LWN.net

Stable kernels 4.16.14, 4.14.48, and 4.9.106 have been released. The 4.16 and 4.14kernels contain the usual set of important fixes. "Not everyone whouses 4.9 needs to upgrade here, it's a big sync of the objtool codebase tomake future maintenance of 4.9.y easier over time, that's all. But ofcourse, updating and verifying that nothing broke is always appreciated:)"

Security updates have been issued by Fedora (chromium, php-symfony3, and wireshark), Mageia (chromium-browser-stable, mariadb, and python3), openSUSE (kernel modules), SUSE (gcc43, oracleasm kmp, and xdg-utils), and Ubuntu (apport and liblouis).

At the 2017 Linux Storage, Filesystem, and Memory-Management Summit(LSFMM), Amir Goldstein presented his workon adding a superblock watch mechanism to provide a scalable way to notifyapplicationsof changes in a filesystem. At the 2018 edition of LSFMM, he was back todiscuss adding NTFS-like changejournals to the kernel in support of backup solutions of varioussorts. As a second topic for the session, he also wanted to discuss doingmore performance-regression testing for filesystems.

If you use Python, there's a good chance you have heard of IPython, which provides an enhanced read-eval-printloop (REPL) for Python. But there is more to IPython than just a moreconvenient REPL. Today's IPython comes with integrated libraries that turnit into an assistant for several advanced computing tasks. We will look attwo of those tasks, using multiple languages and distributed computing, inthis article.

Security updates have been issued by CentOS (procps, xmlrpc, and xmlrpc3), Debian (batik, prosody, redmine, wireshark, and zookeeper), Fedora (jasper, kernel, poppler, and xmlrpc), Mageia (git and wireshark), Red Hat (rh-java-common-xmlrpc), Slackware (git), SUSE (bzr, dpdk-thunderxdpdk, and ocaml), and Ubuntu (exempi).

Here's thepress release announcing Microsoft's agreement to acquire GitHub for amere $7.5 billion. "GitHub will retain its developer-firstethos and will operate independently to provide an open platform for alldevelopers in all industries. Developers will continue to be able to usethe programming languages, tools and operating systems of their choice fortheir projects — and will still be able to deploy their code to anyoperating system, any cloud and any device."

Linus has released the 4.17 kernel, whichwill indeed be called "4.17"."No, I didn't call it 5.0, even though all the git object countnumerology was in place for that. It will happen in the not _too_distant future, and I'm told all the release scripts on kernel.org areready for it, but I didn't feel there was any real reason for it."Headline features in this release includeimproved load estimation in the CPUscheduler,rawBPF tracepoints,lazytime support in the XFS filesystem,full in-kernel TLS protocol support,histogram triggers for tracing,mitigations for the latest Spectre variants,and, of course, the removal of support for eight unloved processorarchitectures.

There has been a lot of work in recent years to use BPF to push policydecisions into the kernel. But sometimes, it seems, what is really wantedis a way for a BPF program to punt a decision back to user space. That isthe objective behind this patch set givingthe securecomputing (seccomp) mechanism a way to pass complex decisions to a user-space helper program.

The Mozilla blog has anarticle describing the addition of DNS over HTTPS (DoH) as an optionalfeature in the Firefox browser. "DoH support has been added toFirefox 62 to improve the way Firefox interacts with DNS. DoH usesencrypted networking to obtain DNS information from a server that isconfigured within Firefox. This means that DNS requests sent to the DoHcloud server are encrypted while old style DNS requests are notprotected." The configured server is hosted by Cloudflare, whichhas posted thisprivacy agreement about the service.

Security updates have been issued by Debian (kernel, procps, and tiff), Fedora (ca-certificates, chromium, and git), Mageia (kernel, kernel-linus, kernel-tmb, and libvirt), openSUSE (chromium and xen), Oracle (procps, xmlrpc, and xmlrpc3), Red Hat (xmlrpc and xmlrpc3), Scientific Linux (procps, xmlrpc, and xmlrpc3), SUSE (HA kernel modules and kernel), and Ubuntu (libytnef and python-oslo.middleware).

The 4.17 kernel appears to be on track for a June 3 release, barring anunlikely last-minute surprise. So the time has come for the usual look atsome development statistics for this cycle. While 4.17 is a normal cyclefor the most part, it does have one characteristic of note: it is the thirdkernel release ever to be smaller (in terms of lines of code) than itspredecessor.

Security updates have been issued by CentOS (389-ds-base, corosync, firefox, java-1.7.0-openjdk, java-1.8.0-openjdk, kernel, librelp, libvirt, libvncserver, libvorbis, PackageKit, patch, pcs, and qemu-kvm), Fedora (asterisk, ca-certificates, gifsicle, ncurses, nodejs-base64-url, nodejs-mixin-deep, and wireshark), Mageia (thunderbird), Red Hat (procps), SUSE (curl, kvm, and libvirt), and Ubuntu (apport, haproxy, and tomcat7, tomcat8).

The LWN.net Weekly Edition for May 31, 2018 is available.

The4.14.47,4.9.105,4.4.135 and 3.18.112 stable updates have been released;each contains a single commit reverting a networking patch "thatshould not have gotten backported".

In February, the bpfilter mechanism wasfirst posted to the mailing lists. Bpfilter is meant to be a replacementfor the current in-kernel firewall/packet-filtering code. It provideslittle functionality itself; instead, it creates a set of hooks that canrun BPF programs to make the packet-filtering decisions. A version of that patch set has been mergedinto the net-next tree for 4.18. It will not be replacing any existingpacket filters in its current form, but it does feature a significantchange to one of its more controversial features: the new user-mode helpermechanism.

The advent of user namespaces and container technology has made it possibleto extend more root-like powers to unprivileged users in a (we hope) safeway. One remaining sticking point is the mounting of filesystems, whichhas long been fraught with security problems. Work has been proceeding toallow such mounts for years, and it has gotten a little closer with theposting of a patch series intended for the 4.18 kernel. But, as anunrelated discussion has made clear, truly safe unprivileged filesystemmounting is still a rather distant prospect — at least, if one wants to doit in the kernel.

Security updates have been issued by Arch Linux (strongswan, wireshark-cli, wireshark-common, wireshark-gtk, and wireshark-qt), CentOS (libvirt, procps-ng, and thunderbird), Debian (apache2, git, and qemu), Gentoo (beep, git, and procps), Mageia (mariadb, microcode, python, virtualbox, and webkit2), openSUSE (ceph, pdns, and perl-DBD-mysql), Red Hat (kernel), SUSE (HA kernel modules, libmikmod, ntp, and tiff), and Ubuntu (nvidia-graphics-drivers-384).

There is a set of larger-than-usual stable kernel updates available:4.16.13 (272 patches),4.14.45 (496 patches),4.9.104 (329 patches),4.4.134 (268 patches), and3.18.111 (185 patches). Needless to say,each one contains a fair number of important fixes. 4.14 users who wantperf to work will want to go directly to 4.14.46, which fixes a regression in 4.14.45.

Git versions v2.17.1, v2.13.7, v2.14.4, v2.15.2 and v2.16.4 have all beenreleased with fixes to a couple of security issues. The nastier of the two(CVE-2018-11235) enables arbitrary code execution controlled by a hostilerepository. See thisMicrosoft blog entry for more details — after updating.

Stratis is a new localstorage-management solution for Linux. It can be compared to ZFS, Btrfs, or LVM. Its focus is on simplicity of concepts and ease of use,while giving users access to advanced storage features. Internally,Stratis's implementation favors tight integration of existing components instead of the fully-integrated, in-kernel approach that ZFS andBtrfs use. This has benefits and drawbacks for Stratis, but also greatlydecreases the overall time needed to develop a useful and stable initialversion, which can then be a base for further improvement in laterversions. Subscribers can read on for an introduction to Stratis, by guestauthor (and Stratis team lead at Red Hat) Andy Grover.

Security updates have been issued by Debian (wireshark), Fedora (kernel), openSUSE (enigmail), Red Hat (kernel), SUSE (cairo, java-1_7_0-ibm, libvirt, perl-DBD-mysql, and xen), and Ubuntu (batik and isc-dhcp).

Version 26.1 of the Emacs editor is out. Highlights include a built-inLisp threading mechanism that provides some concurrency, double bufferingwhen running under X, a redesigned flymake mode, 24-bit color support intext mode, and a systemd unit file.

Suppose you have a program running on your system that you don't quitetrust. Maybe it's a program submitted by a student to an automatedgrading system. Or maybe it's a QEMU device model running in a Xencontrol domain ("domain 0" or "dom0"), and you want to make surethat even if an attacker from a rogue virtual machine manages to take over the QEMUprocess, they can't do any further harm. There are many things you want to do as faras restricting its ability to do mischief. But one thing in particular you probably want to dois to be able to reliably kill the process once you think it should bedone. This turns out to be quite a bit more tricky than you'd think.

Security updates have been issued by Debian (batik, cups, gitlab, ming, and xdg-utils), Fedora (dpdk, firefox, glibc, nodejs-deep-extend, strongswan, thunderbird, thunderbird-enigmail, wavpack, xdg-utils, and xen), Gentoo (ntp, rkhunter, and zsh), openSUSE (Chromium, GraphicsMagick, jasper, opencv, pdns, and wireshark), SUSE (jasper, java-1_7_1-ibm, krb5, libmodplug, and openstack-nova), and Ubuntu (thunderbird).

This CERTadvisory warns of over 500,000 home routers that have been compromisedby the VPNFilter malware and is advising everybody to reboot their routersto (partially) remove it. This TalosIntelligence page has a lot more information about VPNFilter, though alot apparently remains unknown. "At the time of this publication, wedo not have definitive proof on how the threat actor is exploiting theaffected devices. However, all of the affected makes/models that we haveuncovered had well-known, public vulnerabilities. Since advanced threatactors tend to only use the minimum resources necessary to accomplish theirgoals, we assess with high confidence that VPNFilter required no zero-dayexploitation techniques."

The 4.17-rc7 kernel prepatch is out; it'slikely the last one for this development cycle. "So this week wasn'tas calm as the previous weeks have been, but despite that I suspect this isthe last rc."

The 4.16.12,4.14.44,4.9.103,4.4.133, and3.18.110stable kernel updates have all been released; each contains a relativelylarge set of important fixes.

OpenSUSE Leap 15 has been released."With a brand new look developed by the community, openSUSE Leap 15brings plenty of community packages built on top of a core from SUSE LinuxEnterprise (SLE) 15 sources, with the two major releases being built inparallel from the beginning for the first time. Leap 15 shares a commoncore with SLE 15, which is due for release in the coming months. The firstrelease of Leap was version 42.1, and it was based on the first ServicePack (SP1) of SLE 12. Three years later SUSE’s enterprise version andopenSUSE’s community version are now aligned at 15 with a freshrebase." Leap 15 will receive maintenance and security updates forat least 3 years.

Security updates have been issued by Arch Linux (bind, libofx, and thunderbird), Debian (thunderbird, xdg-utils, and xen), Fedora (procps-ng), Mageia (gnupg2, mbedtls, pdns, and pdns-recursor), openSUSE (bash, GraphicsMagick, icu, and kernel), Oracle (thunderbird), Red Hat (java-1.7.1-ibm, java-1.8.0-ibm, and thunderbird), Scientific Linux (thunderbird), and Ubuntu (curl).

The second Operating-System-Directed Power-Management (OSPM18) Summit tookplace at the ReTiS Lab of the Scuola Superiore Sant'Anna in Pisa betweenApril 16 and April 18, 2018. Like lastyear, the summit was organized as a collection of collaborativesessions focused on trying to improve how operating-system-directed powermanagement and the kernel's task scheduler work together to achieve thegoal of reducing energy consumption while still meeting performance andlatency requirements. Read on for an extensive set of notes collected by anumber of the participants to the summit.

The Linux Journal mournsthe passing of Robin Miller, a longtime presence in our community."Miller was perhaps best known by the community for his role asEditor in Chief of Open Source Technology Group, the company that ownedSlashdot, SourceForge.net, freshmeat, Linux.com, NewsForge, and ThinkGeekfrom 2000 to 2008."

Linux Journal reportsthat Robin "Roblimo" Miller has passed away. "Miller was perhaps best known by the community for his roll as Editor in Chief of Open Source Technology Group, the company that owned Slashdot, SourceForge.net, freshmeat, Linux.com, NewsForge, and ThinkGeek from 2000 to 2008."

During KubeCon+ CloudNativeCon Europe 2018, Justin Cormack and Nassim Eddequiouaq presenteda proposal to simplify the setting of security parameters for containerizedapplications. Containers depend on a large set of intricate security primitives that canhave weird interactions. Because they are so hard to use, people often justturn the whole thing off. The goal of the proposal is to make thosecontrols easier to understand and use; it is partly inspired by mobile appson iOS and Android platforms, an idea that trickled back into Microsoft andApple desktops. The time seems ripe to improve the field ofcontainer security, which is in desperate need of simpler controls.

Security updates have been issued by Debian (imagemagick), Fedora (curl, glibc, kernel, and thunderbird-enigmail), openSUSE (enigmail, knot, and python), Oracle (procps-ng), Red Hat (librelp, procps-ng, redhat-virtualization-host, rhev-hypervisor7, and unboundid-ldapsdk), Scientific Linux (procps-ng), SUSE (bash, ceph, icu, kvm, and qemu), and Ubuntu (procps and spice, spice-protocol).

The LWN.net Weekly Edition for May 24, 2018 is available.

The bcachefs filesystem has been underdevelopment for a number of years now; according to lead developer KentOverstreet, it is time to start talking about getting the code upstream.He came to the 2018 Linux Storage, Filesystem, and Memory-Management Summit(LSFMM) to discuss that in a combined filesystem and storagesession. Bcachefs grew out of bcache, which is a block layercache that was merged into Linux 3.10 in mid-2013.

If pressed, I will admit to thinking that, if NIS was good enough for Charles Babbage, it'sgood enough for me. I am therefore not a huge fan of LDAP; I feel I can detect in it the heavy hand of the ITU,which seems to wish to apply X.500 toeverything. Nevertheless, for secure, distributed, multi-platform identitymanagement it's quite hard to beat. If you decide to run an LDAP serveron Unix, one of the major free implementations is slapd, the coreengine of the OpenLDAP project.Howard Chu is the chief architect of the project,and spoke at FLOSS 2018 about the upcoming 2.5 release. Any rumorsthat he might have passed the time while the room filled up by givinga short but nicely rendered fiddle recital are completely true.

The Python release cycle has an 18-month cadence; a new major release (e.g.Python 3.7) ismade roughly on that schedule. But Łukasz Langa, who is the releasemanager for Python 3.8 and 3.9, would like to see things movemore quickly—perhaps on a yearly cadence. In the first session after lunchat the 2018 Python Language Summit, Langa wanted to discuss that idea.

Security updates have been issued by CentOS (java-1.7.0-openjdk, java-1.8.0-openjdk, kernel, libvirt, and qemu-kvm), Debian (procps), Fedora (curl, mariadb, and procps-ng), Gentoo (samba, shadow, and virtualbox), openSUSE (opencv, openjpeg2, pdns, qemu, and wget), Oracle (java-1.8.0-openjdk and kernel), Red Hat (java-1.7.0-openjdk, java-1.8.0-openjdk, kernel, kernel-rt, libvirt, qemu-kvm, qemu-kvm-rhev, redhat-virtualization-host, and vdsm), Scientific Linux (java-1.7.0-openjdk, java-1.8.0-openjdk, kernel, libvirt, and qemu-kvm), Slackware (kernel, mozilla, and procps), SUSE (ghostscript-library, kernel, mariadb, python, qemu, and wget), and Ubuntu (linux-raspi2 and linux-raspi2, linux-snapdragon).

Case-insensitive file name lookups are a feature that is fairly frequentlyraised at the Linux Storage, Filesystem, and Memory-Management Summit (LSFMM). At the 2018summit, Gabriel Krisman Bertazi proposed a new way to supportthe feature, though it met with a rather skeptical reception—with onenotable exception. Ted Ts'o seemed favorably disposed to the idea, in partbecause it would potentially be a way to get rid of some longstanding Android ugliness:wrapfs.

Kata Containers 1.0 has been released. "This first release of Kata Containers completes the merger of Intel’s Clear Containers and Hyper’s runV technologies, and delivers an OCI compatible runtime with seamless integration for container ecosystem technologies like Docker and Kubernetes."

Stable kernels 4.16.11, 4.14.43, and 4.9.102 have been released. They all containimportant fixes and users should update.

In a filesystem-track session at the 2018 Linux Storage, Filesystem, andMemory-Management Summit (LSFMM), Ronnie Sahlberg talked about some changeshe has made to add support for compounding to the SMB/CIFSimplementation in Linux. Compounding is a way to combine multipleoperations into a single request that can help reduce network round-trips.

Security updates have been issued by Debian (gitlab and packagekit), Fedora (glibc, postgresql, and webkitgtk4), Oracle (java-1.7.0-openjdk, java-1.8.0-openjdk, kernel, libvirt, and qemu-kvm), Red Hat (java-1.7.0-openjdk, kernel-rt, qemu-kvm, and qemu-kvm-rhev), SUSE (openjpeg2, qemu, and squid3), and Ubuntu (kernel, linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem, linux, linux-aws, linux-kvm,, linux-hwe, linux-azure, linux-gcp, linux-oem, linux-lts-trusty, linux-lts-xenial, linux-aws, qemu, and xdg-utils).

In a 2018 Python Language Summit talk that was initially billed as"Mariatta's Topic of Mystery", Mariatta Wijaya described her reasoning for advocating moving Python awayfrom its current bug tracker toGitHub Issues. She wanted to surprise her co-attendees with the talktopic at least partly because it is somewhat controversial. But it wouldcomplete Python's journey to GitHub that started a ways back.

It is the season for web sites to be updating their privacy policies andobtaining consent from their users for whatever data they collect. LWN,being short of staff with the time or interest to work in this area, israther late to this game. The first step is an updatedprivacy policy, which we're now putting out for review. Little has changedfrom the current version; we still don'tcollect much data, share data with others, or attempt to monetize what we have in any way. We would like to ask interested readersto have a look and let us know about any potential problems they see.

Intel has, finally, disclosedtwo more Spectre variants, called 3a and 4. The first ("rogue systemregister read") allows system-configuration registers to be readspeculatively, while the second ("speculative store bypass") could enablespeculative reads to data after a store operation has been speculativelyignored. Some more information on variant 4 can be found in theProject Zero bug tracker. The fix is to install microcode updates,which are not yet available.

At the 2018 Linux Storage, Filesystem, andMemory-Management Summit (LSFMM), Steve French led a discussion of variousproblem areas for network filesystems. Unlike previous sessions (in 2016 and 2017), there was some good news to reportbecause the long-awaited statx()system call was released in Linux 4.11. But thereis still plenty of work to be done to better support network filesystems inLinux.

Parrot 4.0 has been released. Parrotis a security-oriented distribution aimed at penetration tests and digitalforensics analysis, with additional tools to preserve privacy. "OnParrot 4.0 we decided to provide netinstall images too as we would likepeople to use Parrot not only as a pentest distribution, but also as aframework to build their very own working environment with ease."Docker templates are also available.

Security updates have been issued by Arch Linux (lib32-curl, lib32-libcurl-compat, lib32-libcurl-gnutls, libcurl-compat, and libcurl-gnutls), CentOS (firefox), Debian (imagemagick), Fedora (exiv2, LibRaw, and love), Gentoo (chromium), Mageia (kernel, librelp, and miniupnpc), openSUSE (curl, enigmail, ghostscript, libvorbis, lilypond, and thunderbird), Red Hat (Red Hat OpenStack Platform director), and Ubuntu (firefox).