities are not supported:
grant or remove any capability in the
caller's permitted capability set to or from any other process.
(This property of
CAP_SETPCAP
is not available when the kernel is configured to support
file capabilities, since
CAP_SETPCAP
has entirely different semantics for such kernels.)
If file capabilities are supported:
add any capability from the calling thread's bounding set
to its inheritable set;
drop capabilities from the bounding set (via
prctl(2)
PR_CAPBSET_DROP);
make changes to the
securebits
flags.
- CAP_SETUID
-
Make arbitrary manipulations of process UIDs
(setuid(2),
setreuid(2),
setresuid(2),
setfsuid(2));
make forged UID when passing socket credentials via UNIX domain sockets.
- CAP_SYS_ADMIN
-
-
- *
-
Perform a range of system administration operations including:
quotactl(2),
mount(2),
umount(2),
swapon(2),
swapoff(2),
sethostname(2),
and
setdomainname(2);
- *
-
perform privileged
syslog(2)
operations (since Linux 2.6.37,
CAP_SYSLOG
should be used to permit such operations);
- *
-
perform
VM86_REQUEST_IRQ
vm86(2)
command;
- *
-
perform
IPC_SET
and
IPC_RMID
operations on arbitrary System V IPC objects;
- *
-
override
RLIMIT_NPROC
resource limit;
- *
-
perform operations on
trusted
and
security
Extended Attributes (see
attr(5));
- *
-
use
lookup_dcookie(2);
- *
-
use
ioprio_set(2)
to assign
IOPRIO_CLASS_RT
and (before Linux 2.6.25)
IOPRIO_CLASS_IDLE
I/O scheduling classes;
- *
-
forge UID when passing socket credentials;
- *
-
exceed
/proc/sys/fs/file-max,
the system-wide limit on the number of open files,
in system calls that open files (e.g.,
accept(2),
execve(2),
open(2),
pipe(2));
- *
-
employ
CLONE_*
flags that create new namespaces with
clone(2)
and
unshare(2);
- *
-
call
perf_event_open(2);
- *
-
access privileged
perf
event information;
- *
-
call
setns(2);
- *
-
call
fanotify_init(2);
- *
-
perform
KEYCTL_CHOWN
and
KEYCTL_SETPERM
keyctl(2)
operations;
- *
-
perform
madvise(2)
MADV_HWPOISON
operation;
- *
-
employ the
TIOCSTI
ioctl(2)
to insert characters into the input queue of a terminal other than
the caller's controlling terminal;
- *
-
employ the obsolete
nfsservctl(2)
system call;
- *
-
employ the obsolete
bdflush(2)
system call;
- *
-
perform various privileged block-device
ioctl(2)
operations;
- *
-
perform various privileged filesystem
ioctl(2)
operations;
- *
-
perform administrative operations on many device drivers.
- CAP_SYS_BOOT
-
Use
reboot(2)
and
kexec_load(2).
- CAP_SYS_CHROOT
-
Use
chroot(2).
- CAP_SYS_MODULE
-
Load and unload kernel modules
(see
init_module(2)
and
delete_module(2));
in kernels before 2.6.25:
drop capabilities from the system-wide capability bounding set.
- CAP_SYS_NICE
-
-
- *
-
Raise process nice value
(nice(2),
setpriority(2))
and change the nice value for arbitrary processes;
- *
-
set real-time scheduling policies for calling process,
and set scheduling policies and priorities for arbitrary processes
(sched_setscheduler(2),
sched_setparam(2),
shed_setattr(2));
- *
-
set CPU affinity for arbitrary processes
(sched_setaffinity(2));
- *
-
set I/O scheduling class and priority for arbitrary processes
(ioprio_set(2));
- *
-
apply
migrate_pages(2)
to arbitrary processes and allow processes
to be migrated to arbitrary nodes;
- *
-
apply
move_pages(2)
to arbitrary processes;
- *
-
use the
MPOL_MF_MOVE_ALL
flag with
mbind(2)
and
move_pages(2).
- CAP_SYS_PACCT
-
Use
acct(2).
- CAP_SYS_PTRACE
-
-
- *
-
Trace arbitrary processes using
ptrace(2);
- *
-
apply
get_robust_list(2)
to arbitrary processes;
- *
-
transfer data to or from the memory of arbitrary processes using
process_vm_readv(2)
and
process_vm_writev(2).
- *
-
inspect processes using
kcmp(2).
- CAP_SYS_RAWIO
-
-
- *
-
Perform I/O port operations
(iopl(2)
and
ioperm(2));
- *
-
access
/proc/kcore;
- *
-
employ the
FIBMAP
ioctl(2)
operation;
- *
-
open devices for accessing x86 model-specific registers (MSRs, see
msr(4))
- *
-
update
/proc/sys/vm/mmap_min_addr;
- *
-
create memory mappings at addresses below the value specified by
/proc/sys/vm/mmap_min_addr;
- *
-
map files in
/proc/bus/pci;
- *
-
open
/dev/mem
and
/dev/kmem;
- *
-
perform various SCSI device commands;
- *
-
perform certain operations on
hpsa(4)
and
cciss(4)
devices;
- *
-
perform a range of device-specific operations on other devices.
- CAP_SYS_RESOURCE
-
-
- *
-
Use reserved space on ext2 filesystems;
- *
-
make
ioctl(2)
calls controlling ext3 journaling;
- *
-
override disk quota limits;
- *
-
increase resource limits (see
setrlimit(2));
- *
-
override
RLIMIT_NPROC
resource limit;
- *
-
override maximum number of consoles on console allocation;
- *
-
override maximum number of keymaps;
- *
-
allow more than 64hz interrupts from the real-time clock;
- *
-
raise
msg_qbytes
limit for a System V message queue above the limit in
/proc/sys/kernel/msgmnb
(see
msgop(2)
and
msgctl(2));
- *
-
override the
/proc/sys/fs/pipe-size-max
limit when setting the capacity of a pipe using the
F_SETPIPE_SZ
fcntl(2)
command.
- *
-
use
F_SETPIPE_SZ
to increase the capacity of a pipe above the limit specified by
/proc/sys/fs/pipe-max-size;
- *
-
override
/proc/sys/fs/mqueue/queues_max
limit when creating POSIX message queues (see
mq_overview(7));
- *
-
employ
prctl(2)
PR_SET_MM
operation;
- *
-
set
/proc/PID/oom_score_adj
to a value lower than the value last set by a process with
CAP_SYS_RESOURCE.
- CAP_SYS_TIME
-
Set system clock
(settimeofday(2),
stime(2),
adjtimex(2));
set real-time (hardware) clock.
- CAP_SYS_TTY_CONFIG
-
Use
vhangup(2);
employ various privileged
ioctl(2)
operations on virtual terminals.
- CAP_SYSLOG (since Linux 2.6.37)
-
-
- *
-
Perform privileged
syslog(2)
operations.
See
syslog(2)
for information on which operations require privilege.
- *
-
View kernel addresses exposed via
/proc
and other interfaces when
/proc/sys/kernel/kptr_restrict
has the value 1.
(See the discussion of the
kptr_restrict
in
proc(5).)
- CAP_WAKE_ALARM (since Linux 3.0)
-
Trigger something that will wake up the system (set
CLOCK_REALTIME_ALARM
and
CLOCK_BOOTTIME_ALARM
timers).
Past and current implementation
A full implementation of capabilities requires that:
- 1.
-
For all privileged operations,
the kernel must check whether the thread has the required
capability in its effective set.
- 2.
-
The kernel must provide system calls allowing a thread's capability sets to
be changed and retrieved.
- 3.
-
The filesystem must support attaching capabilities to an executable file,
so that a process gains those capabilities when the file is executed.
Before kernel 2.6.24, only the first two of these requirements are met;
since kernel 2.6.24, all three requirements are met.
Thread capability sets
Each thread has three capability sets containing zero or more
of the above capabilities:
- Permitted:
-
This is a limiting superset for the effective
capabilities that the thread may assume.
It is also a limiting superset for the capabilities that
may be added to the inheritable set by a thread that does not have the
CAP_SETPCAP
capability in its effective set.
If a thread drops a capability from its permitted set,
it can never reacquire that capability (unless it
execve(2)s
either a set-user-ID-root program, or
a program whose associated file capabilities grant that capability).
- Inheritable:
-
This is a set of capabilities preserved across an
execve(2).
It provides a mechanism for a process to assign capabilities
to the permitted set of the new program during an
execve(2).
- Effective:
-
This is the set of capabilities used by the kernel to
perform permission checks for the thread.
A child created via
fork(2)
inherits copies of its parent's capability sets.
See below for a discussion of the treatment of capabilities during
execve(2).
Using
capset(2),
a thread may manipulate its own capability sets (see below).
Since Linux 3.2, the file
/proc/sys/kernel/cap_last_cap
exposes the numerical value of the highest capability
supported by the running kernel;
this can be used to determine the highest bit
that may be set in a capability set.
File capabilities
Since kernel 2.6.24, the kernel supports
associating capability sets with an executable file using
setcap(8).
The file capability sets are stored in an extended attribute (see
setxattr(2))
named
security.capability.
Writing to this extended attribute requires the
CAP_SETFCAP
capability.
The file capability sets,
in conjunction with the capability sets of the thread,
determine the capabilities of a thread after an
execve(2).
The three file capability sets are:
- Permitted (formerly known as forced):
-
These capabilities are automatically permitted to the thread,
regardless of the thread's inheritable capabilities.
- Inheritable (formerly known as allowed):
-
This set is ANDed with the thread's inheritable set to determine which
inheritable capabilities are enabled in the permitted set of
the thread after the
execve(2).
- Effective:
-
This is not a set, but rather just a single bit.
If this bit is set, then during an
execve(2)
all of the new permitted capabilities for the thread are
also raised in the effective set.
If this bit is not set, then after an
execve(2),
none of the new permitted capabilities is in the new effective set.
Enabling the file effective capability bit implies
that any file permitted or inheritable capability that causes a
thread to acquire the corresponding permitted capability during an
execve(2)
(see the transformation rules described below) will also acquire that
capability in its effective set.
Therefore, when assigning capabilities to a file
(setcap(8),
cap_set_file(3),
cap_set_fd(3)),
if we specify the effective flag as being enabled for any capability,
then the effective flag must also be specified as enabled
for all other capabilities for which the corresponding permitted or
inheritable flags is enabled.
Transformation of capabilities during execve()
During an
execve(2),
the kernel calculates the new capabilities of
the process using the following algorithm:
P'(permitted) = (P(inheritable) & F(inheritable)) |
(F(permitted) & cap_bset)
P'(effective) = F(effective) ? P'(permitted) : 0
P'(inheritable) = P(inheritable) [i.e., unchanged]
where:
-
- P
-
denotes the value of a thread capability set before the
execve(2)
- P'
-
denotes the value of a capability set after the
execve(2)
- F
-
denotes a file capability set
- cap_bset
-
is the value of the capability bounding set (described below).
Capabilities and execution of programs by root
In order to provide an all-powerful
root
using capability sets, during an
execve(2):
- 1.
-
If a set-user-ID-root program is being executed,
or the real user ID of the process is 0 (root)
then the file inheritable and permitted sets are defined to be all ones
(i.e., all capabilities enabled).
- 2.
-
If a set-user-ID-root program is being executed,
then the file effective bit is defined to be one (enabled).
The upshot of the above rules,
combined with the capabilities transformations described above,
is that when a process
execve(2)s
a set-user-ID-root program, or when a process with an effective UID of 0
execve(2)s
a program,
it gains all capabilities in its permitted and effective capability sets,
except those masked out by the capability bounding set.
This provides semantics that are the same as those provided by
traditional UNIX systems.
Capability bounding set
The capability bounding set is a security mechanism that can be used
to limit the capabilities that can be gained during an
execve(2).
The bounding set is used in the following ways:
- *
-
During an
execve(2),
the capability bounding set is ANDed with the file permitted
capability set, and the result of this operation is assigned to the
thread's permitted capability set.
The capability bounding set thus places a limit on the permitted
capabilities that may be granted by an executable file.
- *
-
(Since Linux 2.6.25)
The capability bounding set acts as a limiting superset for
the capabilities that a thread can add to its inheritable set using
capset(2).
This means that if a capability is not in the bounding set,
then a thread can't add this capability to its
inheritable set, even if it was in its permitted capabilities,
and thereby cannot have this capability preserved in its
permitted set when it
execve(2)s
a file that has the capability in its inheritable set.
Note that the bounding set masks the file permitted capabilities,
but not the inherited capabilities.
If a thread maintains a capability in its inherited set
that is not in its bounding set,
then it can still gain that capability in its permitted set
by executing a file that has the capability in its inherited set.
Depending on the kernel version, the capability bounding set is either
a system-wide attribute, or a per-process attribute.
Capability bounding set prior to Linux 2.6.25
In kernels before 2.6.25, the capability bounding set is a system-wide
attribute that affects all threads on the system.
The bounding set is accessible via the file
/proc/sys/kernel/cap-bound.
(Confusingly, this bit mask parameter is expressed as a
signed decimal number in
/proc/sys/kernel/cap-bound.)
Only the
init
process may set capabilities in the capability bounding set;
other than that, the superuser (more precisely: programs with the
CAP_SYS_MODULE
capability) may only clear capabilities from this set.
On a standard system the capability bounding set always masks out the
CAP_SETPCAP
capability.
To remove this restriction (dangerous!), modify the definition of
CAP_INIT_EFF_SET
in
include/linux/capability.h
and rebuild the kernel.
The system-wide capability bounding set feature was added
to Linux starting with kernel version 2.2.11.
Capability bounding set from Linux 2.6.25 onward
From Linux 2.6.25, the
capability bounding set
is a per-thread attribute.
(There is no longer a system-wide capability bounding set.)
The bounding set is inherited at
fork(2)
from the thread's parent, and is preserved across an
execve(2).
A thread may remove capabilities from its capability bounding set using the
prctl(2)
PR_CAPBSET_DROP
operation, provided it has the
CAP_SETPCAP
capability.
Once a capability has been dropped from the bounding set,
it cannot be restored to that set.
A thread can determine if a capability is in its bounding set using the
prctl(2)
PR_CAPBSET_READ
operation.
Removing capabilities from the bounding set is supported only if file
capabilities are compiled into the kernel.
In kernels before Linux 2.6.33,
file capabilities were an optional feature configurable via the
CONFIG_SECURITY_FILE_CAPABILITIES
option.
Since Linux 2.6.33, the configuration option has been removed
and file capabilities are always part of the kernel.
When file capabilities are compiled into the kernel, the
init
process (the ancestor of all processes) begins with a full bounding set.
If file capabilities are not compiled into the kernel, then
init
begins with a full bounding set minus
CAP_SETPCAP,
because this capability has a different meaning when there are
no file capabilities.
Removing a capability from the bounding set does not remove it
from the thread's inherited set.
However it does prevent the capability from being added
back into the thread's inherited set in the future.
Effect of user ID changes on capabilities
To preserve the traditional semantics for transitions between
0 and nonzero user IDs,
the kernel makes the following changes to a thread's capability
sets on changes to the thread's real, effective, saved set,
and filesystem user IDs (using
setuid(2),
setresuid(2),
or similar):
- 1.
-
If one or more of the real, effective or saved set user IDs
was previously 0, and as a result of the UID changes all of these IDs
have a nonzero value,
then all capabilities are cleared from the permitted and effective
capability sets.
- 2.
-
If the effective user ID is changed from 0 to nonzero,
then all capabilities are cleared from the effective set.
- 3.
-
If the effective user ID is changed from nonzero to 0,
then the permitted set is copied to the effective set.
- 4.
-
If the filesystem user ID is changed from 0 to nonzero (see
setfsuid(2)),
then the following capabilities are cleared from the effective set:
CAP_CHOWN,
CAP_DAC_OVERRIDE,
CAP_DAC_READ_SEARCH,
CAP_FOWNER,
CAP_FSETID,
CAP_LINUX_IMMUTABLE
(since Linux 2.6.30),
CAP_MAC_OVERRIDE,
and
CAP_MKNOD
(since Linux 2.6.30).
If the filesystem UID is changed from nonzero to 0,
then any of these capabilities that are enabled in the permitted set
are enabled in the effective set.
If a thread that has a 0 value for one or more of its user IDs wants
to prevent its permitted capability set being cleared when it resets
all of its user IDs to nonzero values, it can do so using the
prctl(2)
PR_SET_KEEPCAPS
operation.
Programmatically adjusting capability sets
A thread can retrieve and change its capability sets using the
capget(2)
and
capset(2)
system calls.
However, the use of
cap_get_proc(3)
and
cap_set_proc(3),
both provided in the
libcap
package,
is preferred for this purpose.
The following rules govern changes to the thread capability sets:
- 1.
-
If the caller does not have the
CAP_SETPCAP
capability,
the new inheritable set must be a subset of the combination
of the existing inheritable and permitted sets.
- 2.
-
(Since Linux 2.6.25)
The new inheritable set must be a subset of the combination of the
existing inheritable set and the capability bounding set.
- 3.
-
The new permitted set must be a subset of the existing permitted set
(i.e., it is not possible to acquire permitted capabilities
that the thread does not currently have).
- 4.
-
The new effective set must be a subset of the new permitted set.
The securebits flags: establishing a capabilities-only environment
Starting with kernel 2.6.26,
and with a kernel in which file capabilities are enabled,
Linux implements a set of per-thread
securebits
flags that can be used to disable special handling of capabilities for UID 0
(root).
These flags are as follows:
- SECBIT_KEEP_CAPS
-
Setting this flag allows a thread that has one or more 0 UIDs to retain
its capabilities when it switches all of its UIDs to a nonzero value.
If this flag is not set,
then such a UID switch causes the thread to lose all capabilities.
This flag is always cleared on an
execve(2).
(This flag provides the same functionality as the older
prctl(2)
PR_SET_KEEPCAPS
operation.)
- SECBIT_NO_SETUID_FIXUP
-
Setting this flag stops the kernel from adjusting capability sets when
the threads's effective and filesystem UIDs are switched between
zero and nonzero values.
(See the subsection
Effect of User ID Changes on Capabilities.)
- SECBIT_NOROOT
-
If this bit is set, then the kernel does not grant capabilities
when a set-user-ID-root program is executed, or when a process with
an effective or real UID of 0 calls
execve(2).
(See the subsection
Capabilities and execution of programs by root.)
Each of the above "base" flags has a companion "locked" flag.
Setting any of the "locked" flags is irreversible,
and has the effect of preventing further changes to the
corresponding "base" flag.
The locked flags are:
SECBIT_KEEP_CAPS_LOCKED,
SECBIT_NO_SETUID_FIXUP_LOCKED,
and
SECBIT_NOROOT_LOCKED.
The
securebits
flags can be modified and retrieved using the
prctl(2)
PR_SET_SECUREBITS
and
PR_GET_SECUREBITS
operations.
The
CAP_SETPCAP
capability is required to modify the flags.
The
securebits
flags are inherited by child processes.
During an
execve(2),
all of the flags are preserved, except
SECBIT_KEEP_CAPS
which is always cleared.
An application can use the following call to lock itself,
and all of its descendants,
into an environment where the only way of gaining capabilities
is by executing a program with associated file capabilities:
prctl(PR_SET_SECUREBITS,
SECBIT_KEEP_CAPS_LOCKED |
SECBIT_NO_SETUID_FIXUP |
SECBIT_NO_SETUID_FIXUP_LOCKED |
SECBIT_NOROOT |
SECBIT_NOROOT_LOCKED);
CONFORMING TO
No standards govern capabilities, but the Linux capability implementation
is based on the withdrawn POSIX.1e draft standard; see
NOTES
Since kernel 2.5.27, capabilities are an optional kernel component,
and can be enabled/disabled via the
CONFIG_SECURITY_CAPABILITIES
kernel configuration option.
The
/proc/PID/task/TID/status
file can be used to view the capability sets of a thread.
The
/proc/PID/status
file shows the capability sets of a process's main thread.
Before Linux 3.8, nonexistent capabilities were shown as being
enabled (1) in these sets.
Since Linux 3.8,
all nonexistent capabilities (above
CAP_LAST_CAP)
are shown as disabled (0).
The
libcap
package provides a suite of routines for setting and
getting capabilities that is more comfortable and less likely
to change than the interface provided by
capset(2)
and
capget(2).
This package also provides the
setcap(8)
and
getcap(8)
programs.
It can be found at
Before kernel 2.6.24, and since kernel 2.6.24 if
file capabilities are not enabled, a thread with the
CAP_SETPCAP
capability can manipulate the capabilities of threads other than itself.
However, this is only theoretically possible,
since no thread ever has
CAP_SETPCAP
in either of these cases:
- *
-
In the pre-2.6.25 implementation the system-wide capability bounding set,
/proc/sys/kernel/cap-bound,
always masks out this capability, and this can not be changed
without modifying the kernel source and rebuilding.
- *
-
If file capabilities are disabled in the current implementation, then
init
starts out with this capability removed from its per-process bounding
set, and that bounding set is inherited by all other processes
created on the system.
SEE ALSO
capsh(1),
capget(2),
prctl(2),
setfsuid(2),
cap_clear(3),
cap_copy_ext(3),
cap_from_text(3),
cap_get_file(3),
cap_get_proc(3),
cap_init(3),
capgetp(3),
capsetp(3),
libcap(3),
credentials(7),
pthreads(7),
getcap(8),
setcap(8)
include/linux/capability.h
in the Linux kernel source tree
Index
- NAME
-
- DESCRIPTION
-
- Capabilities list
-
- Past and current implementation
-
- Thread capability sets
-
- File capabilities
-
- Transformation of capabilities during execve()
-
- Capabilities and execution of programs by root
-
- Capability bounding set
-
- Effect of user ID changes on capabilities
-
- Programmatically adjusting capability sets
-
- The securebits flags: establishing a capabilities-only environment
-
- CONFORMING TO
-
- NOTES
-
- SEE ALSO
-
This document was created by
man2html,
using the manual pages.
Time: 02:55:20 GMT, September 18, 2014


Customization using themes
As of version 0.9.5 jsTree also supports themes - here is a quick intro to themes.
Each theme must reside in its own directory within the themes path.
NOTE: The themes path is either auto-detected (path-to-jstree/themes/), or can be set manually using the settings.ui.theme_path setting.
The theme to use on a tree is set using the settings.ui.theme_name setting - just set it to a string with the name of your directory (for example theme_name : "my_theme"). If you set theme_name to false no theme will be included.
Each theme consists at minimum of a file called style.css within the theme directory. This file gets included after the default theme file, ensuring that any rules you set (even if the selectors have the same weight as the default theme's selectors) will be respected.
You may also want to include various images in your themes directory, so that you can use them in your style.css file.
Classic theme walkthrough
Here is a walkthrough of the classic theme (included). The most important part is the style.css file.
/* * Note all selectors begin with .tree .tree-classic * This is necessary - keep to this format. * Just replace classic with your theme name . */ /* Setting the icon infront of every closed node */ .tree .tree-classic li.open { background:url("minus.gif") 2px 5px no-repeat; } /* Setting the icon infront of every open node */ .tree .tree-classic li.closed { background:url("plus.gif") 2px 5px no-repeat; } /* This should be same as above. * Used to "close" nested nodes while dragging */ .tree .tree-classic #dragged li.open { background:url("plus.gif") 2px 5px no-repeat; } /* The opened folder icon */ .tree .tree-classic li.open a { background-image:url("folderopen.gif"); } /* The closed folder icon */ .tree .tree-classic li.closed a { background-image:url("folder.gif"); } /* The icon used for nodes with no children */ .tree .tree-classic li.leaf a { background-image:url("folder.gif"); } /* If you want one icon for all above three states use this selector: * .tree .tree-classic li a * It is also useful for setting the text color */ /* The default theme has round borders in firefox. * Undo that if you want */ .tree .tree-classic li a { -moz-border-radius:0; } /* The colors used on the hovered node. * Here they match the background color - so no hover. * Note the second selector - it is applied when hover_mode is on * and you use the get_* functions (mainly used for keyboard shortcuts) */ .tree .tree-classic li a:hover, .tree .tree-classic li a.hover { background-color:white; border-color:white; } /* The colors for the selected state of the node */ .tree .tree-classic li a.clicked, .tree .tree-classic li span.clicked { background-color:navy; border-color:navy; color:white; } /* What follows here are the styles for right-to-left alignment * Include such styles only of you want to support RTL languages */ .rtl .tree-classic li.open { background-position:right 5px; margin-right:-3px; padding-right:19px; } .rtl .tree-classic li.closed { background-position:right 5px; margin-right:-3px; padding-right:19px; } .rtl .tree-classic #dragged li.open { background-position: right 5px; }
Other customizations
The above part does not cover enlarging fonts, or changing the tree background - here is how you do it:
.tree .tree-classic li { font-size:11px; line-height:20px; min-height:20px; font-family:Georgia; } .tree .tree-classic li a { line-height:18px; height:18px; }
/* Using this selector you can set * background, width, etc. * Below are the defaults. */ .tree-default-context { width:160px; background:#F0F0F0 url("context.gif") 22px 0 repeat-y; border:1px solid silver; position:absolute; } .tree-default-context a, .tree-default-context a.disabled:hover { display:block; text-decoration:none; color:black; text-indent:26px; line-height:20px; background-repeat: no-repeat; background-position: 3px center; padding:1px 0; background-color:transparent; border:0; } .tree-default-context a:hover { background-color: #e7f4f9; border:1px solid #d8f0fa; background-position: 2px center; padding:0; text-indent:25px; } .tree-default-context a.disabled, .tree-default-context a.disabled:hover { color:silver; opacity:0.5; -ms-filter:'alpha(opacity=50)'; filter:alpha(opacity=50); zoom:1; } .tree-default-context .separator { background:#FFFFFF; border-top:1px solid #E0E0E0; font-size:1px; height:1px; line-height:1px; margin:0 2px 0 24px; min-height:1px; display:block; }
.tree, .tree ul, .tree li.last { background-color:#666 !important; }
As of v.0.9.6 you can set any background you like (including images and repeat).


"Our Lady of the Assassins"
Writer Fernando Vallejo (German Jaramillo) comes home to the tumultuous city of Medellin, Colombia after 30 years of absence.  The boy moves into the older man's sparsely furnished apartment and the two explore the vibrancy and the violence of the city made infamous by drug trafficking in "Our Lady of the Assassins."
Fernando, as close as I can figure, is a writer of some fame and fortune returning home, as he puts it, to die. (Ambiguous and enigmatic are two words I would use to describe "Our Lady of the Assassins.") He teams up, at once, with pretty, young Alexis, a tough-minded street kid who fears nothing and packs a big gun - for his own protection, he says. The pair set off into the modern/old city of Medellin, now called Medello according to Alexis, to satisfy the boy's desire for rampant consumerism. Fernando buys an expensive stereo and any other trinkets that Alexis wants and, for a while, they have a relationship that borders on being father/son-like (except for the sex part). There is a price to pay for this time of bliss and the violence that clutches the citizens of Medellin will inevitably visit the couple.
Violent confrontation on the mean streets of city is a way life, especially if you are young, male and armed with a semi-automatic pistol - one gift Alexis and other boys ask for is a mini Uzi submachine gun, just to give you some perspective. Car jacking is a popular sport in town and Fernando watches as a guy who owns a car resists and is gunned down in cold blood by the 'jacker. Alexis, himself, is involved in one shooting after another as he protects himself from endless assaults from countless enemies on the street. With sudden death a real possibility for teenaged Colombian boys, the lives of the street kids burns brighter than for kids elsewhere, making the consumer ideology a thriving one in Medellin. Live fast and die young is the motto these kids live by.
Fernando is an enigma as a man returning home to a world that is completely different from the one he left so long ago. The rise and fall of Pablo Escobar, the yoke put upon the country by the drug trade, the violence perpetrated by the country's rulers and, particularly, its youth all washes over Fernando but, apart from a frequently used look of melancholy, he seems unmoved by the events. (The man is humanized when he uses, and loses, Alexis's gun to put an injured dog out of its misery. You know that this is the film's pivotal scene and will color later events dramatically.)
The autobiographical screenplay, by Fernando Vallejo, keeps the central figure, the writer, at arm's length from the events around him, even when tragedy strikes. There are lessons to be learned here but they are muted by keeping the audience from embracing the man. Jaravillo is too much of an enigma and being an observer of his observer, I never embraced the character or cared about the lessons to be learned.  His lack of concern for life, even his own, is conveyed in a professional manner by the young actor.
Barbet Schroeder, with lensing capably handled by Rodrigo Lalinde, uses high-definition digital video to capture the garish look of Medello, a city that was made modern on a foundation of illicit drugs. The utter believability of the violence, its sudden and final nature, that grip the city is palpably felt. I don't think that Schroeder is embellishing on the violence that routinely takes place and gives the film a realistic tenor. The tone of this part of the film put me in mind of the 1981 Brazilian film, "Pixote," an even grittier look at the street life of homeless kids in a violent urban arena.
"Our Lady of the Assassins" succeeds in taking you into the heart of Colombia and showing a violence-laden world that few will ever go to see. The main flaw is I never empathize, or even sympathize, with too enigmatic Fernando. I give it a B-.
For more Reeling reviews visit www.reelingreviews.com
<EMAIL_ADDRESS><EMAIL_ADDRESS>========== X-RAMR-ID: 29591 X-Language: en X-RT-ReviewID: 251221 X-RT-TitleID: 1109717 X-RT-SourceID: 386 X-RT-AuthorID: 1488 X-RT-RatingText: B-
The review above was posted to the
rec.arts.movies.reviews newsgroup (de.rec.film.kritiken for German reviews).
The Internet Movie Database accepts no responsibility for the contents of the
review and has no editorial control. Unless stated otherwise, the copyright
belongs to the author.
Please direct comments/criticisms of the review to relevant newsgroups.
Broken URLs inthe reviews are the responsibility of the author.
The formatting of the review is likely to differ from the original due
to ASCII to HTML conversion.
Related links: index of all rec.arts.movies.reviews reviews


In the WSDL mode, by providing a WSDL file, you can invoke a service or provide a service, without having to construct the payload manually. Few simple steps are required to configure either the client or the service to use the WSDL mode.WSO2 WSF/PHP supports both WSDL 1.1 and WSDL 2.0 in WSDL mode.
There are two WSDL(WSDL 1.1 and WSDL 2.0) files provided in the samples\wsdl_mode folder and sample_wsdl_11.wsdl will be used for the example in this manual. Please have a look at the samples\wsdl_mode\sample_wsdl_11.wsdl.
1.create a WSClient object as follows $client = new WSClient(array("wsdl"=>"sample_wsdl_11.wsdl")); If the service endpoint is different from the location which is defined in the WSDL then you can specify it as $client = new WSClient(array("wsdl"=>"sample_wsdl_11.wsdl", "to" => "http://tempuri.org")); 2.obtain a WSClientProxy object from the WSClient as follows: $proxy = $client->getProxy();
Now you can call any operation defined in the WSDL. For example,you can invoke the QueryPurchaseOrder operation defined in the wsdl, as follows.
$return_value = $proxy->QueryPurchaseOrder($input); The arguments for the function will be either an object defined in the class map or an associative array of arguments which can be constructed in the following two ways. First you should have understood the values that should be pass to the input as defined in the schema in WSDL. You should pass input and output parameters to the function in exactly the same order it is defined in schema. First we will have a look at the schema for the input message. <xsd:element name="orderInfo"> <xsd:complexType> <xsd:sequence> <xsd:element name="productName" type="xsd:string"></xsd:element> <xsd:element name="quantity" type="xsd:float"></xsd:element> <xsd:element name="date" type="xsd:dateTime"></xsd:element> <xsd:element name="orderNo" type="xsd:int"></xsd:element> </xsd:sequence> </xsd:complexType> </xsd:element> 9.1.1.Associative array of arguments As you can see, the input message element of the operation QueryPurchaseOrder in WSDL , is OrderInfo which is a complex type defined in the schema. The complex type OrderInfo has four elements. So the array that you have to construct will be as follows. $input_array =array("productName" => "Testing", "quantity" => 234, "date" => date(20031234), "orderNo" => 345)); Here the key of the array will be the element name of the complex type and the user should provide the appropriate value for the key. If the type of the element is another complex type, there should be another array instead of the value. As an example, imagine if the quantity element's type is another complex type defined in the schema as follows. <xsd:element name="orderInfo"> <xsd:complexType> <xsd:sequence> <xsd:element name="productName" type="xsd:string"></xsd:element> <xsd:element name="quantity" type="tns:quantityType"></xsd:element> <xsd:element name="date" type="xsd:dateTime"></xsd:element> <xsd:element name="orderNo" type="xsd:int"></xsd:element> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:element name="quantityType"> <xsd:complexType> <xsd:sequence> <xsd:element name="amount" type="xsd:int"></xsd:element> <xsd:element name="weight_kg" type="xsd:float"></xsd:element> </xsd:sequence> </xsd:complexType> </xsd:element> Now the array that you should create will be, $input_array =array("productName" => "Testing", "quantity" => $quantity_array, "date" => date(20031234), "orderNo" => 345)); $quantity_array = array("amount" => 2300, "weight_kg" => 203443); After creating the array, pass it to the operation that you are going to invoke. $proxy->QueryPurchaseOrder($input_array); Since you have passed the array type arguments to the function, the return value will also be an associative array. The schema for the return message in the sample wsdl is as follows. <xsd:element name="orderDetails"> <xsd:complexType> <xsd:sequence> <xsd:element name="shipTo" type="tns:address"> </xsd:element> <xsd:element name="billTo" type="tns:address"></xsd:element> <xsd:element name="product" type="tns:orderInfo"></xsd:element> </xsd:sequence> </xsd:complexType> </xsd:element> <xsd:complexType name="address"> <xsd:sequence> <xsd:element name="name" type="xsd:string"></xsd:element> <xsd:element name="street" type="xsd:string"></xsd:element> <xsd:element name="city" type="xsd:string"></xsd:element> <xsd:element name="state" type="xsd:string"></xsd:element> <xsd:element name="zip" type="xsd:decimal"></xsd:element> </xsd:sequence> </xsd:complexType> <xsd:complexType name="orderInfo"> <xsd:sequence> <xsd:element name="productId" type="xsd:int"></xsd:element> <xsd:element name="shippingDate" type="xsd:dateTime"></xsd:element> <xsd:element name="status" type="xsd:boolean"></xsd:element> </xsd:sequence> </xsd:complexType> So the returned array will be of the same structure that we created for the input array. The returned array has three elements shipTo, billTo and product. Since all of these elements are complex types, there should be an associative array for the corresponding elements. Now the return array becomes, $return_array = $proxy->QueryPurchaseOrder($input_array); $return_array = array("shipTo" => $shipToArray, "billTo" => $billToArray, "product" => $order_info_array); $shipToArray = array("name" => "Jane Smith", "street" => "YorkStreet", "city" => "colombo", "state" => "Sri Lanka" , "zip" => 32343); $order_info_array = array("productId" => 2345, "shippingDate" => date(20080101) , "status" => TRUE); This same array structure applies for $billToArray as well. 9.1.2. class objects In this method user should provide a class map which includes the classes for the complex types defined in the WSDL for the corresponding operation he is going to invoke. In this example, you can see that there are four complex types associated with the operation QueryPurchaseOrder. So the class map implementation should be, $class_map = array("complex_type" => "class_name_that_wrapping_the_complex_type"); In our example it should be as $class_map = array( "OrderInfo" => "OrderInfoWrapper", "OrderDetails" => "OrderDetailsWrapper", "address" => "addressWrapper", "productInfo"=> "productInfoWrapper") ; Each element name in the complex type element will be a public attribute in the php class. Then the four classes will be, class OrderInfoWrapper{ public $productName; public $quantity; public $date; public $orderNo; } class OrderDetailsWrapper{ public $shipTo; public $billTo; public $product; } class addressWrapper{ public $name; public $street; public $city; public $state; public $zip; } class productInfoWrapper{ public $produtId; public $shippingDate; public $status; }NOTE: You can use the wsdl2php.php script to generate the classes for the WSDL.
After creating the class map it should be passed to WSClient constructor as, $client = new WSClient(array("wsdl"=>"sample_wsdl_11.wsdl", "classmap" => $classmap)); $proxy = $client->getProxy(); Now create an object from the OrderInfoWrapper class and assign values for the attributes. $input_obj = new OrderInfoWrapper(); $input_obj->productName = "WSF/PHP"; $input_obj->quantity = 232; $input_obj->date = date(20040921); $input_obj->orderNo = 20034; Then pass the $input_obj to operation $return_obj = $proxy->QueryPurchaseOrder($input_obj); If the quantity element is another complex type as in the earlier case, then you should create another object from the relevant class and assign the object to quantity attribute. class quantityTypeWrapper{ public $amount; public $weight_kg; } Make sure to have the class mapping entry in classmap array. $quan_obj = new quantityTypeWrapper(); $quan_obj->amount = 23232; $quan_obj->weight_kg = 2323.24; Now the quantity variable in $input_obj object will be $input_obj->quantity = $quan_obj; Since you passed an object to the operation, the returned value will also be an object with the type OrderDetailsWrapper. It has three atrributes shipTo, billTo and product which are also objects of the type addressWrapper, addressWrapper and productInfoWrapper respectively. As an example you can access the values as, $return_obj->billTo->Name; $return_obj->shipTo->street; $return_obj->product->productId;
We will implement a service to accept the request sent by the above client.
First write a function corresponding to the QueryPurchaseOrder operation defined in the WSDL.
function QueryPurchaseOrderFunction($productName, $quantity, $date, $orderNo){
return $return_array;
}
The return array should be created as the same way it is created in client side.
$return_array = array("shipTo" => $shipToArray,Similar to the client you can use the class map API for implementing services as well. For the above service you can use the classmap API in the following way.
NOTE: You can use the wsdl2php.php script to generate the classes for the WSDL.
class orderInfo { public $productName; // string public $quantity; // float public $date; // dateTime public $orderNo; // int } class orderDetails { public $shipTo; // address public $billTo; // address public $product; // productInfo } class address { public $name; // string public $street; // string public $city; // string public $state; // string public $zip; // decimal } class productInfo { public $productId; // int public $shippingDate; // dateTime public $status; // boolean } // define PHP functions that maps to WSDL operations function QueryPurchaseOrder($input) { // TODO: fill in the business logic // NOTE: $input is of type orderInfo // NOTE: should return an object of type orderDetails $productName = $input->productName; $quantity = $input->quantity; $date = $input->date; $orderNo = $input->orderNo; // You can process the input with above data, $shipTo = new address(); $shipTo->name = "Jane Smith"; $shipTo->street = "York street"; $shipTo->city = "Colombo"; $shipTo->zip = "32234"; $shipTo->state = "-"; $billTo = new address(); $billTo->name = "John Smith"; $billTo->street = "Maple Street"; $billTo->city = "LA"; $billTo->state = "USA"; $billTo->zip = 55432; $product = new ProductInfo(); $product->productId = 2344; $product->shippingDate = date(20080101); $product->status = TRUE; $return_value = new orderDetails(); $return_value->shipTo = $shipTo; $return_value->billTo = $billTo; $return_value->product = $product; return $return_value; } // define the class map $class_map = array( "orderInfo" => "orderInfo", "orderDetails" => "orderDetails", "address" => "address", "productInfo" => "productInfo"); $operations = array( "QueryPurchaseOrder" => "QueryPurchaseOrder"); // define the actions => operations map $actions = array( "http://www.wso2.org/php/QueryPurchaseOrder" => "QueryPurchaseOrder"); // create service in WSDL mode $service = new WSService(array ("wsdl" =>"sample_wsdl_11.wsdl", "actions" => $actions, "classmap" => $class_map, "operations" => $operations)); // process client requests and reply $service->reply();
WSDL Generation in WSO2 WSF/PHP is done using PHP reflection and an annotation parser. In order to generate a WSDL from a given WSO2 WSF/PHP service, a '?wsdl' request or a '?wsdl2' request should be sent to the server. '?wsdl' serves WSDL version 1.1, and '?wsdl2' serves WSDL version 2.0. For example, if you want to generate the WSDL for the service echoService.php, a request should be sent as,
http://localhost/echoService.php?wsdl
or
http://localhost/echoService.php?wsdl2
For more information on the annotation syntax, please have a look at the WSDL generation API document.
You can Generate the PHP code for a given WSDL using wsdl2php.php script bundle with the WSO2 WSF/PHP distribution. You can find the wsdl2php.php script inside the 'scripts' directory.
Here is how you can use this script.
Usage: php wsdl2php.php [-s] <wsdl> wsdl - URL or path to WSDL file Options: -s Generate code for service. By default this is false, meaning code for client will be generated. Eg Consider you have a wsdl named purchaseOrder.wsdl and you want to code generate for that. The following command will generate your client code to a file named purchase_client.php. php wsdl2php.php purchaseOrder.wsdl > purchase_client.php To generate the service use php wsdl2php.php -s purchaseOrder.wsdl > purchase_service.php


CoronaFiles.us
Compare
Hotspots
Alerts
Herd Immunity
Intl. Comparison
Forecast
About
US COVID-19
International Comparison
vs.


Problem Statement
To render a transformer in Renderman with the following effects:
- Indirect Illumination (Color Bleeding)
- Scene elements with caustics
- Area lights and soft shadows
- Texture mapping
- Transparent and metallic objects
A more detailed problem statement can be found
here.
Code Structure
The code has been modularised into separate RIB files and using the ReadArchive
command we patch the files together. Shaders are organised in SL files. A caustic map is separately generated as caus.cpm
from caus.rib
A makefile compiles everything and generates an image.
Dependencies
- Renderman Pro Server 19
- python 2.*
How to Run
To run the code, simply use the makefile with the command:
make
You can see the resultant
.tif
file generated by running:
sho display-transformer.tif
To clean up the generated files and the image generated, do a
make clean
Shader Details
We use the following shaders in this assignment:
- shadowlight: This is a light source shader which causes local illumination at a point only when the poing is unoccluded by any other object
- diffsurf: This is a surface shader with local illumination, indirect lighting and caustics (From a cuastic map)
- texsurf: This is a surface shader much like diffsurf, except, the illumination is used as a weight for a color obtained from a texture map
- metal: This is a surface shader which has a high specular component and high reflectivity. The shader calls the trace function to raytrace the reflection
- transparent: This is a surface shader with very low local illumination and reflection. Most of the light is refracted and raytraced.
Effects Details
The following required effects were achieved in the assignment:
- Color Bleeding: Using indirect illumination in the diffsurf and texsurf shaders.
- Area Lights and Soft Shadows: Placing multiple point lights closely.
- Texture Mapping: Using the texture function in texsurf shader.
- Caustics: Photon mapping the scene to generate a caustic map and then adding it to the illumination.
- Transparent and Metallic Surfaces: Using the transparent and metal shaders respectively.
Result
The following image was generated:
The generated tif can be downloaded from here.
Credits
- Pixar
- Renderman Docs and Forum
- Rohan Prinja


DevOps Services
DevOps Consulting
Managed Kube
DevOps Infrastructure
Blog
Contact
Get in touch today!
Submit
Created with Sketch.
Connect with us


Home Page
My Projects
Welcome to my project archive.
Bouncing Balls - Collision Detection
CSS Layout Grid Examples
Interactive List
CSS Box Model


A particularly common and helpful use of the RollingWindow class is to store past indicator values. The following examples create an indicator and adds its values to a rolling window when the indicator is updated.
SMA("SPY", 5).Updated += (sender, updated) => smaWin.Add(updated); smaWin = new RollingWindow<IndicatorDataPoint>(5);
self.SMA("SPY", 5).Updated += self.SmaUpdated self.smaWin = RollingWindow[IndicatorDataPoint](5) # Adds updated values to rolling window def SmaUpdated(self, sender, updated): self.smaWin.Add(updated)
Indicator objects have the Updated
event that fires after the indicator is updated. To respond to Updated
, we define an event handler method that adds the last value of the indicator to the rolling window. The value is an $[IndicatorDataPoint, C:QuantConnect.Indicators.IndicatorDataPoint] object that represents a piece of data at a specific time.
The most recent element, the previous and the last item for this case are:
var currentSma = smaWin[0]; var previousSma = smaWin[1]; var oldestSma = smaWin[ smaWin.Count - 1 ];
currentSma = self.smaWin[0] previousSma = self.smaWin[1] oldestSma = self.smaWin[ smaWin.Count - 1 ]
// In Initialize, create the rolling windows public override void Initialize() { // Creates an indicator and adds to a rolling window when it is updated SMA("SPY", 5).Updated += (sender, updated) => smaWin.Add(updated); smaWin = new RollingWindow<IndicatorDataPoint>(5); }
# In Initialize, create the rolling windows def Initialize(self): # Creates an indicator and adds to a rolling window when it is updated self.SMA("SPY", 5).Updated += self.SmaUpdated self.smaWin = RollingWindow[IndicatorDataPoint](5) # Adds updated values to rolling window def SmaUpdated(self, sender, updated): self.smaWin.Add(updated)


This sample should make protractor wait for a setTimeout to complete.
Do something async not using angular please!
Do both async things please!
Do both async things in sequence please!
{{main.data}}


--- layout: page title: About header-img: "img/about-bg.png" ---
Has a passion for learning and enjoys helping others.


Claude Lévi-Strauss
The original work to introduce bricolage as a description of a counter-engineering creative-cultural reference.
"His universe of instruments is closed, and the rules of his game are always to make do with ‘whatever is at hand’, that is to say with a set of tools and materials which is always finite and is also heterogeneous because it...is the contingent result of all the occasions there have been to renew or enrich the stock or to maintain it with the remains of previous constructions or destructions”
"the 'bricoleur' ...'speaks' not only with things as we have already seen, but also through the medium of things: giving an account of his personality and life by the choices he makes between the limited possibilities"
"We have already distinguished the scientist and the 'bricoleur' by the invese functions which they assign to events and structures as ends and means, the scientist creating events (changing the world) by means of structures and the 'bricoleur' creating structures by means of events"
"On a different plane we therefore find once more this dialogue with the materials and means of execution by which we defined 'bricolage'"


|
|
struct wl_display * | display |
| |
|
struct wl_registry * | registry |
| |
|
struct wl_compositor * | compositor |
| |
|
struct wl_shell * | shell |
| |
|
struct wl_shm * | shm |
| |
|
struct wl_seat * | seat |
| |
|
struct wl_pointer * | pointer |
| |
|
struct wl_keyboard * | keyboard |
| |
|
struct zwp_relative_pointer_manager_v1 * | relativePointerManager |
| |
|
struct zwp_pointer_constraints_v1 * | pointerConstraints |
| |
|
int | wl_compositor_version |
| |
|
struct wl_cursor_theme * | cursorTheme |
| |
|
struct wl_surface * | cursorSurface |
| |
|
uint32_t | pointerSerial |
| |
|
_GLFWmonitor ** | monitors |
| |
|
int | monitorsCount |
| |
|
int | monitorsSize |
| |
|
short int | publicKeys [256] |
| |
|
struct { |
|
struct xkb_context * context |
| |
|
struct xkb_keymap * keymap |
| |
|
struct xkb_state * state |
| |
|
xkb_mod_mask_t control_mask |
| |
|
xkb_mod_mask_t alt_mask |
| |
|
xkb_mod_mask_t shift_mask |
| |
|
xkb_mod_mask_t super_mask |
| |
|
unsigned int modifiers |
| |
| } | xkb |
| |
|
_GLFWwindow * | pointerFocus |
| |
|
_GLFWwindow * | keyboardFocus |
| |
The documentation for this struct was generated from the following file:


Last week Google announced the PHP support for Google App Engine (GAE). PHPStorm, the great IDE for PHP development, also announced support for Google App Engine PHP. Because of that now is time to hack a little bit with this new toy.
I’ve worked in a couple of projects with Google App Engine in the past (with Python). With PHP the process is almost the same. First we need to define our application in the app.yaml file. In our example we are going to redirect all requests to main.php, where our Silex application is defined.
application: silexgae
version: 1
runtime: php
api_version: 1
threadsafe: true
handlers:
- url: .*
script: main.php
To build a simple Silex application over Google App Engine is pretty straightforward (more info here). Because of that we’re going to go a little further. We are going to use the log-in framework provided by GAE to log-in with our Goggle account within our Silex application. In fact we can use the standard OAuth authentication process but Google provides a simple way to use our gmail account.
Now we’re going to build a LoginProvider to make this process simpler. Our base Silex application will be the following one:
<?php
require_once __DIR__ . '/vendor/autoload.php';
use Silex\Application;
use Gae\LoginProvider;
use Gae\Auth;
$app = new Application();
$app->register(new LoginProvider(), array(
'auth.onlogin.callback.url' => '/private',
'auth.onlogout.callback.url' => '/loggedOut',
));
/** @var Auth $auth */
$auth = $app['gae.auth']();
$app->get('/', function () use ($app, $auth) {
return $auth->isLogged() ?
$app->redirect("/private") :
"getLoginUrl() . "'>login";
});
$app->get('/private', function () use ($app, $auth) {
return $auth->isLogged() ?
"Hello " . $auth->getUser()->getNickname() .
" getLogoutUrl() . "'>logout" :
$auth->getRedirectToLogin();
});
$app->get('/loggedOut', function () use ($app) {
return "Thank you!";
});
$app->run();
Our LoginProvider is a simple Class that implements Silex\ServiceProviderInterface
<?php
namespace Gae;
require_once 'google/appengine/api/users/UserService.php';
use google\appengine\api\users\UserService;
use Gae\Auth;
use Silex\Application;
use Silex\ServiceProviderInterface;
class LoginProvider implements ServiceProviderInterface
{
public function register(Application $app)
{
$app['gae.auth'] = $app->protect(function () use ($app) {
return new Auth($app, UserService::getCurrentUser());
});
}
public function boot(Application $app)
{
}
}
As you can see our Provider class proviedes us an instance of Gae\Auth class
<?php
namespace Gae;
require_once 'google/appengine/api/users/UserService.php';
use google\appengine\api\users\User;
use google\appengine\api\users\UserService;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Silex\Application;
class Auth
{
private $user = null;
private $loginUrl;
private $logoutUrl;
private $logged;
public function __construct(Application $app, User $user=null)
{
$this->user = $user;
if (is_null($user)) {
$this->loginUrl = UserService::createLoginUrl($app['auth.onlogin.callback.url']);
$this->logged = false;
} else {
$this->logged = true;
$this->logoutUrl = UserService::createLogoutUrl($app['auth.onlogout.callback.url']);
}
}
/**
* @return RedirectResponse
*/
public function getRedirectToLogin()
{
return new RedirectResponse($this->getLoginUrl());
}
/**
* @return boolean
*/
public function isLogged()
{
return $this->logged;
}
/**
* @return string
*/
public function getLoginUrl()
{
return $this->loginUrl;
}
/**
* @return string
*/
public function getLogoutUrl()
{
return $this->logoutUrl;
}
/**
* @return \google\appengine\api\users\User|null
*/
public function getUser()
{
return $this->user;
}
}
And that’s all. Full code is available in my github account and you can also use composer to include this provider within your projects.


The AudioRecorder object is returned by Titanum.Media.createAudioRecorder and is used for recording audio from the device microphone.
| Name | Description |
|---|---|
| addEventListener.html | add an event listener for the instance to receive view triggered events |
| fireEvent.html | fire a synthesized event to the views listener |
| removeEventListener.html | remove a previously added event listener |


#include <stream.hpp>
◆ stream() [1/3]
◆ stream() [2/3]
| std::stream::stream |
( |
bool |
canread, |
|
|
bool |
canwrite, |
|
|
bool |
canseek |
|
) |
| |
|
inline |
bool m_canWrite
Definition: stream.hpp:80
bool m_canSeek
Definition: stream.hpp:81
bool m_canRead
Definition: stream.hpp:79
◆ stream() [3/3]
| std::stream::stream |
( |
const stream & |
st | ) |
|
|
inline |
bool m_canWrite
Definition: stream.hpp:80
bool m_canSeek
Definition: stream.hpp:81
bool m_canRead
Definition: stream.hpp:79
◆ ~stream()
| virtual std::stream::~stream |
( |
| ) |
|
|
inlinevirtual |
◆ canRead()
| virtual bool std::stream::canRead |
( |
| ) |
|
|
inlinevirtual |
bool m_canRead
Definition: stream.hpp:79
◆ canSeek()
| virtual bool std::stream::canSeek |
( |
| ) |
|
|
inlinevirtual |
bool m_canSeek
Definition: stream.hpp:81
◆ canWrite()
| virtual bool std::stream::canWrite |
( |
| ) |
|
|
inlinevirtual |
bool m_canWrite
Definition: stream.hpp:80
◆ clear()
| virtual void std::stream::clear |
( |
| ) |
|
|
inlinevirtual |
◆ flush()
| virtual void std::stream::flush |
( |
| ) |
|
|
inlinevirtual |
◆ iseof()
| virtual bool std::stream::iseof |
( |
| ) |
|
|
inlinevirtual |
◆ position()
| virtual long std::stream::position |
( |
| ) |
|
|
inlinevirtual |
◆ read() [1/2]
| virtual char std::stream::read |
( |
| ) |
|
|
inlinevirtual |
◆ read() [2/2]
| virtual size_t std::stream::read |
( |
void * |
data, |
|
|
size_t |
offset, |
|
|
size_t |
size |
|
) |
| |
|
inlinevirtual |
◆ seek()
| virtual size_t std::stream::seek |
( |
size_t |
off, |
|
|
seek_t |
org |
|
) |
| |
|
inlinevirtual |
◆ size()
| virtual long std::stream::size |
( |
| ) |
|
|
inlinevirtual |
◆ write() [1/2]
| virtual void std::stream::write |
( |
char |
c | ) |
|
|
inlinevirtual |
◆ write() [2/2]
| virtual size_t std::stream::write |
( |
const void * |
data, |
|
|
size_t |
offset, |
|
|
size_t |
size |
|
) |
| |
|
inlinevirtual |
◆ m_canRead
| bool std::stream::m_canRead |
|
protected |
◆ m_canSeek
| bool std::stream::m_canSeek |
|
protected |
◆ m_canWrite
| bool std::stream::m_canWrite |
|
protected |
Die Dokumentation für diese Klasse wurde erzeugt aufgrund der Datei:


,
Keywords: Bridge Weigh in Motion, Structural Health Monitoring, Heavy Goods Vehicles, Structural Inspection
Heavy Goods Vehicles (HGVs) are a significant source of wear on bridges. The impact of HG traffic becomes particularly important if a bridge is already in a weakened state. For instance a physical inspection may detect a maintenance issue such as corrosion of a structural element. The next question is how long is it safe to operate the bridge? By giving an accurate, up to date picture of the bridge loading, a BWIM system can support the engineer in this decision.
When assessing safety, surprisingly little attention is paid to the loading of the structure by HG traffic. The assumptions about loading made during the design phase, perhaps forty years earlier, may no longer be valid. They may, for instance, underestimate the amount of HG traffic, the average weight of individual HGVs or the degree of congestion on the bridge. When a bridge's safety is re-assessed it is critical that an appropriate model of the traffic load based on measured data is used. An up to date model of loading will allow engineers to make a more informed decison about the urgency of repairs and the continued operation of the bridge.
Loading can affect the bridge both statically, by exceeding an element's yield strength and dynamically, by causing fatigue failures. In the next section we shall deal with static loading: we describe a statistical approach to assessing structural safety and how data from BWIM can be used to conduct it. We then consider dynamic loading: we describe how cyclic loading is related to fatigue failure and how BWIM data can be processed to predict when a structural element is likely to fail.
The static load on a bridge exerted by HG traffic depends on two factors:
Both of these factors are random variables: they can only be modelled in statistical terms. The weight of a randomly selected vehicle cannot be known in advance, however, we can say that it will fall into a given distribution. We use the Conditional Axle Load (CAL) model to quantify this statistical variation of loads applied to the bridge.. The number of HGVs simultaneously on the bridge depends on whether HGVs are evenly distributed among other traffic, moving in convoy, or in closely packed convoys that are stationary due to congestion. It will also depend on the diurnal and weekly traffic patterns. We quantify these effects using our Traffic Flow Model. Both CAL and traffic Flow models are stochastic, accounting for both random and deterministic factors.
The CAL and Traffic Flow models form the basis of our statistical analysis. They are combined into the load model, which along with a statistical model of the structural element in question are passed to the simulation engine. This will give an estimate of the likelihood the element will fil within the defined time period. In the following subsections we will describe how the load model is derived from BWIM data and the method by which we combine load and structral models within a probablistic framework.
The safety of a bridge is assessed by examining individual structural elements. Like the loading of the bridge, the strength of a given structural element is also a random variable and is also best treated in probabilistic terms. It follows that any prediction about the failure of the element will also be probabilistic.
Consider a trivial example: a beam of resistance R, is loaded with a force S. If the load exceeds the resistance, i.e. R ‹ S, then the beam will fail. We can plot all the possible combinations of strength and load, opposite. The failure region, i.e. those combinations of R and S for which the beam will fail, lie on one side of the line R-S=0, and the safe region lies on the other. We call this line the Limit State Function.
Now, assume that we know that structural elements from the same batch have a statistical distribution of resistances, centred around 90k Newtons (left). Furthermore, we know from our BWIM measurements that most loads occur around 60k Newtons, but occasionally we will get a higher load. What is the probability that the beam will fail? To know this, we must consider the joint probability of R and S (right). The probability of failure, is the sum of probabilities in the failure region. In more mathematical terms, this is the integral of the joint probability function over the region bounded by the limit state function.
In this trivial example, it is easy to understand what is happening, but surprisingly difficult to estimate the probability of an event intuitively. Things get more complicated if there are many variables—as there usually are, or if they are correlated with one another. For this reason, in the early nineties we developed the Variables Processor software library. This remains at computational core of many of our subsequent applications, the interested reader is referred to [2].
With our models of vehicle weight and traffic flow, and data from BWIM, we can predict the likely loads on a bridge. With our structural engineering expertise we select a series of critical structural elements, and estimate the proability of failure as a function of load. The Load Model and Strtuctural Model are then passed to our Stochastic Simulation Engine which will the estimate the likelihood of the element failing.
A more insidious mode of failure is caused by cyclic loading of a bridge. As a vehicle traverses a bridge, each axle induces a loading cycle. The cumulative effect of these impacts may cause a bridge to fail through fatigue — even if its yield strength is never approached.
The number of loading cycles at which an element will fail for a given loading is given by its a curve of the form shown opposite. By measuring the frequency and severity of impacts we can model the stresses to which a bridge is exposed to each day. We can extrapolate this into the past and into the future to show how far along the curve the bridge is and how much longer we can safely operate the bridge.
Bridge Weigh in Motion provides a time history of the axle impacts on the bridge. This must be converted into loading cycles. This is trivial when the peaks are well seperated, but if there is sigificant overlap then Rainflow analysis must be used.
Once the cycles have been identified Miner's Rule can be applied to estimate the structural element's position on the fatigue curve — and predict the time to failure. Alternatively, the cyles can be plotted on a Rainflow Matrix to identify high impact cycles. These can be traced back, using the BWIM database, to the culprit vehicle.
Loading due to HG traffic is a critical factor in any assessment of bridge safety. Yet models of loading by HG traffic are often based on assumptions that out of date, or lack nuances from the real world. It is clearly desirable to get actual measurements of traffic load which can inform our models. Measurements from iBWIM together with appropriate statistical models can take much of the guesswork out of load modelling.


This example uses the addEventListener() method to execute a function when a user clicks on a button.


You just have to check out the GitHub repository: https://github.com/52North/GeologicToolbox. Installation information is given in the project's README file.
Back to main page


I have research a great deal about a specific psychoactive plant DMT and had learned much about the great healing properties of the plant for those with problems like addiction and other like issues. I have also known of the great profound experiences people have had with regard into religious experiences people have had. After 6 months of researching the topic and the compiled Knowles of a friend I had decided that I would like to try it. Taking it with a friend we both had a profound experience where I learned many life lessons about my problems with speaking in public and my strives to be perfect in all I do.
Not knowing the strength of such a psychedelic I decided to try it once again, but this time in hopes to help another friend who had an addiction with medication. The friend was unable to keep down the material but myself able to keep it down started to feel the effects I once felt before. I must note in order to get this extract I took it in the Ayawaska form from boiling it about 30 ounces down for over 6 hours. I would not recommend anyone doing that.
I had a wrist watch on so I was able to check the times.
40 Min-
Felt dizzy and felt a change in temperature, started to get a little woozy.
50 Min-
When I opened my eyes I started to see the walls and area around me look fake and as though space and time was starting to fall apart. Like the world around me was fake and that I was entering another place.
50-1.30
I had a profound experience where a being asked me if I had any questions. I ask him (or her) why I treated people so badly. It said to me that since I didn't learn the first time I had this experience that it was going to teach me the lesson this time (in a more than strong tone of voice) it put me in the position of a slave creature on another planet and left me there for a while, to feel how small I was and unimportant I was. I thought to myself that if I was left there for ever that it would maybe be the worst feeling I could ever have and would never be able to be human again. It brought me back and told me, ' See how it feels to be a slave, to be something so small that no one cares about you.' I said yes, I understand.
It then took me to another place by breaking down the fabric of what makes up everything we see, as though everything was made of energy even the guide. I could not see this type of energy but I could more or less feel it in some way. I still wanted to see what things look like and told the being I wanted to see what things looked like because I wouldn't understand other wise. It replied, 'You humans are so obbessed with what things look like that you do not understand anything besides what you can feel or see, there is so much more going on.
Fine, I will show you.' It showed me something that I saw before from my other experience but only for a moment. The last time I saw the face of a lady with a large head and yellow eyes, she was dominate but uninvolved with me. This time it showed me the big picture, the lady was not a lady at all but a octopus like being with a huge head of what seemed to be a feminine figure. Its tentacles were massive and rapped around the world and I could see bits of energy flying into the receptors of the being. The guide told me that this was what happened when we died and that the being learned from our experiences on earth this way.
The guide then went on to say, ' I don't understand why you humans treat each other so badly when your life is so small and when we die we have so much to look forward to.' It continued, 'You should treat others good for the time on this planet because your are all there and all are going to die and should live as best as possible while dealing with this experience.' I told the being that I understood and the intensity of the psychedelic started to die down.
1.30
I looked at my watch and noticed that the effects of the drug didn't last as long as last time since the last time it lasted for about 6 hours. I got up out of my bed and walked into the kitchen where my roommate was sitting and talked to her about some of the things that had happened.
1.40
Mid speech the walls started to show the same effects of before but this time much more intense and at a speed of which I never have felt before.  Soon after laying down I noticed how intense things had started to get. Time started to fall part and I soon became the mud of the earth and could not move. I heard a sound like the sound of energy rushing over my body and faster than I knew it, I was dead. I could not move and I knew that I had died.
I tried to close my eyes and I could see through my eye lids. I put my hands over my eyes and could see through them. I gave up and could not blink could not do anything and everything was just peaceful but bland, all the pain gone but I was able to still think.   I started to think about all that I had read and realized I wasn't dead, I was alive. I focused, clasped my hands together and managed to come back to myself and walk myself into the bathroom. I used the bathroom and manged to get back into my room at what point I realized I needed to get this out of my system. I tried to puke but nothing came up and as I did that I was transported in front of a being.
The being was so massive that word can not describe. The only thing that describes it is that it was as massive as god. It told me in the most angry voice and most fear dwelling way it could that I was nothing but a slave and that I was not allowed to be where I was. It asked me what I was doing there. I answered that I didnt know and that I would do anything for it to leave me be. It told me to never come back and never challenge it again. As I came back to myself I noticed that my knee was on the ground and I had it bent with my hand up in the air as though I knew how to be in that position all my life, like it was engraved into my body to know how to conduct myself in that situation with that being.
I laid back on my bed and knew that I was going to have to live with this experience and not be able to get it out of myself and that I wasn't going to die even though I felt like it. I realized at this point how much I wanted to live, how much everything in my body wants to fight to keep me alive and live to do something with my life even if that's just to live. I understood how important life is and how treating others good is important.
Over all I learned my lesson, and how much I needed to change the way I lived and hope that I never forget. I learned that my views of religion may have been right in the fact that I do not believe that any of them are right and that we have so much to learn as a species.
Experience Reports are the writings and opinions of the individual authors who submit them.
Some of the activities described are dangerous and/or illegal and none are recommended by Erowid.


Say that you want to borrow $1000 from a bank via an unsecured loan. If the loan were secured, and you didn't pay it back, the bank could seize your house or car or whatever you had secured the loan with. Since it's unsecured, the bank will lose all of the money that they loaned you if you don't pay it back. Therefore, they want to make the expected value of loaning you money positive (for them) - that is, they want to ensure that on average the money that you pay them in interest makes up for the risk of you not paying the loan back.
in-context


This site contains historical archives of the Apache Software
Foundation.
Contents:
The main archive of all public software releases of the Apache
Software Foundation. This is simply a copy of the main distribution
directory with the only difference that nothing will be ever removed
over here. If you are looking for current software releases, please
visit one of our numerous mirrors.
Browsable archives of our mailing lists. One file per month
mbox archives are available under the mail
directory
of each project website.
If you are looking for more information on the Apache Software
Foundation, please visit its main
website.


git push<EMAIL_ADDRESS>initiates a ssh connection to the git
user on the octohost.
The sshd server looks for the ssh public key in /home/git/.ssh/authorized_keys
- if there's no match, it denies access. To add the public key - cat ~/.ssh/{public_key}.pub | ssh -i ~/your-private-key.pem<EMAIL_ADDRESS>"sudo gitreceive upload-key {your-name-here}"
It runs the command
defined in /home/git/.ssh/authorized_keys
- which is normally: /usr/bin/gitreceive run {name} {ssh:key:finger:print}
gitreceive takes over and ends up pushing the code through git archive
to /home/git/receiver.
The receiver loads the main octohost configuration file by sourcing it. This configuration file is used by /home/git/receiver
and /usr/bin/octo
The receiver takes the bare repo it gets and checks out a working repo in /home/git/src/$NAME.git
If the git branch isn't master, it will create a new container named $NAME-$BRANCH
- if it's master, it's just named $NAME
.
The receiver looks for any old containers running with the same name - it will use this information to stop it later. (We're not really using the information anymore, but it's the trigger that helps to know there's something to kill.)
The receiver looks for the image_id of the current running image. This will help to kill old container images.
If there's a Dockerfile inside /home/git/src/$NAME.git/
then it starts to build the container. Otherwise, we're done here.
It looks inside the Dockerfile for an EXPOSE
command - this is used to run the container and figure out how to connect to it from the outside.
Then the Docker container is built. If the build fails, it exits here.
There are a number of options that are needed to run any container, those are all gathered using the /usr/bin/octo config:options
command detailed here.
Any config variables stored in Consul's KV storage are also added to the $RUN_OPTIONS. Config variables can be added with /usr/bin/octo config:set $NAME/$KEY $VARIABLE
Once we have all of the $RUN_OPTIONS, we can actually run the container.
Once the container is running, we look for the exposed port that's connected to the internal port.
If there is no exposed HTTP port, then it kills the old container and is complete.
This section will be removed. It was to work around a specific Docker bug that should be fixed now.
Any tags from the container are grabbed using /usr/bin/octo service:tags
- and the Consul service is created with /usr/bin/octo service:set
We grab all of the possible domains and then set them in Consul with /usr/bin/octo domains:set
.
If you want to launch more than 1 container when you push, you can set a key/value in Consul at $NAME/CONTAINERS
- we check it now and launch more containers as needed.
nginx is reconfigured, a new /etc/nginx/containers.conf
is written and it is reloaded.
If you have a private registry defined in /etc/default/octohost
, then we push the new image there.
Send us an email at<EMAIL_ADDRESS>Follow us on Twitter @octohost.


SPARK RDF ANALYSIS
/
reading...
Statistics
Structure
Connectivity Viewer
Schema Visualizer
Centrality
Select a Node
Search
Searching
Metric:
In degree
Out degree
Closeness Centrality (parquet file)
Start Node
Result:
Calculate
Searching
×
Choose a URI
Searching on graph for URIs that match your query.


Do you want to receive ower newsletter? Yes No
What is your work position: CEO Executive Director Manager QA Tester Software Arquitect Developer
Write your opinion about ower job:


Popper on your side!
What are you waiting for? Select a popper from that dropdown.
Placing poppers around elements is just that easy!
Hey!
Choose where to put your popper!
Popper on {{example1select}}
What are you waiting for? Select a popper from that dropdown.
Placing poppers around elements is just that easy!
Scroll me
up and down
I follow it
staying between boundaries
In this example we have a relative div which contains a div with overflow: scroll
.
Inside it, there are our popper and reference elements.
Drag me
on the edges
Flipping popper
which never flips to right
Try dragging the reference element on the left side, its popper will move on its bottom edge. Then, try to move the reference element on the bottom left corner, it will move on its top edge.
Reference
Shifted popper
on start
Shift your poppers on start or end of its reference element side.
Pop
on the bottom
Popper on bottom
Flips when hits viewport
By default, poppers use as boundaries the page viewport.
Scroll the page to see the popper flip when hits the page viewport margins.


Map: Find the Museum
Exhibitions
200 years of history
At a point that advanced over the sea, later known as Ponta do Calabouço, between beaches Piaçaba and Santa Luzia, in the historic center of Rio de Janeiro, in 1603 the Portugueses built the Fortaleza de Santiago, origin of the architectural ensemble that now houses the National Museum.
Read more


Emma Howells
01.12.17
A correction has been appended
Felicia Mettler never saw herself taking a stand for an environmental cause. But when injection well activity began in Torch, a few miles from her Coolville home, she weighed the impact on her family and the land around her.  “I’m on land that is family land. My mother, I could throw a rock at her house. My brother lives right next door.” Injection wells are used to dispose of the chemical waste that can result from fracking. Mettler and other local residents are concerned whether the three injection wells in Torch — a 30-minute drive from Athens — will affect the environment and people’s health.
Injection wells are involved in the process of hydraulic fracturing, otherwise known as fracking, wherein a mixture of liquids are pumped deep underground to break up rock formations that contain natural gas or oil so those resources can be extracted.
“My mother-in-law and father-in-law live in Torch, they live 1,800 feet from the injection well.” Mettler said. “What are we breathing? What are going to be the health effects?”
In recent years, residents in Athens and across the state have voiced worries regarding fracking and the waste that can result from it. Most recently, those concerns have centered around potential fracking in the nearby Wayne National Forest after the Bureau of Land Management auctioned forest land that could be used for fracking on Dec. 13, according to a previous Post report.
Fracking remains a controversial topic, with some championing its energy and economic potential and others fearing its effects on water sources, forests, air quality and public health.
Patrick Connolly
Protesters hold signs out to drivers at an anti-fracking protest at the Wayne National Forest headquarters along Route 33 on Dec. 10.
But the drilling technique is a somewhat recent development in the decades-long history of land use in Southeast Ohio. And when it comes to people like Mettler who see the issue up-close, the reality is clear: Fracking isn’t going away anytime soon.
“If I could shut all (wells) down, I would,” she said. “But in reality, I know that that is not going to happen, so I will push for other things.”
Southeast Ohio’s early settlers first started extracting resources from the land in the early 19th century, when people mined iron ore and cut down trees to make charcoal, Ohio University geography professor Geoffrey Buckley said.
In the mid-19th century, coal production in Ohio began to increase, continuing into the 20th century until it peaked in the ’70s, according to the Ohio Department of Natural Resources’ website.
“We’ve had sort of a long history of extracting resources in our area,” Buckley said. “Really, the peak for a lot of mining was decades ago, and that’s in part due to competition with western coal. But the introduction of the gas industry has really shifted things.”
In Ohio, underground layers of the rock shale hold reserves of natural gas, which can be extracted through wells drilled into the ground, according to the Ohio Department of Natural Resources. Wells often use “horizontal drilling,” where the well is initially drilled downward and then across a layer of shale.
“With horizontal drilling, it allows pretty pinpoint accuracy,” Natalie Kruse, associate professor of environmental studies at OU’s Voinovich School, said. “(Companies) can direct that well into whatever rock formation they’re trying to hit.”
Fracking is a technique used to force the natural gas out of the shale, and it became a more common practice in the mid-2000s, Kruse said. A mixture of “water, sand and chemical additives” is injected into the ground at a high pressure to break up the shale and force the natural gas upward, according to the ODNR’s website.
About 1 million oil and gas wells in the U.S. have used hydraulic fracturing since the process first began in the late ’40s, according a report from the Environmental Protection Agency. Fracking accounted for more than 50 percent of U.S. oil production and nearly 70 percent of gas production in 2015.
In recent years, wells have become more efficient by extending farther across shale layers to extract more natural gas from a single well, Jason Trembly, an associate professor of engineering at OU said.
Just as coal has affected people in Southeast Ohio in past decades, natural gas extraction presents similar challenges, Buckley said.
“Both mining coal and also in the gas industry, those tend to be pretty migratory industries.” Buckley said. “So if a new mine (or well) opens up somewhere, that really doesn’t employ many locals.”
Residents like Mettler, however, are more concerned about the impacts of fracking — whether through air or water pollution — on people’s health.
“It is a health issue,” Mettler said. “For me, it doesn’t have anything to do about the industry itself, it’s because it’s not safe.”
Though fracking itself doesn’t occur in Athens County, it occurs in neighboring Washington County, as well as other counties on the eastern side of Ohio, according to the data collection website FracTracker.
“There are a lot of potential costs that don’t get factored into our use of fossil fuels: environmental costs, public health costs, things like that,” Buckley said. “That’s probably one of the things that tend to bring people together (in Southeast Ohio), when it’s extracted right under your nose, and the negative consequences can affect everybody.”
Patrick Connolly
A truck leaves the site of a K&H Partners injection well facility near Route 50 in Troy Township on Monday, Jan. 9, 2017.
One notable effect of fracking is on the water that people drink. The U.S. Environmental Protection Agency released a report in December stating that fracking practices can impact drinking water resources in “some circumstances.”
Athens County has eight active class II injection wells, according to the ODNR. Those wells are used to dispose of the chemical fluids that results from fracking, whether that be in Ohio or elsewhere.
In the fracking process, the mixture fluid injected into the wells picks up chemicals found in the shale, some of which can be naturally radioactive, Kruse said.
“That (fluid) is separated and trucked to injection wells,” she said. “Injection wells are either converted old oil and gas wells or newly drilled wells.”
The wells then push the fluid underground and away from the well, Kruse said.
“There are a whole lot of potential pitfalls with that,” she said. “We don’t have a great alternative right now that’s cost-effective.”
One of the major impacts of fracking can be on the groundwater, Kruse said, but she cautioned that effects are long-term and uncertain. Nearly 50 percent of Ohioans rely on groundwater as their main source of drinking water, according to an Ohio EPA report published in December 2014.
“We may see some (contamination), but we have no idea when or how bad it’ll be,” she said. “We fear the unknown, and that’s certainly a reasonable fear to have.”
Mettler and other residents founded a group called Torch Can Do in 2015 with the goal of educating residents about injection wells and fracking and pushing for improved legislation, she said.
“When the (injection well) facility was put in, we were not aware of what it was,” she said. “Still so many people don’t know what it is.”
Patrick Connolly
An injection well owned by Petro Quest Inc and C. & P.J. Gerig on River Road in Canaan Township on Monday, Jan. 9, 2017.
The Bureau of Land Management’s decision to auction parcels of land for oil and gas purposes in the Wayne National Forest has been met with alarm from activists and residents in the region. Most recently, anti-fracking protesters met at the forest’s headquarters in Nelsonville on Dec. 10 to voice their opposition, according to a previous Post report.
Beginning in 2006, the BLM started allowing its federally-owned oil and gas resources to be available for leasing to companies, according to its website. Approximately 39,000 acres of federally owned minerals have been leased, forest spokesman Gary Chancey said.
“The Wayne has gone through a spasm of this kind of resource extraction in the past,” Buckley said. “A lot of the land that makes up the Wayne National Forest today had been mined for coal and left the land without trees. Only when it became a national forest did those trees come back.”
In October, the Bureau of Land Management released an environmental assessment of the Wayne National Forest that found “no significant impact” from leasing federal land. The recent auction involves land in the forest’s Marietta Unit near the Ohio River.
Patrick Connolly
Sean White, co-owner of Little Fish Brewery, holds a sign that reads "You can't brew clean beer with toxic water!" at an anti-fracking protest at the Wayne National Forest headquarters along Route 33 on Dec. 10.
Before any fracking can occur, oil and gas companies must submit applications for drilling to the Bureau of Land Management and the Ohio Department of Natural Resources, BLM spokeswoman Lesley Elser said.
“Those stipulations are intended to mitigate risks to the environment due to ground disturbance,” Elser said. “This whole process could take 4 to 6 months after we receive the (application).”
The Athens County Fracking Action Network, or ACFAN, is one of the main groups involved in protesting fracking in the Wayne National Forest. Members of the group, formed officially in 2012, were active in petitioning officials in 2011 from leasing land for potential fracking, member Heather Cantino said.
The U.S. Forest Service later withdrew a scheduled lease of land for oil and gas purposes after receiving 34 letters of protest from 48 Athens County organizations, according to a previous Post report.
Southeast Ohio is one of many
forested regions across the U.S. where fracking occurs.
“It’s definitely an issue nationwide,” Amy Mall, senior policy analyst with the National Resources Defense Council, said. “Communities are concerned about oil and gas development in their areas.”
Many national forests are used for oil and gas purposes like fracking, ranging from Pennsylvania’s Allegheny National Forest to forests in western states like Colorado and California, Mall said.
In 2014, for example, the U.S. Forest Service approved limited fracking in the George Washington National Forest in Virginia, according to The New York Times.
“Local communities (in Virginia) were very concerned about impacts on agriculture and recreation,” Mall said. “Those are not necessarily politically liberal communities. It involved people from all ideologies.”
Fracking remains a debated practice, with researchers and activists alike identifying many significant impacts that are often disputed by oil and gas companies.
 “One is if the land that is put up for leasing in the Wayne National Forest is by drinking water aquifers … There are a lot of concerns about risks to drinking water.”
Cantino cited several problems with the effects of fracking that she and others believe would apply to fracking in the Wayne National Forest. Among them are air pollution from methane leakage and carbon dioxide emissions, as well as water contamination from leaks or spills that could harm people and natural ecosystems.
“Any impact on the forest is going to have an impact on community around it,” Cantino said.
One notable spill occurred in 2014, when a fire at a fracking well in Monroe County caused a spill that contaminated a creek with fracking chemicals and killed more than 70,000 fish and wildlife, according to the Columbus Dispatch.
Impacts of fracking on ecosystems have been the subject of scientific research. Viorel Popescu, an assistant professor of biological sciences at OU, was an author on a 2014 study published in Frontiers in Ecology and the Environment that identified the biological effects of fracking.
“Whenever you develop anything, including shale gas and oil, you have to look at what are the impacts,” Popescu said.
The study found that plants and wildlife can be hindered by several effects from fracking, such as water contamination, air and noise pollution, habitat loss and climate change.
Cutting down forests to make room for roads and pipelines for oil and natural gas wells can harm forest ecosystems, Mall said.
“The scientific community has to keep going and bring more proof to the table,” Popescu said. “But as long as we know what the impacts are then we can proceed with caution.”
Patrick Connolly
Linda Hiller, an Athens resident, holds a sign that reads "Our Land, Our Future" in Spanish at an anti-fracking protest at the Wayne National Forest headquarters along Route 33 on Dec. 10.
Another impact of fracking scientists have identified is an increased number of earthquakes associated with hydraulic fracturing activity. For example, a 2015 study published in the Bulletin of the Seismological Society of America showed that earthquakes in Mahoning County in Northeast Ohio occurred near local fracking operations.
Others, however, are more skeptical of the effects of fracking. Jackie Stewart, state director at Energy In Depth Ohio, an outreach campaign for the oil and natural gas industry, said fracking is safe and has a number of benefits.
Stewart said hydraulic fracturing causes fewer disturbances than conventional drilling, is protected by state and federal regulations and provides economic benefits to the region. She also cited a recent master’s thesis done with researchers at the University of Cincinnati that found “no evidence for natural gas contamination” in groundwater.
Too often people who criticize shale development have never been on a well pad nor have they taken the time to really learn about the health and safety precautions that are taken by the industry,” Stewart said.
Moving forward, Cantino said activist groups will continue to protest fracking activity in the Wayne National Forest and elsewhere.
“Activists from around the region, not just Ohio, are talking about what can be done,” Cantino said. “People are not going to be silenced.”
Correction: A previous version of this article stated that protestors gathered at Wayne National Forest in Nelsonville on an incorrect date. The protestors gathered Dec. 10. The article has been updated to show the most accurate information.


Home
Project
Open
Save
Add files
Remove file
Preview
Clean
Color
Zoom
Patch
Help
Getting Started
About
Project
Add Files
Remove File


The On Board Computer, or OBC, is the brain of the satellite and has different missions such as the coordination of all the actions, sending orders to the different modules, the reception and storage of information of the CubeSat, sending this information back to Earth via the TCS error handling within the CubeSat.
The OBC is divided into three subsystems which are Microcontroller, Interfaces and Electronics.
The Microcontroller is a processing unit of the OBC dedicated to the Satellite Management (SM). Its has to manage the data from other modules collected through the interface and to use it to give orders.
The interface subsystem is responsible for the communication with other modules. It ensures a good connection with other systems of the satellite and allows them to send information. It is also in charge of collecting the power supplied by the EPS. The microcontroller is in charge of the storing system data, operation data, logs and measurements.
The electronics subsystem protects all the electronic components of the OBC chip from radiation and magnetic fields. It also prevents destructive noise on the signals processed within the OBC.


The ReadNow interface is intended for split-phase low-latency reading of small values. The type of the value is given as a template argument. Because this interface is split-phase, these values may be backed by hardware. Providers of this interface should also provide a Resource interface, and this interface should only be used after the resource has been acquired. Otherwise, the low-latency requirement may be impossible to meet.
This interface has the same calling semantics as the Read interface described in TEP 114, except that it is async.
val_t
- the type of the object that will be returned
result
- SUCCESS if the read() was successful
val
- the value that has been read


Group and ungroup
Precomping can simplify a long list of layers in a single comp but creates multiple inaccessible comps. It is now possible for the first time in After Effects to precomp and un-precomp groups with a click.
Show and hide
Group layers are rectangle guide layers that do not render but can help transform multiple elements. Interacting with these is possible by switching layer visibility eyeball or adjusting the transform properties. Click to toggle all guild layer visibility with a click.
Delete all guide layers
If groups aren’t your thing and you end up with a bunch of unnecessary layers, click to remove all guide layers from the comp.


Some notes want to hide away from the rest of the world but these research notes just want to be free!
Learn moreBootstrap + GitHub + nValt + Zotero + pandoc + mkdocs + (TBD)
Open Research NotebookLike a diamond, this stuff is hard
But if you follow the instructions, you should be ok
You'll never think of close + distant reading the same way again
My affective domain is fully engaged