LWN.net

Security updates have been issued by Debian (htmldoc, lasso, and rails), Fedora (exiv2, firefox, and microcode_ctl), openSUSE (python-HyperKitty), Oracle (389-ds-base, qemu-kvm, qt5-qtimageformats, and samba), Red Hat (container-tools:3.0, container-tools:rhel8, postgresql:12, and postgresql:13), Scientific Linux (389-ds-base, hivex, libwebp, qemu-kvm, qt5-qtimageformats, samba, and thunderbird), SUSE (caribou, djvulibre, firefox, gstreamer-plugins-bad, kernel, libopenmpt, libxml2, python-Pillow, qemu, spice, spice-gtk, and ucode-intel), and Ubuntu (rpcbind).

The LWN.net Weekly Edition for June 10, 2021 is available.

Annotations in Python came late to the party; they were introduced inPython 3 as a way to attach information to functions describing their arguments andreturn values. While that mechanism had obvious applications for addingtype information to Python functions, standardized interpretations for theannotations came later with type hints.But evaluating the annotations at function-definition time caused somedifficulties, especially with respect to forward references to type names,so a Python Enhancement Proposal (PEP) was created to postpone theirevaluation until they were needed. The PEP-described behavior was set tobecome the default in the upcoming Python 3.10 release, but that isnot to be; the postponement of evaluation by default has itself been postponed in thehopes of unwinding things.

Security updates have been issued by Debian (eterm, mrxvt, and rxvt), Mageia (cgal, curl, exiv2, polkit, squid, thunderbird, and upx), openSUSE (firefox and libX11), Oracle (libwebp, nginx:1.18, and thunderbird), Red Hat (.NET 5.0, .NET Core 3.1, 389-ds-base, dhcp, gupnp, hivex, kernel, kernel-rt, libldb, libwebp, microcode_ctl, nettle, postgresql:10, postgresql:9.6, qemu-kvm, qt5-qtimageformats, rh-dotnet50-dotnet, and samba), SUSE (apache2-mod_auth_openidc, firefox, gstreamer-plugins-bad, kernel, libX11, pam_radius, qemu, runc, spice, and spice-gtk), and Ubuntu (intel-microcode and rpcbind).

As movement toward memory-safe languages, and Rust in particular, continues togrow, it is worth looking atone of the larger scale efforts to port C code that has existed for decadesto Rust. The uutils project aims torewrite all of the individual utilities included in the GNU Coreutils project inRust. Originally created by JordiBoggiano in 2013, the project aims to provide drop-inreplacements for the Coreutils programs, addingthe data-race protection and memory safety that Rust provides.

Security updates have been issued by Debian (nginx), Fedora (musl), Mageia (dnsmasq, firefox, graphviz, libebml, libpano13, librsvg, libxml2, lz4, mpv, tar, and vlc), openSUSE (csync2, python-py, and snakeyaml), Oracle (qemu), Red Hat (container-tools:2.0, kernel, kpatch-patch, nettle, nginx:1.16, and rh-nginx116-nginx), Slackware (httpd and polkit), SUSE (389-ds, gstreamer-plugins-bad, shim, and snakeyaml), and Ubuntu (gnome-autoar and isc-dhcp).

The realtime project has been the source of many of theinnovations that have found their way into the core kernel in the lastfifteen years or so. There is more to it than that, though; the wider realtimecommunity is also doing interesting work in a number of areas that go beyond ensuring deterministicresponse. One example is Daniel Bristot de Oliveira's runtimeverification patch set, which can monitor the kernel to ensure that itis behaving the way one thinks it should.

Security updates have been issued by Debian (libwebp, python-django, ruby-nokogiri, and thunderbird), Fedora (dhcp, polkit, transfig, and wireshark), openSUSE (chromium, inn, kernel, redis, and umoci), Oracle (pki-core:10.6), Red Hat (libwebp, nginx:1.18, rh-nginx118-nginx, and thunderbird), SUSE (gstreamer-plugins-bad), and Ubuntu (linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.8, linux-kvm, linux-oracle).

The 5.13-rc5 kernel prepatch is out fortesting. "Hmm. Things haven't really started to calm down very much yet, but rc5seems to be fairly average in size. I'm hoping things will startshrinking now."

Back in a distant time — longer ago than he cares to admit — your editormanaged a system-administration group. At that time, most of the day-to-daypain reliably came from two types of devices: modems and printers. Modemsare more plentiful than ever now, but they have disappeared into interfacecontrollers and (usually) manage to behave themselves. Printers, instead,are still entirely capable of creating problems and forcing areconsideration of one's life choices.Behind the scenes, though, the situation has been getting better but, as arecent conversation within the Fedora project made clear, taking advantageof those improvements will require some changes and a bit of a leap of faith.

There is a new release of CentOS Linux 8. "Effectively immediately, this is the current release for CentOSLinux 8 and is tagged as 2105, derived from Red Hat Enterprise Linux 8.4Source Code." See therelease notes for the changes in this release.

Security updates have been issued by Debian (lasso), Fedora (mingw-djvulibre, mingw-exiv2, python-lxml, and singularity), openSUSE (ceph, dhcp, inn, nginx, opera, polkit, upx, and xstream), Oracle (firefox, perl, and polkit), Scientific Linux (firefox), SUSE (avahi, csync2, djvulibre, libwebp, polkit, python-py, slurm, slurm_18_08, thunderbird, and umoci), and Ubuntu (linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-oem-5.10, and squid, squid3).

The io_uring subsystem, first introduced in2019, has quickly become the leading way to perform high-bandwidth,asynchronous I/O. It has drawn the attention of many developers, including,more recently,those who are focused more on security than performance. Now some membersof the security community are lamenting a perceived lack of thought about security support inio_uring, and are trying to remedy that shortcoming by adding audit andLinux security module support there. That process is proving difficult,and has raised the prospect of an unpleasant fallback solution.

Greg Kroah-Hartman has announced the release of the 5.12.9, 5.10.42, 5.4.124, 4.19.193, 4.14.235, 4.9.271, and 4.4.271 stable kernels. As usual, thesecontain fixes throughout the kernel tree; users should upgrade.

Security updates have been issued by Arch Linux (chromium, curl, dhclient, dhcp, firefox, keycloak, lib32-curl, lib32-libcurl-compat, lib32-libcurl-gnutls, libcurl-compat, libcurl-gnutls, opera, packagekit, pam-u2f, postgresql, rabbitmq, redis, ruby-bundler, and zint), Debian (caribou, firefox-esr, imagemagick, and isc-dhcp), Fedora (mapserver, mingw-python-pillow, and python-pillow), openSUSE (chromium), Red Hat (firefox, glib2, pki-core:10.6, polkit, rh-ruby26-ruby, and rh-ruby27-ruby), SUSE (ceph, dhcp, libwebp, nginx, qemu, squid, and xstream), and Ubuntu (firefox, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux-snapdragon, linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oracle, and policykit-1).

The LWN.net Weekly Edition for June 3, 2021 is available.

When last we looked in on Fedora CoreOS back in December,it was under consideration to become an official Fedora edition. That hasnot happened, yet at least, but it would seem that the CoreOS "emerging edition"is still undergoing some difficulties trying to fit in with the rest ofFedora. There are differences between the needs of a container operatingsystem and those of more general-purpose distributions, which still need tobe worked out if Fedora CoreOS is going to "graduate".

Robert McQueen takesa look at the state of the GNOME Foundation.

Security updates have been issued by Debian (squid), Fedora (dhcp), openSUSE (gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly and slurm), Oracle (glib2 and kernel), Red Hat (kernel, kernel-rt, perl, and tcpdump), Scientific Linux (glib2), SUSE (bind, dhcp, lz4, and shim), and Ubuntu (dnsmasq, lasso, and python-django).

OpenSUSELeap 15.3 has been released. "There is one huge change from theprevious Leap versions. openSUSE Leap 15.3 is built not just from SUSELinux Enterprise source code like in previous versions, but built with theexact same binary packages, which strengthens the flow between Leap and SLElike a yin yang." There are a lot of new features as well, see theannouncement for details.

Matthew Garrett has written up the long,complex series of steps required to build an x86 device that only bootscode that the creator wants to run there. "At this point everythingin the boot process is cryptographically verified, and so should bedifficult to tamper with. Unfortunately this isn't really sufficient - onx86 systems there's typically no verification of the integrity of thesecure boot database. An attacker with physical access to the system couldattach a programmer directly to the firmware flash and rewrite the secureboot database to include keys they control. They could then replace theboot image with one that they've signed, and the machine would happily bootcode that the attacker controlled. We need to be able to demonstrate thatthe system booted using the correct secure boot keys, and the only way wecan do that is to use the TPM."

Over the last month or so, there has been a good bit of newssurrounding the idea of increasing the performance of the CPythoninterpreter. At the 2021Python Language Summit in mid-May, Guido van Rossum announcedthat he and a small team are being funded by Microsoft to work with thecommunity on getting performance improvements upstream into theinterpreter—crucially, without breaking the C API so that the ecosystem ofPython extensions (e.g. NumPy) continue towork. Another talk at the summit lookedat Cinder, which is a performance-oriented CPython fork that is used inproduction at Instagram. Cinder was recently released as open-sourcesoftware, as was anotherproject to speed up CPython that originated at Dropbox: Pyston.

The GCC Steering Committee has decided torelax the requirement to assign copyright to the Free SoftwareFoundation. "Contributors who have an FSF Copyright Assignment don'tneed to change anything. Contributors who wish to utilize the DeveloperCertificate of Origin should add a Signed-off-by message to their commitmessages. Developers with commit access may add their name to the DCO listin the MAINTAINERS file to certify the DCO for all future commits in lieuof individual Signed-off-by messages for each commit."

Firefox 89 has been released. Thechanges in this version focus on the look and feel. "We’ve redesignedand modernized the core experience to be cleaner, more inviting, and easierto use. " This release also includes enhancements to the privacyofferings. "We’veenhanced the privacy of the Firefox Browser’s Private Browsing modewith Total Cookie Protection, which confines cookies to the site where theywere created, preventing companies from using cookies to track your browsing across sites. This feature was originally launched in Firefox’s ETP Strict mode."

Security updates have been issued by Fedora (cflow, chromium, eterm, gnutls, and kernel), Mageia (kernel and kernel-linus), Oracle (glib2), Red Hat (glib2, kernel, kernel-rt, and kpatch-patch), SUSE (curl, djvulibre, gstreamer, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly, nginx, python-httplib2, and slurm), and Ubuntu (gupnp, libwebp, postgresql-10, postgresql-12, postgresql-13, and python3.8).

The GCC compiler, like other GNU projects, has long required contributorsto complete paperwork assigning the copyrights on their work to the FreeSoftware Foundation. That requirement has just been dropped, andcontributors can now attach a Signed-off-by tag indicating use of theDevelopers Certificate ofOrigin instead. "This change is consistent withthe practices of many other major Free Software projects, such as theLinux kernel." Initial discussionsuggests that some developers were surprised by this change and are yet to be convinced that it is a goodidea.

The seccomp()mechanism allows a process to load a BPF program to restrict its future useof system calls; it is a simple but flexible sandboxing mechanism that iswidely used. Those filter programs, though, run on the "classic" BPF virtualmachine, rather than the extended BPF(eBPF) machine used elsewhere in the kernel. Moving seccomp() to eBPF has been an often-requestedchange, but security concerns have prevented that from happening. Thelatest attempt to enable eBPF is this patchset from YiFei Zhu; whether it will succeed where others have failedremains to be seen.

Security updates have been issued by Debian (hyperkitty, libxml2, nginx, openjdk-11-jre-dcevm, rxvt-unicode, samba, and webkit2gtk), Fedora (exiv2, java-1.8.0-openjdk-aarch32, mingw-python-pillow, opendmarc, php-symfony3, php-symfony4, python-pillow, runc, rust-cranelift-codegen-shared, rust-cranelift-entity, and rxvt-unicode), openSUSE (curl, hivex, libu2f-host, libX11, libxls, singularity, and upx), Oracle (dotnet3.1 and dotnet5.0), Red Hat (docker, glib2, and runc), and Ubuntu (lz4).

The fourth 5.13 kernel prepatch is out fortesting. "So after two small rc releases, the other shoe finallydropped, and rc4 is fairly sizable."

AlmaLinux 8.4, a clone of RHEL filling the role that CentOS used toplay, has been released. Changes include full support for secure boot, adeveloper repository with packages not found in RHEL, and more; see the releasenotes for details.

Modern computing systems can feature multiple types of memory that differ intheir performance characteristics. The most common example is NUMAarchitectures, where memory attached to the local node is faster to accessthan memory on other nodes. Recently, persistent memory hasstarted appearing in deployed systems as well; this type of memory isbyte-addressable like DRAM, but it is available in larger sizes and is slower toaccess, especially for writes. This new memory type makes memory allocation even more complicatedfor the kernel, driving the need for a method to better manage multiple types ofmemory in one system.

The 5.12.8, 5.10.41, and 5.4.123 stable kernels have been released.These contain only a small handful of changes, including fixes to the BPFverifier to address a privilegeescalation vulnerability. Users of those series should upgrade.

Security updates have been issued by Debian (nginx), Fedora (chromium, curl, kernel, php-symfony3, php-symfony4, python-lxml, python-pip, and runc), Mageia (ceph and wireshark), openSUSE (mpv), Oracle (bind, idm:DL1, redis:6, slapi-nis, squid:4, and xorg-x11-server), SUSE (curl, nginx, postgresql10, postgresql12, postgresql13, slurm, slurm_18_08, and slurm_20_11), and Ubuntu (nginx).

Over on the Python Software Foundation blog, the reports from day 1 of the Python Language Summit are available. At the time of this writing, a few from day 2 are ready as well. There are lots of interesting topics discussed at the summit, including a talk on making CPython faster from Python creator Guido van Rossum. "Seven months ago, Guido van Rossum left a brief retirement to work at Microsoft. He was given the freedom to pick a project and decided to work on making CPython faster. Microsoft will be funding a small team consisting of Guido van Rossum, Mark Shannon, Eric Snow, and possibly others. [...] The team is optimistic about doubling CPython's speed for 3.11. They plan to try an adaptive, specializing byte code interpreter, which is a bit like the existing inline cache and a bit like the shadow byte code covered in Dino Viehland's talk." Some of the ideas go back to Shannon's thoughts on speeding up the interpreter that we looked at back in December.

When kernel developers want to communicate something about the state of arunning kernel, they tend to use printk(); that results in a logentry that is intended — with varying success — to be human-readable. As ithappens, though, theconsumers of that information are often not human; the kernel's log outputis also read by automated monitoring systems that are looking forproblems. The result is an impedance mismatch that often ends with themonitoring system missing important messages. The printk()format indexing patch set is the latest of many attempts to improvethis situation.

Security updates have been issued by Debian (djvulibre), Fedora (slapi-nis and upx), Gentoo (ceph and nginx), openSUSE (python-httplib2 and rubygem-actionpack-5_1), Slackware (curl), SUSE (curl, libX11, and python-httplib2), and Ubuntu (isc-dhcp, lz4, and nginx).

The LWN.net Weekly Edition for May 27, 2021 is available.

Internet RelayChat (IRC) is a longstanding protocol—or series of protocols—forcreating online,text-based chat rooms.While many of the "channels" (as chat rooms are usually called) are highly useful toa wide variety of projects and organizations, including much of thefree-software world,IRC seems to have a community that suffers frommore than its fair share of disagreements, hostile forks, vitriol, and other types ofdivisiveness. It is perhaps no huge surprise, then, that the IRCworld is currently undergoing another of its periodic upheavals. Thelargest IRC network, freenode, isembroiled in a messy dispute that has ledto the mass resignationof many of its volunteer staff, the founding of a competitor network (run by the former staff),and its abandonment by multiple high-profile projects.

Stable kernels 5.12.7, 5.10.40, 5.4.122, 4.19.192, 4.14.234, 4.9.270, and 4.4.270 have been released. As usual, theycontain important fixes and users should upgrade.

Security updates have been issued by Arch Linux (djvulibre, dotnet-runtime, dotnet-runtime-3.1, dotnet-sdk, dotnet-sdk-3.1, gupnp, hivex, lz4, matrix-synapse, prometheus, python-pydantic, runc, thunderbird, and websvn), Fedora (composer, moodle, and wordpress), Gentoo (bash, boost, busybox, containerd, curl, dnsmasq, ffmpeg, firejail, gnome-autoar, gptfdisk, icu, lcms, libX11, mariadb, mumble, mupdf, mutt, mysql, nettle, nextcloud-client, opensmtpd, openssh, openvpn, php, postgresql, prosody, rxvt-unicode, samba, screen, smarty, spamassassin, squid, stunnel, tar, tcpreplay, and telegram-desktop), openSUSE (Botan), Red Hat (kernel), Slackware (gnutls), SUSE (hivex, libu2f-host, and rubygem-actionpack-5_1), and Ubuntu (apport, exiv2, and libx11).

Version 3.0 ofMagit, a Git interface that runs inside emacs, has been released. "The big change are the completely reworked menus used to selectarguments and invoke suffix commands. Magit now uses the Transient package toimplement these menus." See the releasenotes for more details.

On March 24, version 1.6.0 of the Juliaprogramming language was released. This is thefirst feature release since 1.0 came out in 2018. The new releasesignificantly reduces the "time to first plot", which is a common source ofdissatisfaction for newcomers to the language, by parallelizingpre-compilation, downloading packages more efficiently, and reducing thefrequency of just-in-time re-compilations at run time.

Security updates have been issued by Fedora (python-eventlet), openSUSE (grub2 and mpv), and Red Hat (kpatch-patch and rh-ruby25-ruby).

Version1.1 of the Inkscape vector image editor has been released."Among the highlights in Inkscape 1.1 are a Welcome dialog, a CommandPalette, a revamped Dialog Docking System, and searchable preferenceoptions, along with new formats for exporting your work."

The multi-generational LRU patch set is a significant reworking of thekernel's memory-management subsystem that promises better performance for anumber of workloads; it was covered here inApril. Since then, two new versions of that work have been released bydeveloper Yu Zhao, withversion 3being posted on May 20. Some significant changes have been made sincethe original post, so another look is in order.

Security updates have been issued by Debian (libx11, prosody, and ring), Fedora (ceph, glibc, kernel, libxml2, python-pip, slurm, and tpm2-tss), Mageia (bind, libx11, mediawiki, openjpeg2, postgresql, and thunderbird), openSUSE (Botan, cacti, cacti-spine, chromium, djvulibre, fribidi, graphviz, java-1_8_0-openj9, kernel, libass, libxml2, lz4, and python-httplib2), and Slackware (expat).

The third 5.13 kernel prepatch is out fortesting. "It's been a very calm rc3 week, and at least in purenumber of commits this is the smallest rc3 we've had in the 5.xseries.Considering that the merge window was not in any way small, this is abit surprising, but I suspect it's one of those 'not everybody sent infixes this week' things that will rectify itself next week."This prepatch does include reverts and fixes for a long series of brokenpatches identified in the TAB report on the UMNmess.

The5.12.6,5.10.39,5.4.121,4.19.191,4.14.233,4.9.269, and4.4.269stable kernels have all been released; each contains yet another set ofimportant fixes.

In 2018, LWN covered a talk by GernotHeiser about the seL4 project, which has developed an open-sourceoperating system for safety-critical applications and gone to the troubleof proving its correctness. Much of that work has been done at CSIRO inAustralia. Heiser has announcedvia Twitter that CSIRO's support for this project is being shut down, withthe staff being redirected to artificial-intelligence projects. Hopefully the seL4 Foundation, established in2020, will be able to carry on this interesting work.

Version 5.34.0 of the Perl language has been released."Perl 5.34.0 represents approximately 11 months of development sincePerl 5.32.0 and contains approximately 280,000 lines of changes across2,100 files from 78 authors." See thispage for a list of changes; they include a new try/catch syntax, a newoctal syntax, and many improvements to various modules.