Feed lwn LWN.net

LWN.net

Link https://lwn.net/
Feed http://lwn.net/headlines/rss
Updated 2019-10-16 14:15
Perl 6 renamed to Raku
The pull request changing the name of Perl 6 to Raku has beenmerged. See thefull text for more information. "This document describes the stepsto be taken to effectuate a rename of 'Perl 6' to 'Raku', as described inissue #81. It does not pretend to be complete in scope or in time. Tochange a name of a project that has been running for 19+ years will taketime, a lot of effort and a lot of cooperation. It will affect people inforeseen and unforeseen ways." (Thanks to Sean Whitton)
Security updates for Tuesday
Security updates have been issued by Debian (sudo and xtrlock), openSUSE (sudo), Red Hat (Single Sign-On), Slackware (sudo), SUSE (binutils, dhcp, ffmpeg, kernel, kubernetes-salt, sudo, and tcpdump), and Ubuntu (sudo).
KDE Plasma 5.17 released
The KDE project has announced therelease of version 5.17 of the Plasma desktop environment."Night Color, the color-grading system that relaxes your eyes whenthe sun sets, has landed for X11. Your Plasma desktop also recognizes whenyou are giving a presentation, and stops messages popping up in the middleof your slideshow. If you are using Wayland, Plasma now comes withfractional scaling, which means that you can adjust the size of all yourdesktop elements, windows, fonts and panels perfectly to your HiDPImonitor."
Python 3.8.0 released
Version3.8.0 of the Python language has been released. New features includethe controversial assignment expressions,positional-only arguments,the Vectorcallmechanism, and more; see the what's new in Python3.8 document for more information.
PyPy 7.2 released
Version7.2 of PyPy, an implementation of the Python language, is out. Withthis release, Python 3.6 support is deemed ready: "This releaseremoves the 'beta' tag from PyPy3.6. While there may still be some smallcorner-case incompatibilities (around the exact error messages inexceptions and the handling of faulty codec errorhandlers) we are happywith the quality of the 3.6 series and are looking forward to working on aPython 3.7 interpreter."
[$] Finding race conditions with KCSAN
Race conditions can be some of the trickiest bugs to find. The resultingproblems can be subtle, and reproducing the problem in order to track itdown can be difficult or impossible; often code inserted to narrow down arace condition will cause it to stop manifesting entirely. A tool that canfind race conditions automatically would thus be a valuable thing for thekernel community to have. In late September, Marco Elver announceda tool called KCSAN (the Kernel Concurrency Sanitizer) that doesexactly that — and which has already found a number of real problems.
Security updates for Monday
Security updates have been issued by Arch Linux (chromium, sdl, and unbound), Debian (clamav, libdatetime-timezone-perl, openssl, tcpdump, and tzdata), Fedora (cutter-re, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-parent, libapreq2, ming, opendmarc, radare2, and thunderbird), openSUSE (chromium), Oracle (kernel), and SUSE (axis, jakarta-commons-fileupload, kernel, sles12sp3-docker-image, sles12sp4-image, system-user-root, and webkit2gtk3).
Kernel prepatch 5.4-rc3
The 5.4-rc3 kernel prepatch is out fortesting. "Things continue to look fairly normal, with rc3 beinglarger than rc2, as people are starting to find more regressions, but 5.4so far remains on the smaller side of recent releases."
More stable kernels
The 5.3.6,4.19.79,and 4.14.149stable kernel updates have been released; each contains another set ofimportant updates.
[$] Calibrating your fear of big bad optimizing compilers
As notedearlier,when compiling Linux-kernel code that does a plain C-language load orstore, as in"a=b", the C standard grants the compiler the rightto assume that the affected variables are neither accessed nor modifiedby any other thread at the time of that load or store.The compiler is therefore permitted to carry out a surprisinglylarge number of optimizations, any number of which might ruin yourconcurrent code's day.Given that current compilers usually do not emit diagnostics warning ofpotential ruined days, it would be good to have other tools take on thistask.
Security updates for Friday
Security updates have been issued by Debian (lucene-solr and ruby-openid), Fedora (krb5 and SDL2), openSUSE (kernel and libopenmpt), and Ubuntu (python2.7, python3.4).
Understanding Scheduling Behavior with SchedViz (Google Open Source Blog)
The Google Open Source Blog has an announcement of the release of the SchedViz tool that is used internally at the company "to discover many opportunities for better scheduling choices and to root-cause many latency issues". SchedViz provides a GUI to explore kernel traces: "The SchedViz UI displays collections in several ways. A zoomable and pannable heatmap shows system cores on the y-axis, and the trace duration on the x-axis. Each core in the system has a swim-lane, and each swim-lane shows CPU utilization (when that CPU is being kept busy) and wait-queue depth (how many threads are waiting to run on that CPU.) The UI also includes a thread list that displays which threads were active in the heatmap, along with how long they ran, waited to run, and blocked on some event, and how many times they woke up or migrated between cores. Individual threads can be selected to show their behavior over time, or expanded to see their details."
[$] BPF at Facebook (and beyond)
It is no secret that much of the work on the in-kernel BPF virtual machine and associated user-space support code is being done at Facebook. But lessis known about how Facebook is actually using BPF. At Kernel Recipes 2019,BPF developer Alexei Starovoitov describeda bit of that work, though even he admitted that he didn't know what mostof the BPF programs running there were doing. He also summarized recentdevelopments with BPF and some near-future work.
Security updates for Thursday
Security updates have been issued by Debian (clamav, libtomcrypt, and rsyslog), Fedora (suricata), SUSE (libopenmpt and python-requests), and Ubuntu (libsoup2.4 and octavia).
[$] LWN.net Weekly Edition for October 10, 2019
The LWN.net Weekly Edition for October 10, 2019 is available.
[$] An update on the input stack
The input stack for Linux is an essential part of interacting with oursystems, but it is also an area that is lacking in terms of developers.There has been progress over the last few years, however; Peter Huttererfrom Red Hat came to the 2019 X.Org Developers Conference to talk about some of the work that has been done. He gave a status report on the inputstack that covered development work that is going on now as well as thingsthat have been completed in the last two years or so. Overall, things arelooking pretty good for input on Linux, though the "bus factor" for thestack is alarmingly low.
Stallman: No radical changes in GNU Project
Richard Stallman has issued a brief statement saying that there will not beany radical changes in the GNU Project's goals, principles andpolicies. "I would like to make incremental changes in how somedecisions are made, because I won't be here forever and we need to readyothers to make GNU Project decisions when I can no longer do so. But thesewon't lead to unbounded or radical changes."
[$] Free software support for virtual and augmented reality
A talk at the recent X.Org Developers Conference inMontréal, Canadalooked at support for "XR" in free software. XR is an umbrella term thatincludes both virtual reality (VR) and augmented reality (AR). In thetalk, JoeyFerwerda and Christoph Haag from Collabora gave an overview of XR andthe Monado project that provides support forthose types of applications.
Security updates for Wednesday
Security updates have been issued by Fedora (chromium), openSUSE (rust and sqlite3), SUSE (dnsmasq, firefox, and kubernetes, patchinfo), and Ubuntu (python2.7, python3.5, python3.6, python3.7).
OpenSSH 8.1 released
OpenSSH 8.1 is out. It includes some security fixes, including theencryption of keys at rest to defend them against speculative-executionattacks. There is also an experimental new signature and verificationmechanism for public keys.
Six stable kernels
Stable kernels 5.3.5, 5.2.20, 4.19.78, 4.14.148, 4.9.196, and 4.4.196 have been released. They all containthe usual set of important fixes. This is the last 5.2 kernel and usersshould move to the 5.3.y kernel series now.
Security updates for Tuesday
Security updates have been issued by Debian (openjpeg2, openssh, and xen), openSUSE (dovecot23, jasper, libseccomp, lxc, putty, and singularity), Red Hat (bind, kernel, polkit, python, and wget), and Ubuntu (unbound).
[$] Adding the pidfd abstraction to the kernel
One of the many changes in the 5.4 kernel is the completion (insofar asanything in the kernel is truly complete) of the pidfd API. Getting that work done has been "awild ride so far", according to its author Christian Brauner during asession at the 2019 Kernel Recipes conference. He went on to describethe history of this work and some lessons for others interested in addingmajor new APIs to the Linux kernel.
Richard Stallman and the GNU project
While Richard Stallman has resigned from the Free Software Foundation andMIT, he continues to hold onto his position as the head of the GNU project. Now, the FSF has announced that it is"working with GNU leadership on a shared understanding of the relationship for the future" and is seeking comments from thecommunity on what that should be.Meanwhile, a group of maintainers for specific GNU projects has posteda joint statement calling for new leadership at GNU. "We believethat Richard Stallman cannot represent all of GNU. We think it is now timefor GNU maintainers to collectively decide about the organization of theproject. The GNU Project we want to build is one that everyone can trust todefend their freedom."
Security updates for Monday
Security updates have been issued by Debian (jackson-databind, libapreq2, libreoffice, novnc, phpbb3, and ruby-mini-magick), Fedora (mbedtls and mosquitto), Mageia (xpdf), openSUSE (bind, firefox, nginx, openssl-1_0_0, php7, python-numpy, and thunderbird), Oracle (kernel), SUSE (ansible1, ardana-ansible, ardana-cluster, ardana-db, ardana-extensions-nsx, ardana-glance, ardana-input-model, ardana-installer-ui, ardana-manila, ardana-monasca, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-tls, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, grafana, novnc, openstack-cinder, openstack-dashboard, openstack-designate, openstack-glance, openstack-heat, openstack-horizon-plugin-heat-ui, openstack-horizon-plugin-monasca-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-nova, openstack-octavia, openstack-sahara, openstack-tempest, openstack-watcher, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-urllib3, rubygem-easy_diff, bind, compat-openssl098, nginx, and openssl-1_0_0), and Ubuntu (linux-kvm, linux-raspi2, linux-snapdragon and openexr).
Kernel prepatch 5.4-rc2
The second 5.4 kernel prepatch is out fortesting. "So nothing looks particularly worrisome, but usually rc2is fairly calm and it takes a while for any regressions to benoticed." This release also changes the code name to "NestingOpossum".
Some weekend stable kernel updates
The5.3.4,5.2.19,4.19.77,4.14.147,4.9.195, and4.4.195stable kernel updates have all been released; each contains a relativelylarge set of important fixes and updates.
[$] What to do about CVE numbers
Common Vulnerability and Exposure (CVE) numbers have been used for manyyears as a way of uniquely identifying software vulnerabilities. It hasbecome increasingly clear in recent years that there are problems with CVEnumbers, though, and increasing numbers ofvulnerabilities are not being assigned CVE numbers at all. At the 2019 Kernel Recipes event, GregKroah-Hartman delivered a "40-minute rant with an unsatisfactoryconclusion" on CVE numbers and how the situation might be improved. The conclusion may be"unsatisfactory", but it seems destined to stir up some discussionregardless.
Security updates for Friday
Security updates have been issued by Arch Linux (exim, ruby, ruby-rdoc, ruby2.5, and systemd), Debian (openconnect), Mageia (thunderbird), openSUSE (lxc and mosquitto), Oracle (kernel and patch), Scientific Linux (patch), SUSE (firefox, java-1_7_0-ibm, and sqlite3), and Ubuntu (clamav).
Calibre 4.0 released
Version 4.0 of theCalibre ebook management application is out. "It has been two years since calibre 3.0. This time has been spent mostly in making the calibre Content server ever more capable as well as migrating calibre itself from Qt WebKit to Qt WebEngine, because the former is no longer maintained.The Content server has gained the ability to Edit metadata, Add/removebooks and even Convert books to and from all the formats calibre itselfsupports. It is now a full fledged interface to your calibrelibraries."
[$] Why printk() is so complicated (and how to fix it)
The kernel's printk()function seems like it should be relatively simple; all it does is format astring and output it to the kernel logs. That simplicity hides a lot ofunderlying complexity, though, and that complexity is why kernel developersare still unhappy with printk() after 28 years. At the 2019 LinuxPlumbers Conference, John Ogness explainedwhere the complexity in printk() comes from and what is being doneto improve the situation.
Security updates for Thursday
Security updates have been issued by CentOS (kernel), Debian (jackson-databind, libapreq2, and subversion), Fedora (glpi, memcached, and zeromq), openSUSE (rust), Oracle (kernel), Red Hat (patch), and SUSE (dovecot23, git, jasper, libseccomp, and thunderbird).
PostgreSQL 12 released
Version 12 of the PostgreSQL database management system is out. "PostgreSQL 12 enhancements include notable improvements to queryperformance, particularly over larger data sets, and overall spaceutilization. This release provides application developers with newcapabilities such as SQL/JSON path expression support, optimizations forhow common table expression ('WITH') queries are executed, and generatedcolumns. The PostgreSQL community continues to support the extensibilityand robustness of PostgreSQL, with further additions tointernationalization, authentication, and providing easier ways toadministrate PostgreSQL. This release also introduces the pluggabletable storage interface, which allows developers to create their ownmethods for storing data."
[$] LWN.net Weekly Edition for October 3, 2019
The LWN.net Weekly Edition for October 3, 2019 is available.
[$] Starting The Document Collective
The Document Foundation (TDF) isthe home of the LibreOfficefree-software office suite; it provides financial, governance, andother administrative services to LibreOffice. The foundation wasestablished in part to ensure that commercial entities did not have undueinfluence on the project, which limited the types of activities in which itcan engage. In particular, selling branded versions of LibreOffice in themacOS and Windows app stores has not been something that TDF could tackle.The TDFboard of directors is looking to change that with the creation of a new entity, The Document Collective (TDC), to engage in commercial activity thatis complementary to that of TDF members—hopefully as an income source tohelp support TDF.
Security updates for Wednesday
Security updates have been issued by Debian (openssl and openssl1.0), Fedora (expat, kernel, kernel-headers, kernel-tools, and phpMyAdmin), openSUSE (nghttp2 and u-boot), Oracle (kernel), Red Hat (rh-nodejs8-nodejs), Slackware (libpcap), SUSE (bind, jasper, libgcrypt, openssl-1_0_0, and php7), and Ubuntu (clamav).
[$] PostgreSQL considers seccomp() filters
A discussion on the pgsql-hackers mailinglist at the end of August is another reminder that the suitability ofseccomp()filters is likely more narrow than was hoped. Applying filters to the PostgreSQL database is difficult for a number of reasons and thebenefit for the project and its users is not entirely clear. Thediscussion highlights the tradeoffs inherent in adding system-callfiltering to a complex software suite; it may help crystallize the thinkingof other projects that are alsolooking at supporting seccomp() filters.
Stable kernel updates
Stable kernels 5.3.2, 5.2.18, and 4.19.76 have been released. They all containimportant fixes and users should upgrade.
Security updates for Tuesday
Security updates have been issued by Debian (apache2, linux-4.9, netty, phpbb3, and poppler), openSUSE (chromium, djvulibre, ghostscript, python-numpy, SDL2, and varnish), Oracle (nodejs:10), Red Hat (httpd24-httpd and httpd24-nghttp2, kpatch-patch, and rh-nodejs10-nodejs), and Ubuntu (linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon, and SDL 2.0).
TensorFlow 2.0.0
Version2.0.0 of the TensorFlow machine-learning system is out. Headlinefeatures include the "Keras" high-level API, support for distributedtraining, and more, including a number of API-breaking changes.
[$] 5.4 Merge window, part 2
The release of the 5.4-rc1 kernel and the closing of the merge window forthis development cycle came one day later than would have normally beenexpected. By that time, 12,554 non-merge changesets had been pulledinto the mainline repository; that's nearly 2,900 since the first-week summary was written. Thatrelatively small number of changes belies the amount of interesting changethat arrived late in the merge window, though; read on for the full list.
The 5.4-rc1 kernel is out
Linus has tagged the 5.4-rc1 release, thus ending the merge window for thisdevelopment cycle. An apparent linux-kernel outage means that there is noannouncement to post yet; we'll do that as soon as it becomes available.Meanwhile, though, everything can be seen in his repository.Update: the 5.4-rc1 announcement isnow available. "I didn't really extend the merge window by a day here, but I gavemyself an extra day to merge my pending queue. Thus the Monday datefor the rc1 rather than the usual Sunday afternoon."
Exim 4.92.3 security release
Exim 4.92.3 has been released with a fix for CVE-2019-16928, a heap-basedbuffer overflow in string_vformat that could lead to remote codeexecution. "The currently known exploit uses a extraordinary longEHLO string to crash the Exim process that is receiving the message. Whileat this mode of operation Exim already dropped its privileges, other paths toreach the vulnerable code may exist."
Security updates for Monday
Security updates have been issued by CentOS (dovecot, kernel, and qemu-kvm), Debian (cimg, cups, e2fsprogs, exim4, file-roller, golang-1.11, httpie, and wpa), Fedora (curl, ghostscript, ibus, krb5, mod_md, and nbdkit), Mageia (chromium-browser-stable, libheif, and nghttp2), openSUSE (djvulibre, expat, libopenmpt, mosquitto, phpMyAdmin, and webkit2gtk3), Red Hat (nodejs:10), SUSE (gpg2), and Ubuntu (e2fsprogs and exim4).
[$] Compiling to BPF with GCC
The addition of extended BPF to the kernel has opened up a whole range ofuse cases, but few developers actually write BPF code. It is, like anyother assembly-level language, a tedious pain to work with; developerswould rather use a higher-level language. For BPF, the language of choiceis C, which is compiled to BPF with the LLVM compiler. But, as JoseMarchesi described during the Toolchainsmicroconference at the 2019 LinuxPlumbers Conference, LLVM will soon have company, as he has just addedsupport for a BPF back-end to the GCC compiler.
RPM 4.15.0 released
After "more than two years in development and half a year in testing", version 4.15.0 of the RPM package manager has been released. It has a wide range of new features, including faster parallel builds; support for %elif, %elifos, and %elifarch statements in RPM spec files; new %patchlist and %sourcelist sections; experimental support for non-privileged operation in a chroot() environment; and, of course, plenty of bug fixes and such. More details can be found in the release notes.
Purism’s Librem 5 phone starts shipping—a fully open GNU/Linux phone (Ars Technica)
Ars Technica reports on the Librem 5 smartphone from Purism, which has begun shipping. The article provides an initial review of the phone, with pictures of the interface and hardware inside the case. "The Librem 5 is unlike anything else on the market. Not only is it one of the only smartphones on Earth that doesn't ship with Android, a fork of Android, or iOS—Purism's commitment to 100% open software, with no binary blobs, puts severe restrictions on what hardware it can use. Android's core might be open source, but it was always built for wide adoption above all else, with provisions for manufacturers to include as much proprietary code as they want. Purism's demand that everything be open means most of the major component manufacturers were out of the question.Perhaps because of the limited hardware options, the internal construction of the Librem 5 is absolutely wild. While smartphones today are mostly a single mainboard with every component integrated into it, the Librem 5 actually has a pair of M.2 slots that house full-size, off-the-shelf LTE and Wi-Fi cards for connectivity, just like what you would find in an old laptop. The M.2 sockets look massive on top of the tiny phone motherboard, but you could probably replace or upgrade the cards if you wanted."
How to contribute to Fedora (Fedora Magazine)
Over at Fedora Magazine, Ben Cotton has an article on contributing to the Fedora distribution. Obviously, it is pretty Fedora-specific, but the general ideas can be applied to other distributions and/or projects. He lists several areas where contributors are needed—beyond just the obvious candidates: "Cooperative effort is a hallmark of open source communities. One of the best ways to contribute to any project is to help other users. In Fedora, that can mean answering questions on the Ask Fedora forum, the users mailing list, or in the #fedora IRC channel. Many third-party social media and news aggregator sites have discussion related to Fedora where you can help out as well."
[$] Fixing getrandom()
A report ofa boot hang in the 5.3 series has led to an enormous, somewhat contentiousthread on the linux-kernel mailing list. The proximate cause was some changes that made theext4 filesystem do less I/O early in the boot phase, incidentally causingfewer interrupts, but the underlying issue was the getrandom()system call, which was blocking until the /dev/urandom poolwas initialized—as designed. Since the system in question was notgathering enough entropy due to the lack of unpredictable interrupttimings, that would hang more or less forever. That has called intoquestion the design and implementation of getrandom().
Security updates for Friday
Security updates have been issued by Fedora (dcmtk), openSUSE (rust), Red Hat (redhat-virtualization-host), and SUSE (ghostscript, nghttp2, and u-boot).
12345678910...