Version 2.52.0 of the Gitsource-code management system has been released. Changes include a newlast-modified command to find the closest ancestor commit thattouched one or more paths, a couple of git refs improvements, anew git repo command for obtaining information about therepository itself, and more. See the announcement and thisGitHub blog entry for more information.
For better or for worse, the NUMA node is the abstraction used by thekernel to keep track of different types of memory. How that abstraction isused, though, is still an active area of development. Two patch setsfocused on this problem are currently under review; one addresses theperennial problem of promoting heavily used folios from slower to fastermemory, while the other aims to improve the kernel's handling of nodescontaining special memory installed for a specific purpose.
Linus has released 6.18-rc6 for testing."So we have a slightly larger rc6 than usual, but I think it's just therandom noise and a result of pull request timings rather than due to anyissues with the release. But I guess we have a couple of weeks remaining tofind out."
One of the many objectives of the LinuxKernel Self-Protection Project (KSPP), which just completed ten years ofwork, is to ensure that all array references can be bounds-checked,even in the case of flexible array members, the size of which is not knownat compile time. One of the most challenging flexible array members in thekernel is not even declared as such. Almost exactly one year ago, LWN looked at the effort to increase safety aroundthe networking subsystem's heavily used sockaddr structure. Oneyear later, Kees Cook is still looking for a way to bring this work to aclose.
Greg Kroah-Hartman has announced the release of the 6.17.8 and 6.12.58 stable kernels. Each contains animportant set of fixes. Users are advised to upgrade.
The SUSE Security Team has published an in-deptharticle on its findings after reviewing a D-Bus service containedin LightDMGreeter by KDE (the lightdm-kde-greeter package)for addition to openSUSE Tumbleweed. The team found a privilegeescalation from the lightdm service user to root, aswell as other attack vectors in the service:
Version145 of the Thunderbird email client has been released. Notablechanges in this release include enabling DNS over HTTPS, support forMicrosoft Exchange via Exchange Web Services, and quite a few bugfixes. As of 145, the project is no longer shipping 32-bit binariesfor Linux on x86.
Many distributions provide support out of the proverbial box forFlatpak packages, but Fedora is unusual in that it also provides, anddefaults, to its own repository of Fedora-built Flatpaks. This has beena source of confusion for Fedora users, who expect to get the Flatpakbuilt by the original developers and hosted on Flathub. It has also been a sourceof conflict with upstream projects, because users complain of bugs inFlatpak packages they are not responsible for. The situation has also frustrated someFedora developers, who would prefer to put Flathub's offeringsfirst. A new complaint that Fedora has apparently used manifestsfrom Flathub to build the packages for Fedora-without giving credit tothe original authors-has spurred discussions about Fedora'sFlatpaks once again. While no concrete changes are on the table, yet,there may be some movement toward addressing persistent complaints.
Security updates have been issued by Debian (chromium and firefox-esr), Fedora (firefox, rubygem-rack, skopeo, and webkitgtk), Mageia (perl, perl-CPAN, perl-HTTP-Tiny, perl-Data-Entropy, perl-FCGI, perl-File-Find-Rule, perl-YAML-LibYAML, python-tornado, python-urllib3, python-pip, python3, and unbound), Oracle (ipa and kernel), Red Hat (container-tools:rhel8, krb5, openssl, pcs, podman, and runc), Slackware (mozilla), SUSE (binutils, kernel, netty, netty-tcnative, podman, python311-pdfminer, and tomcat11), and Ubuntu (bind9 and linux-aws-6.8).
Version5.0.0 of the Homebrew packagemanager for Linux and macOS has been released. Notable changes in thisrelease include download concurrency by default, official support for64-bit Arm on Linux, and more.
Longtime LWN readers will have encountered the concept of "stable pages"before; it was first covered here nearly15years ago. For the most part, the problem that stable pages weremeant to solve - preventing errors when user space modifies a buffer thatis under I/O - has been dealt with. Butrecent discussions show that there is one area where problems remain:direct I/O. There is some disagreement,though, over whether those problems are the result of user-space bugs andhow much of a performance price should be paid to address them.
Security updates have been issued by AlmaLinux (kernel, kernel-rt, and libtiff), Debian (kernel, libarchive, rust-sudo-rs, and squid), Fedora (chromium, dotnet8.0, forgejo, ruby, and webkitgtk), Oracle (bind, bind9.18, kernel, kernel-uek*, libtiff, and runc), Red Hat (firefox, kernel, and kernel-rt), Slackware (mozilla), SUSE (buildah, colord, containerd, kernel, lasso, libsoup, micropython, ongres-scram, openssh, proxy-helm, uyuni-tools, python-pdfminer.six, qatengine, qatlib, regclient, and runc), and Ubuntu (raptor and raptor2).
Firefox 145 has been released. Notablechanges in this release include note-takingfeatures for PDFs viewed in Firefox, enhancedprivacy protections, and the ability to access and manage passwords inthe sidebar. This release also drops support for 32-bit Linux systems.
Tails is an unusual Linuxdistribution developed by the Tor Project; itis designed to help users work around internet censorship and avoidsurveillance. It is a "portable" operating system that is meant to berun from a USB stick or ISO image and to leave no trace on thecomputer it was run on. Tails routes connections to the internet overthe Tornetwork and includes a selection of applications and toolssuited to working with sensitive documents, communicating securely,and preserving users' anonymity. The tradeoff, of course, is thatTails is less convenient and requires users to learn a new set oftools to avoid compromising their own security and anonymity. Tails7.1 wasreleased in October, and it seemed like as good a time as any to takeit for a spin.
Security updates have been issued by AlmaLinux (bind, expat, kernel, osbuild-composer, qt6-qtsvg, runc, valkey, and xorg-x11-server-Xwayland), Debian (incus), Fedora (cef and dotnet8.0), Mageia (strongswan), Red Hat (fence-agents and python-requests), SUSE (chromium, colord, erlang26, java-1_8_0-openjdk, libsoup, python-django, thunderbird, tiff, and warewulf4), and Ubuntu (intel-microcode and rust-sudo-rs).
Version 2.0.0 of public-inbox, the mail archiving system behindlore.kernel.org and LWN's email archive, has been released. "Thisrelease includes several new features and fixes; mostly around improvedintegration between inboxes and coderepos for solver. Portability andreliability is also improved, especially in the internal process managementof lei."
When programs written in BPF (the kernel's hot-loadable virtual-machine bytecode) call kernel functions (kfuncs), it may be usefulfor those functions to have additional information about the context in whichthose BPF programs are executing. Rather than requiring it to supplythat information, it would be convenient to let the BPF verifier pass thatinformation to the called function automatically. That is already possible, buta recent patch set from Ihor Solodrai would make it more ergonomic.It allows kerneldevelopers to specify that a kfunc should be passed additionalparameters inferred by the verifier, invisibly to the BPF program. Thediscussion included concerns that Solodrai's implementation was unnecessarily complex, however.
Version9.0.0 of pytest has been released. Notable changes in this releaseinclude the addition of subtests,native support for TOML configuration files, and a new strictmode. See the changelogfor a complete list of new features, enhancements, and bug fixes.
The KeePassXC project has recently updated its contributionpolicy and READMEto note its policy around contributions created with generative AItools. The project's use of those tools, such as GitHub Copilot, haveraised a number of questions and concerns, which the project hasrespondedto:
The kernel community is currently reviewing aproposed policy for contributors who are using large language models toassist in the creation of their patches; the primary focus is on disclosureof the use of those tools. "The goal here is to clarify communityexpectations around tools. This lets everyone become more productive whilealso maintaining high degrees of trust between submitters andreviewers."
The bootc project allows users tocreate a bootable Linux system image using the container tooling that manydevelopers are already familiar with. It is an evolution of OSTree(now called libostree), which is used to create FedoraSilverblue and other image-based distributions. While creatingcustom images is still a job for experts, the container technologysimplifies delivering heavily customized images to non-technicalusers.
Version4.5 of the Mastodondecentralized social-media platform has been released. Notablefeatures in this release include quoteposts, native emoji support, as well as enhanced moderation andblocking features for server administrators. The project also has a postdetailing new features in 4.5 for developers of clients and othersoftware that interacts with Mastodon.
The future of the Filesystem Hierarchy Standard (FHS) has been under discussion for some time; now,Neal Gompa has announcedthat the FHS is "hosted and stewarded" by Freedesktop.org.
Filesystems are complex and performance-sensitive beasts. They can alsopresent security concerns. Microkernel-based systems have long pushedfilesystems into separate processes in order to contain any vulnerabilitiesthat may be found there. Linux can do the same with the Filesystem inUserspace (FUSE) subsystem, but using FUSE brings a significantperformance penalty. Darrick Wong is working on ways to eliminate thatpenalty, and he has a massive patchset showing how ext4 filesystems can be safely implemented in user space byunprivileged processes with good performance. This work has the potentialto radically change how filesystems are managed on Linux systems.
Mason Freed and Dominik Rottsches have published a documentwith a timeline and plans for removing Extensible Stylesheet LanguageTransformations (XSLT) from the Chromium project and Chromebrowser:
Version2.3.0 of the Lightweight Qt Desktop Environment (LXQt) has beenreleased. The highlight of this release is continued improvement inWayland support across LXQt components. Rather than offering its owncompositor, the LXQt project takes a modular approach and works withseveral Wayland compositors, such as KWin, labwc, and niri.
Linux has many security features and tools that have evolved overthe years to address threats as they emerge and security gaps as theyare discovered. Linux security is all, as Lennart Poettering observed at the All Systems Go! conference heldin Berlin, somewhat random and not a "clean"design. To many observers, that may also appear to be the case forsystemd; however, Poettering said that he does have a vision for howall of the security-related pieces of systemd are meant to fittogether. He wanted to use his talk to explain "how the individualsecurity-related parts of systemd actually fit together and why theyexist in the first place".
Version1.3 of the Open Container Initiative (OCI) RuntimeSpecification has been released. The specification covers theconfiguration, execution environment, and lifecycle of containers. Themost notable change in 1.3 is the addition of FreeBSD to thespecification, which the FreeBSD Foundation calls"a watershed moment for FreeBSD":
Version6.18 of the Incus container and virtual-machine management systemhas been released. Notable changes in this release include newconfiguration keys for providing credentials to systemd, BPF tokendelegation, VirtIO support for sound cards, the ability to export ISOvolumes, improvements to the IncusOS command-line utility, and more.
Julia is a modern programminglanguage that is of particular interest to scientists due to its highperformance combined with language features such as Lisp-style macros, anadvanced type system, and multiple dispatch. We last looked at Julia in January on the occasion ofits 1.11release. Early in October Julia1.12appeared, bringing a handful of quality-of-life improvements for Juliaprogrammers, most notably support, though still experimental and limited,for the creation of binaries.
Security updates have been issued by Debian (dcmtk, geographiclib, gimp, pure-ftpd, and ruby-rack), Fedora (dotnet9.0), Oracle (expat, kernel, tigervnc, xorg-x11-server, and xorg-x11-server-Xwayland), Red Hat (git, mariadb:10.5, multiple packages, osbuild-composer, pcs, sssd, and tigervnc), SUSE (kernel and redis), and Ubuntu (google-guest-agent).
Version1.0 of the Capability Hardware Extension to RISC-V for IoT(CHERIoT) specification has been released. CHERIoT is ahardware-software system for secure embedded devices, and thespecification provides a full description of the ISA and its intendeduse by CHERIoTRTOS. David Chisnall has written a blogpost about the release that explains its significance as well as plansfor CHERIoT 2.0 and beyond:
The Project Zero blog explainsthat, on 64-bit Arm systems, the kernel's direct map is always placed atthe same virtual location, regardless of whether kernel address-spacelayout randomization (KASLR) is enabled.
Barry Warsaw, writing for the Python steering council, has announcedthat PEP810 ("Explicit lazyimports") has been approved, unanimously, by the four who could vote. SincePablo Galindo Salgado was one of the PEP authors, he did not vote. The PEP provides a way to defer importing modules until the namesdefined in a module areneeded by other parts of the program. We covered the PEP and the discussion around ita few weeks back. The council also had "recommendations about some ofthe PEP's details, a few suggestions for filling a couple of smallgaps", including:
Python already has several ways to run programs concurrently -including asynchronous functions, threads, subinterpreters, and multiprocessing- but all of those options have drawbacks of one kind or another.PEP703 ("Making the Global Interpreter Lock Optional in CPython")removed a major barrier to running Pythonthreads in parallel, but also exposed Python programmers to the same trickysynchronization problems found in other languages supporting multithreadedprograms. A new draft proposalby Mark Shannon,PEP805 ("Safe Parallel Python"), suggests a way for the CPython runtimeto cut down on concurrency bugs, making it more practical for Python programmersto use versions of the language without the global interpreter lock (GIL).
Version6.0 ("Excalibur") of the systemd-averse Devuan distribution has beenreleased. It is based on Debian13 ("trixie"), and includes some ofthe significant changes from that release, including the merged/usr hierarchy. See therelease notes for details.
The kernel's namespaces feature is, amongother things, a key part of the implementation of containers. Like much inthe kernel, though, the namespace API evolved over time; there was nodesign at the outset. As a result, this API has some rough edges andmissing features. Christian Brauner is working to straighten out thenamespace situation somewhat with thisdaunting 72-part patch series that, among other things, adds a newsystem call to allow user space to query the namespaces present on thesystem.
LWN.net