Back in 2017, Waiman Long posted a patchset placing limits on the number of "negative dentries" stored by thekernel. The better part of three years later, that work continues with,seemingly, no better prospects for getting into the mainline. It would beunderstandable, though, if many people out there don't really know whatnegative dentries are or why kernel developers care about them. That, atleast, can be fixed, even if the underlying problem seems to be moredifficult.
A recent message tothe debian-project mailing list by Debian project leader (DPL) Sam Hartman isabout a proposal to moderate the mailing list. There have been repeatedattacks on various project members and the distribution itself posted tothe list over the last few years, many from sock-puppet, throwaway email accounts, which spawned a recent discussion onthe debian-private mailing list; Hartman was summarizing that discussionfor those who are not on the private list. But the problems ondebian-project (and other Debian public lists) are kind of just the tip ofthe iceberg; there is an ongoing, persistent effort to roil thedistribution and its community.
Version 3.36 of the GNOME desktop environment is out. "This release brings a new lock screen and a new app for managing shellextensions, among other things. Once again, the shell has received manyperformance improvements.Improvements to core GNOME applications include better support for meterednetworks and parental controls in GNOME Software, a new look for the initialsetup assistant, a redesigned GNOME Clocks, and many more." See the releasenotes for details and screenshots.
For those who are interested in the details of graphics synchronization:Jason Ekstrand describes in detail the value of explicit synchronization,the reason why we can't have it now, and a proposal for eventually makingit possible to go explicit. "Explicit synchronization is the future of graphics and media. Atleast, that seems to be the consensus among all the graphics peopleI've talked to. I had a chat with one of the lead Android graphicsengineers recently who told me that doing explicit sync from the startwas one of the best engineering decisions Android ever made. It'salso the direction being taken by more modern APIs such as Vulkan."
Security updates have been issued by CentOS (qemu-kvm and sudo), Debian (chromium), Mageia (gpac, libseccomp, and tomcat), openSUSE (gd and postgresql10), Oracle (qemu-kvm), Red Hat (chromium-browser), Scientific Linux (qemu-kvm), Slackware (firefox), and SUSE (ipmitool, java-1_7_0-openjdk, librsvg, and tomcat).
The Let's Encrypt project has madereal strides in helping to ensure that every web site can use the encryptedHTTPS protocol; it has provided TLS certificates at no charge that areaccepted by most or all web browsers. Free certificates accepted by thebrowsers are something that was difficult to find prior to the advent of the project in 2014; as of the end of February, theproject has issuedover a billion certificates. But a bug that was recentlyfound in the handling of Certificate AuthorityAuthorization (CAA) by the project put roughly 2.6% of the activecertificates—roughly three million—at risk of immediate revocation. As might beexpected, that caused a bit of panic in some quarters, but it turned outthat the worst outcome was largely averted.
The latest release of Firefox features some login management improvements,the ability to add custom sites to the Facebook Container, better privacyfor web voice and video calls, and better add-on management. See the release notesfor more information.
Security updates have been issued by Debian (libvpx and network-manager-ssh), Fedora (cacti, cacti-spine, and podman), openSUSE (chromium and python-bleach), Oracle (curl), Red Hat (ansible and qemu-kvm), SUSE (gd, ipmitool, and php7), and Ubuntu (runc and sqlite3).
The Linux development community is spread out over the planet andinteracts primarily through email and online systems. It is widelyfelt, though, that there is great value in getting people together inperson occasionally to talk about current issues and get to knoweach other as people. This year, though, the coronavirus pandemic isdisrupting the conference schedule to an extent that won't be known forsome time. But there are longer-term concerns as well, to the point thatthe head organizer for one of the kernel community's most successful eventsis questioning whether it should continue to exist.
LibrePlanet was scheduled for March 14-15 but it has been canceled. "However, just because we won't be holding a conference in person this year doesn't mean that we've given up our fight to "free the future." Instead, LibrePlanet will be a fully free (as in freedom) virtual conference and livestream. We had an extremely exciting program planned, and we're going to try and maintain as much of that schedule as possible with all of the speakers who are willing and able to participate remotely. The resulting livestream will be run on and entirely accessible via free software, so that you can enjoy these amazing talks from the comfort of your home."
The ChemnitzerLinux-Tage that was to take place March 14-15 has been canceled. "Whether we meet later this year or first in March 2021, we will discuss within the organization team in the next few days."
The openSUSE Summit in Dublin, Ireland was scheduled for March 27-28. Theevent has been canceleddue to travel bans. SUSECON isstill scheduled for March 23-27, however it will be a digital event. Thein-person meeting in Dublin has been canceled.
Linus has put out a high-altitude 5.6-rc5prepatch release. "That said, everything looks mostly fine. I say'mostly', because while nothing in particular looks worrisome, this rc5 isbigger than I'd have liked. In fact, it's not only bigger than rc4 was, butit's bigger than we historically are at this point."
Systemd 245 is out. As usual, the list of new features is long; perhapsthe one that has gained the most attention is systemd-homed:A small new service systemd-homed.service has been added, that may be used to securely manage home directories with built-in encryption. The complete user record data is unified with the home directory, thus making home directories naturally migratable.There is also a new database for holding user and group data and asystemd-repart tool for the management of partitions on storage-devices atboot time.
DNF, the Fedora package manager, is going to be significantly rewritten; itseems it is truly "development not finished" for now."We've managed to drop a lot of redundant code across the whole DNF stack in the past years, but we have reached a point when it's nearly impossible to consolidate the code any further without breaking the API/ABI. Especially with PackageKit being dead, we can't move with the old 'libhif' API in libdnf, because making any bigger changes to PackageKit is clearly out of scope."
System calls on Linux are relatively cheap, though the mitigations forspeculative-execution vulnerabilities have made them more expensive thanthey once were. But even cheap system calls add up if one has to make alarge number of them. Thus, developers have been working on ways to avoidsystem calls for a long time. Currently under discussion is a pair of waysto reduce the number of system calls required to read a file's contents,one of which is rather simpler than the other.
Security updates have been issued by Arch Linux (chromium, opensc, opensmtpd, and weechat), Debian (jackson-databind and pdfresurrect), Fedora (sudo), openSUSE (openfortivpn and squid), Red Hat (virt:8.1 and virt-devel:8.1), Scientific Linux (http-parser and xerces-c), and SUSE (gd, kernel, postgresql10, and tomcat).
Over on the Collabora blog, Julian Bouzas writes about PipeWire, which is a relatively new multimedia server for the Linux desktop and beyond. "PipeWire was originally created to only handle access to video resources and co-exist with PulseAudio. Earlier versions have already been shipping in Fedora for a while, allowing Flatpak applications to access video cameras and to implement screen sharing on Wayland. Eventually, PipeWire has ended up handling any kind of media, to the point of planning to completely replace PulseAudio in the future. The new 0.3 version is marked as a preview for audio support.But why replace PulseAudio? Although PulseAudio already provides a working intermediate layer to access audio devices, PipeWire has to offer more features that PulseAudio was not designed to deliver, starting with a better security model, which allows isolation between applications and secure access from within containers.Another interesting feature of PipeWire is that it unifies the two audio systems used on the desktop, JACK for low-latency professional audio and PulseAudio for normal desktop use-cases. PipeWire was designed to be able to accommodate both use cases, delivering very low latency, while at the same time not wasting CPU resources. This design also makes PipeWire a much more efficient solution than PulseAudio in general, making it a perfect fit for embedded use cases too."
The Positive Technologies blog is reporting on an unfixable flaw the company has found in Intel x86 hardware that has the potential to subvert the hardware root of trust for a variety of processors. "The EPID [Enhanced Privacy ID] issue is not too bad for the time being because the Chipset Key is stored inside the platform in the One-Time Programmable (OTP) Memory, and is encrypted. To fully compromise EPID, hackers would need to extract the hardware key used to encrypt the Chipset Key, which resides in Secure Key Storage (SKS). However, this key is not platform-specific. A single key is used for an entire generation of Intel chipsets. And since the ROM vulnerability allows seizing control of code execution before the hardware key generation mechanism in the SKS is locked, and the ROM vulnerability cannot be fixed, we believe that extracting this key is only a matter of time. When this happens, utter chaos will reign. Hardware IDs will be forged, digital content will be extracted, and data from encrypted hard disks will be decrypted." Intel has said that it is aware of the problem (CVE-2019-0090), but since it cannot be fixed in the ROM, Intel is "trying to block all possible exploitation vectors"; the fix for CVE-2019-0090 only blocks one such vector, according to the blog post.
Greg Kroah-Hartman has announced the release of the 5.5.8, 5.4.24,and 4.19.108 stable kernels. There arefixes throughout the tree, as usual; users should upgrade.
Like many larger free-software projects, openSUSE has an elected board that is charged with handling various non-technical tasks: organizing events,dealing with conduct issues, managing the project's money, etc. Sitting onsuch a board is usually a relatively low-profile activity; developmentcommunities tend to pay more attention to technical contributions thanother types of service. Every now and then, though, board-related issuesburst into prominence; that is the case now in the openSUSE project, whichwill be holding a special election after the abrupt resignation ofone-third of its board.
KubeCon + CloudNativeCon Europe 2020, which was originally scheduled for March 30-April 2 in Amsterdam, has been postponed until July or August due to COVID-19 concerns. In addition, KubeCon + CloudNativeCon China 2020, scheduled for July in Shanghai, has been canceled "due to the uncertainty around travel to China and our ability to assemble the speakers, sponsors, and attendees necessary for a successful event". It seems likely that these are not the last conferences that will be affected in our communities.
Security updates have been issued by CentOS (http-parser and xerces-c), Debian (tomcat7), Fedora (opensmtpd), openSUSE (openfortivpn and permissions), Red Hat (http-parser, openstack-octavia, python-waitress, and sudo), Slackware (ppp), and SUSE (kernel).
By most accounts, the freedesktop.org (fd.o) GitLab instance has beena roaring success; lots of projects are using it, including Mesa, Linux kernelgraphics drivers, NetworkManager, PipeWire, and many others. Inaddition, a great deal ofcontinuous-integration (CI) testing is being done on a variety of projectsunder the fd.o umbrella. That success has come at a price, however. Arecent message from the X.Org Foundation, which mergedwith fd.o in 2019, has made it clear that the current situation is untenable from a financialperspective. Given its current resources, X.Org cannot continue coveringthose costs beyond another few months.
Sam Hartman has announced that he will not run for a second term as DebianProject Leader at this time. "TL;DR: Overall, being DPL has beenincredibly rewarding. I have enjoyed working with you all, and haveenjoyed the opportunity to contribute to the Debian Project. I hope to beDPL again some year, but 2020 is the wrong year for me and for the project.So I will not nominate myself this year, but hope to do so some futureyear."
Security updates have been issued by Debian (libzypp), Fedora (opensmtpd and thunderbird), openSUSE (nodejs8), Red Hat (http-parser, kpatch-patch, and xerces-c), SUSE (cloud-init, compat-openssl098, kernel, postgresql96, python, and yast2-rmt), and Ubuntu (python-django and rake).
Handling time zones is a pretty messy affair overall, but language runtimes mayhave even bigger problems. As a recent discussion on the Python discussionforum shows, there are considerations beyond those that an operatingsystem or distribution needs to handle. Adding support for the IANA time zonedatabase to the Python standard library, which would allow using nameslike "America/Mazatlan" to designate time zones, is more complicated thanone might think—especially for a language trying to support multiple platforms.
Security updates have been issued by Debian (linux-4.9, proftpd-dfsg, rrdtool, and zsh), Fedora (kernel), openSUSE (cacti, cacti-spine, mariadb, and ppp), Red Hat (kernel, qemu-kvm, qemu-kvm-ma, and ruby), Slackware (seamonkey), SUSE (kernel, libpng16, ovmf, python-aws-sam-translator, python-boto3, python-botocore, python-cfn-lint, python-jsonschema, python-nose2, python-parameterized, python-pathlib2, python-pytest-cov, python-requests, python-s3transfer, and python36), and Ubuntu (libpam-radius-auth, OpenSMTPD, and ppp).
The kernel development process is based on trust at many levels — trust indevelopers, but also in the infrastructure that supports the community. Insome cases, that trust may not be entirely deserved; most of us have longsince learned not to trust much of anything that shows up in email, forexample, but developers still generally trust that emailed patches will be whatthey appear to be. In his ongoing effort to bring more security to kerneldevelopment, Konstantin Ryabitsev has proposed apatch attestation scheme that could help subsystem maintainers verifythe provenance of the patches showing up in their mailboxes.
The 5.6-rc4 kernel prepatch has beenreleased. "Fairly reasonably sized rc4, and the diffstat looks nice and flattoo (which basically means 'lots of small changes') except for anetfilter ipset fix that ended up being somewhat big and involved dueto locking changes."
The Netdev 0x14 conference, scheduled to begin March 17 in Vancouver,has been postponed due to coronavirus concerns; it has been tentativelyrescheduled for June 16 to 19 at the same location.
One of the basic rules of kernel-module development is that modules canonly access symbols (functions and data structures) that have beenexplicitly exported. Even then, many symbols are restricted so that onlymodules with a GPL-compatible license can access them. It turns out,though, that there is a readily available workaround that makes it easy fora module to access any symbol it wants. That workaround seems likely to beremoved soon despite some possible inconvenience for some out-of-treeusers; the reason why that is happening turns out to be relativelyinteresting.
Security updates have been issued by CentOS (java-1.7.0-openjdk and ppp), Debian (libimobiledevice, libusbmuxd, and pure-ftpd), Fedora (caddy, firejail, golang-github-gorilla-websocket, golang-vitess, hugo, mingw-libpng, php, and proftpd), openSUSE (chromium, enigmail, ipmitool, libsolv, libzypp, zypper, weechat, and yast2-rmt), Oracle (java-1.7.0-openjdk and ppp), Red Hat (java-1.7.0-openjdk and ppp), Scientific Linux (java-1.7.0-openjdk and ppp), and SUSE (java-1_8_0-ibm, kernel, mariadb, mariadb-100, openssl, php5, python, rsyslog, and texlive-filesystem).
Thispatch from Johannes Weiner seemed like a straightforward way to improvememory-reclaim performance; without it, the virtual filesystem layer throwsaway memory that the memory-management subsystem thinks is still worthkeeping. But that patch quickly ran afoul of a feature (or "misfeature"depending on who one asks) from the distant past,one which goes by the name of "high memory". Now, more than 20 years after itsaddition, high memory may bebrought down low, as developers consider whether it should be deprecatedand eventually removed from the kernel altogether.
Security updates have been issued by CentOS (kernel, ksh, python-pillow, and thunderbird), Debian (opensmtpd, proftpd-dfsg, and rake), Fedora (NetworkManager-ssh), openSUSE (chromium), and SUSE (libexif, mariadb, ovmf, python3, and squid).
The "kernel runtime security instrumentation" (KRSI) patch set has beenmaking the rounds over the past few months; the idea is to use the Linuxsecurity module (LSM) hooks as a way to detect, and potentially deflect,active attacks against a running system.It does so by allowing BPF programs to be attached to the LSM hooks. That hascaused some concern in the past about exposing thesecurity hooks as external kernel APIs, which makes them potentiallysubject to the "don't break user space" edict. But there has been no real objectionto the goals of KRSI. The fourth versionof the patch set was postedby KP Singh on February 20; the concerns raised this time are aboutits impact on the LSM infrastructure.
Security updates have been issued by Debian (python-pysaml2), Mageia (clamav, graphicsmagick, opencontainers-runc, squid, and xmlsec1), Oracle (kernel, ksh, python-pillow, systemd, and thunderbird), Red Hat (rh-nodejs12-nodejs), Scientific Linux (ksh, python-pillow, and thunderbird), and SUSE (nodejs6, openssl, ppp, and squid).
BPF has exploded within the Linux worldover the last few years, growing from its networking roots into the go-to tool for running customin-kernel programs. Its role seems to expand with every kernel releaseinto diverse areas such as security and device control. But none of thatis the focus of a relatively new book from Brendan Gregg, BPFPerformance Tools; it looks, instead, at how BPF provides visibility intothe guts of the kernel. Finding performance bottlenecks ofvarious sorts on (generally large) production systems is an area where BPFand the tool set that has grown up around it can excel; Gregg's bookdescribes that landscape in great depth.
Version19 of the Arch-based Manjaro distribution is out."The Xfce edition remains our flagship offering and has received theattention it deserves. Only a few can claim to offer such a polished,integrated and leading-edge Xfce experience. With this release we ship Xfce4.14 and have mostly focused on polishing the user experience with thedesktop and window manager. Also we have switched to a new theme calledMatcha. A new feature Display-Profiles allows you to store one or moreprofiles for your preferred display configuration. We also have implementedauto-application of profiles when new displays are connected."
The Free Software Foundation has announcedthat it is planning to launch a public code hosting and collaborationplatform later this year. "We plan on contributing improvementsupstream for the new forge software we choose, to boost its score on [GNUethical repository] criteria. Our tech team is small for the size of thenetwork we maintain, and we don't have any full-time developers who workfor the FSF, so we are limited in the amount of time we can spend on thesoftware we choose. We'll communicate with the upstream developers torequest improvements and help clarify any questions related to the ethicalrepository criteria."
Security updates have been issued by Debian (curl and otrs2), Fedora (NetworkManager-ssh and python-psutil), Mageia (ipmitool, libgd, libxml2_2, nextcloud, radare2, and upx), openSUSE (inn and sudo), Oracle (kernel, ksh, python-pillow, and thunderbird), Red Hat (curl, kernel, nodejs:10, nodejs:12, procps-ng, rh-nodejs10-nodejs, ruby, and systemd), SUSE (dpdk, firefox, java-1_7_1-ibm, java-1_8_0-ibm, libexif, libvpx, nodejs10, nodejs8, openssl1, pdsh, slurm_18_08, python-azure-agent, python3, and webkit2gtk3), and Ubuntu (libapache2-mod-auth-mellon, libpam-radius-auth, and rsync).
Filesystems, by design, hide a lot of complexity from users. At times,though, those users need to be able to look inside the black box and extractinformation about what is going on within a filesystem. Answering thisneed is David Howells, the creator of a number of filesystem-orientedsystem calls; in thispatch set he tries to add three more, one of which we have seen beforeand two of which are new.
The 5.6-rc3 kernel prepatch is out fortesting. Linus says: "Fairly normal rc3 as far as I can tell. We'veseen bigger, but we've seen smaller ones too. Maybe this is slightly on the low side ofaverage at this time, which would make sense since this was a smallermerge window. Anyway, too much noise in the signal to be sure eitherway."
LWN.net