Security updates for Friday

Security updates have been issued by Debian (grub2, libvpx, libx11, libxpm, and qemu), Fedora (firefox, matrix-synapse, tacacs, thunderbird, and xrdp), Oracle (glibc), Red Hat (bind, bind9.16, firefox, frr, ghostscript, glibc, ImageMagick, libeconf, python3.11, python3.9, and thunderbird), Scientific Linux (ImageMagick), SUSE (kernel, libX11, and tomcat), and Ubuntu (linux-hwe-5.15, linux-oracle-5.15).

https://lwn.net/Articles/946848/


Ferrocene released as open source

Ferrous Systems has https://ferrous-systems.com/blog/ferrocene-open-source/

that its Ferrocene Rust compiler will be released under the Apache-2.0 and
MIT licenses.

	Ferrocene is the main Rust compiler - rustc - but quality managed
	and qualified for use in automotive and industrial environments
	(currently by ISO 26262 and IEC 61508) by Ferrous Systems. It
	operates as a downstream to the Rust project, further increasing
	its testing and quality on specific platforms.

The license is free, but this is not being run as an open-source project;
specifically, contributions from the "general public" are not accepted.

https://lwn.net/Articles/946732/


[$] GCC features to help harden the kernel

Hardening the Linux kernel is an endless task, with work required on
multiple fronts.  Sometimes, that work is not done in the kernel itself;
other tools, including compilers, can have a significant role to play.
At the 2023 GNU Tools
Cauldron, Qing Zhao covered some of the work that has been done in the
GCC compiler to help with the hardening of the kernel — along with work
that still needs to be done.

https://lwn.net/Articles/946041/


Security updates for Thursday

Security updates have been issued by Debian (chromium, libx11, and libxpm), Fedora (ckeditor, drupal7, glibc, golang-github-cncf-xds, golang-github-envoyproxy-control-plane, golang-github-hashicorp-msgpack, golang-github-minio-highwayhash, golang-github-nats-io, golang-github-nats-io-jwt-2, golang-github-nats-io-nkeys, golang-github-nats-io-streaming-server, golang-github-protobuf, golang-google-protobuf, nats-server, and pgadmin4), Red Hat (firefox and thunderbird), SUSE (chromium, exim, ghostscript, kernel, poppler, python-gevent, and python-reportlab), and Ubuntu (binutils, exim4, jqueryui, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15,
 linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15,
 linux-gke, linux-gkeop, linux-gkeop-5.15, linux-ibm, linux-ibm-5.15,
 linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia,
 linux-oracle, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4,
 linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4,
 linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle,
 linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-6.2, linux-azure, linux-azure-6.2,
 linux-azure-fde-6.2, linux-gcp, linux-gcp-6.2, linux-hwe-6.2, linux-kvm,
 linux-lowlatency, linux-lowlatency-hwe-6.2, linux-oracle, linux-raspi,
 linux-starfive, linux-kvm, linux-oem-6.1, nodejs, and python-django).

https://lwn.net/Articles/946698/


Security updates for Wednesday

Security updates have been issued by Debian (glibc, postgresql-11, and thunderbird), Fedora (openmpi, pmix, prrte, and slurm), Gentoo (glibc and libvpx), Oracle (kernel), Red Hat (kernel), Slackware (libX11 and libXpm), SUSE (firefox, kernel, libeconf, libqb, libraw, libvpx, libX11, libXpm, mdadm, openssl-1_1, poppler, postfix, python311, rubygem-puma, runc, and vim), and Ubuntu (freerdp2, glibc, grub2-signed, grub2-unsigned, libx11, libxpm, linux-intel-iotg, linux-intel-iotg-5.15, linux-oracle, linux-oracle-5.15, and mozjs102).

https://lwn.net/Articles/946496/


[$] Linux ecosystem contributions from SteamOS

The https://store.steampowered.com/steamos
 Linux
distribution is focused on gaming, naturally, but the effort to build it
has resulted
in contributions to multiple areas in the Linux ecosystem.  Alberto Garcia
has been working on SteamOS and came to Bilbao, Spain to describe some of those
contributions at Open Source Summit Europe 2023.  There are some obvious
areas where a gaming-focused OS might contribute upstream, such as
graphics, but the talk showed contributions in several other areas as well.

https://lwn.net/Articles/946188/


Security updates for Tuesday

Security updates have been issued by Debian (exim4), Fedora (firecracker, rust-aes-gcm, rust-axum, rust-tokio-tungstenite, rust-tungstenite, and rust-warp), Gentoo (nvidia-drivers), Mageia (chromium-browser-stable, glibc, and libwebp), Red Hat (kernel), SUSE (ghostscript and python3), and Ubuntu (firefox, libtommath, libvpx, and thunderbird).

https://lwn.net/Articles/946313/


Notes from the Git Contributor's Summit

For those who are curious about the recently concluded Git Contributor's
Summit, Taylor Blau has posted https://lwn.net/ml/git/ZRregi3JJXFs4Msb@nand.local/

from the event.  Topics include next-generation backends, libification,
backward compatibility, project management, and more.

https://lwn.net/Articles/946208/


Python 3.12 released

Version 3.12 of the Python programming language has been https://www.python.org/downloads/release/python-3120/
 for profiling, and lots more.

https://lwn.net/Articles/946189/


Kernel prepatch 6.6-rc4

Linus has released https://lwn.net/Articles/946092/
 for testing.
"There's nothing particularly odd in here, if you don't count a week of
no networking pull as being odd.  That does result in rc4 being fairly
small, but I suspect we'll just see a bigger rc5 to compensate."

https://lwn.net/Articles/946093/


[$] Impressions from the GNU Project's 40th anniversary celebration

On September 27, 1983, Richard Stallman announced the
founding of the GNU project.  His goal, which seemed wildly optimistic
and unattainable at the time, was to write a complete Unix-like operating
system from the beginning
and make it freely available.  Exactly 40 years later, the GNU project
celebrated with https://www.gnu.org/gnu40
 in
Switzerland.  Your editor had the good fortune to be able to attend.

https://lwn.net/Articles/945912/


Security updates for Friday

Security updates have been issued by Debian (firefox-esr, jetty9, and vim), Gentoo (Fish, GMP, libarchive, libsndfile, Pacemaker, and sudo), Oracle (nodejs:16 and nodejs:18), Red Hat (virt:av and virt-devel:av), Slackware (mozilla), SUSE (chromium, firefox, Golang Prometheus, iperf, libqb, and xen), and Ubuntu (linux-raspi).

https://lwn.net/Articles/945965/


[$] Security policies for GNU toolchain projects

While the CVE process was created in response to real problems, it's https://lwn.net/Articles/944209/
 that CVE numbers are
creating problems of their own.  At the https://gcc.gnu.org/wiki/cauldron2023
,
Siddhesh Poyarekar expressed the frustration that toolchain developers have
felt as the result of arguing with security researchers about CVE-number
assignments.  In response, the GNU toolchain community is trying to better
characterize what is — and is not — considered to be a security-relevant
bug in its software.

https://lwn.net/Articles/945536/


[$] LWN.net Weekly Edition for September 28, 2023

The LWN.net Weekly Edition for September 28, 2023 is available.

https://lwn.net/Articles/945211/


[$] Moving the kernel to large block sizes

Using larger block sizes in the kernel for I/O is a recurring topic in
storage and
block-layer circles.  The topic came up in https://lwn.net/Articles/933437/

at the Linux Storage, Filesystem, Memory-Management and BPF Summit (LSFMM)
back in
May.  One of the participants in those discussions, Hannes Reinecke,  gave
a talk at Open Source Summit Europe 2023 with an overview of the reasons
behind using larger blocks for I/O, the current status of that work, and
where it all might lead from here.

https://lwn.net/Articles/945646/


Security updates for Wednesday

Security updates have been issued by Oracle (libtiff), Red Hat (libtiff, nodejs:16, and nodejs:18), Slackware (mozilla), SUSE (bind, cacti, cacti-spine, ImageMagick, kernel, libwebp, netatalk, open-vm-tools, postfix, quagga, wire, and wireshark), and Ubuntu (cups, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp,
 linux-gcp-4.15, linux-hwe, linux-oracle, linux-bluefield, and linux-bluefield, linux-raspi, linux-raspi-5.4).

https://lwn.net/Articles/945700/


[$] AI from a legal perspective

The AI boom is clearly upon us, but there are still plenty of questions
swirling around this technology.  Some of those questions are legal ones
and there have been lawsuits filed to try to get clarification—and perhaps
monetary damages.  Van Lindberg is a lawyer who is well-known in the
open-source world; he came to Open
Source Summit Europe 2023 in Bilbao, Spain to try to put the current
work in AI into its legal context.

https://lwn.net/Articles/945504/


Firefox 118.0 released

Version
118.0 of the Firefox browser has been released.  Changes include
improved fingerprinting prevention and automated translation: "Automated
translation of web content is now available to Firefox users! Unlike
cloud-based alternatives, translation is done locally in Firefox, so that
the text being translated does not leave your machine."

https://lwn.net/Articles/945608/


Security updates for Tuesday

Security updates have been issued by Debian (exempi, glib2.0, lldpd, and netatalk), Fedora (curl, libppd, and linux-firmware), Oracle (kernel), and SUSE (Cadence, frr, modsecurity, python-CairoSVG, python-GitPython, and tcpreplay).

https://lwn.net/Articles/945559/


LibrePCB 1.0.0 Released

The https://librepcb.org/blog/2023-09-24_release_1.0.0/

"free, cross-platform, easy-to-use electronic design automation suite to draw schematics and design printed circuit boards".
As noted in a https://librepcb.org/blog/2023-05-15_roadmap_1.0/
, a grant has helped spur development of the tool.
The focus for the release has been in adding features that were needed so that "there should be no show stopper anymore which prevents you from using LibrePCB for more complex PCB [printed circuit board] designs".
New features include a 3D viewer and export format for working with designs in a mechanical computer aided design (CAD) tool, support for manufacturer part number (MFN) management, and lots of board editor features such as
thermal relief pads in planes, blind & buried vias,
keepout zones, and more. [Thanks to Alphonse Ogulla.]

https://lwn.net/Articles/945519/


[$] The European Cyber Resilience Act

The security of digital products has become a topic of regulation
in recent years. Currently, the European Union is moving forward
with another new law, which, if it comes into effect in a form
close to the current draft, will affect software developers worldwide.
This new proposal, called the "Cyber
Resilience Act" (CRA), brings mandatory security requirements on all
digital products, both software
and hardware, that are available in Europe. While it aims at a worthy goal, the
proposal is causing a stir among open-source communities.

https://lwn.net/Articles/944300/


The Debian Project mourns the loss of Abraham Raji

The Debian project is https://www.debian.org/News/2023/20230914
, who was killed in an accident on September 13.

Abraham was a popular and respected Debian Developer as well a prominent free software champion in his home state of Kerala, India. He was a talented graphic designer and led design and branding work for DebConf23 and several other local events in recent years. Abraham gave his time selflessly when mentoring new contributors to the Debian project, and he was instrumental in creating and maintaining the Debian India website.

The Debian Project honors his good work and strong dedication to Debian and Free Software. Abraham’s contributions will not be forgotten, and the high standards of his work will continue to serve as an inspiration to others.

https://lwn.net/Articles/944596/


[$] Shrinking shrinker locking overhead

Much of the kernel's performance is dependent on caching — keeping useful
information around for future use to avoid the cost of looking it up again.
The kernel aggressively caches pages of file data, directory entries,
inodes, slab objects, and much more.  Without active measures, though,
caches will tend to grow without bounds, leading to memory exhaustion.  The
kernel's "shrinker" mechanism exists to be that active measure, but
shrinkers have some performance difficulties of their own.  This
patch series from Qi Zheng seeks to address one of the worst of those
by removing some locking overhead.

https://lwn.net/Articles/944199/


[$] Why glibc's fstat() is slow

The https://man7.org/linux/man-pages/man2/stat.2.html

system call retrieves some of the metadata — owner, size, protections,
timestamps, and so on — associated with an open file descriptor.  One might
not think of it as a performance-critical system call, but there are
workloads that make a lot of fstat() calls; it is not something
that should be slowed unnecessarily.  As it turns out, though, the GNU C
Library (glibc) has been doing exactly that, but a fix is in the works.

https://lwn.net/Articles/944214/


Security updates for Thursday

Security updates have been issued by Debian (firefox-esr, libwebp, ruby-loofah, and ruby-rails-html-sanitizer), Fedora (open-vm-tools and salt), Oracle (.NET 7.0, dmidecode, flac, gcc, httpd:2.4, keylime, libcap, librsvg2, and qemu-kvm), Red Hat (.NET 6.0 and .NET 7.0), Slackware (libarchive and mozilla), SUSE (chromium and kernel), and Ubuntu (curl, firefox, ghostscript, open-vm-tools, postgresql-9.5, and thunderbird).

https://lwn.net/Articles/944481/


[$] LWN.net Weekly Edition for September 14, 2023

The LWN.net Weekly Edition for September 14, 2023 is available.

https://lwn.net/Articles/943823/


Stable kernels 6.5.3, 6.4.16, and 6.1.53

The
https://lwn.net/Articles/944356/
,
https://lwn.net/Articles/944357/
, and
https://lwn.net/Articles/944358/

stable kernel updates have been released; each contains a large number of
important fixes.  Note that the 6.4.x line ends with 6.4.16.

https://lwn.net/Articles/944355/


A GCC -fstack-protector vulnerability on arm64

The GCC stack-protector feature detects stack-based buffer overruns by
putting a canary value on the stack and noticing if that value is changed.
It
turns out, though, that dynamically allocated local variables (such as
variable-length arrays and space obtained with alloca()) are
placed beyond the canary, so overflows of those variables will not be
detected.  As a result, arm64 binaries built with vulnerable versions of
GCC are not as protected as they should be and need to be rebuilt.

	Dynamic allocations are just as susceptible to overflows as other
	locals. In fact, they're arguably more susceptible because they're
	almost always arrays, whereas fixed locals are often integers,
	pointers, or other types to which variable-length data is never
	written. GCC's own heuristics for when to use a stack guard reflect
	this.

Kees Cook, meanwhile, has https://fosstodon.org/@kees/111054213020992461
 that
the kernel no longer uses variable-length arrays, so kernel builds should
not be affected by this vulnerability.

https://lwn.net/Articles/944307/


Benjamin: Towards a new SymPy

In a https://oscarbenjamin.github.io/blog/czi/index.html#new-sympy
 covers polynomial handling; subsequent articles will examine other pieces of the puzzle.

I will be writing this in a series of blog posts. This first post will outline the structure of the foundations of a computer algebra system (CAS) like SymPy, describe some problems SymPy currently has and what can be done to address them. Then subsequent posts will focus in more detail on particular components and the work that has been done and what should be done in the future.

https://lwn.net/Articles/943995/


[$] Prerequisites for large anonymous folios

The work to add support for large anonymous
folios to the kernel has been underway for some time, but this feature
has not yet landed in the mainline.  The author of this work, Ryan Roberts,
has been trying to get a handle on what the remaining obstacles are so he
can address them.  On September 6, an online meeting of
memory-management developers discussed that topic and made some progress;
there is still some work to do, though, before large anonymous folios can
go upstream.

https://lwn.net/Articles/943758/


Security updates for Friday

Security updates have been issued by Debian (chromium, libssh2, memcached, and python-django), Fedora (netconsd), Oracle (firefox and thunderbird), Scientific Linux (firefox), SUSE (open-vm-tools), and Ubuntu (grub2-signed, grub2-unsigned, shim, and shim-signed, plib, and python2.7, python3.5).

https://lwn.net/Articles/943990/


Google bakes a user-tracking ad platform directly into Chrome (ars technica)

This
ars technica article looks at the widespread deployment of Google's
"privacy sandbox" in the Chrome browser:

	If you haven't been following this, this feature will track the web
	pages you visit and generate a list of advertising topics that it
	will share with web pages whenever they ask, and it's built
	directly into the Chrome browser. It's been in the news previously
	as "FLoC" and then the "Topics API," and despite widespread
	opposition from just about every non-advertiser in the world,
	Google owns Chrome and is one of the world's biggest advertising
	companies, so this is being railroaded into the production builds.

For those who use Chrome anyway, there are instructions on how to disable
this functionality.

https://lwn.net/Articles/943969/


Ubuntu to add TPM-backed full-disk encryption

The Ubuntu blog has a
detailed article on plans to add full-disk encryption, with the key
stored in the system's trusted platform module (TPM), to the desktop
distribution.

	In order to deliver these benefits, the implementation of
	TPM-backed FDE relies on two main design principles. First, it
	seals the FDE secret key to the full EFI state, including the
	kernel command line. Second, access to the decryption key will only
	be permitted if and when the device boots software that has been
	defined as authorised to access the confidential data.  This is
	when the initrd code will unseal the key in the secure-boot
	protected kernel.efi at boot time.

https://lwn.net/Articles/943869/


[$] Replacing openSUSE Leap

https://get.opensuse.org/leap/15.5/
 is a hybrid
distribution; it is based on SUSE's enterprise distribution (SLE), which
follows the "slow and stable" approach, but adds a number of newer packages
on top.  Leap is intended to be a desktop-oriented distribution with a stable
and reliable base.  As SUSE transitions away from its traditional
enterprise distribution toward its "Adaptable
Linux Platform" (ALP), though, the stable base upon which openSUSE Leap
is built is going away.  The openSUSE community is currently discussing how
the project should respond.

https://lwn.net/Articles/943591/


Security updates for Thursday

Security updates have been issued by Fedora (erofs-utils, htmltest, indent, libeconf, netconsd, php-phpmailer6, tinyexr, and vim), Red Hat (firefox), and Ubuntu (linux-aws, linux-aws-5.15, linux-ibm-5.15, linux-oracle, linux-oracle-5.15, linux-azure, linux-azure-fde-5.15, linux-gke, linux-gkeop, linux-intel-iotg-5.15, linux-raspi, linux-oem-6.1, linux-raspi, linux-raspi-5.4, shiro, and sox).

https://lwn.net/Articles/943856/


[$] LWN.net Weekly Edition for September 7, 2023

The LWN.net Weekly Edition for September 7, 2023 is available.

https://lwn.net/Articles/943199/


Four stable kernel releases

The
https://lwn.net/Articles/943752/
,
https://lwn.net/Articles/943753/
,
https://lwn.net/Articles/943754/
, and
https://lwn.net/Articles/943755/

stable kernels have been released; each contains another set of important
fixes.

https://lwn.net/Articles/943751/