LWN.net

More bugs in free software are being found these days, which is good formany reasons, but there are some possible downsides to that as well. Inaddition, projects like OSS-Fuzz arefinding lots of bugs in an automated fashion—many of which may be securityrelevant. The sheer number of bugs being reported is overwhelming many(most?) free-software projects, which simply do not have enough eyeballs tofix, or even triage, many of the reports they receive. A discussion aboutthat is currently playing out on the oss-security mailing list.

GitLab 12.0 has been released. "GitLabgives users the ability to automatically create review apps for each merge request. This allows anyone to see how the design or UX has been changed.In GitLab 12.0, we are expanding the ability to discuss those changes bybringing the ability to insert visual reviewtools directly into the Review App itself. With a small code snippet,users can enable designers, product managers, and other stakeholders toquickly provide feedback on a merge request without leaving theapp." Other features include the ability to easily access aproject's Dependency List, restrict access by IP address, and much more.

Stable kernels 5.1.15, 4.19.56, and 4.14.130 have been released. The all containimportant fixes and users should upgrade.

Security updates have been issued by CentOS (python), Debian (bzip2, libvirt, python2.7, python3.4, rdesktop, and thunderbird), Fedora (thunderbird and tomcat), openSUSE (aubio, docker, enigmail, GraphicsMagick, and python-Jinja2), SUSE (kernel, libvirt, postgresql96, and tomcat), and Ubuntu (ceph, firefox, imagemagick, libmysofa, linux, linux-hwe, neutron, and policykit-desktop-privileges).

Konstantin Ryabitsev has announceda new public blogging platform for kernel developers. "Ever since the demise of Google+, many developers have expressed a desire to have a service that would provide a way to create and manage content in a format that would be more rich and easier to access than email messages sent to LKML.Today, we would like to introduce people.kernel.org, which is anActivityPub-enabled federated platform powered by WriteFreely and hosted byvery nice and accommodating folks at write.as." (LWN looked at WriteFreely back in March).

Here's astatement from the Apache Software Foundation regarding changes in itsleadership: "It is with a mix of sadness and appreciation that theASF Board accepted the resignations of Board Member Jim Jagielski, ChairmanPhil Steitz, and Executive Vice President Ross Gardler last month."There is no indication of why all these people decided to leave at the sametime.

Technologies like UEFI secure boot are intended to guarantee that alocked-down system is running the software intended by its owner (for adefinition of "owner" as "whoever holds the signing key recognized by thefirmware"). That guarantee is hard to uphold, though, if a program run onthe system in question is able to modify the running kernel somehow. Thus,proponents of secure-boot technologies have been trying for years toprovide the ability to lockdown many types of kernel functionality on secure systems. The latestattempt posted by Matthew Garrett, at an eyebrow-raising version 34,tries to address previous concerns by putting lockdown under the control ofa Linux security module (LSM).

Canonical has letit be known that minds have been changed about removing all 32-bit x86support from the Ubuntu distribution. "Thanks to the huge amount of feedback this weekend from gamers, Ubuntu Studio, and the WINE community, we will change our plan and build selected 32-bit i386 packages for Ubuntu 19.10 and 20.04 LTS.We will put in place a community process to determine which 32-bit packages are needed to support legacy software, and can add to that list post-release if we miss something that is needed."

PostmarketOS is an Alpine Linux based operating system for mobiledevices. The postmarketOS blog takes a lookat the project after two years of development. "Wouldn't it be great if you could take any obsolete smartphone from the past ten years and replace its outdated and insecure software with a maintained, modular free software stack? How about then using it as a Raspberry Pi-like device for your next tinkering project? With some constraints, postmarketOS makes this possible today for 139 booting devices. Every single package in the whole OS can be updated, with the only exceptions being the vendor's Linux kernel and firmware blobs (if you plan on using them). In a few cases, it is even possible to switch out the discontinued vendor kernel forks with the upstream kernel releases straight from Linus Torvalds."

Security updates have been issued by Debian (jackson-databind, libvirt, pdns, and vim), Fedora (evince, firefox, gjs, libxslt, mozjs60, and poppler), openSUSE (dbus-1, firefox, ImageMagick, netpbm, openssh, and thunderbird), Oracle (libssh2, libvirt, and python), Scientific Linux (python), SUSE (compat-openssl098 , dbus-1 , evince , exempi , firefox , glib2 , gstreamer-0_10-plugins-base , gstreamer-plugins-base , java-1_8_0-ibm , libssh2_org , libvirt , netpbm , samba , SDL2 , sqlite3 , thunderbird , and wireshark ), and Ubuntu (web2py).

The 5.2-rc6 kernel prepatch has beenreleased. Linus worries that the volume of changes has increased — but nottoo much. "With all that out of the way, I'm still reasonablyoptimistic that we're on track for a calm final part of the release, and Idon't think there is anything particularly bad on the horizon." Healso notes that, due to travel, he'll be releasing 5.2-rc7 later thanusual.

The 5.1.13,4.19.54,4.14.129,4.9.183, and4.4.183 stable kernels have all beenreleased with another set of important fixes. A few milliseconds later,5.1.14 and4.19.55 came out with one more networkingfix.

The FreeBSD operating system is continuingto make progress, 26 years after it got its name. Among the areas wherework is being done is onimproved support for RISC-V, FUSEfilesystem updates, C runtime changes, and security improvements. FreeBSDDay is celebrated on June 19, in recognition of the date in 1993 whenthe name FreeBSD was coined fora fork of the 386BSD project. The first official release of FreeBSD did not occur until November 1, 1993, however.Ahead of FreeBSDDay, the project released its quarterlyreport for the first quarter of 2019, outlining some of its ongoingefforts. In addition to the quarterly report, the executive director of theFreeBSD Foundation provided LWN with some insights into the state of theproject and the foundation that supports it.

As of this writing, just over 13,600 non-merge changesets have been pulledinto the mainline repository for the 5.2 development cycle. The time hascome, once again, for a look at where that work came from and who supportedit. There are some unique aspects to 5.2 that have thrown off some of theusual numbers.

Bunnie Huang writesabout the escalating trade wars and how they could be harmful to theopen-source community. "Because the administrative action so faragainst Huawei relies only upon export license restrictions, the LinuxFoundation has been able to find shelter under a license exemption for opensource software. However, should Huawei be designated as a 'foreignadversary' under EO13873, it greatly expands the scope of the ban becauseit prohibits transactions with entities under the direction or influence offoreign adversaries. The executive order also broadly includes anyinformation technology including hardware and software with no exemptionfor open source."

Security updates have been issued by CentOS (libvirt and python), Debian (intel-microcode, php-horde-form, and znc), Fedora (firefox), Mageia (firefox, flash-player-plugin, git, graphicsmagick, kernel, kernel-linus, kernel-tmb, phpmyadmin, and thunderbird), Oracle (libssh2, libvirt, and python), Red Hat (libvirt and python), Scientific Linux (libvirt), Slackware (bind and mozilla), SUSE (enigmail), and Ubuntu (bind9, intel-microcode, mosquitto, postgresql-10, postgresql-11, and thunderbird).

The calling interfaces between programming languages are, by their nature,ripe for misunderstandings; different languages can have subtly differentideas of how data should be passed around. Such misunderstandings oftenhave the effect of making things break right away; these are quicklyfixed. Others can persist for years or even decades before jumping out ofthe shadows and making things fail. A problem of the latter varietyrecently turned up in how some C programs are passing strings to Fortransubroutines, with unpleasant effects on widely used packages like LAPACK.

The Kubernetes container orchestrator team has announced the release of Kubernetes 1.15; the main themes of this release are "extensibility and continuous improvement". One of the focus areas was on usability and lifecycle stability for clusters:"Work on making Kubernetes installation, upgrade and configuration even more robust has been a major focus for this cycle for SIG Cluster Lifecycle (see our last Community Update). Bug fixes across bare metal tooling and production-ready user stories, such as the high availability use cases have been given priority for 1.15.kubeadm, the cluster lifecycle building block, continues to receive features and stability work required for bootstrapping production clusters efficiently. kubeadm has promoted high availability (HA) capability to beta, allowing users to use the familiar kubeadm init and kubeadm join commands to configure and deploy an HA control plane. An entire new test suite has been created specifically for ensuring these features will stay stable over time."More information can be found in therelease notes.

Security updates have been issued by Debian (firefox-esr, gvfs, intel-microcode, and python-urllib3), Fedora (advancecomp, firefox, freeradius, kubernetes, pam-u2f, and rubygem-jquery-ui-rails), openSUSE (elfutils and sssd), Red Hat (chromium-browser), SUSE (doxygen and samba), and Ubuntu (evince, firefox, Gunicorn, libvirt, and sqlite3).

The LWN.net Weekly Edition for June 20, 2019 is available.

Selectiveacknowledgment (SACK) is a technique used by TCP to help alleviatecongestion that can arise due to the retransmission of dropped packets. It allowsthe endpoints to describe which pieces of the data they have received,so that only the missing pieces need to be retransmitted. However, a bugwas recently found in the Linux implementation of SACK that allows remoteattackers to panic the system by sending crafted SACK information.

Starting with the upcoming "Eoan Ermine" (a.k.a. 19.10) release, the Ubuntudistribution willnot support 32-bit x86 systems. "The Ubuntu engineering team hasreviewed the facts before us and concluded that we should not continue tocarry i386 forward as an architecture. Consequently, i386 will not beincluded as an architecture for the 19.10 release, and we will shortlybegin the process of disabling it for the eoan series across Ubuntuinfrastructure."

Version3.10.0 of the Alpine Linux distribution is out. It includes a switchto the iwd WiFi management daemon, supportfor the ceph filesystem, the lightdm display manager, and more.

Python has followed an 18-month release cycle for many years now; eachnew 3.x release comes at that frequency. It has worked well, overall,but there is interest in having a shorter cycle, which would mean that newfeatures get into users' hands more quickly. But changing that longstandingcycle has implications in many different places, some of which have come upas part of a discussion on switching to a cycle of a different length.

Stable kernels 5.1.12, 4.19.53, and 4.14.128 have been released. They all containimportant fixes and users should upgrade.

Security updates have been issued by Arch Linux (dbus, firefox, kernel, linux-lts, linux-zen, and python), CentOS (bind and kernel), Debian (firefox-esr, glib2.0, and vim), Fedora (dbus, kernel, kernel-headers, mingw-libxslt, poppler, and python-gnupg), openSUSE (gnome-shell, kernel, libcroco, php7, postgresql10, python, sssd, and thunderbird), Oracle (kernel and libvirt), Red Hat (go-toolset:rhel8, gvfs, java-11-openjdk, pki-deps:10.6, systemd, and WALinuxAgent), SUSE (docker, kernel, libvirt, openssl, openssl1, and python-Jinja2), and Ubuntu (samba).

Maintaining a subsystem, as a general rule, requires a familiarity with theGit source-code management system. Git is a powerful tool with a lot offeatures; as is often the case with such tools, there are right and wrongways to use those features. This document looks in particular at the useof rebasing and merging. Maintainers often get in trouble when they usethose tools incorrectly, but avoiding problems is not actually all thathard.

Security updates have been issued by Arch Linux (linux-hardened), Debian (kdepim, kernel, linux-4.9, and phpmyadmin), Fedora (ansible and glib2), openSUSE (kernel and vim), Oracle (bind and kernel), Red Hat (kernel and kernel-rt), Scientific Linux (bind and kernel), SUSE (dbus-1, ImageMagick, kernel, netpbm, openssh, and sqlite3), and Ubuntu (linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon and linux, linux-aws, linux-azure, linux-lts-trusty, linux-lts-xenial).

Stable kernels 5.1.11, 4.19.52, 4.14.127, 4.9.182, and 4.4.182 have been released. They all contain arelatively small set of important fixes; users should upgrade.

At KubeCon +CloudNativeCon Europe 2019 there was a public meeting of the Cloud Native Computing Foundation (CNCF) TechnicalOversight Committee (TOC); its members outlined the currentstate of the CNCF and where things are headed.What emerged was apicture of how the CNCF's governance is evolving as it brings in moreprojects, launches a new special interest group mechanism, andcontemplates what to do with projects that go dormant.

Security updates have been issued by Arch Linux (chromium and thunderbird), Debian (php-horde-form, pyxdg, thunderbird, and znc), Fedora (containernetworking-plugins, mediawiki, and podman), openSUSE (chromium), Red Hat (bind, chromium-browser, and flash-plugin), SUSE (docker, glibc, gstreamer-0_10-plugins-base, gstreamer-plugins-base, postgresql10, sqlite3, and thunderbird), and Ubuntu (firefox).

The 5.2-rc5 kernel prepatch is out fortesting. "But the good news is that we're getting to the later partsof the rc series, and things do seem to be calming down. I was hoping rc5would end up smaller than rc4, and so it turned out."

There's yet another set of stable kernel updates out there:5.1.10,4.19.51, and4.14.126.Each contains another set of important fixes.

The 2019 Linux Storage, Filesystem, andMemory-Management Summit included adetailed discussion about a memory-management fix thataddressed one performance regression while causing another. That fix,which was promptly reverted, is still believed by most memory-managementdevelopers to implement the correct behavior, so apatch posted by Andrea Arcangeli in early May has relatively broadsupport. That patch remains unapplied as of this writing, but thediscussion surrounding it has continued at a slow pace over the lastmonth. Memory-management subsystem maintainer Andrew Morton is faced witha choice: which performance regression is more important?

Security updates have been issued by Arch Linux (gvim, lib32-openssl, openssl, and vim), Debian (dbus), Fedora (dovecot, evince, js-jquery-jstree, libxslt, php-phpmyadmin-sql-parser, and phpMyAdmin), openSUSE (neovim and rubygem-rack), Oracle (docker-engine and python), Scientific Linux (python), Slackware (mozilla), and SUSE (containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork, elfutils, libvirt, and python-requests).

If a user-space process needs to wait for some event to happen, there is awhole range of mechanisms provided by the kernel to make that easy. Butcalling into the kernel tends not to work well for the shortest of waits— those measured in small numbers of microseconds. For delays of thismagnitude, developers often resort to busy loops, which have a muchsmaller potential for turning a small delay into a larger one.Needless to say, busy waiting has its own disadvantages, so Intel has come upwith a set of instructions to support short delays. A patchset from Fenghua Yu to support these instructions is currently workingits way through the review process.

Security updates have been issued by Fedora (firefox, kernel, kernel-headers, libreswan, python-urllib3, and vim), Red Hat (python), SUSE (sssd), and Ubuntu (dbus).

The LWN.net Weekly Edition for June 13, 2019 is available.

In an offshoot of the Debian discussion we looked at last week, the Debian project hasbeen discussing the idea of paying developers to work on the distribution.There is some history behind the idea, going back to the controversial Dunc-Tank initiative in 2006,but some think attitudes toward funding developers may have changed—or thata new approach might be better accepted. While it is playing out with regard toDebian right now, it is a topic that other projects have struggled withalong the way—and surely will again.

Security updates have been issued by Debian (libgd2, mediawiki, otrs2, vlc, and zookeeper), Fedora (containernetworking-plugins, kernel, kernel-headers, nodejs-tough-cookie, podman, python-django, and python-urllib3), openSUSE (virtualbox), SUSE (gnome-shell, libcroco, and php7), and Ubuntu (dbus, Neovim, and vim).

Python is, famously, a "batteries included" language; it comes with a richstandard library right out of the box, which makes for a highly usefulstarting point for everyone. But that does have some downsides as well. Thestandard library modules are largely maintained by the CPython coredevelopers, which adds to their duties; the modules themselves aresubject to the CPython release schedule, which may be suboptimal. Forthose reasons and others, there have been thoughts about retiring someof the older modules; it is a topic that has come up several times over thelast year or so.

The Matrix team has announcedthe first stable release of the Matrix protocol and specification acrossall APIs. The Synapse 1.0 reference implementation, which implements thefull Matrix 1.0 API surface, has also been released. "Now, before you get too excited, it’s critical to understand that Matrix 1.0 is all about providing a stable, self-consistent, self-contained and secure version of the standard which anyone should be able to use to independently implement production-grade Matrix clients, servers, bots and bridges etc. It does not mean that all planned or possible features in Matrix are now specified and implemented, but that the most important core of the protocol is a well-defined stable platform for everyone to build on.On the Synapse side, our focus has been exclusively on ensuring thatSynapse correctly implements Matrix 1.0, to provide a stable and securebasis for participating in Matrix without risk of room corruption or othernastinesses." The announcement also covers the launch of theMatrix.org Foundation.

Interfaces for the reporting of events to user space from the kernel havebeen a recurring topic on the kernel mailing lists for almost as long asthe kernel has existed; LWN covered one 15years ago, for example. Numerous special-purpose event-reporting APIsexist, but there are none that are designed to be a single place toobtain any type of event. David Howells is the latest to attempt to changethat situation with anew notification interface that, naturally, uses a ring buffer totransfer events to user space without the need to make system calls. TheAPI itself (which hasn't changed greatly since it was posted in 2018) is not hugely controversial,but the associated security model has inspired a few heated discussions.

Stable kernels 5.1.9, 4.19.50, 4.14.125, 4.9.181, and 4.4.181 have been released. They all containimportant fixes and users should upgrade.

Security updates have been issued by CentOS (bind and thunderbird), Mageia (firefox, ghostscript, graphicsmagick, imagemagick, postgresql, and thunderbird), Oracle (kernel), Red Hat (Advanced Virtualization and rh-haproxy18-haproxy), SUSE (bind, gstreamer-0_10-plugins-base, thunderbird, and vim), and Ubuntu (elfutils, glib2.0, and libsndfile).

BPF is probably familiar to many LWN readers, though it's likely not yetquite as well known in the Kubernetes community — but that could soonchange. At KubeCon +CloudNativeCon Europe 2019 there were multiple sessions with BPF in the title where developers talked about how BPF can be used tohelp with Kubernetes security, monitoring, and even chaos engineeringtesting.We will look at two of those talks that were led by engineers closelyaligned with the open-source Cilium project, which is allabout bringing BPF to Kubernetes container environments.Thomas Graf, who contributes to BPF development in the Linux kernel,led a session on transparent chaos testing with Envoy, Cilium, and BPF,while his counterpart Dan Wendlandt, who is well known in the OpenStackcommunity for helping to start the Neutron networking project, spoke aboutusing the kernel's BPF capabilities to add visibility andsecurity in a Kubernetes-aware manner.

Security updates have been issued by Arch Linux (chromium and pam-u2f), Debian (cyrus-imapd), Fedora (curl, cyrus-imapd, kernel, kernel-headers, php, and vim), openSUSE (axis, bind, bubblewrap, evolution, firefox, gnome-shell, libpng16, and rmt-server), Oracle (edk2 and kernel), and SUSE (bind, cloud7, and libvirt).

The 5.2-rc4 kernel prepatch is out fortesting. "We've had a fairly calm release so far, and on the whole that seems tohold. rc4 isn't smaller than rc3 was (it's a bit bigger), but rc3 wasfairly small, so the size increase isn't all that worrisome. I do hopethat we'll start actually shrinking now, though."

The5.1.8,4.19.49,and 4.14.124stable kernel updates have been released; each contains another set ofimportant fixes.

The Intel architecture allows misaligned memory access in situationswhere other architectures (such as ARM or RISC-V) do not. One suchsituation is atomic operations on memory that is split across two cachelines. This feature is largely unknown, but its impact is even less so. Itturns out that the performance and security impact can be significant,breaking realtime applications or allowing a rogue application to slow thesystem as a whole. Recently, Fenghua Yu has been working on detecting andfixing these issues in the split-lockpatch set, which is currently on its eighth revision.