ThePSP security protocol (PSP) is a way to transparently encrypt packets byefficiently offloading encryption and decryption to the networkinterface cards (NICs) that Google uses for connections inside its data centers. Theprotocol is similar toIPsec, in that it allows for wrapping arbitrary trafficin a layer of encryption. The difference is that PSP is encapsulated in UDP, anddesigned from the beginning to reduce the amount of state that NICshave to track in order to send and receive encrypted traffic, allowing for moresimultaneous connections. Jakub Kicinskiwants to add support for the protocol to the Linux kernel.
Alexander "Solar Designer" Peslyak has disclosed another OpenSSHvulnerability that can be exploited for remote code execution, but onlyon distributions that have applied a patch to add auditing support.Specifically, RHEL9 and derivatives are affected, as areFedora36 and37 (but not later releases).
The 6.6.38 stable kernel update has beenreleased, without the benefit of the usual review process. It reverts someBPF changes with patches that do not appear in the mainline (in this form,at least). "All powerpc and arm64 users of the 6.6 kernel series mustupgrade. Everyone else probably should as well to be safe."
On his blog, Behdad Esfahbod has published a lengthy and detailed look at the state of open-source text rendering. It looks at the libraries available, application support, future directions, and gives a summary analysis of the ecosystem.
At DevConf.cz 2024,Marta Lewandowska gave a talk to discuss anew approach for booting Linux systems, "No more bootloader: Please use the kernel instead". The talk, available onYouTube, introduced a new project called nmbl (for "no more bootloader",pronounced "nimble"). The idea is to get rid of bootloaders (e.g., GNU GRUB) with aUnifiedKernel Image (UKI) that removes the need for a separate bootloaderaltogether. It is early days for nmbl, currently the project is onlybeing tested for use with virtual machines, but the idea iscompelling. If successful, nmbl could offer security, performance, andmaintenance benefits compared to GRUB and other separate bootloaders.
Version 15.1 of the GNU debugger has been released. Changes include anumber of enhancements to GDB's Python support, some Debugger AdapterProtocol additions, some new GDBserver options, and more.
ISO releases new C++language standards on a three-year cadence; now that it's beenmore than a year since the finalization ofC++23, we have a good idea of whatfeatures could be adopted forC++26 - although proposals canstill be submitted until January 2025. Of particular interest is the addition ofsupport forhazard pointers anduser-space read-copy-update (RCU).Even though C++26 is not yet a standard, many of the proposed features are alreadyavailable to experiment with in GCC or Clang.
Greg Kroah-Hartman has announced the release of seven more stable kernels.Versions 6.9.8,6.6.37,6.1.97,5.15.162,5.10.221,5.4.279,and 4.19.317 are now available.
Security updates have been issued by Fedora (cockpit, python-astropy, python3-docs, and python3.12), Gentoo (BusyBox, GNU Coreutils, GraphicsMagick, podman, PuTTY, Sofia-SIP, TigerVNC, and WebKitGTK+), Mageia (chromium-browser-stable and openvpn), SUSE (cockpit, krb5, and netatalk), and Ubuntu (kopanocore, libreoffice, linux-aws, linux-oem-6.8, linux-aws-5.15, linux-azure, linux-azure-4.15, linux-lowlatency, linux-lowlatency-hwe-6.5, linux-oracle, linux-starfive-6.5, and virtuoso-opensource).
Random numbers, it seems, can never be random enough, and they cannot begenerated quickly enough. The kernel's getrandom()system call might, after years of discussion, be seen as sufficientlysecure by most users, but it is still a system call. Linux system callsare relatively fast, but they are necessarily slower than calling afunction directly. In an attempt to speed the provision of secure randomdata to user space, Jason Donenfeld has put together animplementation of getrandom() that lives in the virtual dynamicshared object (vDSO) area.
There are a handful of extensions to the "new" mount API that ChristianBrauner wanted to discuss as part of a filesystem session at the2024 Linux Storage,Filesystem, Memory Management, and BPF Summit. In the session, though,the only one that he got to was a followup to last year's discussion on mount-operation monitoring.There is a need for user-space programs to be able to follow mountoperations (e.g. mount and unmount) that happen in the system, especiallyfor tools like containermanagers or systemd.
Debian's proposed tag2uploadservice would be worthy of an articleeven if it wasn't so contentious; tag2upload promises astreamlined way for Debian developers using Git to upload packages tothe DebianArchive. But tag2upload has been in limbo foryears due to disagreement and a communication breakdown between the teambehind tag2upload and the ftpmasters team. It took thethreat of a GeneralResolution (GR), weeks of discussion, and more than1,000 emails to finally move forward.
The Universal Blueproject, which produces operating system images based on Fedora's Atomic Desktops,has issued an announcementthat manual steps are required to continue receiving updates. JorgeCastro wrote:
In 2016, Oliver Smith reached a point of frustration with the shortlifespan of updates for his Android phone. Taking matters into his ownhands, he began developing postmarketOS, a Linux distribution formobile phones. Eight years later, the core team andtrusted contributors have grown to twenty individuals, while the latestrelease, v24.06,now shows support for over 250devices. Although postmarketOS isn'tusable as a day-to-day phone operating system on all of them, it can also enable repurposing devices into compact servers or kiosk machines.
Version 4.10.0 of GNU findutils has been released. Notable changesinclude allowing find -name / as a validpattern, and accepting larger UIDs/GIDs for find -user andfind -group. It is also once again possible to buildfindutils on systems with musl-libc.
Like many kernel subsystems, the Linux security module (LSM) subsystemmakes extensive use of indirect function calls. Those calls, however, areincreasingly problematic, and the pressure to remove them has been growing. The good news is that there is a patchseries from KP Singh that accomplishes that goal. Its progress intothe mainline has been slow - this change was first proposedby Brendan Jackman and Paul Renauld in 2020 - and this work has been caughtup in some wider controversies along the way, but it should be close tobeing ready.
Security updates have been issued by AlmaLinux (httpd:2.4/httpd), Arch Linux (openssh), Fedora (cups, emacs, and python-urllib3), Gentoo (OpenSSH), Mageia (ffmpeg, gdb, openssl, python-idna, and python-imageio), Red Hat (golang and kernel), SUSE (booth, libreoffice, openssl-1_1-livepatches, podman, python-arcomplete, python-Fabric, python-PyGithub, python- antlr4-python3-runtime, python-avro, python-chardet, python-distro, python- docker, python-fakeredis, python-fixedint, pyth, python-Js2Py, python310, python39, and squid), and Ubuntu (cups and netplan.io).
While the end of support for CentOS 7, which happened on June30, issignificant, it is also worth taking a moment to reflect on the end ofScientific Linux7, which has also just occurred. Scientific Linuxwas once a popular RHEL rebuild supported by Fermilab, CERN, DESY, and ETHZurich. Development of Scientific Linux stopped with SL7, with the labsswitching to CentOS thereafter, but the SL7 release was supported throughto the bitter end. Thanks are due to all who built and supportedScientific Linux; you provided a useful and stable platform for many years.
On May 7, Kees Cook senta proposal to the linux-kernel mailing list, asking for the kerneldevelopers to startworking on a way to mitigate unintentional arithmetic overflow, which has been asource of many bugs. This is not the first time Cook has made a request alongthese lines; he sent a related patch set inJanuary 2024.Several core developers objected to the plan for differentreasons. After receiving their feedback,Cook modified his approach to tackle the problemin a series of smaller steps.
Linus has released 6.10-rc6 for testing."This release continues to be fairly calm, and rc6 looks pretty small.It's also entirely just random small fixes spread all over, with no biggerpattern."
FreeDOS is an open-sourceoperating system designed to be compatible with the now-defunct MS-DOS. Three decadeshave now passed since the FreeDOS project was first announced, and itis still alive and well with a small community of developers andusers committed to running legacy DOS software, classic DOS games, anddeveloping modern applications that extend its functionality well beyond theoriginal MS-DOS. It may well be around in another30 years.
The Free Software Foundation Europe hassubmitted a joint position to the European Commission (EC), claiming that Applehas failed to comply with the EU's Digital Markets Act (DMA). This is the lawthat requires Apple to support alternative application stores on the devices itmakes.
With theRust-for-Linux project starting to gain some ground, it is worthlooking at other operating systems that use Rust in their kernels. Thereare many attempts to useRust for operating system development, but Redoxmay be the most complete.Redox is an MIT-licensed microkernel and corresponding user space, designedaround concepts taken fromPlan 9. While nowhere near being usable as areplacement for Linux, it already provides a graphical user interface andthe ability to run many POSIX programs.
Security updates have been issued by AlmaLinux (pki-core), Debian (dlt-daemon and plasma-workspace), Fedora (emacs and kernel), Mageia (erofs-utils, libheif, libopenmpt, and wget), Red Hat (pki-core and python3), SUSE (frr), and Ubuntu (fontforge, sqlite3, and squid3).
The FreeBSD Foundation has publishedaset of reports from the May2024 FreeBSD Developer Summit held in Ottawa, Canada. The topicsinclude FreeBSD Core Team updates, FreeBSD 15 release planning,Integration with Rust, and OCIcontainers on FreeBSD:
The academic and the Linux real-time and scheduling community mourns thepremature death of Daniel Bristot deOliveira. Daniel died at the age of 37 on Monday, June 24, 2024.Juri Lelli, Tommaso Cucinotta, Steve Rostedt, Kate Stewart, and ThomasGleixner have come together to share their thoughts on his life and what hehas left behind
The Free Software Foundation (FSF) has announcedthe addition of three new members to its board: John Gilmore,Christina Haralanova, and Maria Chiara Pievatolo. This is part of FSFgovernance changes announcedin January 2023. The next step is a review of current boardmembers:
It has been nearly one year since thefirst version of the device memory TCP patches was posted by MinaAlmasry. Now on the 14threvision, this series appears to be stabilizing. Device memory TCP isa specialized networking feature requiring a certain amount of setup, butit could provide a significant performance improvement for somedata-intensive applications.
An upgrade from Python 3.11 to 3.12 has led to the rejection ofsome Python apps by Apple's app stores. That led to Eric Froemling submitting a bug reportagainst CPython. That, in turn, led to an interestingdiscussion among Python developers about how far the project waswilling to go to accommodate app store review processes. Developersreached a quick consensus, and a solution that may arrive as soon asPython3.13.
Security updates have been issued by Debian (ffmpeg, kernel, libvpx, and linux-5.10), Fedora (chromium, firefox, freeipa, moodle, and openvpn), Oracle (git), Red Hat (golang and java-1.8.0-ibm), and Ubuntu (linux-oracle-6.5, netplan.io, openssl, plasma-workspace, ruby2.7, ruby3.0, ruby3.1, sqlite3, and wget).
The openSUSE project has announcedLeap Micro version6.0. Leap Micro is an image-based, lightweight Linux distributionthat is designed to run containerized and virtualized applications. Itis based on SUSE LinuxEnterprise (SLE) Micro. Changes in this release include thesupport for full-disk encryption, the addition of Cockpit forweb-based system management, and an optional real-time kernel forx86_64. Boot support for legacy BIOS on x86_64 is deprecated with 6.0, and will be removed in a later release. See the SLEMicro release notes for more information.
Eric Sandeen led a filesystem-track session at the2024 Linux Storage,Filesystem, Memory Management, and BPF Summit on completing theconversion of the existing kernel filesystems to use the mount API that was added for the 5.2 kernel in 2019. That API isinvariably called the "new" API, which it is when compared to thevenerable mount()system call, but it has been available for five years or so at this pointwithout really pushing its predecessor aside. Sandeen wanted to discussthe status of the conversion process and some other questions surroundingthe new API.
Security updates have been issued by AlmaLinux (git, python3.11, and python3.9), Debian (chromium, emacs, git, linux-5.10, and org-mode), Fedora (libopenmpt, nginx-mod-modsecurity, and thunderbird), Mageia (emacs, python-ansible-core, and python-authlib), Oracle (git, python3.11, and python3.9), Red Hat (kernel, kernel-rt, and samba), and Ubuntu (ansible, cups, google-guest-agent, google-osconfig-agent, libheif, openvpn, roundcube, and salt).
Unison is aMIT-licensed programming language, in development since 2013, thatexplores the ramifications of making code immutable and stored in a database,instead of a set of text files.Unison supports a greatly simplified model for distributedprogramming - one that describes the configuration of and communication betweenprograms in the same language as the programs themselves. Along the way, itintroduces a new approach to interfacing with programming languages, which is tailored toits design.
Version4.8.0 of the darktablephoto editor has been released. Changes include performanceimprovements for large collections, addition of more EXIF fields inthe image information module, and two new modules for imagecomposition: Enlarge Canvas and Overlay. Enlarge Canvas allows addingareas to an image, while Overlay allows adding new content byoverlaying pixels from the current image or another image. LWN lastlooked at darktable in2022. Users are "strongly advised" to make a backup of theirconfiguration and library before upgrading, as they will not becompatible with darktable 4.6.
Dan Walsh, Stef Walter, and Colin Walters all walk into apresentation and Walter asks, "why wouldyou want to boot your containers?" This isn't the setup for some technology joke, this is part of the trio'skeynote atDevConf.cz in Brno, Czech Republic on June14 about bootable containers(bootc). The talk, which was streamed to YouTube for those of us whodidn't attend DevConf.cz in person, provided a solid overview of bootcand the problems it is intended to solve. The idea behind bootc is tomake creating operating-system images just as easy as creatingapplication-container images while using the same tools.
We have just received thesad news of the passing of Daniel Bristot de Oliveira at far too youngan age. He was a strong contributor to the core kernel and associatedrealtime infrastructure, and always a joyful presence in person; he will bedeeply missed.
LWN.net