LWN.net

The 2017Realtime Summit was held October 21 at Czech Technical Universityin Prague to discuss all manner of topics related to realtime Linux.Nearly two years ago, a collaborativeproject was formed with the goal of mainlining the realtime patch set. At thesummit, projectlead Thomas Gleixner reported on the progress that has been made and theplans for the future.

Security updates have been issued by Fedora (cacti, glibc, kernel, libXfont, libXfont2, mingw-poppler, nodejs-forwarded, procmail, SDL2, thunderbird, and tnef), openSUSE (freeradius-server, kernel, and libraw), Oracle (kernel), Red Hat (ntp), Scientific Linux (ntp), Slackware (irssi), SUSE (kernel), and Ubuntu (python-werkzeug).

The LWN.net Weekly Edition for October 26, 2017 is available.

The Linux Foundation has announcedthe availability of its roughly annual report on kernel development."This is the eighth such report that is released on a roughly annualbasis to help illustrate the Linux kernel development process and the workthat defines the largest collaborative project in the history ofcomputing. This year’s paper covers work completed through Linux kernel4.13, with an emphasis on releases 4.8 to 4.13.". This report,written by LWN editor Jonathan Corbet and Greg Kroah-Hartman, will havelittle that's new to regular LWN readers, but there is a set of nicedeveloper profiles.

<p>Academics generate enormous amounts of software, some of which inspirescommercial innovations in networking and other areas. But little academicsoftware gets released to the public and even less enters common use. Issome vast "dark matter" being overlooked in the academic community? Wouldthe world benefit from academics turning more of their software into freeand open projects?

The SciPy project has announced the release of SciPy 1.0. The "Python-based ecosystem of open-source software for mathematics, science, and engineering" has been around for 16 years since version 0.1 and, in reality, the 1.0 designation is overdue. "Some key project goals, both technical (e.g. Windows wheels and continuousintegration) and organisational (a governance structure, code of conductand aroadmap), have been achieved recently.Many of us are a bit perfectionist, and therefore are reluctant to callsomething '1.0' because it may imply that it's 'finished' or 'we are 100%happywith it'. This is normal for many open source projects, however thatdoesn'tmake it right. We acknowledge to ourselves that it's not perfect, and thereare some dusty corners left (that will probably always be the case).Despitethat, SciPy is extremely useful to its users, on average has high qualitycodeand documentation, and gives the stability and backwards compatibilityguarantees that a 1.0 label imply." Beyond the Windows wheels (a binary distribution format) mentioned above, there are some other new features in the release: continuous-integration coverage for macOS and Windows, a set of new ordinary differential equation solvers and a unified interface to them, two new trust region optimizers and a new linear programming method,many new BLAS and LAPACK functions were wrapped, and more.

Security updates have been issued by Debian (curl and mupdf), Fedora (glibc, SDL2, and sssd), Mageia (kernel, kernel-linus, and kernel-tmb), and Ubuntu (apache2 and subversion).

One of the key values provided by an operating system like Linux isthat it provides abstract interfaces to concrete devices. Though theoriginal "character device" and "block device" abstractions have beensupplemented with various others including "network device" and"bitmap display", the original two have not lost their importance. Theblock device interface, in particular, is still central to managingpersistent storage and, even with the growth of persistent memory, thiscentral role is likely to remain for some time. Unpacking andexplaining some of that role is the goal of this pair of articles.

Security updates have been issued by CentOS (kernel), Fedora (check-mk and dnsmasq), Mageia (kernel-linus, kernel-tmb, mysql-connector-java, and recode), openSUSE (irssi and jq), Red Hat (httpd24, java-1.6.0-sun, and java-1.7.0-oracle), Slackware (curl), SUSE (openvpn), and Ubuntu (bzr, curl, icu, libffi, libidn, mysql-5.5, mysql-5.7, nvidia-graphics-drivers-384, pacemaker, and webkit2gtk).

There is a lot of information buried in the kernel's Git repositories that,if one looks closely enough, can yield insights into how the developmentcommunity works in the real world. It can show how theidealized hierarchical model of the kernel development community matcheswhat actually happens and provide a picture of how the community's web oftrust is used to verify contributions. Read on for an analysis of themerge operations that went into the 4.14 development cycle.

<p>Refactoring the kernel means taking some part of the kernel thatis showing its age and rewriting it so it works better.Thomas Gleixner has done a lot of this over the past decade; he spokeat Kernel Recipes about the details of some of that work and the lessonsthat he learned. By way of foreshadowing how much fun this canbe, he subtitled the talk "Digging in Dust".

The 4.14-rc6 kernel prepatch is out. "rc6 is a bit larger than I was hoping for, and I'm not sure whetherthat is a sign that we _will_ need an rc8 after all this release(which wouldn't be horribly surprising), or whether it's simply due totiming. I'm going to leave that open for now, so just know that rc8_may_ happen."

The Linux Foundation has announced a pair of licenses for data that are modeled on the two broad categories of free-software licenses: permissive and copyleft. The Community Data License Agreement (CDLA) comes in two flavors: Sharing that "encourages contributions of data back to the data community" and Permissive that allows the data to be used without any further requirements."Inspired by the collaborative software development models of open source software, the CDLA licenses are designed to enable individuals and organizations of all types to share data as easily as they currently share open source software code. Soundly drafted licensing models can help people form communities to assemble, curate and maintain vast amounts of data, measured in petabytes and exabytes, to bring new value to communities of all types, to build new business opportunities and to power new applications that promise to enhance safety and services.The growth of big data analytics, machine learning and artificial intelligence (AI) technologies has allowed people to extract unprecedented levels of insight from data. Now the challenge is to assemble the critical mass of data for those tools to analyze. The CDLA licenses are designed to help governments, academic institutions, businesses and other organizations open up and share data, with the goal of creating communities that curate and share data openly."

Greg Kroah-Hartman has announced the release of four new stable kernels: 4.13.9, 4.9.58, 4.4.94, and 3.18.77. There are fixes throughout the treein them, so users of those series should upgrade.

Security updates have been issued by Arch Linux (irssi, musl, and xorg-server), CentOS (httpd and java-1.8.0-openjdk), Debian (libav, ming, and openjfx), Fedora (ImageMagick, libwpd, rubygem-rmagick, and sssd), Gentoo (adobe-flash, chromium, dnsmasq, go, kodi, libpcre, and openjpeg), openSUSE (bluez, exiv2, python3-PyJWT, salt, xen, xerces-j2, and xorg-x11-server), Oracle (java-1.8.0-openjdk and kernel), Red Hat (java-1.8.0-oracle and rh-nodejs4-nodejs), and Scientific Linux (java-1.8.0-openjdk).

Christian Schaller has posted alist of the Fedora Workstation project's accomplishments since itsinception. "Wayland – We been the biggest contributor since wejoined the effort and have taken the lead on putting in place all thepieces needed for actually using it on a desktop, including starting toship it as our primary offering in Fedora Workstation 25. This includesputting a lot of effort into ensuring that XWayland works smoothly toensure full legacy application support."The list as a whole is quite long.

The 4.14 kernel, due in the first half of November, is moving into therelatively slow part of the development cycle as of this writing. The timeis thus ripe for a look at the changes that went into this kernel cycle andhow they got there. While 4.14 is a fairly typical kernel developmentcycle, there are a couple of aspects that stand out this time around.

The upcoming Firefox 57 release presents a challenge to distributors, whohave to decide when and how to ship a major update that will break a bunchof older extensions. ThisFedora Magazine article describes the plan that Fedora has come up withfor this transition. "Users probably shouldn’t 'hold back at FF56 asmy favorite extensions don’t work.' Recall that security fixes only comefrom new versions, and they’ll all be WebExtension only. The ExtendedSupport Release version will also switch to WebExtensions only at the nextrelease. This date, June 2018, marks the deadline for ESR users to migratetheir extensions."

Security updates have been issued by Arch Linux (chromium), Debian (jackson-databind, libvirt, and mysql-5.5), Fedora (SDL2_image), Mageia (db53, kernel, poppler, and wpa_supplicant, hostapd), Oracle (httpd), Red Hat (ansible, chromium-browser, httpd, java-1.8.0-openjdk, kernel, and kernel-rt), and Scientific Linux (httpd and kernel).

Version 17.01.4 of the LEDE router distribution is available with a numberof important fixes."While this release includes fixes for the bugs in the WPA Protocoldisclosed earlier this week, these fixes do not fix the problem on theclient-side. You still need to update all your client devices. As someclient devices might never receive an update, an optional AP-sideworkaround was introduced in hostapd to complicate these attacks,slowing them down."

The OpenOffice4.1.4 release is finally available; see this article for some background on thisrelease. The announcement is all bright and sunny, but a look at theAugust 16 Apache board minutes shows concern about the state ofthe project. Indeed, the OpenOffice project management committee was,according to these minutes, supposed to post an announcement about thestate of the project; it would appear that has not yet happened.

Here's aSamsung press release describing the company's move into the "run Linuxon your phone" space. "Installed as an app, Linux on Galaxy givessmartphones the capability to run multiple operating systems, enablingdevelopers to work with their preferred Linux-based distributions on theirmobile devices. Whenever they need to use a function that is not availableon the smartphone OS, users can simply switch to the app and run anyprogram they need to in a Linux OS environment."

The Ubuntu 17.10 release is out. "Under the hood, there have been updates to many core packages, includinga new 4.13-based kernel, glibc 2.26, gcc 7.2, and much more.Ubuntu Desktop has had a major overhaul, with the switch from Unity asour default desktop to GNOME3 and gnome-shell. Along with that, thereare the usual incremental improvements, with newer versions of GTK andQt, and updates to major packages like Firefox and LibreOffice."See therelease notes for more information.

Security updates have been issued by CentOS (wpa_supplicant), Debian (db, db4.7, db4.8, graphicsmagick, imagemagick, nss, and yadifa), Fedora (ImageMagick, rubygem-rmagick, and upx), Mageia (flash-player-plugin, libxfont, openvpn, ruby, webmin, and wireshark), openSUSE (cacti, git, and upx), Oracle (wpa_supplicant), Red Hat (kernel-rt, rh-nodejs4-nodejs-tough-cookie, rh-nodejs6-nodejs-tough-cookie, and wpa_supplicant), Scientific Linux (wpa_supplicant), and Slackware (libXres, wpa_supplicant, and xorg).

The LWN.net Weekly Edition for October 19, 2017 is available.

<p>Monday October 16 was not a particularly good day for those who areeven remotely security conscious—or, in truth, even for those who aren't. Twoseparate security holes came to light; one probably affects almost allusers of modern technology. The other is more esoteric at some level, butstill serious. In both cases, the code in question is baked into variousdevices, which makes it more difficult to fix; in many cases, the devicesin question may not even have a plausible path toward a fix. Encryptionhas been a boon for internet security, but both of these vulnerabilitieshave highlighted that there is more to security than simply cryptography.

Konstantin Ryabitsev argueson Linux.com that WiFi security is only a part of the problem."Wi-Fi is merely the first link in a long chain of communicationhappening over channels that we should not trust. If I were to guess, theWi-Fi router you’re using has probably not received a security update sincethe day it got put together. Worse, it probably came with default or easilyguessable administrative credentials that were never changed. Unless youset up and configured that router yourself and you can remember the lasttime you updated its firmware, you should assume that it is now controlledby someone else and cannot be trusted."

At the X.Org Developers Conference, hosted by Google in Mountain View, CASeptember 20-22, Manasi Navare gave a talk about her journey learningabout kernel graphics on the way to achieving DisplayPort (DP)compliance for Intel graphics devices.Making that work involved learning about DP, the kernel graphics subsystem,and how to dokernel development, as well. There were plenty of details to absorb,including the relatively new atomic modesetting support, the design of which was described in a two-part LWNarticle.

Alberto Ruiz announcesthat Fleet Commander is ready for production use."Fleet Commander is an integrated solution for large Linux desktopdeployments that provides a configuration management interface that iscontrolled centrally and that covers desktop, applications and networkconfiguration. For people familiar with Group Policy Objects in ActiveDirectory in Windows, it is very similar."

Greg Kroah-Hartman has released stable kernels 4.13.8, 4.9.57, 4.4.93, and 3.18.76. All of them contain important fixesand users should upgrade.

Security updates have been issued by Arch Linux (kernel, linux-hardened, and linux-zen), CentOS (wpa_supplicant), Debian (xorg-server), Fedora (selinux-policy), Gentoo (libarchive, nagios-core, ruby, and xen), openSUSE (wpa_supplicant), Oracle (wpa_supplicant), Red Hat (Red Hat Single Sign-On, rh-nodejs6-nodejs, rh-sso7-keycloak, and wpa_supplicant), Scientific Linux (wpa_supplicant), SUSE (git, wpa_supplicant, and xen), and Ubuntu (xorg-server, xorg-server-hwe-16.04, xorg-server-lts-xenial).

Let's Encrypt has announcedthat Automatic Certificate Management Environment (ACME) protocol supportis being integrated into the Apache HTTP Server (httpd). "ACME support being built in to one of the world’s most popular Web servers, Apache httpd, is great because it means that deploying HTTPS will be even easier for millions of websites. It’s a huge step towards delivering the ideal certificate issuance and management experience to as many people as possible."

An earlier LWN article showed thatprivate key storage is an importantproblem to solve in any cryptographic system and established keycardsas a good way to store private key material offline. But which keycardshould we use? This article examines the form factor, openness, andperformance of four keycards to try to help readers choose the one thatwill fit their needs.

Security updates have been issued by Arch Linux (flashplugin, hostapd, lib32-flashplugin, and wpa_supplicant), Debian (sdl-image1.2), Fedora (curl, openvswitch, weechat, and wpa_supplicant), openSUSE (GraphicsMagick, kernel, mbedtls, and wireshark), Red Hat (flash-plugin), and Ubuntu (wpa).

Matthew Green exploresthe origins of the KRACK vulnerability."I don’t want to spend much time talking about KRACK itself, becausethe vulnerability is pretty straightforward. Instead, I want to talk aboutwhy this vulnerability continues to exist so many years after WPA wasstandardized. And separately, to answer a question: how did this attackslip through, despite the fact that the 802.11i handshake was formallyproven secure?"

The GNU C Library (glibc) project produces regular releases on anapproximately six-month cadence. The current release is 2.26from early August; the 2.27 release is expected at the beginning ofFebruary 2018. Unlike many other projects, though, glibc does not normallycreate point releases for important fixes between the major releases.The last point release from glibc was 2.14.1, which came out in 2011.A discussion on the need for a 2.26 point release led to questions aboutwhether such releases have a useful place in the currentsoftware-development environment.

DragonFly BSD 5.0 has been released. "Preliminary HAMMER2 support has been released into the wild as-of the 5.0 release. This support is considered EXPERIMENTAL and should generally not yet be used for production machines and important data. The boot loader will support both UFS and HAMMER2 /boot. The installer will still use a UFS /boot even for a HAMMER2 installation because the /boot partition is typically very small and HAMMER2, like HAMMER1, does not instantly free space when files are deleted or replaced.DragonFly 5.0 has single-image HAMMER2 support, with live dedup (for cp's), compression, fast recovery, snapshot, and boot support. HAMMER2 does not yet support multi-volume or clustering, though commands for it exist. Please use non-clustered single images for now."

Ars Technica is reporting on a flaw in the RSA library developed by Infineon that drastically reduces the amount of work needed to discover a private key from its corresponding public key. This flaw, dubbed "ROCA", mainly affects key pairs that have been generated on keycards. "While all keys generated with the library are much weaker than they should be, it's not currently practical to factorize all of them. For example, 3072-bit and 4096-bit keys aren't practically factorable. But oddly enough, the theoretically stronger, longer 4096-bit key is much weaker than the 3072-bit key and may fall within the reach of a practical (although costly) factorization if the researchers' method improves.To spare time and cost, attackers can first test a public key to see if it's vulnerable to the attack. The test is inexpensive, requires less than 1 millisecond, and its creators believe it produces practically zero false positives and zero false negatives. The fingerprinting allows attackers to expend effort only on keys that are practically factorizable. The researchers have already used the method successfully to identify weak keys, and they have provided a tool here to test if a given key was generated using the faulty library. A blog post with more details is here."

Security updates have been issued by Debian (wpa), Fedora (perl, recode, and tor), Gentoo (elfutils, gnutls, graphite2, libtasn1, puppet-agent, shadow, and webkit-gtk), Mageia (pjproject, thunderbird, and weechat), and SUSE (kernel).

The Linux Foundation's Technical Advisory board, in response to concernsabout exploitative license enforcement around the kernel, has put togetherthis patch adding a document to the kerneldescribing its view of license enforcement. This document has been signedor acknowledged by a long list of kernel developers.In particular, it seeks toreduce the effect of the "GPLv2 death penalty" by stating that a violator'slicense to the software will be reinstated upon a timely return tocompliance. "We view legal action as a last resort, to be initiatedonly when other community efforts have failed to resolve the problem.Finally, once a non-compliance issue is resolved, we hope the user will feelwelcome to join us in our efforts on this project. Working together, we willbe stronger."See thisblog post from Greg Kroah-Hartman for more information.

The "krackattacks" web sitediscloses a set of WiFi protocol flaws that defeat most of the protectionthat WPA2 encryption is supposed to provide. "In a keyreinstallation attack, the adversary tricks a victim into reinstalling analready-in-use key. This is achieved by manipulating and replayingcryptographic handshake messages. When the victim reinstalls the key,associated parameters such as the incremental transmit packet number(i.e. nonce) and receive packet number (i.e. replay counter) are reset totheir initial value. Essentially, to guarantee security, a key should onlybe installed and used once. Unfortunately, we found this is not guaranteedby the WPA2 protocol".

The 4.14-rc5 kernel prepatch is out."We've certainly had smaller rc5's, but we've had bigger ones too, andthis week finally felt fairly normal in a release that has up untilnow felt a bit messier than it perhaps should have been.So assuming this trend holds, we're all good. Knock wood."

James Bottomley describesthe use of the trusted platform module with elliptic-curvecryptography, with a substantial digression into how the elliptic-curvealgorithm itself works."The initial attraction is the same as for RSA keys: making itimpossible to extract your private key from the system. However, themathematical calculations for EC keys are much simpler than for RSA keysand don’t involve finding strong primes, so it’s much simpler for the TPM(being a fairly weak calculation machine) to derive private and public ECkeys."

The 4.13.7 stable kernel update has beenreleased; it contains a fix for an unpleasantlocal vulnerability that affects only 4.13 kernels.

When a veteran kernel developer introduces a severe security hole into thekernel, it can be instructive to look at how the vulnerability came about.Among other things, it can point the finger at an API that lends itselftoward the creation of such problems. And, as it turns out, the knowledgethat the API is dangerous at the outset and marking it as such may not beenough to prevent problems.

Security updates have been issued by Arch Linux (botan, flyspray, go, go-pie, pcre2, thunderbird, and wireshark-cli), Fedora (chromium and mingw-poppler), Red Hat (Red Hat JBoss BPM Suite 6.4.6 and Red Hat JBoss BRMS 6.4.6), SUSE (git and kernel), and Ubuntu (libffi and xorg-server, xorg-server-hwe-16.04, xorg-server-lts-xenial).

Mozilla's manifesto commitsthe organization to a number of principles, including support forindividual privacy and an individual's right to control how they experiencethe Internet. As a result, when Mozilla recently stated its intent toremove the "text only" option from its mailing lists — for the purpose oftracking whether recipients are reading its emails — the reaction was, toput it lightly, not entirely positive. The text-only option has beensaved, but the motivation behind this change is indicative of thechallenges facing independent senders of email.

Greg Kroah-Hartman has announced the release of the 4.13.6, 4.9.55, 4.4.92, and 3.18.75 stable kernels. As usual, theycontain fixes throughout the tree, so users should upgrade.Update: Kroah-Hartman released 4.9.56: "It fixes a networkingbug in 4.9.55. Don't use 4.9.55, it's busted, sorry about that, Ishould have held off and gotten more testing on it, my fault :("

Security updates have been issued by CentOS (httpd and thunderbird), Debian (nss), Fedora (git), openSUSE (krb5, libvirt, samba, and thunderbird), Oracle (httpd and thunderbird), Red Hat (httpd, rh-mysql57-mysql, and thunderbird), Scientific Linux (httpd and thunderbird), and Ubuntu (ceph).

The LWN.net Weekly Edition for October 12, 2017 is available.