Kernel developers are encouraged to send their changes in small batches asa way of making life easier for reviewers. So when a longtime developerand maintainer hits the list with a 437-patch series touching 859 files,eyebrows are certain to head skyward. Specifically, this seriesfrom Jens Axboe is cleaning up one of the core abstractions that hasbeen part of the Linux kernel almost since the beginning; authors of devicedrivers (among others) will have to take note.
Security updates have been issued by Fedora (chromium, grub2, httpd, kernel, libcoap, matrix-synapse, python-pip, and rust-pythonize), Red Hat (kernel and libxml2), SUSE (kernel), and Ubuntu (eglibc, glibc and php7.4, php8.1, php8.2).
Greg Kroah-Hartman has announced the release of the 6.8.9, 6.6.30,6.1.90, 5.15.158, 5.10.216, 5.4.275, and 4.19.313 stable kernels. As is the norm, theycontain lots of important fixes throughout the kernel tree.
In Unix-like systems, an open file descriptor carries the right to accessthe opened object in specific ways. As a general rule, that filedescriptor does not enable access to any other objects. Therecently merged BPF token feature runscounter to this practice by creating file descriptors that carry specificBPF-related access rights. A similar but different approach tocapability-carrying file descriptors, in the form of directory filedescriptors that include their own credentials, is currently underconsideration in the kernel community.
Version1.78.0 of the Rust language has been released. Changes include a newmechanism for diagnostic attributes, changes to how assertions aroundunsafe blocks are handled, and more.
Security updates have been issued by Debian (chromium and distro-info-data), Fedora (et, php-tcpdf, python-aiohttp, python-openapi-core, thunderbird, tpm2-tools, and tpm2-tss), Red Hat (nodejs:16 and podman), and Ubuntu (firefox).
Version 8.0 of the terminal text editor GNU nano has beenreleased. This update includes several changes to keybindings to bemore newcomer-friendly, such as remapping Ctrl-F to forward-search andadding an option for modern bindings:
Ubuntu24.04LTS, code-named "NobleNumbat", was released on April25. This release includes GNOME46, installer updates,security enhancements, a lot of updated packages, and a new App Centerthat puts a heavy emphasis on using Snaps to install software. It is not an ambitious release, but it brings enough to the table that it's a worthwhile update.
Security updates have been issued by Debian (nghttp2 and qtbase-opensource-src), Mageia (cjson, freerdp, guava, krb5, libarchive, and mediawiki), Oracle (container-tools:4.0 and container-tools:ol8), Red Hat (bind, buildah, container-tools:3.0, container-tools:rhel8, expat, gnutls, golang, grafana, kernel, kernel-rt, libreswan, libvirt, linux-firmware, mod_http2, pcp, pcs, podman, python-jwcrypto, rhc-worker-script, shadow-utils, skopeo, sssd, tigervnc, unbound, and yajl), SUSE (kernel and python311), and Ubuntu (gerbv and node-json5).
When it comes to security, telling developers to do (or not do)something can be ineffective. Helping them understand the why behindinstructions, by illustrating good and bad practices using stories, can bemuch more effective. With several such stories MartaRybczyska fashioned an interesting talkabout patterns and anti-patterns in embedded Linux security at theEmbeddedOpen Source Summit (EOSS), co-located with OpenSource Summit North America (OSSNA), on April 16 in Seattle, Washington.
ThisMastodon stream from Lennart Poettering describes a sudoreplacement - called run0 - that will be part of the upcomingsystemd 256 release. It takes a rather different approach to the executionof privileged commands, avoiding the use of setuid (which he calls "SUID")permissions entirely.
Version 2.45.0 of the Gitsource-code management system has been released. Changes include a newlist command for gitreflog, a couple of newconfiguration variables for gitdiff, the ability to dropredundant commits while cherry-picking, a number of performanceimprovements, and more.
The Amarok music player projecthas announcedthe release of version3.0, which is codenamed "Castaway". It is the firststable version using Qt5 and KDE Frameworks5, and the first stablerelease since the final Qt-4-based2.9.0 in 2018.
On April 21, a group of anonymous authors and non-anonymous signatories publisheda lengthy open letter to theNix communityand Nix founder Eelco Dolstra calling for his resignation from the project. Theyclaimed ongoing problems with the project's leadership, primarily focusing on theway his actions have allegedlyundermined people nominally empowered to perform variousmoderation and governance tasks. Since its release, the letter has gainedmore than 100 signatures.
Security updates have been issued by AlmaLinux (buildah, go-toolset:rhel8, golang, java-11-openjdk, java-21-openjdk, libreswan, thunderbird, and tigervnc), Debian (chromium, emacs, frr, mediawiki, ruby-rack, trafficserver, and zabbix), Fedora (chromium, grub2, python-idna, and python-reportlab), Mageia (chromium-browser-stable, firefox, opencryptoki, and thunderbird), Red Hat (container-tools:4.0, container-tools:rhel8, git-lfs, and shim), SUSE (frr, java-11-openjdk, java-1_8_0-openjdk, kernel, pdns-recursor, and shim), and Ubuntu (apache2, cpio, curl, glibc, gnutls28, less, libvirt, and pillow).
Robert McQueen has posted a messagefrom the GNOME Foundation board describing the current financialsituation, plans to improve it, and an increase in the size of the board.
The6.8.8,6.6.29,6.1.88, and5.15.157stable kernels have been released; each contains another set of importantfixes.Update: 6.1.89 was released two dayslater to fix abuild problem in 6.1.88.
Video playback is undeniably one of the most important features in modernconsumer devices. Yet, surprisingly, users are by and large unaware of theintricate engineering involved in the compression and decompression ofvideo data, with codecs being left to find a delicate balance between imagequality, bandwidth, and power consumption. In response to constantperformance pressure, video codecs have become complex and hardwareimplementations are now common, but programming these devices is becomingincreasingly difficult and fraught with opportunities for exploitation. Ihope to convey how Rust can help fix this problem.
At the CPU level, a memory model describes, among other things, the amountof freedom the processor has to reorder memory operations. If low-levelcode does not take the memory model into account, unpleasant surprises arelikely to follow. Naturally, different CPUs offer different memory models,complicating the portability of certain types of concurrent software. Tomake life easier, some Arm CPUs offer the ability to emulate the x86 memorymodel, but efforts to make that feature available in the kernel are runninginto opposition.
Security updates have been issued by Debian (knot-resolver, pdns-recursor, and putty), Fedora (xen), Mageia (editorconfig-core-c, glibc, mbedtls, webkit2, and wireshark), Oracle (buildah), Red Hat (buildah and yajl), Slackware (libarchive), SUSE (dcmtk, openCryptoki, php7, php74, php8, python-gunicorn, python-idna, qemu, and thunderbird), and Ubuntu (cryptojs, freerdp2, nghttp2, and zabbix).
On April 11, Brandt Bucher postedPEP 744 ("JIT Compilation"),which summarizes the current state of Python's new copy-and-patch just-in-time (JIT) compiler. The JIT is currentlyexperimental, but the PEP proposes some criteria for the circumstances under which itshould become a non-experimental part of Python.The discussion of the PEP hasn'treached a conclusion, butseveral members of the community have already raised questionsabout how the JIT would fit into future iterations of the Python language.
Linux, famously, appears in a wide range of systems. While servers andlarge data centers get a lot of the attention, and this year will always bethe year of the Linux desktop, there is also a great deal of Linux to befound in realtime and embedded applications. Two talks held in therealtime and embedded tracks of the 2024 OpenSource Summit North America provided listeners with an update on howLinux is doing in those areas. Work on realtime Linux appears to be nearingcompletion, while the embedded community is still pushing forward at fullspeed.
Security updates have been issued by Fedora (curl, filezilla, flatpak, kubernetes, libfilezilla, thunderbird, and xen), Oracle (go-toolset:ol8, kernel, libreswan, shim, and tigervnc), Red Hat (buildah, gnutls, libreswan, tigervnc, and unbound), SUSE (cockpit-wicked, nrpe, and python-idna), and Ubuntu (dnsmasq, freerdp2, linux-azure-6.5, and thunderbird).
BleepingComputerreported on April 20 that some malware was being distributed via GitHub.Uploading files as part of a comment gives them a URL that appears to beassociated with a repository, even if the comment is never posted.
Version 9.0 ofthe QEMU emulator has been released. "This release contains 2700+commits from 220 authors." The list of improvements is long; see theannouncement and thechangelog for details.
For several years, contributors to the Rust project havebeen working to improve support for asynchronouscode. The benefits of these efforts are not confined to asynchronous code,however. Members of the Rust community have been working toward adding explicitexistential types to Rust since 2017. Existential types are not a common featureof programming languages (somethingthe RFC acknowledges), so the motivation for their inclusion might be somewhatobscure.
The long-running effort to complete the work on stacking (or composing) theLinux security modules (LSMs) recently encountered a barrier-in the form ofa "suggestion" to discontinue it from Linus Torvalds. His complaintrevolved around the indirect function calls that are used to implementLSMs, but he also did not think much of the effort to switch away fromthose calls. While it does not appear that a major course-change is in storefor LSMs, it is clear that Torvalds is not happy with the direction of thatsubsystem.
The Fedora 40 distribution has beenreleased. See the "what's new" pages for FedoraWorkstation and FedoraKDE to learn more about the desktop spins, along with this LWN article, for more information.
The Rust programming language, it is hoped, will bring a new level ofsafety to the Linux kernel. At the moment, though, there are still anumber of impediments to getting useful Rust code into the kernel. In theEmbedded Open Source Summit track of the OpenSource Summit North America, Fabien Parent provided an overview of hiswork aimed at improving the infrastructure needed to write the devicedrivers needed by embedded systems in Rust; there is still some work to bedone.
Security updates have been issued by Debian (glibc and samba), Fedora (chromium, cjson, mingw-python-idna, and pgadmin4), Mageia (kernel, kmod-xtables-addons, kmod-virtualbox, kernel-linus, and perl-Clipboard), Red Hat (go-toolset:rhel8, golang, java-11-openjdk, kpatch-patch, and shim), Slackware (freerdp), SUSE (apache-commons-configuration, glibc, jasper, polkit, and qemu), and Ubuntu (google-guest-agent, google-osconfig-agent, linux-lowlatency-hwe-6.5, pillow, and squid).
The Debian project leaderelection results are in and Andreas Tillehas been elected.In a fairly competitive vote, Tille beat Sruthi Chandran to fill theposition for the coming year. We looked at the election and thecandidates a few weeks back.
One of the mainstays of the the Linux Foundation's Open Source Summit is the "fireside chat"(sans fire) between Linus Torvalds and Dirk Hohndel to discuss open source andLinux kernel topics of the day. On April 17, at Open Source SummitNorth America (OSSNA) in Seattle, Washington, they held with traditionand discussed a range of topics including proper whitespace parsing,security, and the current AI craze.
Gregory Price recently posteda patch set that adds support for weighted memory interleaving - allowing aprocess's memory to be distributed betweennon-uniform memory access (NUMA)nodes in a more controlled way.According to his performance measurements, the patch set could provide asignificant improvement for computers with network-attached memory.The patch set alsointroduces new system calls and paves the way for future extensionsintended to give processes more control over their own memory.
Security updates have been issued by AlmaLinux (gnutls, java-17-openjdk, mod_http2, and squid), Debian (firefox-esr), Fedora (editorconfig, perl-Clipboard, php, rust, and wordpress), Mageia (less, libreswan, puppet, and x11-server, x11-server-xwayland, and tigervnc), Slackware (aaa_glibc), and SUSE (firefox, graphviz, kernel, nodejs12, pgadmin4, tomcat, and wireshark).
Gentoo Council member Micha Gorny postedan RFC to the gentoo-dev mailinglist in late February about banning "'AI'-backed (LLM/GPT/whatever)contributions" to the Gentoo Linux project. Gorny wrote that the spread of the"AIbubble" indicated a need for Gentoo to formally take a stand on AItools. After a lengthy discussion, the Gentoo Council votedunanimously this week to adopt his proposal and ban contributions generated with AI/ML tools.
Kernel developers, like conscientious developers for many projects, willoften include checks in the code for conditions that are never expected tooccur, but which would indicate a serious problem should that expectationturn out to be incorrect. For years, developers have been encouraged (toput it politely) to avoid using assertions that crash the machine for suchconditions unless there is truly no alternative. Increasingly, though, useof the kernel's WARN_ON() family of macros, which developers weretold to use instead, is also being discouraged.
Security updates have been issued by Debian (firefox-esr, jetty9, libdatetime-timezone-perl, tomcat10, and tzdata), Fedora (cockpit, filezilla, and libfilezilla), Red Hat (firefox, gnutls, java-1.8.0-openjdk, java-17-openjdk, kernel, kernel-rt, less, mod_http2, nodejs:18, rhc-worker-script, and shim), Slackware (mozilla), SUSE (kernel), and Ubuntu (apache2, glibc, and linux-xilinx-zynqmp).
LWN.net