LWN.net

A discussion on the python-ideas mailing list touched on a number ofinteresting topics, from the problems with misspelled attribute namesthrough the design of security-sensitive interfaces and to the use of the__slots__ attribute of objects. The latter may not be all thatwell-known (or well-documented), but could potentially fix the problem athand, though not in a backward-compatible way. The conversation revolvesaround the ssl modulein the standard library, which has been targeted forupgrades, more than once, over the years—with luck, the maintainers may find time for some upgrades relatively soon.

The Virtuozzo team has announcedthe release of VzLinux 8.4; its fork of RHEL. "Thanks for noticing that we are fixing bugs so quickly (24 hours) and that you think VzLinux is stable and enterprise ready. To those who have asked if we will be following a similar path as CentOS, shifting its focus to Stream, the answer is: there are no plans for us to go this route, VzLinux will remain free to download, use and distribute.See the releasenotes for details.

Security updates have been issued by Arch Linux (python-django), Debian (libuv1, libxstream-java, and php7.3), Fedora (rabbitmq-server), Gentoo (glibc, google-chrome, libxml2, and postsrsd), openSUSE (libqt5-qtwebengine and roundcubemail), SUSE (python-rsa), and Ubuntu (djvulibre).

The addition of system calls to the Linux kernel is a routine affair; ithappens during almost every merge window. The removal of system calls,instead, is much more uncommon. That appears likely to happensoon, though, as discussions proceed on the removal of bdflush().Read on for a look at the purpose and history of this obscure system call and tolearn whether you will miss it (you won't).

Security updates have been issued by Arch Linux (electron11, electron12, istio, jenkins, libtpms, mediawiki, mruby, opera, puppet, and python-fastapi), Debian (djvulibre and openexr), Fedora (dovecot, libtpms, nginx, and php-league-flysystem), Gentoo (corosync, freeimage, graphviz, and libqb), Mageia (busybox, file-roller, live, networkmanager, and php), openSUSE (clamav-database, lua53, and roundcubemail), Oracle (389-ds:1.4, kernel, libxml2, python38:3.8 and python38-devel:3.8, and ruby:2.5), and SUSE (crmsh, djvulibre, python-py, and python-rsa).

Version 3.6of the Darktable raw photo editor has been released. "The darktableteam is proud to announce our second summer feature release, darktable3.6. Merry (summer) Christmas! This is the first of two releases this yearand, from here on, we intend to issue two new feature releases each year,around the summer and winter solstices." The list of new featuresis long, including a new color-balance module, a "censorize" module forpartial pixelization of images, a new demosaic algorithm, and more.

As of this writing, just under 5,000 non-merge changesets have been pulledinto the mainline repository for the 5.14 development cycle. That is lessthan half of the patches that have been queued up in linux-next, so it isfair to say that this merge window is getting off to a bit of a slowstart. Nonetheless, a fair number of significant changes have been merged.

Security updates have been issued by Fedora (ansible and seamonkey), openSUSE (go1.15 and opera), Oracle (kernel and microcode_ctl), and Red Hat (go-toolset-1.15 and go-toolset-1.15-golang).

Bradley Kuhn has posted alengthy missive on the Software Freedom Conservancy blog about thehazards of distributed copyright ownership.

The core scheduling feature has been underdiscussion for over three years. For those who need it, the waitis over at last; core scheduling was merged for the 5.14 kernel release.Now that this work has reached a (presumably) final form, a look at why this featuremakes sense and how it works is warranted. Core scheduling is not foreverybody, but it may prove to be quite useful for some user communities.

Security updates have been issued by Debian (htmldoc, ipmitool, and node-bl), Fedora (libgcrypt and libtpms), Mageia (dhcp, glibc, p7zip, sqlite3, systemd, and thunar), openSUSE (arpwatch, go1.15, and kernel), SUSE (curl, dbus-1, go1.15, and qemu), and Ubuntu (xorg-server).

The LWN.net Weekly Edition for July 1, 2021 is available.

A new project from Mozilla, which is meant to help researchers collectbrowsing data, but only with the informed consent of the browser-user, is taking a lot ofheat, perhaps in part because the company can never seem to do anythingright, at least in theeyes of some. Mozilla Rally wasannouncedon June 25 as joint venture between the company and researchers atPrinceton University "to enable crowdsourced science for publicgood". The idea is that users can volunteer to give academic studies access tothe same kinds of browser data that is being tracked in some browserstoday. Whether the privacy safeguards are strong enough—and if there is sufficient reason for users to sign up—remains to be seen.

Stable kernels 5.12.14, 5.10.47, 5.4.129, 4.19.196, 4.14.238, 4.9.274, and 4.4.274 have been released. They all containimportant fixes and users should upgrade.

Security updates have been issued by Debian (fluidsynth), Fedora (libgcrypt and tpm2-tools), Mageia (nettle, nginx, openvpn, and re2c), openSUSE (kernel, roundcubemail, and tor), Oracle (edk2, lz4, and rpm), Red Hat (389-ds:1.4, edk2, fwupd, kernel, kernel-rt, libxml2, lz4, python38:3.8 and python38-devel:3.8, rpm, ruby:2.5, ruby:2.6, and ruby:2.7), and SUSE (kernel and lua53).

Over at the Project Zero blog, Felix Wilhelm posted a lengthy account of a vulnerability he found in the Linux kernel's KVM (Kernel-based virtual machine) subsystem:

Embedded devices need regular software updates in order to even beminimally safe on today's internet. Products that have reached their "endof life", thus are no longer being updated, are essentially ticking timebombs—it is only a matter of time before they are vulnerable toattack. That situation played out in June for owners of WesternDigital (WD) My Book Live network-attached storage (NAS) devices; what wasmeant to be a disk for home users accessible via the internet turned into a black hole when a remotecommand-execution flaw was used to delete all of the data stored there. Orso it seemed at first.

Security updates have been issued by Debian (klibc and libjdom2-java), Mageia (bash, glibc, gnutls, java-openjdk, kernel, kernel-linus, leptonica, libgcrypt, openjpeg2, tor, and trousers), openSUSE (bouncycastle, chromium, go1.16, and kernel), Oracle (docker-engine docker-cli and qemu), Red Hat (kpatch-patch), and SUSE (arpwatch, go1.16, kernel, libsolv, microcode_ctl, and python-urllib3, python-requests).

The KernelCI continuous-integration project heldits first hackfest recently. Developers from the KernelCI team,Google, and Collabora worked to improve many different aspects of KernelCItesting capabilities. There are plans for more hackfests.

As expected, the 5.13 development cycle turned out to be a busy one, with16,030 non-merge changesets being pulled into the mainline over aperiod of nine weeks. The 5.13release happened on June 27, meaning that it must be time for our traditional look at the provenance of the codethat was merged for this kernel.

Security updates have been issued by Debian (bluez, intel-microcode, tiff, and xmlbeans), Fedora (openssh and php-phpmailer6), openSUSE (freeradius-server, java-1_8_0-openjdk, live555, openexr, roundcubemail, tor, and tpm2.0-tools), SUSE (bouncycastle and zziplib), and Ubuntu (linux-kvm and thunderbird).

Linus has released the 5.13 kernel.

Over on the Mozilla blog, the company has announced a new platform, Mozilla Rally, that "puts users in control of their data and empowers them to contribute their browsing data to crowdfund projects for a better Internet and a better society". Rally comes out of work that Mozilla did with Professor Jonathan Mayer's research group at Princeton University .

The mmap()system call creates a mapping for a range of virtual addresses; ithas a long list of options controlling just how that mapping should work.Ming Lin is proposingthe addition of yet another option, called MAP_NOSIGBUS, whichchanges the kernel's response when a process accesses an unmapped address.What this option does is relatively easy to understand; why it is useful takes a bit more explanation.

Security updates have been issued by Arch Linux (chromium, dovecot, exiv2, helm, keycloak, libslirp, matrix-appservice-irc, nginx-mainline, opera, pigeonhole, tor, tpm2-tools, and vivaldi), Debian (libgcrypt20), Fedora (pdfbox), Mageia (graphicsmagick, matio, and samba and ldb), openSUSE (dovecot23, gupnp, libgcrypt, live555, and ovmf), SUSE (gupnp, libgcrypt, openexr, and ovmf), and Ubuntu (ceph and rabbitmq-server).

The Google Security Blog announcesthe release of a schema intended to describe vulnerabilities in aproject-independent manner:

The first stable release of MyGNUHealth is out.

It has been well over three years now since theSpectre hardware vulnerabilities were disclosed, but Spectre is truly a gift that keeps ongiving. Writing correct and secure code is hard enough when the hardwarebehaves in predictable ways; the problem gets far worse when processors cando random and crazy things. For an illustration of the challengesinvolved, one need look no further than the BPF vulnerability described inthisadvisory, which was fixed in the 5.13-rc7 release.

Security updates have been issued by Mageia (apache-mod_auth_openidc, bind, bluez, cifs-utils, ffmpeg, gnome-autoar, guacd, kernel, kernel-linus, qtwebsockets5, slic3r, tunnel, wavpack, wireshark, and xscreensaver), openSUSE (apache2, cryptctl, go1.15, libnettle, python-rsa, salt, thunderbird, wireshark, libvirt, sbc, libqt5-qtmultimedia, xstream, and xterm), and SUSE (cryptctl, freeradius-server, libnettle, and libsolv).

The LWN.net Weekly Edition for June 24, 2021 is available.

There is an ongoing effort to "modernize" the kernel-development process;so far, the focus has been on providing bettertools that can streamline the usual email-based workflow. But that"email-based" part has proven to be problematic for some potentialcontributors, especially those who might want to simply submit a small bugfix and are not interested in getting set up with that workflow. Theproject-hosting "forge" sites, like GitHub and GitLab, provide a nearlyfrictionless path for these kinds of one-off contributions, but they donot mesh well—at all, really—with most of mainline kernel development.There is some ongoing work that may change all of that, however.

At the behest of the Linux Foundation, a security-oriented review of thekernel project's release-signing and key-management practices was done; thereport from this work has now been published.

For those wanting lots of grungy details about how the PipeWire systemworks, thisblog entry from Patrick Louis should be of interest.

SUSE Linux Enterprise (SLE) 15 SP3 hasbeen released.

Stable kernels 5.12.13, 5.10.46, and 5.4.128 have been released with the usual setof important fixes. Users should upgrade.Note that 5.12.13 and 5.10.46 contain a fix for asignificant Spectre vulnerability; stay tuned to LWN for details.

Security updates have been issued by Debian (kernel and linux-4.19), Fedora (tor), Oracle (rh-postgresql10-postgresql), Red Hat (kernel), SUSE (ansible, apache2, dovecot23, OpenEXR, ovmf, and wireshark), and Ubuntu (linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux, linux-aws, linux-aws-5.8, linux-azure, linux-azure-5.8, linux-gcp, linux-gcp-5.8, linux-hwe-5.8, linux-kvm, linux-oracle, linux-oracle-5.8, linux-raspi, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, linux-hwe, linux-oracle, linux-raspi2, linux-snapdragon, linux, linux-aws, linux-azure, linux-gcp, linux-oracle, linux-raspi, linux-hwe, linux-gke-5.3, linux-raspi2-5.3, linux-oem-5.10, and thunderbird).

Python 3.10 is proceeding apace; everything looks to be ontrack for the final release, which is expected onOctober 4. The beta releases started in early May, with the first of those marking the feature-freeze for this version ofthe language. There are a number of interesting changes that are coming withPython 3.10, including what is perhaps the "headline feature":structural pattern matching.

Security updates have been issued by Fedora (audacity), openSUSE (chromium), Oracle (glib2), SUSE (Salt and salt), and Ubuntu (apache2 and openexr).

Rocky Linux is a community enterpriseoperating system, created by Gregory Kurtzer, founder of the CentOSproject. Rocky Linux 8.4 has beenreleased for x86-64 and aarch64. "Sufficient testing has been performed such that we have confidence in its stability for production systems."

The kernel-development community has long had a tense relationship withcompanies that create and ship proprietary loadable kernel modules. In theview of many developers, such modules are a violation of the GPL and shouldsimply be disallowed. That has never happened, though; instead, thecommunity has pursued a policy of legal ambiguity and technicalinconvenience to discourage proprietary modules. A"technical-inconvenience" patch that was merged nearly one year ago hasbegun to show up in stable kernel releases, leading at least onedeveloper to complain that things have gone a little too far.

Security updates have been issued by Arch Linux (connman, go, and grub), Debian (nettle, prosody, and tor), Fedora (iaito, mingw-ilmbase, mingw-openexr, mingw-python-urllib3, mosquitto, nettle, polkit, and radare2), Mageia (puddletag, python-babel, python-eventlet, and python-pikepdf), openSUSE (htmldoc), SUSE (go1.15, go1.16, gupnp, and libgcrypt), and Ubuntu (apache2 and dovecot).

The 5.13-rc7 kernel prepatch is out fortesting. "So there's not a huge number of patches in here, and most of thepatches are pretty small too. A fair number of one-liners and'few-liners'.Which is just how I like it."For reasons that have not been disclosed on the list, the codename for this release has been changed to "Opossums on Parade".

The 5.12.12, 5.10.45, and 5.4.127 stable kernels have been released.They contain important fixes, as usual, so users should upgrade.

Memory ordering issues are, as Linus Torvalds recentlyobserved, "the rocket science of CS". Understandingmemory ordering is increasingly necessary to write scalable code, so kerneldevelopers often find themselves having to become rocket scientists. Thesubtleties associated with control dependencies turn out to be anespecially tricky sort of rocket. A recent discussion about how to forcecontrol dependencies to be observed shows the sorts of difficulties thatarise in this area.

Security updates have been issued by Arch Linux (aspnet-runtime, aspnet-runtime-3.1, chromium, drupal, intel-ucode, nginx, opera, python-django, radare2, thefuck, and vivaldi), Debian (jetty9), Fedora (dogtag-pki and pki-core), openSUSE (htmldoc and postgresql10), Oracle (dhcp), SUSE (apache2, caribou, jetty-minimal, libxml2, postgresql12, python-PyJWT, python-rsa, python-urllib3, thunderbird, tpm2.0-tools, xstream, and xterm), and Ubuntu (grub2-signed, grub2-unsigned and libxml2).

Kernel development is not for people who lack persistence; changes can takea number of revisions and a lot of time to make it into a mainlinerelease. Even so, the story of the Landlock security module, developed byMickaël Salaün, seems like an extreme case; this code was merged for 5.13 aftermore than five years of development and 34 versions of the patch set.This sandboxing mechanism has evolved considerably since LWN covered version 3 of the patch set in2016, so a look at what Landlock has become is warranted.

The Prossimo project has announcedthat it has contracted with Miguel Ojeda to work on Rust in the Linux kernelfor the next year. Prossimo is a new name for the memory-safetyprojects being run by the Internet Security ResearchGroup (ISRG), which is the organization behind the Let's Encrypt certificate authority(CA) project. Google provided the funds to enable Ojeda to work full-timeon the project starting back in April.

Security updates have been issued by CentOS (gnupnp and postgresql), Fedora (dino, microcode_ctl, and xen), Mageia (apache, gsoap, libgd, openssh, perl-Image-ExifTool, python-bleach, and qt4 and qtsvg5), openSUSE (chromium, containerd, docker, runc, djvulibre, htmldoc, kernel, libjpeg-turbo, libopenmpt, libxml2, spice, squid, and ucode-intel), Red Hat (dhcp and glib2), SUSE (apache2, inn, java-1_8_0-openjdk, and webkit2gtk3), and Ubuntu (nettle).

The LWN.net Weekly Edition for June 17, 2021 is available.

The specter of more events like the SolarWindssupply-chain attacks is something that concerns many in ourcommunities—and beyond. Linux distributions provide a supply chain thatobviously needs to be protected against attackers injecting malicious codeinto the update stream. This problem recently came up on the Fedora develmailing list, which led to a discussion covering a few different topics.For the most part, Fedora users are protected against such attacks, whichis not to say there is nothing more to be done, of course.