LWN.net

The LWN.net Weekly Edition for September 14, 2017 is available.

<p>Security for Internet of Things (IoT) devices is something of a hot topicover the last year or more. Marti Bolivar presented an overview of some ofthe antipatterns that are leading to the lack of security forthese devices at a session at the 2017 Open Source Summit North America inLos Angeles. He also had some specific recommendations for IoT developerson how to think about these problems and where to turn for help in makingsecurity a part of the normal development process.

The Free Software Foundation Europe has joined severalorganizations in publishing an open letter urging lawmakersto advance legislation requiring publicly financed software developed forthe public sector be made available under a Free and Open Source Softwarelicense. "The initial signatories include CCC, EDRi, Free SoftwareFoundation Europe, KDE, Open Knowledge Foundation Germany, openSUSE, OpenSource Business Alliance, Open Source Initiative, The Document Foundation,Wikimedia Deutschland, as well as several others; they ask individuals andother organisation to sign the open letter. The open letter will be sent to candidates for the German Parliament election and, during the coming months, until the 2019 EU parliament elections, to other representatives of the EU and EU member states."

The GNOME Project has announced the release of GNOME 3.26 "Manchester"."This release brings refinements to the system search, animations formaximizing and unmaximizing windows and support for color Emoji.Improvements to core GNOME applications include a redesigned Settingsapplication, a new display settings panel, Firefox sync in the Web browser,and many more." There are openSUSE nightly live images that includeGNOME 3.26.

At his 2017 OpenSource Summit North America talk, Matthew Garrett looked at the stateof cryptographic signing and verification of programs for Linux. Allowingpolicies that would restrict Linux from executing programs that are notsigned would provide a measure of security for those systems, but there iswork to be done to get there.Garrettstarted by talking about "binaries", but programs come in other forms(e.g. scripts) so any solution must look beyond simply binary executables.

Security updates have been issued by Arch Linux (bluez and linux-hardened), CentOS (bluez and kernel), Debian (bluez, emacs24, tcpdump, and xen), Fedora (kernel and mimedefang), Oracle (bluez and kernel), Red Hat (bluez, flash-plugin, instack-undercloud, kernel, kernel-rt, and openvswitch), Scientific Linux (bluez and kernel), Slackware (emacs and libzip), SUSE (xen), and Ubuntu (bluez and qemu).

The Android system may be based on the Linux kernel, but its developershave famously gone their own way for many other parts of the system. Thatincludes the graphics subsystem, which avoids user-space components like Xor Wayland and has special (often binary-only) kernel drivers as well. Butthat picture may be about to change. As Robert Foss described in his OpenSource Summit North America presentation, running Android on the mainlinegraphics subsystem is becoming possible and brings a number of potentialbenefits.

Ars technica reportson a set of just-disclosed Bluetooth vulnerabilities in multipleoperating systems."BlueBorne, as the researchers have dubbed their attack, is notable for its unusual reach and effectiveness. Virtually any Android, Linux, or Windows device that hasn't been recently patched and has Bluetooth turned on can be compromised by an attacking device within 32 feet. It doesn't require device users to click on any links, connect to a rogue Bluetooth device, or take any other action, short of leaving Bluetooth on."

Security updates have been issued by Debian (icedove), Fedora (file and kernel), Red Hat (chromium-browser, rh-postgresql94-postgresql, and rh-postgresql95-postgresql), and SUSE (qemu).

The kernel's configuration system can be challenging to deal with; LinusTorvalds recently called it "one ofthe worst parts of the whole project". Thus, anything that mighthelp users with the process of configuring a kernel build would bewelcome. A talk by Junghwan Kang at the 2017 Open-Source Summitdemonstrated an interesting approach, even if it's not quite ready forprime time yet.

Mongoose OS is an open-sourceoperating system for tiny embedded systems. It is designed to run ondevices such as microcontrollers, which are often constrained with memory on theorder of tens of kilobytes, while exposing a programming interface thatprovides access to modern APIs normally found on more powerful devices. Adevice running Mongoose OS has access to operating system functionalitysuch as filesystems and networking, plus higher-level software such as aJavaScript engine and cloud access APIs.

The LXC team has announcedthe release of LXC 2.1. LXC provides a userspace interface for the Linuxkernel containment features. New features include resource limit support,support for unprivileged openvswitch networks, a newlxc.cgroup.dir key, support for hybrid cgroup layout, and more.

Security updates have been issued by Debian (freerdp, mbedtls, tiff, and tiff3), Fedora (chromium, krb5, libstaroffice, mbedtls, mingw-libidn2, mingw-openjpeg2, openjpeg2, and rubygems), Mageia (bzr, libarchive, libgcrypt, and tcpdump), openSUSE (gdk-pixbuf, libidn2, mpg123, postgresql94, postgresql96, and xen), Slackware (bash, mariadb, and tcpdump), and SUSE (evince and kernel).

The Apache Struts project has put out astatement on the possible role played by a Struts vulnerability in themassive Equifax data breach. "Regarding the assertion thatespecially CVE-2017-9805 is a nine year old security flaw, one has tounderstand that there is a huge difference between detecting a flaw afternine years and knowing about a flaw for several years. If the latter wasthe case, the team would have had a hard time to provide a good answer whythey did not fix this earlier. But this was actually not the case here --wewere notified just recently on how a certain piece of code can be misused,and we fixed this ASAP. What we saw here is common software engineeringbusiness --people write code for achieving a desired function, but may notbe aware of undesired side-effects. Once this awareness is reached, we aswell as hopefully all other library and framework maintainers put highefforts into removing the side-effects as soon as possible. It's probablyfair to say that we met this goal pretty well in case ofCVE-2017-9805."

The4.13.1,4.12.12, and4.9.49stable kernel updates have been released; each contains another set ofimportant fixes. There is no 4.4.x stable update this time around.

As of this writing, just over 8,000 non-merge changesets have been pulledinto the mainline kernel repository for the 4.14 development cycle. Inother words, it looks like the pace is not slowing down for this cycleeither. The merge window is not yet done, but quite a few significantchanges have been merged so far. Read on for a summary of the mostinteresting changes entering the mainline in the first half of this mergewindow.

Security updates have been issued by Debian (icedove, libarchive, and unrar-free), Fedora (thunderbird), openSUSE (kernel), and Ubuntu (file).

The LWN.net Weekly Edition for September 8, 2017 is available.

Version 5.0.0 of the LLVM compiler infrastructure is out."This release is the result of the community's work over the past sixmonths, including: C++17 support, co-routines, improved optimizations,new compiler warnings, many bug fixes, and more". See the releasenotes (and release notes for Clang,Clangtools,lld,and polly)for details.

Drivers are a consistent source of kernel bugs, at least partly due to lessreview, but also because drivers are typically harder for tools toanalyze. A team from the University of California, Santa Barbara has setout to change that with a static-analysis tool called DR. CHECKER. In a paper[PDF] presented at the recent 26th USENIXSecurity Symposium, the team introduced the tool and the results ofrunning it on nine production Linux kernels. Those results were ratherencouraging: "it correctly identified 158 critical zero-day bugs with an overall precision of 78%".

The application for the (northern-hemisphere) Outreach winter internshipcycle is open, with applications due by October 23. "Outreachy is paid, remote, three month internship program that helpspeople traditionally underrepresented in tech make their firstcontributions to Free and Open Source Software (FOSS) communities."

Greg Kroah-Hartman has released the 4.12.11, 4.9.48, 4.4.87, and 3.18.70 stable kernels. As usual, there arefixes throughout the tree and users of those series should upgrade.

As much as we get addicted to mobile phones and online services, nobody(outside of cyberpunk fiction) actually lives online. That's why maps,geolocation services, and geographic information systems (GISes) have come to play a bigger role online. They reflect they way we live,work, travel, socialize, and (in the case of natural or human-madedisasters, which come more and more frequently) suffer. Thus there isvalue in integrating geolocation into existing web sites, but systems likeWordPress do not make supporting that easy.The software development firm LuminFirehas contributed to the spread of geolocation services by creating a library forWordPress that helps web sites insert geolocation information into webpages. Thisarticle describes how LuminFire surmounted the challenges posed byWordPress and shows a few uses for the library.

Security updates have been issued by Arch Linux (chromium and postgresql), Fedora (gd and mingw-libzip), Mageia (groovy18, libxdmcp, mariadb, and mercurial), openSUSE (salt), Red Hat (instack-undercloud, kernel-rt, openvswitch, and rh-nodejs6-nodejs-qs), and SUSE (gdk-pixbuf).

Version 2.2 of the GNU COBOL compiler is out. Changes include arelicensing to GPLv3, a set of new intrinsic functions, a direct callinterface for C functions, and more.

Kees Cook highlightsthe security-related changes in the 4.13 kernel."Daniel Micay created a version of glibc’s FORTIFY_SOURCEcompile-time and run-time protection for finding overflows in the commonstring (e.g. strcpy, strcmp) and memory (e.g. memcpy, memcmp)functions. The idea is that since the compiler already knows the size ofmany of the buffer arguments used by these functions, it can already buildin checks for buffer overflows. When all the sizes are known at compiletime, this can actually allow the compiler to fail the build instead ofcontinuing with a proven overflow. When only some of the sizes are known(e.g. destination size is known at compile-time, but source size is onlyknown at run-time) run-time checks are added to catch any cases where anoverflow might happen. Adding this found several places where minor leakswere happening, and Daniel and I chased down fixes for them."

As Steve Dower noted in his lightningtalk at the 2017 Python LanguageSummit, Python itself can be considered a securityvulnerability—because of its power, its presence on a target system isa boon to attackers. Now, Dower is trying to address parts of thatproblem with a Python Enhancement Proposal (PEP) that would enable systemadministrators and others to detect when Python is being used for anefarious purpose by increasing the "security transparency" of thelanguage. It is not a solution that truly thwarts an attacker's ability to use Python in an unauthorized way, but will make it easier foradministrators to detect, and eventually disable, those kinds of attacks.

Security updates have been issued by Debian (file, icedove, irssi, ruby2.3, and tcpdump), Fedora (libzip and openjpeg2), openSUSE (clamav-database, icu, libzypp, zypper, and php5), Oracle (389-ds-base), Red Hat (rh-maven33-groovy), SUSE (postgresql94, postgresql96, and python-pycrypto), and Ubuntu (bzr and libgd2).

One does not normally expect to see significant changes to an importantinternal memory-management mechanism in the time between the ‑rc7 prepatchand the final release for a development cycle, but that is exactly whathappened just before 4.13 was released. A regression involving thememory-management unit (MMU) notifier mechanism briefly threatened todelay this release, but a last-minute scramble kept 4.13 onschedule and also resulted in a cleanup of that mechanism.This seems like a good time to look at a mechanism that LinusTorvalds called "a badly designed mistake" and how it was madeto be a bit less mistaken.

Version 11.0 of the PulseAudio sound system has been released. Newfeatures include more hardware support, a priority change so that externalsound devices are preferred over internal devices, support for operating asa Bluetooth headset device, and the long awaited GNU Hurd port. See therelease notes for details.

Security updates have been issued by Debian (asterisk and irssi), Fedora (glibc), Gentoo (mcollective), openSUSE (pspp and wireshark), Red Hat (389-ds-base, docker-distribution, kernel-rt, and qemu-kvm-rhev), Scientific Linux (389-ds-base), SUSE (kernel, libzypp, zypper, and xen), and Ubuntu (fontforge and liblouis).

The kernel's CPU-frequency ("cpufreq") governors are charged with pickingan operating frequency for each processor that minimizes power use whilemaintaining an adequate level of performance as determined by the currentpolicy. These governors normally run locally, with each CPU handling itsown frequency management. The 4.14 kernel release, though, will enable theCPU-frequency governors to control the frequency of any CPU in thesystem if the architecture permits, a change that should improve theperformance of the system overall.

Security updates have been issued by Debian (enigmail, gnupg, libgd2, libidn, libidn2-0, mercurial, and strongswan), Fedora (gd, libidn2, mbedtls, mingw-openjpeg2, openjpeg2, and xen), Mageia (apache-commons-email, botan, iceape, poppler, rt/perl-Encode, samba, and wireshark), and openSUSE (expat, freerdp, git, libzypp, and php7).

Linus has released the 4.13 kernel, right on schedule.Headline features in this release includekernel hardening via structure layoutrandomization,native TLS protocol support,better huge-page swapping,improved handling of writeback errors,better asynchronous I/O support,better power management via next-interruptprediction,the elimination of the DocBook toolchain for formatted documentation,and more. There is one other change that is called out explicitly in theannouncement: "The change in question is simply changing the default cifs behavior:instead of defaulting to SMB 1.0 (which you really should not use:just google for 'stop using SMB1' or similar), the default cifs mountnow defaults to a rather more modern SMB 3.0."

Steve McIntyre reports from a BoF session on the year-2038 problem atDebConf 17. "It's important that we work on fixing issues *now* to stop peoplebuilding broken things that will bite us. We all expect that our owncomputer systems will be fine by 2038; Debian systems will be fixedand working! We'll have rebuilt the world with new interfaces andfound the issues. The issues are going to be in the IoT, with systemsthat we won't be able to simply rebuild/verify/test - they'll fail. Weneed to get the underlying systems right ASAP for those systems."

The postmarketOS distribution looksback at its first 100 days. "One of our previously stated goalsis using the mainline Linux kernel on as many mobile devices aspossible. This is not as easy as it might sound, since many Linux-basedsmartphones (Android) require binary drivers which depend on very specifickernel versions. It's a tremendous task to rewrite these drivers to workwith the current kernel APIs. Nevertheless, some people have been doingthat since long before postmarketOS existed. In the case of the Nokia N900this has been going on for some number of years and almost all componentsare now supported in the mainline kernel. This has allowed us to use themainline kernel as the default kernel for the N900, jumping from Maemo's2.6.x to mainline 4.12!"

The 4.9.47,4.4.86, and3.18.69stable kernel updates have been released; each contains another set ofimportant fixes. Note that there is no 4.12 update in this series.

Running one's own mail system on the Internet has become an increasinglydifficult thing to do, to the point that many people don't bother, even ifthey have the necessary skills. Among the challenges is spam; withouteffective spam filtering, an email account will quickly drown under adeluge of vile offers, phishing attempts, malware, and alternative facts. Many ofus turn to SpamAssassin forthis task, but it's not the only alternative; Rspamd is increasingly worth considering inthis role. Your editor gave Rspamd a spin to get a sense for whetherswitching would be a good thing to do.

Security updates have been issued by CentOS (openssh, poppler, and thunderbird), Debian (graphicsmagick and openexr), Fedora (cacti, dnsdist, exim, groovy18, kernel, libsndfile, mingw-libzip, and taglib), Oracle (openssh), Red Hat (openssh), Scientific Linux (openssh), and SUSE (git and xen).

Allan Day sharessome welcome news about the GNOME status icon tray."GNOME 3 currently shows status icons in the bottom-left corner ofthe screen, in a tray that slides in and out. We know that this isn’t agood solution. The tray gets in the way and it generally feels quiteawkward. There’s a general consensus that we don’t want to continue withthis UI for the upcoming version of GNOME 3."

Security updates have been issued by Debian (connman, faad2, gnupg, imagemagick, libdbd-mysql-perl, mercurial, and php5), openSUSE (postgresql93 and samba and resource-agents), Oracle (poppler), Scientific Linux (poppler), SUSE (firefox and php7), and Ubuntu (pyjwt).

The Android Developers Blog has anoverview of the security features added to the kernel in the Android"Oreo" release. "Usercopy functions are used by the kernel totransfer data from user space to kernel space memory and back again. Since2014, missing or invalid bounds checking has caused about 45% of Android'skernel vulnerabilities. Hardened usercopy adds bounds checking to usercopyfunctions, which helps developers spot misuse and fix bugs in theircode. Also, if obscure driver bugs slip through, hardening these functionsprevents the exploitation of such bugs."

The LWN.net Weekly Edition for August 31, 2017 is available.

A nearly year-old "fix" to the main logging function used in the kernel,printk(), changed the appearance of some log messages in anunexpected way, at least for some.Messages that had appeared on a single line will now be spread over multiplelines as each call to printk() begins a new line in the outputunless the KERN_CONT flag is used.That is how a comment in the kernel code says it should work, but thechange was made by Linus Torvalds without any discussion orfanfare, so it took some by surprise.

In many ways, distributions shackle their users to particular versions oftools, libraries, and frameworks. Distributions do not do that to becruel, of course, but to try to ensure aconsistent and well-functioning experience across all of the software they ship. But users have often chafed at these restrictions, especiallyfor the fast-moving environments surrounding various web frameworks and theirdependencies. Fedora has been making an effort to make it easier for a single system tosupport these kinds of environments with its Modularityinitiative. In late July, Fedora announced apreview release of the server side of the Modularity equation, Boltron, which is aversion of the distribution that supports the initiative.

Stable kernels 4.12.10, 4.9.46, 4.4.85, and 3.18.68 have been released. They all containimportant fixes and users should upgrade.

Security updates have been issued by Debian (libgcrypt20, poppler, and wordpress), Fedora (cvs, java-1.8.0-openjdk-aarch32, and postgresql), Mageia (gstreamer0.10-plugins-base, gstreamer1.0-plugins-base and libgit2), openSUSE (exim), Red Hat (instack-undercloud, openvswitch, and poppler), Scientific Linux (poppler), SUSE (kernel and quagga), and Ubuntu (linux-lts-trusty).

<p>Importing a module into a Python program is a pretty invasive operation; itdirectly runs code in the current process that has access to anything theprocess can reach. So it is not wildly surprising that a suggestion to adda way to directly import modules from remote sites was met with considerabledoubt—if not something approaching hostility. It turns out that the personsuggesting the change was not unaware of the security implications of theidea, but thought it had other redeeming qualities; others in thediscussion were less sanguine.

Stack-smashing attacks have a long history; they featured, for example, asa core part of the Morris worm back in1988. Restrictions on executing code on the stack have, to a great extent,put an end to such simple attacks, but that does not mean thatstack-smashing attacks are no longer a threat. Return-orientedprogramming (ROP) has become a common technique for compromising systems via astack-smashing vulnerability. There are various schemes out there fordefeating ROP attacks, but a mechanism called "RETGUARD" that is being implementedin OpenBSD is notable for its relative simplicity.

A team of Positive Technologies researchers describethe discovery of a mechanism that can disable Intel Management Engine(ME) 11 after hardware is initialized and the main processor starts."Intel Management Engine is a proprietary technology that consists of a microcontroller integrated into the Platform Controller Hub (PCH) chip and a set of built-in peripherals. The PCH carries almost all communication between the processor and external devices; therefore Intel ME has access to almost all data on the computer. The ability to execute third-party code on Intel ME would allow for a complete compromise of the platform. We see increasing interest in Intel ME internals from researchers all over the world. One of the reasons is the transition of this subsystem to new hardware (x86) and software (modified MINIX as an operating system). The x86 platform allows researchers to make use of the full power of binary code analysis tools. Previously, firmware analysis was difficult because earlier versions of ME were based on an ARCompact microcontroller with an unfamiliar set of instructions."