Security basics, Part 1

Understanding file attribute bits and modes

Summary
In this month's Unix 101, Mo Budlong begins a three-part series on Unix security. In this installment, he explains how to set basic file and directory permissions. (1,500 words)

---

Security is always an issue in multiuser computing systems. Unix provides a rich set of security options, and this month we begin a three-part security series by exploring some basics.
As a true multiuser, multitasking operating system, Unix has a fairly sophisticated method for setting file and directory permissions.
The chmod command is simple once you've grasped the basics. To understand it, let's start with a small directory listing that can be generated by the ls -l command.

$ ls -l
  drwxrwxr-x    1 mob      wp    2018 Aug 30 23:45 adir
  -rw-rw-r--    1 mob      wp    8755 Aug 30 23:37 picture.gif
  -rwxrwxr-x    1 mob      wp    8525 Sep  4 02:48 command.sh

$

The permissions are indicated by a series of letters on the left-hand side of the listing. The first character indicates the type of the entry. For our purposes, the first character will be either a dash (-) to indicate that the entry is a file or a d to indicate that it's a directory.
After the initial character, a series of rwxs (or the absence of the same) on the left side of the listing indicates the access permissions for that file or entry.
The nine characters after the initial entry-type indicator are broken into three groups, each containing three characters. Each group of three from left to right indicates the permissions given to the owner, group, and others, respectively.
An r indicates that read permission is given to the user who owns the file, group the owner belongs to, or the rest of the world. An r allows a file to be read, and a directory to be listed with ls and related utilities. A w indicates write permission. If this is an entry for a directory, w means that new files can be created within it.
In the following example, the owner, mob, has read and write permissions on picture.gif. The group wp has read permission only, and no other permissions are given.

$ ls -l
  -rw-r-----    1 mob      wp    8755 Aug 30 23:37 picture.gif

$

An x indicates execute permission for executable files, and search permission for directories.
In the following example mob members of the group wp, and all others have search permission for adir.

$ ls -l
  drwxrwxr-x    1 mob      wp    2018 Aug 30 23:45 adir
  -rw-rw-r--    1 mob      wp    8755 Aug 30 23:37 picture.gif
  -rwxrwxr-x    1 mob      wp    8525 Sep  4 02:48 command.sh

$

An x permission on a standard data file has no effect.
To change the permissions on a file, use chmod, followed by the permissions you want to change and the file name. A permission is expressed as a one-character identifier that signifies (u)ser, (g)roup, (o)thers, or (a)ll, followed by +, -, or =, meaning add, remove, or set, respectively. After these characters, add one or more of the following permissions: r, w, or x. The permission strings should look something like the following examples:

u+rw
a-w
o+x
a=rwx

Some more examples are shown below. Line 3 adds write privileges to group, line 6 removes write privileges, and line 9 adds read privileges for others. Line 12 sets privileges for others to write only. In line 14, the r has disappeared and the w has appeared. Line 15 removes read and write privileges for all; note the result at line 17. Line 18 uses ug+rw to add read and write privileges for both user and group.

1  $ ls -l
2    -rw-r-----    1 mob      wp    8755 Aug 30 23:37 picture.gif
3  $ chmod g+w picture.gif
4  $ ls -l
5    -rw-rw----    1 mob      wp    8755 Aug 30 23:37 picture.gif
6  $ chmod u-w picture.gif
7  $ ls -l
8    -r--rw----    1 mob      wp    8755 Aug 30 23:37 picture.gif
9  $ chmod o+r picture.gif
10 $ ls -l
11   -r--rw-r--    1 mob      wp    8755 Aug 30 23:37 picture.gif
12 $ chmod o=w picture.gif
13 $ ls -l
14   -r--rw--w-    1 mob      wp    8755 Aug 30 23:37 picture.gif
15 $ chmod a-rw picture.gif
16 $ ls -l
17   ----------    1 mob      wp    8755 Aug 30 23:37 picture.gif
18 $ chmod ug+rw picture.gif
19 $ ls -l
20   -rw-rw----    1 mob      wp    8755 Aug 30 23:37 picture.gif
$

User and group categories
In a Unix system, a user is a member of a higher-echelon grouping, simply called a group. Some common groups on Unix systems are root, admin, users, and mail.
superuser and root would be members of the root group. Users that have administrative access to backup, restore, and mount operations might be placed in the admin group. Whoever handles the mail system might be in the mail group. The remaining mortals would be in the users group.
A user is given a new group when first created. To see your group, type the following command, using your login where I have mob in the command.

cat /etc/passwd|grep mob
mob:x:537:500::/home/mob/:/bin/ksh
$

The first field, mob, is the login ID. The second field, x, is the encrypted password, which will appear as an x or an unreadable character. The third field is your user ID, the value returned when you type id and press enter. The fourth field, 200, is the group ID. Keep that number written down, and search in your group file to find out which group is 500 and who the members of that group are. In this example, wp is group 500 and is password protected. The members of the wp group are mob and jjk.

cat /etc/group|grep 200
wp:x:500:mob,jjk
$

If you want to see all the groups you're in, repeat the command but grep out your user ID. In this example, mob shows up in the groups wp, accounting, and admin.

cat /etc/group|grep mob
wp:x:500:mob,jjk
accounting:x:512:mob,jan,ded
admin:x:mob,root
$

When you first log in, you're set to the default group specified in your /etc/passwd file.
When you create a new file and then ls -l it, you'll find it's assigned to you as owner and your default group as a group.
This example uses touch to create an empty file, and then displays the directory entry.

$ touch newfile
$ ls -l
  -rw-rw-r--    1 mob      wp    0 Sep 22 23:37 newfile

$

You may change to a new group if you're a member of that group by using newgrp. If the group is password protected, you'll be asked for a password. Once you've changed to the new group, if you create a new file, it will be owned by the new group.

newgrp accounting
$ touch nextfile
$ ls -l
  -rw-rw-r--    1 mob    wp           0 Sep 22 23:37 newfile
  -rw-rw-r--    1 mob    accounting   0 Sep 22 23:37 nextfile

$

As an exercise, you should create a new file with vi and put a couple of lines into it. Close the file and change permissions by adding and subtracting read and write privileges from user, group, and others. Try to edit the file. If you can get your hands on another user login that's not part of your group, try logging in as that person and editing the file.
Here are some general rules. Start with a file that has read and write privileges for all users, -rw-rw-rw-; anyone should be able to edit the file. If you chmod o-rw to -rw-rw----, only you and members of your group will be able to edit it. If you chmod g-rw to -rw-------, only you can edit the file. If you chmod u-w to -r--------, only you can view the document, but you cannot change it or delete it.
Try some similar experiments with a directory. Anyone can read, write (create new files), or search in a directory with a privilege string of drwxrwxrwx. A more typical string for a directory would be drwxrwxr-x, indicating that you and your group have full access, while other users can only read and search. A very secured directory might be set up as dr--------, allowing only the owner to read the directory.

Security basics, Part 2

More advice on file attribute bits and modes

Summary
Could you use a quick refresher course on binary numbers? Need an expert to clarify hexadecimal and octal notation? This month in Unix 101, Mo Budlong continues his three-part series on Unix security with a closer look at file attribute bits and modes. (1,900 words)

---

While everyone knows that computers are binary, not many people understand the numbering systems that represent the binary numbers stored in computers, or the notational conventions used for displaying this information.

This may be a teensy bit painful, but I need to cover it to further explain setting file modes. If you understand binary numbering, feel free to skip ahead.

Binary numbers
An odometer in an automobile measures mileage by wheels that rotate through the digits 0 to 9. Each time a wheel completes a revolution from 0 through 9 and back to 0, it trips the wheel to its left up one position. When that wheel reaches 9 and is tripped over to 0, it increments the next wheel to its left.

Now imagine that each wheel in your odometer only had the digits 0 and 1. The first wheel would increment from 0 to 1 and back to 0 again. As it rotated back to 0, it would trip the wheel to the left over to 1. Wheel 1 would again spin through 1 and back to 0, and this time it would trip wheel 2 over to 0. This would trip wheel 3 over to 1. The following illustrates the sequence of positions for our wheels. The wheel positions are numbered down the left-hand side so that position 0 is 0000, position 1 is 0001, position 2 is 0010, and so on.

Figure 1. Binary notation

wheel -> 4 3 2 1 position 0 0 0 0 0 1 0 0 0 1 2 0 0 1 0 3 0 0 1 1 4 0 1 0 0 5 0 1 0 1 6 0 1 1 0 7 0 1 1 1 8 1 0 0 0 9 1 0 0 1 10 1 0 1 0 11 1 0 1 1 12 1 1 0 0 13 1 1 0 1 14 1 1 1 0 15 1 1 1 1

Here are some basics to keep in mind:

• A byte of computer data is made up of 8 bits, which could be represented by eight wheels.
• All information in a computer is stored as accumulations of bits and bytes.
• A byte of data might represent a single character or eight separate flags. Two bytes could be strung together to hold 16 separate flags.

Hexadecimal notation
You could represent the value in a byte by writing out all of the 0s and 1s on each wheel (e.g., 01001101), but that would be cumbersome. Hexadecimal notation is a convenient way of representing the values in a byte with two characters. The characters used are the numbers 0 through 9 and the letters A through F. Figure 2 illustrates how a single hexadecimal digit can represent 4 bits.

Figure 2. Binary numbers and their hexadecimal equivalents

wheel -> 4 3 2 1 position Hex 0 0 0 0 0 0 1 0 0 0 1 1 2 0 0 1 0 2 3 0 0 1 1 3 4 0 1 0 0 4 5 0 1 0 1 5 6 0 1 1 0 6 7 0 1 1 1 7 8 1 0 0 0 8 9 1 0 0 1 9 10 1 0 1 0 A 11 1 0 1 1 B 12 1 1 0 0 C 13 1 1 0 1 D 14 1 1 1 0 E 15 1 1 1 1 F

The 8 bits of a byte are frequently represented by grouping the bits into two collections of 4 bits each, then representing each of these with a hexadecimal digit. In our case, the number 00101101 becomes 0010 1101, and that, in turn, becomes 2D.

Octal notation
Hexadecimal notation represents bits in groups of four. Octal notation slices a byte and represents it in groups of three, as shown in Figure 3.

Figure 3. Octal notation

wheel -> 3 2 1 position Oct 0 0 0 0 0 1 0 0 1 1 2 0 1 0 2 3 0 1 1 3 4 1 0 0 4 5 1 0 1 5 6 1 1 0 6 7 1 1 1 7

Using this technique, 00111101 becomes 00 111 101 which, in turn, becomes 075 in octal notation. A byte only has 8 bits, so the highest 2 bits are presented as if they had a leading 0, and 10111101 becomes 010 111 101, or 275 in octal. In fact, longer strings of bits can be represented by longer hexadecimal or octal notation. The 16 bits of 2 bytes, 00101011 10010110, become 0010 1011 1001 0110, which can be represented as 2B96 in hexadecimal. If you divide the number into groups of 3 bits and add two extra 0s to the beginning, you get 000 010 101 110 010 110, or 025626 in octal.

The mode bits
From last month's article, you know that the ls -l mode bits are displayed (from left to right) as read, write, and execute for owner; read, write, and execute for group; and read, write, and execute for other.

-rwxrwxr-x    1 mob      wp    2018 Aug 30 23:45 afile

These nine flags are actually saved as 9 mode bits (a byte plus part of another), and the mode bits can be represented by the octal notation for that bit pattern.

The above flags represent a bit pattern of 111111101 or 111 111 101, and can be expressed as 775. If you wanted to set those exact permissions for the file, you would use the following command:

$ chmod 775 afile
$ ls -l
-rwxrwxr-x    1 mob      wp    2018 Aug 30 23:45 afile

Figure 4 shows several examples of directly setting mode bits using octal notation. The last example makes the file read only.

Figure 4. Setting mode bits using octal notation

$ chmod 775 afile $ ls -l -rwxrwxr-x 1 mob wp 2018 Aug 30 23:45 afile $ chmod 770 afile $ ls -l -rwxrwx--- 1 mob wp 2018 Aug 30 23:45 afile $ chmod 750 afile $ ls -l -rwxr-x--- 1 mob wp 2018 Aug 30 23:45 afile $ chmod 740 afile $ ls -l -rwxr----- 1 mob wp 2018 Aug 30 23:45 afile $ chmod 444 afile $ ls -l -r--r--r-- 1 mob wp 2018 Aug 30 23:45 afile

In fact, there are 3 more bits available for controlling the mode of files and directories, but these display in different ways. Two of the bits apply to files, and one to directories.

The first bit controls the set user ID property of an executable program or shell script. When a program or script has this bit set and is executed, the script assumes the privileges of the owner of the script. The purpose of this mode would be to provide something like a backup script. The script owner would be root and root would have the privileges needed to back up all files, but the script could be executed by any backup operator who wouldn't need to be given root privileges in order to run the backup.

The second bit controls the same feature for the group. The program or script acquires the privileges of the group that owns the file.

The third bit controls the behavior of directories and is popularly called the stick bit. When this bit is set on a directory, the only people who can delete or rename files from that directory are root and the owner of the directory, regardless of any other permission a user's been granted. This is frequently used on temporary and work directories where many users need to be able to write to the directory, but where no one should be allowed to rename or delete anyone else's files.

These 3 bits are added at the front of the 9-bit bit pattern for access permission, creating a 12-bit pattern. In Figure 5, the first command prevents anyone but root or mob (the directory owner) from deleting or renaming any files in adir. Note the t in the final position of the permission string. The second command allows anyone to run the backup script, but when the script runs it has the privileges of root. Note the s:

Figure 5. Using a full 12-bit pattern for permissions

$ chmod 1777 adir $ ls -l drwxrwxrwt 1 mob wp 2018 Aug 30 23:45 adir $ chmod 4111 backup $ ls -l ---s--x--x 1 root wp 2018 Aug 30 23:45 backup

There is a security feature built in to the set user ID bit and set group ID bits that causes the bit to be reset if the file is written or renamed by anyone other than the superuser. This prevents someone from editing a script that has extra privileges, because root or someone with more privilege owns the script and the set user ID bit is set.

The character representation of these extra 3 bits worth of permission/behavior is handled by cramming their values into the existing permission string with different letters.

The normal state of the owner execute flag is either x or - (dash). If the owner has execute permission and the set user ID bit is on, the x becomes an s. If the owner does not have execute permission but the set user ID bit is on, the - becomes an S, as in Figure 6.

Figure 6. The difference between s and S for a file owner

$ chmod 100 backup $ ls -l ---x------ 1 root wp 2018 Aug 30 23:45 backup $ chmod 4100 backup $ ls -l ---s------ 1 root wp 2018 Aug 30 23:45 backup $ chmod 4000 backup $ ls -l ---S------ 1 root wp 2018 Aug 30 23:45 backup

The normal state of the group execute flag is either x or -. If the group has execute permission and the set group ID bit is on, the x becomes an s. If the group does not have execute permission but the set group ID bit is on, the - becomes an S, as in Figure 7.

Figure 7. The difference between s and S for a file owner's group

$ chmod 010 backup $ ls -l ------x--- 1 root wp 2018 Aug 30 23:45 backup $ chmod 2010 backup $ ls -l ------s--- 1 root wp 2018 Aug 30 23:45 backup $ chmod 2000 backup $ ls -l ------S--- 1 root wp 2018 Aug 30 23:45 backup

The normal state of the execute flag for others for a directory is either x, indicating that others can search the directory, or -, indicating that they cannot. If others have search permission and the sticky bit is on, the x becomes a t. If others don't have search permission but the sticky bit is on, the - becomes a T.

Figure 8. The difference between t and T

$ chmod 001 adir $ ls -l d--------x 1 root wp 2018 Aug 30 23:45 adir $ chmod 1001 adir $ ls -l d--------t 1 root wp 2018 Aug 30 23:45 adir $ chmod 1000 adir $ ls -l d--------T 1 root wp 2018 Aug 30 23:45 adir

Now you have two ways to set up the modes for a file and directory, and three extra security permissions to control the access level of executable programs and protect files within a directory from being deleted or renamed.

What happens when you throw the switch?

Booting is a shortened version of bootstrapping, which comes from the expression "to lift yourself up by your own bootstraps." Oddly enough, that would be impossible, but the expression means "to help yourself without assitance from others."  

On a computer, bootstrapping is the process of loading and executing a startup standalone program. Although that description may not be exactly accurate for any given computer, all computers must go through similar steps to start up.

Deep in the bowels of the computer lies a Read Only Memory (ROM) that contains a short program burned into the memory. When the computer is switched on, the CPU is configured to start its internal program counter at the beginning of the ROM program.

The ROM program varies in length, but basically performs the following:

• Diagnostics, usually called Power On Self Test (POST)
• Location, loading, and execution of a larger bootstrap program from the bootable drive
• Loading and execution of the kernel by the bootstrap program

The ROM bootstrap program does the following, though not necessarily in this order:

• Performs POST, including testing memory, keyboard, and console.
• Polls all addresses where a device can reside, and either runs diagnostics in the ROM or asks the device to run a self-diagnostic and report the results.
• Finds the device that is bootable, usually the first drive.
• Determines whether that device has a program in its own ROM that needs to be loaded in order to control the device, then loads it.
• Jumps to the now-loaded device control program that lets you load the disk bootstrap program, and loads it. The program resides in the boot block or boot sector of a disk. That sector has become a favorite target area for virus writers, because it's very hard to boot a computer without loading and executing the boot sector.
• Jumps to the beginning of the now-loaded disk bootstrap program and executes it.

Then the disk bootstrap program locates and loads a larger program (usually the Unix/Linux kernel) and begins executing. In an alternative version, the disk bootstrap program loads and runs a very extensive booting program. When complete, that booting program finally loads and executes the Unix kernel.

You can see why this process is called booting. The ROM program A loads small disk program B (the boot sector) and executes it. Disk program B loads larger program C and executes it. Possible program C ends by loading program D and executing it.

This process is similar for all machines, unless you're working with an embedded operating system, in which most or all of the operating system is preburned into a ROM and doesn't have to load from a disk drive.

In the above example, the standalone program that's loaded, the kernel, doesn't have to be a full operating system. For example, if you boot a SPARC system in diagnostic mode, a diagnostic monitor operating system is loaded for running tests on system hardware. That operating system is used only for SPARC testing.

A typical Unix boot sequence is:

• Power-on
• ROM boot starts and runs POST
• ROM boot loads and executes the boot sector or boot block (commonly called primary boot)
• Boot block executes by loading and executing the secondary boot program, which does a local or network boot
• Unix kernel is loaded from a local disk drive or over the network, then executed

The boot procedure on an x86 machine is slightly different, but the same basic steps are performed. The primary boot is implemented in the Basic Input Output System (BIOS) ROM that exists on the system board and on BIOS extensions in ROMs that are plugged into the various peripheral boards.

The combination of system-board ROM and peripheral ROM programs loaded from peripheral boards provides all the basic abilities to control the installed peripheral devices and provide I/O services through software interrupts.

After the ROM boot is complete, the ROM program loads and executes the first physical sector from either a floppy or hard disk. (There's the boot sector again.) This load and execution is still part of the primary boot process.

The secondary boot loads and runs a more extensive boot program, which determines the installed devices in the system, possibly with the user's help. The secondary boot then reads in a script file, such as /etc/bootrc, which controls the booting process. That file contains boot interpreter commands, which can be modified to change defaults or adapt to a specific machine.

The boot script completes by loading the kernel. The kernel then starts the operating system, loads the necessary modules, mounts the necessary filesystems, and runs an init program to bring the system to the initialized default state.

The init program also has to spawn all system processes that need to run as part of a Unix startup. Those processes are listed in the /etc/inittab file, with the action code respawn. The first time through, the processes are spawned, and respawn occurs whenever the process stops running, or during changes in run state while booting or shutting down.

Here are some typical respawn entries from an /etc/inittab file. These are used to launch the getty (or in this case, mingetty) program that sits on the Unix/Linux box waiting for someone to log in at a terminal.

# run gettys in standard run levels 
1:2345:respawn:/sbin/mingetty tty1 
2:2345:respawn:/sbin/mingetty tty2 
3:2345:respawn:/sbin/mingetty tty3 
4:2345:respawn:/sbin/mingetty tty4 
5:2345:respawn:/sbin/mingetty tty5 
6:2345:respawn:/sbin/mingetty tty6 

The action codes in /etc/inittab might include:

• respawn: If the process doesn't exist, start it. When the process dies, restart it. If the process currently exists, do nothing and continue scanning the inittab file.
• once: Start the process. When it dies, do not restart it.
• boot: This entry is to be processed only at the init boot-time read of the inittab file.
• powerfail: Execute the process associated with this entry only when init receives a power failure signal.

There are many more action types in the /etc/inittab file. I wanted to give you a taste of what it contains, as reading and executing the entries is the last formal act before the login prompts appear on the terminals.

At this point the computer is booted and (pant, pant) you can log in.

A bootstrap process has been necessary since the very first computer was switched on. Without it, you would have to hand-enter a startup program using switches and other arcane controls on a front loading panel. That was how the earliest personal computers were started. As computers became more sophisticated, so did the process, but it's interesting that the general description of the bootstrap process would look familiar to even to a mainframe administrator. Comprehending it helps you understand one of your computer's most basic functions.

Paapi Kondalu

Papi Kondalu or Paapi Hills are a part of the Eastern Ghats through which the river Godavari flows where the width is barely one kilometer with a depth of about 100-130 ft. The panoramic view of the hills is spellbound attraction to the visitors. The scenic view, the grandeur of the hills and the flowing of river Godavari cannot be explained in words. One must visit and experience. The green lush rain forest on the hills reflect in the waters of Godavari add much more beauty to the on looking tourists. There is a legendary story behind Papikondalu is that during vanavasa period Lord Rama and Sita stayed in this region.
One can reach Papikondalu either from Rajahmundry (East Godavari District) or Bhadrachalam (Khammam District). The actual boat journey from Rajahmundry side starts from a small village about 20 kilometers away from a village named Pattisam or Pattiseema. This village is famous for an ancient Hindu temple of Lord Veerabhadraswamy. The journey from this village to Papikondalu takes about three hours in a mechanized boat run by several private boat owners and the A.P. Tourism. The boat takes the tourists up to a village Peranatallapalli. The boat journey gives a pleasure and peace of mind to the visitors with the cool breeze from Godavari waters, and the picturesque view of the hills. From Bhadrachalam side the boat journey starts from a village named Sri Ramgiri or Kunuru about one and half hours Journey from Bhadrachalam. Both Bhadrachalam and Rajahmundry are well connected by rail and busses.
For the boat journeys one can hire a boat entirely or can also purchase individual tickets and travel. Generally the fare of the boat journey includes breakfast, lunch and evening snacks. Enjoying the sight seeing of the scenic beauty along with the hospitality and the food served by the boat’s management staff is an experience by itself. One can also enjoy the panoramic view of the hills and the twists of Godavari River by sitting on the terrace of the boat which is an unforgettable experience to anybody. The best period to visit is from September to December where the rain fall is less with optimum waters in the river. If there are rains it is better to avoid the journey.



















Places of interest to see on the way to Papikondalu:
1. Pattisam or Pattiseema: The boat journey for Papikondalu starts from this village. It is a small village situated on the banks of river Godavari. A temple is located on the top of a hill for the God Sri Uma Nandeeswara Swamy constructed during 12th century which is worth seeing.
2. Polavaram Project: This can be seen from the top of the hill situated on the back side.
3. Gonduru: The next stop is at Gonduru a small village where a temple was constructed for the Goddess Gandhi Pochamma.
4. Papikondalu: The final stop of the journey to Papikondalu is at a village named Peranatallapalli after viewing the Papikondalu. At this village Sri Ramakrishna Hermitage is worth visiting. A small water fall flowing from the hills can also be seen. Lot of varieties of handicrafts made by the local people is available for sale worth purchasing.
The whole of the Journey from Pattisam to Papikondalu and back takes about six hours which is very exciting and enjoyable one must get experienced.

Amazing Fantasy Garden - Get Lost in it

  Bruno Torf is an artist that creates beautiful works of fantasy art in his sculpture garden. This garden resides in Marysville, Victoria hidden away in a magical rainforest setting.

Originally from South America, Bruno moved his family to Marysville in 1995. He originally started his career as a sign writer, but gradually made the transition to being a fulltime artist. He wanted a place to exhibit his artwork, so he opened Bruno's Art and Sculpture Garden.

He travels around the world quite frequently, studying different styles of art. This is definitely apparent in his garden sculptures. He decided to create the sculpture garden so that he could run it as a permanent attraction. The garden began with a little over 15 life-size terracotta sculptures and now has over 115 on display. Combined with his oil paintings, sketches and small sculptures, there are now over 300 works of art on display at Bruno's Art and Sculpture Garden.











I would love to go to this garden to see these sculptures. It reminds me of a Lord of the Rings type setting. Now that I think about it....I don't want to just visit, I'd totally live in a place like this. Imagine waking up in this fantasy world every day. But then I'd be on display for all of the tourists....they would probably think I was a scary gnome when they see what I look like waking up in the morning.