LWN.net

Today's crop of new stable kernels consists of seven new versions: 6.10.6, 6.6.47, 6.1.106, 5.15.165, 5.10.224, 5.4.282, and 4.19.320. As usual, each contains importantfixes throughout the kernel tree.

Security updates have been issued by Debian (python-asyncssh), Fedora (bind, bind-dyndb-ldap, httpd, and tor), SUSE (cosign, cpio, curl, expat, java-11-openjdk, ncurses, netty, netty-tcnative, opera, python-Django, python-Pillow, shadow, sudo, and wpa_supplicant), and Ubuntu (firefox).

The Rust code being added to the kernel is documented using the usual rustdocconventions; that documentation is now available on kernel.org informatted form. There is also the linux-next version ofthe documentation for Rust code that will land in the kernel soon.

The fourth 6.11 kernel prepatch is out fortesting. According to Linus:

The Gentoo Linux project hasannouncedthat it is dropping support for Itanium:

Python has hadformatted string literals(f-strings), a syntactic shorthand for buildingstrings, since 2015. Recently, Jim Baker, Guido van Rossum, and Paul Everitt haveproposedPEP 750 ("Tag Strings For Writing Domain-Specific Languages") which wouldgeneralize and expand that mechanism to provide Python library writers with additionalflexibility. Reactions to the proposed change were somewhat positive, althoughthere was a good deal of discussion of (and opposition to)the PEP's inclusion of lazy evaluation of template parameters.

Security updates have been issued by Fedora (389-ds-base, dotnet8.0, python3.13, roundcubemail, thunderbird, and tor), Mageia (roundcubemail), Oracle (.NET 8.0, bind and bind-dyndb-ldap, bind9.16, container-tools:ol8, edk2, firefox, gnome-shell, grafana, httpd:2.4, jose, kernel, krb5, mod_auth_openidc:2.3, orc, poppler, python-urllib3, python3.11-setuptools, thunderbird, and wget), Red Hat (kernel), SUSE (apptainer, curl, kernel, kernel-firmware, libqt5-qtbase, python-aiosmtpd, and ucode-intel), and Ubuntu (bind9, gnome-shell, libreoffice, and orc).

The kernel's memory-management developers have been busy in recent times;it can be hard to keep up with all that has been happening in this corearea. In an attempt to catch up, here is a look at recent workaffecting tiered-memory systems, underutilized huge pages, and duplicatedfile data in the Enhanced Read-Only Filesystem (EROFS).

Security updates have been issued by AlmaLinux (container-tools:rhel8), Debian (flatpak), Fedora (389-ds-base, dotnet8.0, and roundcubemail), Red Hat (bind9.16, firefox, python-setuptools, and thunderbird), Slackware (dovecot), SUSE (389-ds, curl, kernel, kernel-firmware, kubernetes1.25, openssl-1_1, openssl-3, python-Pillow, and zziplib), and Ubuntu (busybox, linux-azure, and ruby-rmagick).

The LWN.net Weekly Edition for August 15, 2024 is available.

Three new stable kernels have been released: 6.10.5, 6.6.46, and 6.1.105. As usual, they contain importantfixes all over the kernel tree.

Rust is intended to let programmers write safer code.But compilers arenot omniscient, and writing Rust code that interfaces with hardware (or thatworks with memory outside of Rust's lifetime paradigm) requires, atsome point, the programmer's assurance that some operations are permissible. Benno Lossinsuggested addingsome more documentation tothe Rust-for-Linux project clarifying thestandards for commenting uses of unsafe in kernel code. There's generalagreement that such standards are necessary, but less agreement on exactly whenit is appropriate to use unsafe.

Security updates have been issued by AlmaLinux (389-ds-base), Debian (ffmpeg), Fedora (chromium), Red Hat (.NET 8.0, container-tools:rhel8, edk2, firefox, gnome-shell, grafana, jose, kernel, kernel-rt, krb5, open-vm-tools, orc, pcs, poppler, python-urllib3, and wget), SUSE (gtk2, gtk3, kernel, python-setuptools, python310-setuptools, python312-setuptools, python39-setuptools, and webkit2gtk3), and Ubuntu (dotnet8, libcroco, linux-azure, linux-lowlatency, linux-raspi, and linux-oracle).

Markdown editors are a dime a dozen. Cheaper than that, actually,since many of them are opensource software. Despite the sheer number ofoptions, finding an editor that has all of the features that one might want canbe tricky. For some users, Zettlrmight be the right tool. It is a What You See is What YouMean (WYSIWYM) editor that stores its work locally as plain Markdownfiles. The project is billed as a "one-stop publicationworkbench", and is suitable for writing anything from blog posts toacademic papers, maintaining a personal journal, or keeping notes in a Zettlekasten. Itis simple to get started with, but rewards deeper exploration andcustomization.

ThePostgreSQL project hasreleased betaversions of PostgreSQL 17 containing several interesting security and usabilityimprovements, alongside the usual performance improvements and bug fixes. If therelease proceeds according to the usual timeline, the full release of version 17is expected in September or October.The most important changes are in what PostgreSQL does when a databasesupervisor has their credentials revoked, and addedsupport for incremental database backups.

Lix, the fork of Nix that LWN covered in July, has made its second release since forking. This one includes substantial changes to the backend code, including removing a dependency on Bison, and getting a change to the Nix language back upstream.

Version 6.4 of the Incus container manager is out.

Security updates have been issued by Debian (kernel and roundcube), Fedora (microcode_ctl, pypy, python2.7, and python3.6), Oracle (389-ds-base, httpd, kernel, kernel-container, and linux-firmware), Red Hat (kernel-rt), SUSE (firefox, kubernetes1.23, libqt5-qtbase, openssl-1_1, python-gunicorn, python-Twisted, python-urllib3, and qt6-base), and Ubuntu (linux-aws-5.15, linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-raspi, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-oem-6.8, linux-oracle-5.15, and qemu).

Linux hardware vendor System76 started promotingits work on a Rust-based, Waylanddesktop environment for its Pop!_OSUbuntu-derivative distribution almost two yearsago. On August 8, the company released an alpha version of the COSMIC desktop environment forusers to test out. While it has rough edges and missing features, itis stable enough to get a good feel for what the finished product hasin store-and the initial results are promising.

Version 4.0 of the Magit text-basedGit user interface for Emacs has been released. Changes since the 3.3.0release include the addition of context menus, a makeover for themenu-bar menu, new menu commands, and many other new features and bugfixes. See the releasenotes for full details.

The Rust project has developed aset of goals for the latter half of 2024.

Security updates have been issued by AlmaLinux (httpd:2.4), Fedora (chromium, firefox, frr, neatvnc, nss, python-setuptools, and python3.13), Gentoo (AFLplusplus, Bundler, dpkg, GnuPG, GPAC, libde265, matio, MuPDF, PHP, protobuf, protobuf-python, protobuf-c, rsyslog, Ruby on Rails, and runc), Red Hat (389-ds-base, container-tools:rhel8, and httpd:2.4), SUSE (bind and ca-certificates-mozilla), and Ubuntu (linux-azure).

Linus has released 6.11-rc3 right onschedule. "Nothing particularly strange or interesting going on, thingslook normal".

The6.10.4,6.6.45, and6.1.104stable kernel updates have been released; each contains another set ofimportant updates as usual.

It is something of a DebConf tradition that members of the Debian TechnicalCommittee (TC) take the stage to talk about the work that the committeedoes-and more. DebConf24 inBusan, South Korea was no exception, as TC chair Sean Whitton, whowill complete his term at the end of the year, and oneof its newest members, Stefano Rivera, described the constitutionalunderpinnings of the TC, how it tries to make decisions when it needs to,and the constant process of recruiting new members. After that, they tooka few questions from the audience. The session provided a nice overview ofthe TC and its role in Debian, but it may well be of interest further afield.

The Canonical Kernel Team has announceda new policy regarding the version of the kernel that will ship with eachUbuntu release; the result will generally be the shipping of newerreleases.

Sometimes, the smallest changes create the longest discussions. As a casein point, a proposal to make a one-line change in an informational textfile on systems running the Debian unstable distribution has blown up intoan interminable and sometimes unfriendly debate. At its core, though, thisdiscussion comes down to a seemingly simple question: should a program beable to determine whether it is running on a Debian testing or unstablesystem?

Researchers from Graz University of Technology havepublished details of a new attackon the Linux kernel called SLUBStick. The attack uses timing information to turn an ability to trigger use-after-free or double-free bugs into the ability to overwrite page tables, and thence into the ability to read and write arbitrary areas of memory. The good news is that this attack does require an existing bug to be usable; the bad news is that the kernel regularly sees bugs of this kind.

Security updates have been issued by AlmaLinux (httpd, kernel, kernel-rt, and libtiff), Debian (postgresql-13, postgresql-15, and thunderbird), Fedora (frr, thunderbird, vim, and xrdp), Gentoo (Librsvg, Nautilus, ncurses, Percona XtraBackup, QEMU, and re2c), Red Hat (httpd, kernel, kernel-rt, openssl, and python-setuptools), SUSE (bind, ffmpeg-4, kubernetes1.23, kubernetes1.24, python-Django, and python3-Twisted), and Ubuntu (linux, linux-aws, linux-aws-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-raspi, linux-xilinx-zynqmp, linux, linux-aws, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-nvidia, linux-nvidia-6.8, linux-oem-6.8, linux-nvidia-lowlatency, linux-oracle, linux-oracle, linux-oracle-5.4, and salt).

The Oligo Security blog disclosesa web-browser vulnerability that has been named "0.0.0.0 day". In short,browsers will allow JavaScript code to open connections to the all-zeroesIPv4 address; the result is that any port that is open on the local hostcan be accessed by a remote site. "When services use localhost, theyassume a constrained environment. This assumption, which can (as in thecase of this vulnerability) be faulty, results in insecure serverimplementations."

Endless OS is a Linux distribution with a focus on improving access toeducational tools by providing a simple-to-manage, full-featured desktop foreducators and students - one that works offline, with minimal maintenance. Thedistribution also aims to be suitable for older devices, in order to promote access tocomputers by ensuring those systems remain usable.In pursuit of those goals, it makes some unusual technicalchoices. But what makes the distribution really shine is its curated collectionof software and educational resources.

Security updates have been issued by AlmaLinux (freeradius and freeradius:3.0), Debian (chromium, odoo, and roundcube), Fedora (microcode_ctl, mingw-qt5-qtbase, mingw-qt6-qtbase, opentofu, orc, python-setuptools, and vim), Gentoo (Nokogiri), Oracle (kernel), Red Hat (go-toolset:rhel8, golang, kernel, krb5, libtiff, python-setuptools, and python39:3.9 and python39-devel:3.9), SUSE (python-Django), and Ubuntu (krb5).

The LWN.net Weekly Edition for August 8, 2024 is available.

Mozilla has announced that Puppeteer, a browser automation and testing library, now has first-class support for Firefox using theWebDriver BiDi protocol. Puppeteer can be used to drive headless browser instances, and is commonly used for automated end-to-end web-site tests.

The desire for the ability to checkpoint a process - to record its state ina form that can be restarted at a future time - on Linux is almost as old asLinux itself. See, for example, this announcement of a checkpointproject that appeared in LWN in 1998. While working solutions exist, theycan be somewhat fragile and difficult to use; it is not surprising thatsome people are interested in finding a better alternative. A currenteffort goes by the name CRIB,for Checkpoint/Restore in (naturally) BPF. It is far from clear that CRIBwill replace the existing solutions, but it is an interesting look at adifferent way of solving the problem.

There are lots of places in the kernel where an EINVAL can bereturned to user space, but it is often unclear what the actual underlyingproblem is because the errnoerror codes are too generic. That is the problem that Miklos Szerediwanted to discuss in a filesystem session that he led remotely at the 2024 Linux Storage,Filesystem, Memory Management, and BPF Summit. He would like to helpthose who are trying to debug problems trace where in the kernel aparticular error code is being generated.

Security updates have been issued by Debian (firefox-esr, openjdk-17, and wpa), Gentoo (aiohttp, Bitcoin, Cairo, Go, json-c, Levenshtein, libXpm, nghttp2, PostgreSQL, and Redis), Red Hat (kernel, kernel-rt, python-setuptools, python-urllib3, python3.11-setuptools, and wget), Slackware (mozilla), SUSE (bind, curl, docker, ffmpeg, ffmpeg-4, kernel, kernel-firmware, libnbd, patch, shadow, and thunderbird), and Ubuntu (python-django and wpa).

CircuitPython is an open-sourceimplementation of the Python programming language for microcontrollerboards. The project, which is sponsored by Adafruit Industries, is designed withnew programmers in mind, but it also has many features that may be ofinterest to more-experienced developers. The recent 9.1.0releaseadds a few minor features, but it follows just a few months after CircuitPython9.0.0,which brings some more significant changes, including improved graphics andUSB support.

Version129.0 of the Firefox browser has been released. Changes include someimprovements to the reader mode, tab previews, and use of HTTPS by default.

Security updates have been issued by Debian (libreoffice), Gentoo (containerd and firefox), Red Hat (httpd), SUSE (ca-certificates-mozilla, ksh, openssl-3-livepatches, podman, python-Twisted, and skopeo), and Ubuntu (imagemagick).

David Howells wanted to discuss changing the way filesystem code handlesthe ability to interrupt or kill operations, in order to fix somelongstanding problems with network (and other) filesystems, in a session atthe 2024 LinuxStorage, Filesystem, Memory Management, and BPF Summit. As noted inhis sessionproposal, some filesystems may be expecting to not be interruptible,but are calling code can take locks and mutexes that are interruptible (orkillable), which are effectivelychanging the state of the task incorrectly.He would like to find a solution for that problem.

The BusinessSource License (BUSL) is a source-available license that "converts"to an open-source license after a period of time. In theory, thismeans that a few years after a version of a product is released underthe BUSL, it becomes open source and is fair game for Linuxdistributions to package along with regular open-source projects. Inpractice, the license throws a few curveballs that require specialconsideration and caution, as the Fedora Project recently discussed.

Version 2.43 of the GNU Binutils package is out. Changes include someimprovements to the assembler and the linker, better support for hardwareevent counters in the Gprofng profiler, and more.

Security updates have been issued by Debian (openjdk-11), Fedora (bind, bind-dyndb-ldap, chromium, ffmpeg, hostapd, trafficserver, and wpa_supplicant), and Ubuntu (curl and linux-oem-6.5).

Linus has released 6.11-rc2 for testing."Hopefully we've gotten rid of the bulk of the silly noise here in rc2,and not added too much new noise, so that we can get on with the process offinding more meaningful issues."

The 6.10.3, 6.6.44, and 6.1.103 stable kernel updates have all been released. As usual, theycontain important fixes throughout the tree. Users of those kernelsshould upgrade.

There is ongoing discussion about the ethics and effectiveness oftelemetry following some recent LWN articles that touched onThunderbird's use of opt-outtelemetry and planned metrics in Fedora. TheInternet Security Research Group (ISRG), the nonprofit behindLet's Encrypt, has a potential solution to the problem of how to collect andaggregate telemetry without violating users' privacy. The scheme is based on adraftprotocol being standardized with the Internet Engineering Task Force (IETF),and has anopen-source implementationavailable.

Security updates have been issued by Fedora (chromium), SUSE (docker and patch), and Ubuntu (bind9, gross, linux-azure, linux-azure-4.15, linux-lowlatency-hwe-6.5, and tomcat8, tomcat9).

The Sovereign Tech Fund (STF) has announceda fellowship program to support "the dedicated individuals who keepour digital infrastructure running":

Like many projects written in C, the kernel makes extensive use of the Cpreprocessor; indeed, the kernel's use is rather more extensive than most.The preprocessor famously has a number of sharp edges associated with it.One might not normally think of increased compilation time as one of them,though. It turns out that some changes to a couple of conceptually simplepreprocessor macros - min() and max() - led to some trulypathological, but hidden, behavior where those macros were used.