As Lea said, I'm here to talk about IOU ring, but first, you know, just a thank you to Elena. She does a lot of work coordinating things and, you know, keeping the program committee in line. So a big thanks to her, as well as the Linux Foundation, all of our sponsors that make this happen, you know, recording the room, the stuff isn't free. So a big thank you to all those people that help make this work, too. But anyway, IOU ring, so fast it's scary. We're going to talk about a lot of things, but before we do that, I think it's important to give a quick overview of IOU ring. Hopefully, you're not hearing about this for the first time, because I've only got a couple slides on it. But if you haven't, and this is something that interests you, I would encourage you to go out. There's been a lot of talks and presentations, blog articles, and whatnot written about IOU ring. So just type IOU ring into your favorite search engine. You'll get plenty of information. But the basic idea of IOU ring is it's a form of asynchronous IO. And asynchronous IO is pretty cool, because it allows an application to submit multiple IO requests without having to wait for them to complete. So it can say, hey, go off, write this buffer to disk. And if you do that with a write, just call it. You've got to wait for that to complete. You get the error code, and then you can move on. With this one, you say, hey, here's the buffer. Here's the vial descriptor. Go write it to disk. I'm going to go off and do other things. And then I'm going to come back later and check to see if that worked. So it's kind of cool. You can do other things while you're waiting for your disk or network adapter to catch up. And this is pretty nice, because traditionally, if you wanted to do a lot of IOU, you would have a pool of threads or other processes that would go and do this so that you wouldn't block. You could send it off to this pool. The pool would do all the servicing, and you could keep going on. The problem is if you've got a bunch of processes, you've got overhead of context switching and synchronization. If you've got threads a little bit less, but you still have issues around synchronization and still bouncing back between the user space and the kernel. So asynchronous IOU allows you to do a lot more IOU with a lot less resources and a lot less synchronization and overhead. So it's pretty nice. And like I said, if you Google around, you can see some pretty impressive numbers through this stuff. Now, IOU ring isn't the first form of asynchronous IOU that the kernel has seen, but it's undoubtedly the most popular, and it's likely going to be far more successful than what we've seen. In fact, I'm pretty sure at this point it already is far more successful than all the previous attempts. And it does this basically because it's got a pretty simple ECDU interface. It's basically composed of two ring buffers. These are shared memory between the kernel and user space. One of the ring buffers is a submission queue. So you basically form up your IOU requests, you put on the submission queue. Kernel takes that, does whatever you've requested of it, and then it puts the result back on a completion queue, which then you can go back and read whenever you like. And there's also an optional kernel thread that exists. Basically, it's a kernel thread that basically pulls the submission queue.  What's kind of neat about that is you can do IOU without any sys calls once you've established the IOU rings. So you just basically write your request into a structure, put that on the submission queue. You don't have to do a system call. That kernel thread will pull the submission queue, see it, and do your work. So it's kind of neat and allows for some really impressive performance numbers. And I guess the last thing I wanted to mention about IOU ring is this is really a pretty thin layer designed to kind of replace the sys call layer for these IOU, for these IOU operations. It's not intended to replace all of the existing kernel mechanisms for IOU. So for example, IOU ring, it gets these requests for IOU. And if you're doing file IOU, it leverages all of the existing VFS and file and device infrastructure that the kernel has. It doesn't duplicate any of that. So it's more or less the same code path of, you know, open read write. It's just it really kind of replaces that sys call layer and all of the overhead there. So that's also kind of nice. It's a lot more manageable and you're going to get a lot of the same behaviors that you're used to seeing with the traditional synchronous calls. Now that's pretty much all I'm going to say about IOU ring for background. So I'm just going to pause for a minute if anybody's got any questions about that. You can just raise your hand. No? Okay. Do we have any on the virtual? All right. We're either still asleep or I've explained it exceedingly well. So as the saying goes, you move fast and you break things, right? It's important to know it's not move fast or break things. It's move fast and break things. And IOU ring is definitely very fast, which means it's definitely going to break things. First thing is it broke audit. IOU ring operations for quite a while bypassed all of the audit mechanisms in the kernel. So you could submit IOU and you would have no idea that it was happening if you were looking at just at the audit logs. Now for some of you that don't use audit, probably not a big deal. In fact, you'd be like, hey, less performance overhead. But there's a lot of users out there that do require auditing either for legal reasons or security requirements or they just like to know what's going on with their system. So this turned out to be actually a pretty serious problem. The reason why is, as we talked about, IOU ring is intended to kind of bypass the syscall framework. And audit has traditionally always relied on the syscall framework being there and part of the code path that applications took to perform IOU because before IOU ring, that was pretty much true. And it uses syscall framework to basically do all the setup, initialize, you know, the VFS logging and whatnot and doing all that. So without that, auditing didn't happen. The other thing, and perhaps even more serious, was it broke all of the LSM access controls. So think if you've got SE Linux, App Armor, SMAC, any of the number of LSM access controls, and you had it restricted so that only certain processes, only certain security contacts or domains would be able to do certain sorts of IOU operations, well, you could bypass all of that with IOU ring. The idea is basically this concept around credential sharing or what IOU ring calls personalities. The idea is that with IOU ring, you have the ability to store your credentials in the IOU rings itself. So imagine you were a privileged user, root user, whatnot. You could store your credentials in an IOU ring and then hand that IOU ring off to an unprivileged or normal user. And that normal user could then go ahead and perform any IOU ring operation as that privileged user. So, oh, and there would be no LSM oversight of this. There would be no LSM access controls imposed on, you know, the transfer of credentials, the delegation of privilege across this. So that was pretty scary. That was actually kind of terrifying when we first figured that out. And like I said, this was called personalities, which we're going to get to this a little bit later. But I think that kind of masked this for a while, because those of you that play with the Linux kernel may already recognize the fact that the Linux kernel has a concept of personalities already.  You might think that's a little odd, but okay, whatever. Well, turns out it was credentials. But that was not it, actually. And this was really kind of funny because after we had a lot of, and once we realized there were these issues around IOU ring, we had some pretty long discussions with the IOU ring developers. And for the most part, they were very cooperative. And they kind of understood that, okay, these were serious problems that needed to be addressed. But, you know, as is usual, it takes a while to get there. And it took a little bit longer to get the holes fixed. And so we got those fixed. And that was good. And then as happens in the Linux kernel, functionality comes along. There was a new IOU ring operation that was proposed.  This is, you know, can we put an LSM hook here? And we looked at it and we provided them some feedback. And, you know, we said, hey, the API doesn't have enough context for us to be able to make a good access control decision on this. We kind of need some more information. And then things kind of went quiet, you know, for a couple months. And can anybody guess what maybe happened a couple months later? I mean, somebody's got to have an idea, right? Let me just randomly guess something. Otherwise, it's really quiet and boring. Richard, close. Yeah, very good. But, you know, what's the implication of that? Right? You know, if you had to guess, did it go well? Yeah, they broke it all again. So, yeah, evidently, evidently.  So basically, yes, they put in this command pass through which, without going into details, I think we're all familiar with the IACTL, CISCALL, right? And kind of envision this as IACTL, but maybe worse, if you can think of that. It basically allows arbitrary users to submit arbitrary commands directly to hardware or to kernel modules in the kernel. Once again, without any LSM oversight or any access control points. So that was fun. We did have some auditing, though, so I guess they didn't really break auditing too badly this time. So, baby steps, I guess. Anyway, so those were our problems. Those are some of the things we had to solve. And even though they broke them relatively quickly, it took us a little while to go ahead and fix those. So, here's how we went about doing it. First thing we wanted to do was we wanted to restore audit visibility. Simply because once we have visibility with audit, it makes it easier to fix the LSM access controls and do a lot of other things. So, first off, we had to kind of teach audit about IOU ring and say, you know, okay, these are, it's like a CISCALL, but it's not exactly a CISCALL. So we had to create a new audit record, which we call U-ring-up. I know, we're not creative people. Then we had to support all the different multiple calling contexts that you can get IOU ring in, because as we talked about earlier, it's asynchronous, which means you're going to have multiple different ways that IOU operations can get serviced inside the kernel.  So, we had to do some work in audit to support all those different contexts. And basically, we had to kind of pretend that IOU ring was basically a CISCALL. So all those hooks that we had around the CISCALL framework for when you first enter the kernel and then exit back out, we basically just put very similar hooks with a little less overhead into the IOU ring code before and after it serviced an operation. So we, from audit perspective, IOU ring is very similar to a CISCALL, which allows us to basically reuse most of our mechanisms in audit. And for the most part, that seems to be working well. Then once we got that sorted out, we could actually see what was going on inside the kernel with IOU ring. We moved around to actually putting the LSM hooks in there and kind of restoring access control points to IOU ring operations. So the biggest thing, like we talked about earlier, we had the personalities of the credential sharing. So we wanted to make sure that we had a control point in there so that whenever there was a task that was going to execute an IOU ring operation with the credential other than its own, we wanted to make sure that went through an LSM hook so that the LSMs could weigh in on whether that should be allowed or not. And thankfully enough, I guess if there is any kind of positive here, if you're going to transfer an IOU ring from one process to another, you basically just transfer it as a file descriptor and you can already transfer file descriptors between processes. There's several ways to do that. We already had hooks for that. So that was covered. So we were all set there. We just needed the LSM hook for the credential delegation. And the only other hook we added in is we added a hook for if you were using a configuration that spawned a kernel thread, we put a hook on that. And there's a variety of reasons, one of which, at least from a credential point of view, was that when you create one of these kernel threads to pull for new IOS submissions, it inherits the credentials of the task which creates that kernel thread. And also because of if you have this kernel polling thread, you can do IOU without ever having to issue a syscall. And as some of you know, there's things like Sec Comp and other things that work, that provide some sort of security mechanisms at the syscall layer. We wanted to make sure that there was an access control point so that, you know, if you wanted to block certain applications, certain users from using this dedicated kernel thread to do this and potentially bypassing some of these other security mechanisms, we wanted to make sure we had an LSM access control point to gate that so that you could define your security policy to either allow or restrict that. And as I mentioned, there was the command pass through, the little surprise addition at the end. We basically, we had to add in another LSM access control point for this because there was just no other way to control this. And it's particularly crude right now. It just went into the kernel not too long ago. We're going to backport it into 5.19, it looks like. Like I said, very crude. There's not much granularity to it. It's either you can do it or you can't. We don't have the ability, because as I mentioned before, there's not enough context there to make a good access control decision to say, we want to allow this particular command to be passed through, but we want to block this one. We don't have that ability right now. However, you know, and this is the benefit of, you know, being able to come back and have these conferences, was able to get together with the developers and the maintainer that put together the IOU ring command pass through earlier this week. We had a lot of good discussions that above. I think we've kind of, we've sorted things out a little bit more. I think they understand our concerns a little bit better, and they're going to start looking at ways to improve that in the future. So that's a positive thing. It's crude right now, but I think there's hope that in future kernel releases, we'll have a better solution here. So probably on to the next thing. Does that, how's everybody doing? Does this all make sense so far? Zero questions. Nothing. Wow. Guys awake? Laugh a little so I know you're awake, something. Okay. Richard's got one. Hi. Richard Briggs. I have worked with Paul in the past. He was at Red Hat a little while ago. When the IOU ring stuff first came in, we approached them and said, well, we need some insight as to what's going on here. And they said, but that'll make it slower. And they were pretty reluctant to work with us at first. And we basically said, well, the auditing stuff is fairly important for a number of our customers and for other users of the Linux kernel. And if we're not able to get your cooperation and putting stuff in here, then we may need to submit a patch upstream to make audit and IOU ring mutually exclusive kernel configuration options. And at this point, they kind of went, well, all right, we'll work with you. Yeah. And it's a good point. And it's something that comes up fairly often is, you know, especially around performance oriented features like IOU ring, is somebody will say, well, we can do this as long as we, you know, we don't care what you do from a security perspective. We'll just make it optional. And so you can turn it off. And that's always going to be useful because there are certain use cases, certain users that they really they need every, I mean, every microsecond, every now second of performance they can get out of their systems. And that's fine. I'm not going to criticize those people. But I would say most users, and there's definitely a class of users where it's a strong requirement. If they don't have these security features, they can't deploy these Linux systems. I mean, it's a hard requirement for them. But we still want to be able to offer more these new performance functionality too. And so it's good if we can make security features optional, but at the same point in time, it's very important for us to find a way to develop the security functionality and the performance functionality in such a way that they can coexist. And they need to coexist well, because if it's awkward, like for example, with the command pass through right now, where it's a very coarse control, there's going to be a lot of situations where people are going to have to basically allow a command pass through for more security domains than they want, and for perhaps more commands than they want, because they simply don't have the flexibility and granularity in the security functionality that they need. So it puts users in an awkward situation, where they're either going to have to disable something, or where they're going to have to basically enable far more access than they want. So if there's anything you take away from this talk, it's please go out, find a way to work with each other. That's the key here. And when we don't work well together, we end up in situations like this, where we could have multiple kernel releases spanning several years, where we have huge security holes in the system. And that's not good for anybody. And that's kind of a good little segue. I don't know if, well, I know Richard hasn't seen the slides, but it's a good segue into the next session. As an LSM community, we're doing a pretty poor job at identifying security critical kernel changes outside of the LSM. And this is not a new problem. This has been going on for quite a while. And we do spot some changes. So I mean, it's not like we miss everything, but the kernel is a big space. There's a lot of stuff going on. And I think everybody in the LSM space is kind of heads down, you know, we just we don't have enough time in the day. There's not enough people looking at code. Priorities are always in the state of flux. And we just can't keep up with it. Making things worse is that a lot of these other security or a lot of the other kernel subsystems, especially those that are focused more on priority or on performance, generally don't engage very well with the LSM community. Because why would they? We slow things down, right? You know, it's not in the front of their mind when they're developing new functionality. And I don't mean to single anyone's subsystem out. I'm using IOU ring today because it was a recent example and I thought makes for a good use case. But there's definitely other subsystems that we've had problems with in the past. And it could be for a number of reasons. I think it changes depending on the individual and perhaps, you know, time and whatnot. But much like we're doing a bad job with this from an LSM side, I think they're doing a bad job of it from the other side. And these are both not new problems they've been going on for as long as I've been playing in the Linux kernel space, which is quite a while at this point. So I don't really see either one of these things improving in the near future. And it gets even worse. This is a real downer section here. Even when we do cooperate, there are still some challenges. I talked about some of the terminology differences earlier where we've got in the LSM world, we typically talk about credentials and, you know, even the kernel, it's struct cred, right? But when the IOU ring folks were implementing this, when they were caching the credentials, they kept referring to them as personalities, which like I said, is perhaps doubly confusing because the Linux kernel already has a concept of personalities. And so funny thing was when IOU ring first came out, and there was an LWN article about it, and there was some other information about it, kept referring to personalities. And so I'm, you know, I'm quickly reading through the article because, hey, new feature, I should look at this, see if there's some security stuff we should look at. Didn't even register with me that there was credential sharing because I would see personalities. And like I said, I thought, this is weird. I don't know why they're caching personalities. But okay, there's probably some reason that I'm not aware of. Had I know, had they used the term credentials, when I was reading this information, it would have jumped out right away and was like, oh, okay, we need to go talk to the IOU ring guys. This is, this could be an issue if we don't catch this soon enough. Another problem we have is that, you know, especially for new functionality, you know, those of us in the LSM space, we know security pretty well. We know the LSM's pretty well, but I didn't know anything about IOU ring till I first read about it. And on the same or on the same concept, but from their point of view, they knew IOU ring very well, but they didn't really know what an LSM would need. They didn't even know that an LSM would care about IOU ring because, well, it still uses all of the same VFS code paths, and you've got access controls for VFS. It should just work, right? So I think everyone has good intentions, but it doesn't always work out the way we need it to work out. So how can we do this a little bit better? Well, my thought was maybe we need to start doing some automated code inspection. Coordination is still the best. And please, these next few slides, don't take this as an excuse to not go out and talk to other people about what they're doing and figure out, you know, okay, how can we work with you to make sure that, you know, the kernel security remains intact and things are good going forward? So please, continue to do that. But I think we also need to be realistic that it's not going to work as well as we need it to work. And we've got several years of proof that that's the case. So my hope is that perhaps if we can come up with some automated code scanning, can help focus what limited review resources we have on to commits or changes or new functionality, new subsystems that are security relevant, that do potentially need some extra scrutiny. And so this is kind of well outside my wheelhouse and area of expertise. But I was thinking like, well, okay, what, having done this for a while now, what are, what are some of the things that usually stand out when we have these problems? What, what could we use as potential flags or patterns to see that, okay, maybe we need to have some extra LSM access control points in there? Well, one thing, and I've actually been doing this first point for a couple of years now since I started maintaining some kernel code is I have a small little script that runs, you know, fairly regularly a couple of times a day. And it looks for changes in LSM subsystems that happen outside of the LSM tree. Now, there's plenty of reasons why this is okay. And this happens every kernel cycle. There's a few kind of innocuous little changes that go in. And that's all right. But occasionally, you'll have somebody that'll come in and, you know, they look at it and they're like, I know a little bit about the LSM.  I can just go ahead and drop some code in there and it's fine. And of course, they don't CC the SC Linux list because that's all right. They've been doing this for a long time. They know what they're doing. And for the most part is okay. I mean, it's only a couple of people that do this. It usually works out pretty well. But there have been the occasional case where it's like, hey, I see what you're trying to do. That's fine. But we need to kind of change this a little bit. So that's a good thing to catch. Another thing is if you've ever looked at the kernel source code, you've probably run across an LSM hook at some point. They all start security underscore blah. So basically wanted to look at all of the LSM call sites scattered throughout the kernel and just keep track of those and try to see like, when do those change? Do people move them around? Does somebody add a new one? Is somebody maybe taking a hook and said like, wow, I'm adding some new functionality. And it looks like maybe this LSM hook could also be used in my new functionality. And maybe it can maybe it can't, but it's something that, you know, maybe we should take a look at. Also, we talked a lot about credentials. So I'm not going to hash over that again. But basically anytime there's a credential override in the kernel with there's actually a specific kernel function for that. So we want to watch that carefully. And if somebody's doing that, you bring that to our attention. Also anytime the kernel makes a capability check, while most Linux kernel developers, you know, they might not necessarily be super familiar with the LSM. And when there's a hook that needs to be placed there, they are pretty good about figuring out when you need a capability check because that's the traditional Linux, you know, permissions model. And so they might put in a capability check but not do anything with the LSM. And if we had had this in place before IOU ring went in, we probably would have caught the IOU ring stuff because they did have the capability checks in there, even though the LSM story was lacking. And finally, I want to put a check in there. Whenever there's a new IOU ring operation that's added to the kernel, you know, let's watch that because as we've seen, IOU ring is a bit of a special case because it doesn't have that syscall layer. So this might be something that we need either for auditing or for LSM access controls as we saw with the command pass through. So we got a list of things. I had an afternoon. I was like, you know, okay, let's let's see what I can do with a couple hours. So I'm going to there's a link at the end of the slide. You can go look at my scripts. I put them up there so you can grab them and take a look. Here's just kind of a quick example of some things that I'm doing. And this is all running out of bash script. This is not fancy. Like I said, this is an afternoon's worth of work. That first they get log command line. If you're not too familiar with get this basically just compares two branches, two trees and basically says, okay, what's in, you know, compare the LSM next branch with what's in Linus's master tree and basically check to see, you know, Hey, is somebody putting code in the security directory that hasn't gone through the LSM next tree? You know, for example, are the VFS guys, did they add something in did they add a new LSM hook or did they change one of our existing hooks? So just kind of gives heads up if something's going on there. And the next thing is this is perhaps it's a little more interesting. So the first thing I'm using a tool called C grab, which I don't know if you're familiar with that. I spent when I first started this, I had never really heard of secret before, but it popped up when I was searching because grep is nice, but it doesn't always necessarily work extremely well with source code sometimes, you know, lines wrap. There's other oddities that won't go into but I started off using grab and it was kind of a little awkward. So I looked around found C grab and it works beautifully. The parameters here dash dash code that basically tells C grab, you know, Hey, ignore all the comments, because oftentimes people put function names and comments, which is good, but I don't want any false positives there. No column and no numbers that basically, you know, in the grep output, you know, you can see a row and a column for the file. That doesn't display those because, you know, if I was doing that in a snapshot, that's going to change quite a bit. So I didn't want that. And the dash dash word is just basically like I said, C grab is kind of intended for going through source code. This basically says, Hey, look for an identifier override cred.  And as you'll see, I'm not blindly searching through the entire kernel. When I was first doing this, I was a little concerned that I was going to get a lot of noise. A lot of change that was going to be continuously flagging a lot of false positives. So I wanted to kind of limit this to particular areas. You'll notice like drivers are noticeably missing in that subters list, which in general is okay because from an LSM, from an auditing perspective, there's usually not a whole lot we do with individual drivers. We try to stay up a layer because otherwise the amount of work adding hooks in would be tremendous maintaining those. But you can see it is a pretty, pretty full list of things I was looking at there. And so once I had these commands, it was just a matter of, you know, throwing them into a quick little bash script and this runs multiple times a day. It's pretty simple. I execute those commands and a few others. It basically generates kind of a snapshot of the kernel at a point in time where it calls out, you know, all those different call sites, all those different, you know, git history. And like I said, there's no function or there's no line numbers and there's no column numbers. So if there is a little bit of, you know, patch merging and whatnot, if they move up and down a little bit, that's okay. It won't necessarily catch all those. But it still catches kind of the horizontal white space. So if the level of indentation changes, so like let's say somebody puts a LSM hook, it was inside an if statement or if it was inside a loop and now they bring it out, that'll show up, which one would think that might actually be kind of helpful. So we'll see. So anyway, it creates a snapshot. It compares the snapshot to the previously run snapshot. And when I say compare, it just does a diff. And then, you know, if there are any differences, it sends me a report via email. And then the last thing it does is it replaces the previous snapshot with the snapshot just generated and then, you know, wash, rinse, repeat, just keeps doing this multiple times a day. Like I said, this is a very simple first attempt afternoon worth of work. I was like, okay, let's see what this gets me. I mean, is this worthwhile? Is it just going to be all noise all the time? Is it even going to find anything interesting? Well, so far so good. So I did this probably about in the middle of the 519 RC cycle, I think it was around RC4, RC5 that I first turned this on. And like I said, my biggest concern was the amount of noise that would come out of this. And it actually turns out the noise is very minimal to almost non-existent thus far. It's been a limited number of times, but it seems to be working pretty well. Turns out that the changes that it catches outside the merge window have been very small. There's not been a whole lot there. Most of the things that do pop up there are fixes for code that went in during the merge window.  So we need to change this a little bit. So and that that's to be expected. And so that was that was pretty good. So what actually what are some of the positive things that it did catch? Well, during the 519 to the 6.0 merge window, IOU ring kind of reorganized their code and decomposed a lot of things into multiple files. And when they did this, this caught all of the LSM call site changes and the capability changes. So that was good capability wise, so not necessarily specific to the LSM. It did catch a number of debugging mechanisms that were added during the last merge window and that, you know, were gated with Capsis admin. And but perhaps I think one of the more interesting things, and this kind of surprised me, both the good and the bad way, good that this tool actually caught it bad in the sense that this was kind of one of those like, oh, man, how happened does or how often does this happen sort of thing? I'm not going to list the specific commits. I want to shame anybody here. But there was a PROC FS tunable that like a lot of PROC FS tunables was gated with Capsis admin. And this commit went in and they changed some things with the tunable, and they removed the capability check. And so I sent a private email off to the patch author and the maintainer and said, Hey, I know very little about your subsystem. I don't know if this was intentional. It wasn't mentioned anywhere in the commit description, but this commit removed a capability check from this PROC FS tunable. Was this was this intentional? Is this okay? And had a little discussion and neither the patch author or the maintainer had realized that Capsis admin had been removed. Now the good news is we had a bit of a discussion some back and forth. And it turns out that maybe that was okay. Perhaps it didn't really need to be there in the first place. So that was good. But, and this highlights once again how important it is to go out and talk to people. When we were having this discussion, they realized that, okay, maybe there are some other parts of their code that do need a capability check for Capsis admin. So this was a little bit of a surprise. I wasn't expecting to see this, but it was kind of nice to see that at least we're on the right track with some of this, that maybe this could be useful. And so next steps. Once again, I keep harping on this, but don't take away from this talk that, you know, we can do all of this through automation. Keep talking with each other. Also, while this little automation toy has had some limited success for a small period of time, it's pretty crude. It's really, it was just aiming at low hanging fruit to see if this is something that could have some value. And I think there is a lot of potential here. I think, you know, one of the simple next steps would be to identify some more complex code patterns. You know, there's a lot of tools, Kachanel, which I'm sure I'm pronouncing incorrectly, but that has a lot of power to do, you know, some code analysis. It's already used in the kernel source tree for doing other things. I think that might be something we could leverage here or similar tools. I'm also, once again, this is well outside my area of expertise, but I know there's been a lot of focus recently on machine learning and other forms of pattern matching and whatnot. That might be an area that could yield some fruit here as well. Basically, my hope here in giving this talk is that somebody either in the room or on the virtual session who has a bit more experience in here that could potentially find this interesting and run with this a little bit, because I really think this is perhaps our best hope at preventing the next IOU ring problem. And with that, my last slide, I promised you a link to the scripts that I'm using. That's it right up there. These slides I will put on the scheduled thing later today. My apologies. I got back, sorry. I got back late last night from an event and didn't get these slides up there, but I will do that today so that you'll have this URL. Otherwise, you can take a picture of it. But that's my email address if you want to be in touch. It's also my Twitter handle. If you want to be in touch that way, whatever works for you. I guess the only catch I will say about the scripts is those scripts are intended to be run from a little kind of home grown job scheduler thing. So there's some stuff in the scripts that might not make a whole lot of sense. So you can just ignore that and just look for the C grab and to get commands and make sense with that way. So that's it. Are there any questions now? Someone other than Richard? He's a nice guy and all, but come on. All right. Oh, do you have one, Richard? So the automated stuff is good to have in there because it can catch certain things, but then you have to constantly update it to look for certain keywords. And so that's going to be a bit of a challenge, but it's it's part of the equation of trying to get at some of this stuff. So you're talking about the, you know, keep on talking idea. I mean, I guess the one comment I will make.  I mean, those don't really change. So keeping on top of that is easy enough. The LSM hooks that we look for in those call sites, that's generated dynamically from the kernel source and the script. So the overhead for that is very minimal. Sure. But then there's entire new subsystems and things like looking for, looking in the entire IOEuring thing. Now that you know that it exists, you know, to look there for that kind of change. When, so it, it turned out that Paul and I had actually been at the same IP sec bakeoff many years ago and didn't realize it until I pulled up a bunch of photos of it and Paul's kind of like, yeah, there I am in that picture. Oh my God. Okay. We went through this stuff when looking at IPv4 and bolting on IP sec onto that, it was, it was a security bolt onto the side. And so when IPv6 was being developed, there was active work to try and integrate security in it from the get go so that we weren't trying to play catch up. In 2013, when Edward Snowden blew the lid off the NSA, at that point, the IETF had, I guess they added a bit more formality to their process. And if in every RFC after that, there was a section called security considerations, and it had to be reviewed by people to be able to make sure that what was being added was going to not cause some new problems. So the Linux kernel development process is a bit more organic. And I mean, there's some quote from Linux about you guys, you security guys are crazy, or insane, I think was the name of the word that he used. And so there is some reluctance from the rest of the Linux community to be able to acknowledge the security concerns that we do raise. But that's the kind of thing that I would like to see is in any new features or patch sets of some bit more formal security review being added to the process. I agree. I mean, I think it would be wonderful if any new, you know, kernel subsystem or significant bit of functionality did have to go through a security review and at least, you know, get a quick thumbs up or thumbs down. But the hard reality is that's not going to happen any time soon.  Can you, can you hold this for a second? Because we need to add some extra hooks. And they're like, Well, no, we're not going to gate new features on the LSM. And we've heard that time and time again earlier this week at plumbers. There's a new IOU ring functionality for spawning new executables basically replacing the whole fork and exec process with IOU ring. And there's a couple of us that were in that talk.  Can you please CC the LSM mailing list? And they said, Oh, sure, we haven't thought about it yet. But yeah, we'll do that. And we're happy to work with you as long as you don't impact performance. So I mean, this is the sort of thing that we're we're up against. And so, you know, I think if we're careful and we're persistent enough, you know, we can make inroads, but I'm not expecting this to change substantially anytime soon. The LSM is it is it is and the LSMs are becoming more and more common. In fact, I'm pretty sure every major enterprise all links distribution has at least one LSM enabled these days. So it's not it's not a fringe technology anymore. Case? I just pulled your scripts really quickly to take a look at just how are you gripping please don't I'm not a script person. Oh, no, I'm just trying to look at it and yeah, see your approach to it. And I'm in looking at it, I realized like, Oh, wait, I'm sort of already doing this a little bit for some of the hardening things because I ran over the same problem of like, Oh my God, why did you touch that? How did didn't you CC me like what? Yeah. And while it's not a perfect solution, listing a couple of the like file or or identifier regular expressions in the maintainers file will at least trigger adding someone to CC when certain things come up. So it might make sense for I mean, it's a pretty limited set of words. Yeah, you know, it's like, are did you change capable? Or did you touch capable? Did you touch NS capable? There's a short list of them. And again, it's not 100% because not everyone runs get maintainer. Yeah, but it has worked pretty well for for me when I added those types of things for things and like sec comp and like, I get, I get CC when an architecture ad sec comp support and I can go did you add a self test stuff like that. So it might be nice to like do it on two fronts, like you're proactive trying to find them.  It's a very good point. I hadn't really thought of that. But yeah, I mean, it's because and that would be much more preferable. That would get us closer to the let's have a conversation beforehand. So yeah, that's definitely something to look at. It's fun. My laptop just beeped at me. So find out what that means. So I'm just curious, when there's been a release where there has been a missing LSM hook or something like that, does that generate a CVE? Because arguably there's now a bypass for security control. So there's a fun topic around Linux kernel CVEs that we could probably spend a couple hours on. I'm personally of the mindset that CVEs aren't anything to be ashamed of and we should have CVEs for these things. But there's some prominent kernel maintainers that have a very different view of those things. So, you know, they're also as an individual kernel maintainer. Well, as an individual open source maintainer, the path to getting a CVE is fraught with a number of difficulties. So I usually try to make people very aware when there are issues. And we work hard to get things back ported whenever we can. There once again, there are other issues we face with getting security fixes back ported specifically around IOU ring. I think we are going to get it back ported. So that's good. But yeah, I think we, or at least my approach thus far has been to make people very aware of this. And I've seen that a number of Linux distributions have then created CVEs for them. But unfortunately, my results have been very mixed trying to do it as an individual. So I just rely on getting the word out and hope that the Linux distributions will pick it up and do the right thing in terms of CVEs. So, okay, thanks. Yeah, I'm sorry. It's not very satisfying. And I'll be the first to admit that. But there's a number of process problems here as I think you found from this talk. So we're just trying to do the best we can. One more question. So I think we, well, I don't know. Am I over time? I'm at time. Okay. Well, thank you very much. I hope you enjoy the rest. Sorry. Last question. Sorry. Would it be possible instead of opening a CVE to have like an issue in GitHub or like for example, for hardening, there are tickets. And maybe. So, yeah, yeah, there's the kernel bugzilla. So we do have at least speaking point my SELinux hat on for a minute. So we do maintain a mirror of the SELinux kernel tree on GitHub for people that prefer to get it that way. And we do have some issues that we allow people to submit issues that way. It's a kernel development. So we prefer to use the mailing list, but I know some people prefer GitHub. So that is a possibility. We don't use that for any formal, you know, GitHub has some really cool CVE and security functional. I use that for Libsec comp, which maintain. That's all on GitHub. But for the kernel stuff, we still really kind of steer people towards the mailing list whenever possible, just because trying to synchronize up to main forms of communication, it's difficult. So all right, I think we were at time. I'm not seeing any other hand. So I'm going to get down, but I'm going to be here both today and tomorrow. Feel free to catch me in the hallway. I'm more than happy to talk to you guys. And if you're virtual or if you think about it next week, you've got my email. There's my Twitter too. But anyway, thank you all for sitting there patiently with my presentation at the beginning and enjoy the rest of the conference.


But let's begin reading here in Acts chapter 1 at verse 1. I'll read to verse 8 and we'll get into our study. The former account I made, O theophilus, of all that Jesus began both to do and to teach, until the day in which he was taken up, after he, through the Holy Spirit, had given commandments to the apostles whom he had chosen. To whom he also presented himself alive after his suffering, by many infallible proofs, being seen by them during forty days and speaking of the things pertaining to the kingdom of God. And being assembled together with them, he commanded them not to depart from Jerusalem, but to wait for the promise of the Father which he said, you have heard from me. For John truly baptized with water, but you shall be baptized with the Holy Spirit not many days from now. Therefore, when they had come together, they asked him saying, Lord, will you at this time restore the kingdom to Israel? And he said to them, it is not for you to know times or seasons which the Father has put in his own authority, but you shall receive power when the Holy Spirit has come upon you. You shall be witnesses to me in Jerusalem, in Al-Judea and Samaria, and to the end of the earth. And so I'm going to give to you some information, some basic information concerning the Book of Acts. Then we're going to move into verses one through eight and we're going to be looking at the introduction to our study of the Book of Acts. Now when you look at the Book of Acts, I want you to notice how it says, the former in verse one, the former account I made Otheophilus of all that Jesus began to do and teach. The Book of Acts is the second book that was written by the writer Luke. Luke wrote the Book of Luke or the Gospel according to Luke as well as the Book of Acts. We know that when we study scripture that this man Luke was a friend and traveling companion of the apostle Paul. That will be noted when we get into chapter 16 verse 10. From some of the things that you can glean from Acts and all and the things that are set of him, we know that Luke was a Gentile. It's probable that he came from Antioch in Syria. So as such, Luke is the only Gentile writer contributing to the Bible. Now we know that he served with Paul because Philemon verse 24 speaks of Mark, Aristarchus, Demas, and Luke and he's referred to there as a fellow laborer. We know according to Colossians chapter four verse 14 that he is a beloved physician. So as a physician or a doctor, he highlighted many of the healings in his Gospel and you're gonna see that he highlights healings also in the Book of Acts. Now, when he was writing the Book of Acts, Luke relied on various sources for his information. We know that he pulled from written sources as we will see when we get into chapters 15 and 23 and we also know that he interviewed eyewitnesses in the same way that he did when he wrote his Gospel because you see that in Luke chapter one verses one through four. Now, Paul's subsequent ministry, a second imprisonment that we see in 2 Timothy four and his death are not recorded. He doesn't mention the death of James. He doesn't speak of Nero's persecution and he doesn't speak of the fall of Jerusalem. So we know that the Book of Acts is in reality a documentation of the life of the early church. It provides a backdrop of how things began and it also gives us information concerning how the Lord moved when the church was new. This book has been the book that has actually been the model for many ministries, including our own. When you look at what is called the distinctives that make us a Calvary ministry, you'll see that according to the distinctives, the Book of Acts is really a blueprint for us and there's a reason why. It's when you begin to look at the history of the church, when you begin to see the history of the church, much of the early history of the church up to today is really tragic. You see, by the end of the first century, the church was already in very poor shape. How do we know that? Well, when you read the Book of Revelation, which was written in the 90, 90, 96 AD, when you look at the Book of Revelation, there are seven churches that are mentioned in Revelation chapters two and three and of these seven churches that are mentioned there by Jesus himself, five of the churches are already receiving condemnation by the Lord. And so the church's birth in around 33 AD, 32 33 AD, but within 60 years, it's already going down the tubes. It's already having problems. And so by the time you read Revelation, you see that the Lord is speaking concerning some things that he's not pleased with. You can see how Jesus speaks of how they left their first love, how they had begun to accept compromise, greed and undisciplined living, how they had set up a priesthood over the believer and how they had allowed false doctrine to enter into the church. That all took place within the first 60 years or so of the history of the church. And so when you read Revelation, you see that Jesus declares that he's ready to remove his presence from them.   This all took place within the first 60 years or so of the history of the church. The interesting thing about it, and we'll be looking at that in the book of Acts, is when you see the origin of the church, it was a work that was birthed by and sustained by the Spirit of God. The book of Acts gives us insight into how to be led as well as empowered by the Holy Spirit. And so as we go through this particular book, one of the things I'm gonna be encouraging us to is to learn how to walk in the Spirit. You see, its purpose was to document church history, showing how the church began, in order that it might fulfill what has been called the Great Commission. You've heard the term the Great Commission. The Great Commission is the marching orders that the church received from Jesus Christ. The Great Commission is his command for the church to enter into the world with the intention of preaching the gospel of Jesus Christ. There are people today, though, who will say, well, why do you wanna even continue preaching this gospel? Why do you think it's necessary? Don't all roads lead to God? And the answer is all roads in a sense do lead to God because every man will stand before God to give an account of himself. But not every religion leads you to heaven. And so the message of the gospel is a message that gives to us clarity concerning how you can arrive in heaven. And Jesus Christ gave to us this gospel and he said, take it to the whole world and proclaim this message. This is a message that we have, a message of freedom that you have in Jesus Christ. In the book of Luke in chapter four, verses 18 and 19, we read, the Spirit of the Lord is upon me because he has anointed me to preach the gospel to the poor. He has sent me to heal the brokenhearted to proclaim liberty to the captives, recovery of sight to the blind, to set at liberty those who are oppressed to proclaim the acceptable year of the Lord. And so Jesus' mission was to do this, to bring people to faith in him so that they might enter into the kingdom of God. And so the word of Christ gives life to those who are spiritually dead in trespasses and sins. In John 5, 24 and 25, Jesus said, most assuredly I say unto you, he who hears my word and believes in him who sent me has everlasting life, shall not come into judgment but has passed from death into life. Most assuredly I say to you, the hour is coming and now is when the dead will hear the voice of the Son of God and those who hear will live. And so the spiritually dead are made alive as they invest their faith in Christ, receive his life and those who are at one time dead in their trespasses and sins are made alive through Jesus Christ by his message in faith in him. So is the message of the gospel important and the answer biblically is absolutely. Of course it's important. You see the church received marching orders and those orders again are called the Great Commission. This commission was given various times. You actually see it in John 20 verses 21 through 23. You see Mark 16 verses 14 through 18 and you also see it in Luke 24 verses 46 through 49. But what we associate with this great commission most readily is what is found in Matthew 28. All of you are familiar with this because in Matthew 28 verses 18 through 20 it says Jesus came and spoke to them saying, all authority has been given to me in heaven and on earth. Go therefore and make disciples of all the nations baptizing them in the name of the Father and of the Son and of the Holy Spirit teaching them to observe all things that I've commanded you and law I'm with you always even to the end of the age. That's the Great Commission. Go out and make disciples teach them to observe all things that I've commanded you and the mark or the demonstration that they are my disciples is that you will baptize them in the name of the Father, Son and the Holy Spirit. Your Great Commission. To go out and proclaim this message. And so what we have here is once again Jesus giving another facet and aspect of this Great Commission. Again, it's been said that the Great Commission was given in Matthew 28, but I just alluded to the fact that it's actually given in various ways in the other gospels as well as here in the Book of Acts because when we get to verse eight, he says you shall receive power after that you have after that the Holy Spirit has come upon you and you shall be witnesses to me in Jerusalem, Judea, Samaria into the other most parts of the earth. So once again, the four gospels as well as the Book of Acts, you have a commission. You have Jesus saying I'll be with you always to the end of the age. In the Book of Acts chapter one verse eight, he's telling us it's the power of the Holy Spirit that is combining with the gospel message that transforms people's lives. We'll be seeing that as we go through the Book of Acts. Now he begins in verse one and I'm gonna continue giving a little bit of introductory comments and then I'm gonna move into some things that I hope are practical for us as believers. But again, I'll begin slowly and move on to our really slow. The former account I made Otheophilus of all that Jesus began, both to do and teach. Luke begins by referring to the former account. The former account I made Otheophilus. The former account would be the gospel of Luke. He's speaking of something that he had written earlier. So he says this former account would be the gospel but he also is writing notice with me to a man by the name of Theophilus. Theophilus literally can be translated friend of God. That's what it literally means. Now there are those who would say is this a real person or is this simply a title? Is this a real person or is this speaking of the church in general because we through Christ have become friends of God? But more than likely he's speaking to an individual by the name of Theophilus. A man who would be called, what would have been called during that time, a patron. Somebody who was supplying funds to him in order that he might be able to give the account of the life of Jesus Christ. And so it would be as if Luke had been hired to accumulate all this information, which is what he did. And so he refers to the former account which would be the gospel and now a continuation of that account which is the book of Acts. And so this is written to a man by the name of Theophilus who more than likely was the individual who had hired him to go out and collect these things and then give the information to him. Now I want you to notice something. I want you to see how it says the former account I made O Theophilus of all that Jesus began both to do and teach. Began both to do and to teach. That tells us that God's work is intended to continue. He began to do these things but he continues to work amongst men. He intends this work to continue until his return in power and glory. Now remember in Matthew in chapter 16 verse 18 how Jesus said to the apostle Peter, you are Peter and upon this rock I will build my church and the gates of Hades will not overcome it. The church is intended to continue influencing people for God until Jesus returns. And Jesus's influence is to continue after he died, was buried and resurrected. But how could this influence continue if he's physically gone? It's gonna continue through the power and the presence of the spirit in the body of Christ. Notice how he says in verse two until the day in which he was taken up after he through the Holy Spirit had given commandments to the apostles whom he had chosen. And so through the Holy Spirit he had given commandments to the apostles whom he had chosen. Now we know that the Holy Spirit is the source of Jesus's power while Jesus was walking on the face of the earth. Matthew 12 18 says, here is my servant whom I have chosen, the one I love in whom I delight, I will put my spirit on him and he will proclaim justice to the nation. So Jesus was filled with the Holy Spirit and it's the same Holy Spirit that continues to work after Jesus as ascended. Now in John 14 verses 16 and 17 Jesus said, I will pray the Father he will give you another helper that he may abide with you forever the spirit of truth whom the world cannot receive because it neither sees him nor knows him but you know him for he dwells with you and will be in you, with you and in you. So it's the Holy Spirit who empowers believers to be witnesses of Jesus to the world. What is it that we testify? And we're gonna see this and I'm getting a little ahead of myself in my notes but we're gonna see this. He says, you shall be my witnesses. What is it that we testify? What are we witnessing? We're witnessing the reality of the fact that Jesus Christ died, was buried but he rose again from the dead. Listen, people don't have a problem. Many people don't have a problem saying, well, I'll give you that. Jesus Christ may have lived on the face of the earth. Yes, there may have been a teacher. There may have been a prophet of the nation of Israel. There may have been a good man by the name of Jesus. I'll give you that. And so you can speak to them concerning Jesus and you can speak to them concerning how good he was and how kind he was, how loving he was, how gentle he was. As a matter of fact, you and I, those of us who share our faith or speak to people concerning Christ, we know that there are many people who are out there in the world today who will grant to you that there was someone like Jesus but the problem is, is they only agree with Jesus insofar as he agrees with them. And so what happens is when you say something like, but Jesus said, I am the way, the truth and the life and no man comes to the Father but by me, that's where they have a problem. They'll say, listen, I think Christmas is fine. You know, it's a nice time to think of family and to give presents and receive presents. All you gotta do is watch some of the programs today where they have ban on the street interviews and just the other day I was watching a program where somebody is saying to these people on the street, he's saying to them, what is Christmas? And they'll tell you, oh, it's a time for family. It's a time for meals. It's a time for us to get together and exchange gifts. But what does it celebrate? It celebrates family. It celebrates goodness. It celebrates love. It celebrates peace. What's it celebrate? See, an older generation would say, I know exactly what it celebrates because the older generation had Christmas carols in classrooms. The first time I ever sang in a choir was not in a church. The first time I ever sang in a choir was at William W. Orr School in Norwalk, California. It was an elementary school. We had a Christmas play every year and the kids would get together and we would sing Silent Night way in the manger. We would sing traditional Christmas carols that would celebrate the reality of the birth of the savior. There were stores that were all closed on Christmas day. You didn't go to any stores on Christmas day because they were all closed. The nation basically was shut down on Christmas to commemorate the birth of Jesus Christ. And that's why older people know that.  What does Christmas, they'll say, well, they celebrate the birth of Christ. If they can remember who they are, they'll remember that. But they'll say that to you. And a lot of people know exactly what I'm saying by experience because it was a slow turn, but it finally did occur where you stopped saying Merry Christmas and you started saying Happy Holidays. That was a slow turn, but it took place. And to me again, when this is not trying to celebrate the good old days, I'm just trying to make a point how things can change when you reject the person Christ. I can still remember watching Christmas specials with Jewish men like Jack Benny and others who had people singing away in the manger, giving gospel messages. They weren't upset. They weren't offended. They didn't say Happy Holidays. That did not exist. That has recently existed within the last several years. That has made people like you feel like, oh gosh, well, they're trying to make you feel like you're harsh and unloving and not caring when in fact, what it is, it's a rejection of who Jesus Christ is. And listen, the gospel of Jesus Christ influenced the church, influenced the society, influenced television, influenced movies. I was sharing just today with somebody, I was saying, you realize that when the motion, what are called motion pictures, when movies were first beginning to be presented, you realize that the original movies, many of the original movies were actually gospel presentations so that people would hear the gospel of Jesus Christ. That even in the 40s, the most popular radio program that was played on Sunday nights, I think it was called something like, I can't remember, I wanna call it back to the Bible, but it was, or the old-time gospel hour, or something like that. It was the number one listen-to radio program on Sunday nights, the nation would listen to gospel messages as a nation on Sunday nights for years and years and years. See, the things that we're seeing today in our society are really just outward rejections of who Jesus Christ is. And the church has got to be careful that we don't hide Jesus somewhere and that he may not be found. He has to be openly presented. And so what makes the church powerful has not simply been the ability to present a message. The message in and of itself, of course, is God's powerful message. I'm not denigrating that, but it is the power of the Holy Spirit within the body of Christ that takes this powerful message, presents it through the anointing of Christ and sees transformation. And that's what God would have for the church, all through its ages, all through the lifetime of the church. And so Jesus had said to his men, the Holy Spirit will be with you and the Holy Spirit will be in you. And he was given to them a promise of the Holy Spirit who in the Old Testament would rest upon but depart. You see King David, as he says, take not thy Holy Spirit from me. You see, Samson who knew not that the Spirit had departed from him. You see, King Saul, the Spirit had departed from him because in the Old Testament, the Holy Spirit would rest upon, empower, but would also leave. In the New Testament, Jesus says, no, he will be with you and he will be in you. And that's how you become a Christian. See, a lot of people think they're Christians because they go to church. They think they're Christian. Well, we're gonna have a whole lot of people visiting us on Christmas because Christians go to church. And then I'll see them next year. Or in Easter, because you go at least twice, right?  So yeah, I'm a good Christian. And so a lot of people think that way. America, by and large, has moved in that direction. But it's the Holy Spirit, and we'll look at this. I'm just giving you a little bit of an introduction. I'll get there in a moment. It's the Holy Spirit who empowers believers to be witnesses of Jesus Christ. What is it that we are witnessing? I will be your witness concerning your resurrection. Now in verse three, he presented himself alive after his suffering by many infallible proofs being seen by them. So we testify that Jesus has been resurrected from the dead. It's not just that he was a good man. It's not that he was just a good teacher. It's not even that he was a prophet. It's that he was resurrected from the dead. That's what we speak about. And when we get to Acts chapter two, verse 32, it says that this Jesus, God has raised up of which we are all witnesses. So Jesus was with them over a 40 day period. He instructed them concerning the work of God as he rules in the lives of believers. And we'll see that in again when we get into chapter two. It says in verse four and five, being assembled together with them, he commanded them not to depart from Jerusalem, but to wait for the promise of the Father, which he said, you have heard from me for John, truly baptized with water, but you shall be baptized with the Holy Spirit not many days from now. And so what we have first is a promise. Jesus often spoke with the Holy Spirit. And the Holy Spirit has spoken up here as notice the promise of the Father. So in order to successfully accomplish the task of being witnesses, power is required. In the Old Testament book of Joel in chapter two, verses 28 and 29, it says afterward, I will pour out my spirit on all people, your sons and daughters will prophesy, your old men will dream dreams, your young men will see visions, even on my servants, both men and women, I will pour out my spirit in those days. That's the promise of the Father. In Luke 24.49, Jesus said, I'm going to send you what my Father has promised, but stay in the city until you have been clothed with power from on high. So one, we have a promise and the promise is the promise of the Father. And so one, he has stated, I will fulfill that promise that you have in the Old Testament and that I reiterated in the new. This promise that the Holy Spirit will come upon you. He moves into verse five and I'll just touch it lightly where he says, John truly baptized with water, but you shall be baptized with the Holy Spirit, not many days from now. John's baptism, John's baptism was of water. He was preparing people to meet Messiah. Later on in the book of Acts in chapter 19 verse four, we see John's baptism was a baptism of repentance. He told the people to believe in the one coming after him, that is Jesus. So you have John's baptism, but Jesus's baptism is called the baptism of the spirit. It's going to take place on Pentecost. In Matthew three, verse 11, he said, John said, I baptize you with water for repentance. After me will come one who is more powerful than I, who sandals I'm not fit to carry. He will baptize you with the Holy Spirit and with fire. I'm going to look at that when we get to verse eight and verse six, therefore, when they had come together, they asked him, saying, Lord, will you at this time restore the kingdom to Israel?   He said to them, it is not for you to know times or seasons which the Father has put in his own authority. Remember, those of you who've been with me in the book of Matthew, remember in chapter 19, how Jesus had said to his men, you shall be seated on thrones judging. Well, in the minds of the apostles, they really didn't have yet the revelation of what is called the church age. So when Messiah died was buried and resurrected as they understood it through the rabbinic teachings many had been saturated with, their belief eschatologically would have been that Messiah would instantly become the ruler. And that's why they wanted to know whether his promise that he had made in Matthew in chapter 19, verse 28, if that promise was being fulfilled. And so Jesus immediately says to them, this isn't something that you need to know about. You see, they knew that Jesus would establish a literal earthly kingdom because he had taught that he would. In the Old Testament in Psalm 2, verse 6, it says, I have installed my king on Zion, my holy hill. But the exact moment of the reign is not to be revealed to them. You see, in Mark 12, rather Mark 13, verse 32, he said no one knows the day or the hour, not even the angels in heaven nor the sun, only the Father. So he said, this is not something for you to be asking questions about because I have something else for you. And then he speaks in verse eight. You shall receive power when the Holy Spirit has come upon you. You shall be witnesses to me in Jerusalem, Judea, Samaria, to the end of the earth. I wanna spend some time looking at this. Again, Jesus had spoken about the Holy Spirit being with you and in you.  And thus, you're no longer a religious person, but you are now made into a genuine Christian. When Jesus was speaking of the works of the Spirit, he said he'll be with you, he'll be in you.  The Holy Spirit, when he comes upon you with power, is gonna also fill you with the fruit of the Spirit. You will also have the ability to exercise the gifts of the Holy Spirit and you're gonna evidence that you have a relationship with God through the transformation that takes place by the Holy Spirit. You're gonna be born again. You're gonna have a relationship with God that is going to be overt.  And this is one of the areas that I really believe there's so much confusion about that there are a lot of people who've actually become a bit afraid of opening themselves up to the Holy Spirit. There have been people who have said, I don't know if I want all that God has for me because what if he sends me to some place I don't wanna go? Or what if he has me give up something that I wanna keep? What if he wants me to do something that I don't want to do? Whenever God guides for you he always provides for you. Whenever the Lord moves you it's because he has placed in your heart this sense that he will meet you. Many years ago when I was a new believer I was going to Biola and I had a friend of mine who was placed in student ministries and he was overseeing outreaches and there were two particular outreaches he was overseeing. One was to Watts and the other was to a place called Ramona Gardens. So he asked one of the African American kids, friends will you oversee the work in Watts? And this young African American brother said, yeah of course and he began to do ministry in Watts. At that time Watts was heavily African American and this brother had ministry there and he felt that it would be good because they'd be able to work together well there and on then my friend approaches me and says, will you go to Ramona Gardens? I said, no, you kidding me? You're looking at an ex hippie I was never a cholo what are you talking about? You see I know this could be offensive if I don't say it right. It can be offensive if I say it right. Know my heart as I say it and you'll understand what I'm trying to say. When I first got saved I said, Lord I'll do anything but Lord I know that I'm Mexican American we used to refer to ourselves as Chicano I know that that's what I am. But Lord I didn't grow up in the projects I didn't grow up in a barrio I didn't grow up in that. That's just not who I am.  Here's my friend Jimmy David will you go to Ramona Gardens? Charlie no I said I said no I said no I said what? He said will you go to Ramona Gardens?  Will you go to Ramona Gardens?  I don't know why I was nervous I still to this day don't know why I just was. The first day we came we pulled up in a bus and you know little yellow bus with all of these oh people climb in on out we're from Biola you know and this guy I guess I guess he thought he was the neighborhood bad guy walks up to me well he walks up to all this he just comes walking up and he says who's in charge here? I looked around and I walked up to him and I said well I am I'm leading this group what are you doing here? First thing challenge what are you doing here? I said I don't know you want us to leave? No I said get on the bus we're out of here let's go to the beach what are you doing here? I said we're here to minister the gospel of Jesus Christ to this community we're here to minister to your children we're coming with a team of people that can give them crafts can sing with them we're gonna play games with them we're committing our lives to them so that we can communicate to them especially the life-changing message of the gospel of Jesus Christ that's what we're doing here and he looks at me and he gives me that look like are you real? and he says if anybody asks you you tell them so and so says you're okay and I said great of course see I already knew a guy named Chewy also known as Jesus was we're okay I already knew that I already knew that but the bottom line and I'm trying to I'm enjoying myself I shouldn't I should be real serious but listen when God moves you someplace he's with you all the way and you can't you cannot walk into you cannot walk into areas that you're uncomfortable with without the peace of God that passes all understanding and you can't be effective in areas that you're feeling unequipped for without the power of the Holy Spirit who gives you and gives you the words to speak and you need to rely on the power of the Holy Spirit we are saved and we receive the Holy Spirit seal in our life but Jesus said you shall receive power after that the Holy Spirit has come upon you so I want all that the Lord has for me I want to walk in the fullness of his spirit I want to sense his presence in my life I want to live by the spirit in order that as he says in Galatians 516 I will not gratify the sinful desires of my flesh you see Jesus said that the Holy Spirit will come upon you with power and he's going to fill you with love he's going to fill you with his goodness you will be his witnesses so the baptism of the Holy Spirit is what made the church a powerful witness throughout its history the most powerful witness has always been the transformed lives that occur because of the gospel being received and the power of the Holy Spirit transforming a person and being present in the way that they live you see today if you don't mind I think I can speak with some authority on this I've been around for a while today my concern and it is a great concern a great concern for the church because I love the church not just this fellowship I love the church, the body of Christ and my great concern is that many today are confusing the work of the Holy Spirit with the efforts of human flesh and so we say that we're going to church and while we're there we're in this visible location and we'll say God is really moving because we have a new building or God is present because we have a great band or God is really reaching people because we have good programs or God is really moving on my pastor because he's got such a personality how did God move before without you know without fog machines without lights without the net how did he move how did these people they had the reputation that they were turning the world upside down how did that happen without the winning personalities listen, Paul is the greatest mind that the church ever had but when he preached a guy named Uticus fell asleep and fell out of the window and died when the Corinthians spoke about Paul they said oh he's a paper tiger and he writes weighty letters but his presence is weak his speech is contemptible this guy is boring beyond words this guy doesn't entertain us and they read 2 Corinthians and when you read 2 Corinthians you will find no less than 21 accusations lodged against the apostle Paul no less than 21 accusations he and 2 Corinthians had to answer and they said he's just boring they said he's ugly they said everything that you can imagine about this man and yet he was the greatest apostle taking the gospel of Jesus throughout the world he said I have made it my aim to proclaim the name of Christ where his name has never been preached lest I should build on another man's foundation this man, the apostle Paul was breathing out threat means for those who were followers of Christ was radically transformed to a man who went everywhere for Jesus Christ how did that happen? and can that happen today? and should that happen today? and has the church been deceived into thinking that we need certain things like the building, like the music like the lights, like the entertainment like the personality and I have to say absolutely, you know what we need? we need the power of the Holy Spirit and the power of the word of God that's what we need I'm 20 years old once I was talking to my wife about this just today 20 years old I know times have changed and no I'm not trying to match sin for sin forgive me if it sounds that way when I grew up there just wasn't that much dope use there just wasn't there weren't that many people who drank radically and smoked pot and dropped acid that just wasn't happening it was just beginning California was never going to legalize marijuana are you kidding me? no because a Californian was a conservative at that time they actually loved God, Apple Pie and the American flag we didn't have athletes who said I'm not going to stand for the National Lent we didn't have any of that we didn't have marches in the street the way we do now it's changed in a way that some of you wouldn't understand you wouldn't understand so when I was growing up I was one of the radical kids I was one of those I was the kid who stumbled down the street in the middle class neighborhood loaded or drunk all the time I was a thief I was a liar I was everything that that that went along with the drugs and the alcohol I didn't care about I stole from stores I would go to stores and I would walk out with armful of goods I didn't even hide it I just would walk between the clerks I did that I stole, I'd sell it and I'd buy dope with it I was a Catholic kid and I thought I was a Christian because I'd been baptized as an infant I was a Catholic kid I was a Christian don't tell me about Jesus Christ I can tell you about Jesus Christ that's how I was but I wasn't unlike a lot of people there were a lot of people like me all my friends were like me in one form or another that's just the truth and I'm having people say you need Jesus and I'd say I already got Jesus I'm a Catholic I'm a member of the very first church Peter's the first pope I knew my catechism that's the fact and I would argue and so my friend invites me to go to this church called Calvary and I walk in and it's a church that was built to seat about 300 and there's about four or five hundred people in that building and I sit down I can tell you where I was I was sitting in the back and I had the long hair and I had smoked some pot and I had drank some beer and I walked in barefooted and I went in rebellious and angry and I walked in there thinking these hypocrites will kick me out in a moment just like they would at my church because if I'd have walked into St. Pius X Church in Santa Fe Springs like that they would have escorted me out the door that's a fact we all know that and you know that when I went in there I sat down and I looked at all these hippie kids and they're singing about God's love and I'm looking around and I'm thinking this is weird because I actually like it I actually like this I didn't know what it was that I was feeling but I do now I was feeling conviction because I wasn't like these people and I was feeling lonely because I didn't have God and I was feeling the presence of an other that I only had heard about but didn't know personally and that was the spirit of God and I experienced something that we used to sing about we used to say all you need is love and I was in the midst of hundreds of kids and it hit me I'm feeling in a church for the first time in my life love love it was not a I'll let you do whatever you want because I love you man it was God's love it was a sense that it was a sense that I'm unworthy to be amongst these people I'm not like these people they have something I don't have I didn't know exactly what it was then but when I got saved the light bulb went off and I said that's what it was Jesus said you shall receive power after that the Holy Spirit has come upon you and when the Holy Spirit comes upon you He transforms you unrecognizable to those who know you best have you been changed like that or do people still think you're the same guy haven't changed at all if you haven't changed you haven't connected yet you haven't I always say this dumb some of you have heard it all of you probably have but for the one or two who hasn't we had a project we were working on a building and I'm no construction worker but they handed me a hammer and I walked up and started hammering on a wall and then they gave me a screwdriver and I unscrewed a light switch I pulled the box off and one of my boys walked up to me they were little at the time and I leaned my hand against the wall and I was talking to them when I I felt something and I looked and I the wires had made connection on this finger here so one of the wires was on one side of my fingernail and the other was on the other side and I connected and I pulled my hand out and my fingernail was on fire and I was a hippie so I started going that's a fact I really look at that and I discovered something when you make contact with power you will know it you will know it there are a number of Christians today who are walking around with no power you're constantly hurting constantly sad constantly remembering hey get over it look to Jesus he transforms lives that's Christianity he forgives you of your sins he makes you a new creation he gives you the power to overcome and you can overcome I don't say that I am a recovering alcoholic I've been recovered by Jesus man, you know I am an entirely new creation because old things are passed away see I don't identify with the sin the old sin I identify with the new man that I became in Jesus Christ and I know that because of the power of the Holy Spirit and a lot of us today want to remain where we were and we want people to give us permission to continue where we were but Jesus doesn't he says you need to leave that behind and follow me that's what God has called us to do without that without the power of the Spirit you can't some of you are frustrated because you've tried I don't think there are very many people in this room who are more messed up than I was and I don't say that than anything other than I don't think there are you don't know my real testimony but I'll tell you this God is able God transforms God gives God empowers that's Christianity we do not hold to a philosophy we hold to a savior Jesus Christ and when he is presented people get saved they get saved and they're transformed you shall receive power you shall be witnesses to me in Jerusalem Judea, Samaria I will be with you I will be in you and my Spirit will come upon you you will be baptized in the power of the Holy Spirit witnesses of the Holy Spirit the Spirit changing our life there's an instant we'll see this in chapter 4 how that the apostles performed a mighty work and people began to question them how this took place in Acts 4 verse 13 it says when they saw the boldness of Peter and John perceived that they were uneducated and untrained men, they marveled and they realized that they had been with Jesus you know the history of the Calvary movement is that we in the eyes of many are uneducated and untrained but the one thing they can't say about us and they can't say they're uneducated and they can't say they're untrained they can't but another thing they can say is we've been with Jesus and that's what the testimony is they looked at them they said they haven't gone through our rabbinic schools and these are individuals who haven't been trained in our ways but there's one thing that we know about them they've been with Jesus and guess what they had been and they still were the Holy Spirit wants to come upon you tonight Jesus said you will receive power and the Holy Spirit comes upon you the Holy Spirit wants to baptize you in order that you might walk in His power and He wants to fill you and we'll see this as we go through the book of Acts He wants to fill you so this presence might be there His gifts and graces will be there and what happens is when you're baptizing the Spirit you begin to walk and you begin to witness you said Jerusalem, Judea, Samaria to the end of the earth you begin in your Jerusalem I began with my family I brought them to Christ I began to share with my neighbors I began to have Bible studies and then I began to go to other cities even when my ministry began here we met in Ontario we met in Montclair we met in Clermont we went back to Ontario came to Chino we reached out of Chino we trained disciples and we reached other cities we have churches that have come out of this church in Ohio in Ontario and Southgate, Upland, Fontana, Montclair Weirica we have churches in Lake Havasu in Great Falls, Montana Corpus Christi, Texas, San Antonio Madison, Wisconsin and Clialum, Washington we are wanting to reach people our studies are seen via the internet we are beginning a podcast ministry to take this gospel out we are on radio stations throughout the United States I didn't even know this I looked it up today we are on radio stations in Arizona California, Colorado, Connecticut, Florida, Georgia, Hawaii Indiana, Maine Missouri, North Carolina North Dakota, New Jersey New York, Nevada Ohio, Oregon, Pennsylvania South Carolina, South Dakota Tennessee, Texas, Washington and Hawaii we are on in a variety of places we have internet radio through many states we are on various things right now we have prison ministries we have church in Mexico God is doing neat things and it's all through the Holy Spirit it's all through Jesus' teaching it's through the power of the Spirit and that's what happens when you are obedient you can do a great work because God is with you you know I was taught first by the Bible and then by the example of my pastor if you strive to attain you will strive to maintain but walking in God's Spirit is a way of life seeking His presence hungry for His help we need His Spirit we need His Spirit today guys because the church in the United States is ashamed of the gospel ashamed ashamed you know there's a guy who influences me his name is A.W. Tozer and A.W. Tozer said this he said if the Holy Spirit was withdrawn from the church today 95% of what we what we do would go on and no one would know the difference if the Holy Spirit had been withdrawn from the New Testament church 95% of what they did would stop and everybody would know the difference be careful be careful what you allow to influence you into believing that the Spirit of God is moving because sometimes it's all light and no fire sometimes it's just all noise but not a message seek God seek God walk in His power every day Father in Jesus' name fill me with your Spirit every day God use me for your glory every day God change me God transform me God make me different every day that's what I do every day every day God make me a better Christian God make me a better husband God make me a better father God make me a better grandfather God make me a better man God help me to be a pastor God help me to care for people God fill me with your Spirit pray that way and watch what God will do you'll never think you arrive by the way you'll always discover that you need Him more you'll always discover that but what a place to be depending on the Lord you shall receive power after the Spirit has come upon you oh God may we have your power


This module is actually the continuation of medium sterilization, but particularly in this module we will talk about the scale up of batch sterilization process. As we have seen in our previous module, while talking about the calculation of the del factors, actually how the del factor is involved in the scale ups sterilization. So, the use of the del factor in scale up of the batch sterilization process that was established and discussed by bank in 1979. According to bank it should be appreciated by this stage that the del factor does not include the volume of the fermentor or the volume of the medium, but when we are talking about the medium sterilization, we are not concerned with that what will be the volume of the medium. We are dealing with the absolute number of the contaminants. As we have discussed as if you know if you remember that in our previous module we talk about that when we are dealing with the sterilization process apart from the volume of the medium, we are just focusing on the viable number of organisms. In other way we can say that the number of the contaminants and the survivors when we are dealing with some treatment which we called as sterilization treatment then the term is the survivors. So, we only focused on the contaminants and the survivors not their concentration, we are just dealing with their number. So, if the volume is less the number is more, if the volume is more then the number is more we are dealing with the number actually. So, if the size of the fermentor is increased the initial number of the spores in the medium will also increase. So, if a medium contain a uniform amount of the viable cells and then if we increase the volume of the medium in the same fermentor. So, that will also be the multiplying and increase with the same rate. So, the medium will also be increased then if the same probability of achieving the sterility is required. The final spore number should be remain the same. So, resulting in an increase in the del factors. If we take an example of a pilot scale sterilization. So, if we have a pilot scale example. So, if the pilot scale sterilization were carried out in 1000 liter vessel with the medium that contain the actually 10 raise to power 6 organism. So, the total microbial load in that medium is 10 raise to power 6 per ml require a probability of the contaminants of 1 in 1000. So, the del factors would be ln. So, this is 10 raise to power 6 is actually the microbial load or the number of the contaminants or the survivors multiply by the vessel volume and then is the number of probability of the contaminants in 1 in 2000. So, then divided by 10 raise to power minus 3. So, if we just calculate according to logarithm theory. So, 10 raise to power 6 6 and 3 9 9 and 3 12. So, this is the 10 raise to power minus 13. So, ln the answer will be ln 10 raise to power 15. If we calculate the log of nature of the 10 that is 34.5. So, in another if the same probability of the contaminants. So, contaminant probability is the same and then required in a volume that is 10 raise to power 4 using the same medium the del factor. So, we are changing just 1000 liter to 10000 liter and then the del factor you can say that the contaminants are the same only the change is here in the volume. Then we can say that 6 3 9 and 9 and 4 13 and then the answer is ln 10 raise to power 16. So, in this case the del factor will be 36.8. So, just by increasing the vessel and there is an increase in the del factors from 34.5 to 36.8. Thus the del factor increase with the increase in the size of the fermentor volume. The holding time in the large vessel may be calculated by the graphical integration method or by the rapid methods as reported by the Richard 1968 as we discussed in our previous module. So, based on the temperature time profile of the sterilization cycle. However, it must be appreciated that extending the holding time on the larger scale to achieve the increased delta factor will result in the increase the nutrient degradation. So, also the contribution of the heating up and the cooling down period to the nutrient reduction will be greater as the scale increase. So, when there is an increase in the del factor while increasing the fermentor volume. So, if we using with that same temperature then that require the more holding time. So, if we will give the more holding time then there will be the nutrient loss. So, the maintaining the same nutrient quality on a small and the large scale can be achieved in batch sterilization because when we are dealing with and comparing the batch sterilization to the continuous sterilization at that point I told you that the negative aspect of the batch sterilization is because in batch sterilization that effect the nutrient quality. So, if we want to maintain the nutrient quality from the small scale to the large scale then we have to be only by compromising the sterility of the vessels which is totally unacceptable. So, if there will be no sterility then there will be no sterilization. So, actually so thus we have to decrease the yield of if we compromise either over the sterilization then there will be a no more require product. If we compromise on the same method just for the sterilization but there will be a deficiency or the degradation of the nutrients then that also effect on the yield of the fermentation product. So, by large and in short we can say that it is scale up often due to the problem of the nutrient degradation during the batch sterilization and only the way to eradicate the problem is to sterilize the medium in a continuous mode. So, there is only a one choice because in batch sterilization if we do the maximum quality of the sterilization then there is a nutrient loss. So, the ultimately our choice is a continuous sterilization as compared to batch sterilization.


Diabetes, obesity, and old age all lead to an inability to heal wounds, creating what is known as the silent epidemic. This is because survival is fundamentally linked to the ability to heal damage to our skin. By creating a formidable barrier, it keeps us safe from infections that would otherwise be fatal. Globally, non-healing ulcers on diabetic feet lead to an amputation every 30 seconds and carry with them lower five-year survival rates than breast and prostate cancer. With the number of diabetics predicted to increase over 50% to 640 million in the next 20 years, this is a rapidly growing global epidemic. The cost of treating these ulcers is staggering. $17 billion is spent in the U.S. alone equal to the direct health care spending on breast cancer. In other countries, treating a single ulcer can consume the equivalent of six years of personal income. Rather than treating complications, this money is better spent on preventing and curing disease. Despite diabetes consuming over 800 billion international dollars and diabetics with ulcers being twice as expensive to treat, attempts over the past 20 years to develop drugs to heal these wounds has produced a graveyard of failure. This is because healing our wounds is one of the most complex biological processes that our bodies must perform. Following wounding, different cells work together over time in a coordinated fashion to heal the damage, similar to musicians in an orchestra. Therefore, it is highly unlikely that a therapeutic strategy targeting only one of the many defects in this complex process will be successful at promoting healing. But is it possible to design a therapy that works like a conductor in the orchestra, instructing multiple players on when, where, and what they need to do? My research group at Imperial College London is answering this question by developing dynamic biomaterials that rewire the process of wound repair over time. Historically, materials have largely been passive players in tissue repair. They serve as band-aids or supportive scaffolds such as collagen, but lack the ability to actively direct repair. But tissues are fundamentally dynamic. They respond to changes in their environment. This means that therapeutic materials need to seamlessly interact with tissues over time. My approach combines aspects of material science, DNA nanotechnology, self-assembly, and additive manufacturing to develop materials that coordinate biological activity. This allows the creation of materials that work like a conductor, actively synchronizing the process of repair. For instance, my materials aim to concentrate key therapeutic molecules found within the body, subsequently activating them at various stages during repair. In addition, they deliver therapeutics that rewire how cells interpret instructions, making them more likely to heal. This is a fundamentally different approach to treatment. It recognizes that the process of wound repair has inherent spatial and temporal dynamics that are critical to successful healing. But it also relies on understanding what the key barriers to healing are at each time point during the process of repair. To identify these barriers, it takes diverse expertise. I am working with clinicians to identify the local biological defects within diabetic ulcers that prevent them from healing. I am also working with biologists to understand how natural biological variation between individuals gives rise to differing ability to heal wounds. These insights are then combined to program specific therapeutic combinations and sequences into my materials. These materials can be applied like a bandaid, but unlike a bandaid, they orchestrate the process of wound repair as it progresses over time. But these materials are only part of the story. The same biological insights used to program my materials may also identify the patients who are most likely to develop chronic non-healing wounds. This may provide the opportunity to develop personalized comprehensive treatment programs that drive efficient healing. But these materials are only useful if they reach the market. Therefore, I have recently started establishing industrial collaborations to drive these innovations to market, where they have the potential to treat a variety of damaged issues throughout the body, not just diabetic ulcers. But the path to market is still an uphill climb. There are currently no approved combination therapies available for treating wounds, despite non-healing wounds having lower survival rates than several cancers. So, I leave you with a question. How many limbs and lives do we need to lose before we make a concerted effort to push revolutionary wound care technologies to market? Thank you.