[$] A new version of modversions

The genksyms tool has long been buried deeply within the kernel's
build system; it is one of the two C-code parsers shipped with the kernel
(the other being the
horrifying kernel-doc script).  It is a key part of how the
kernel's module-loading infrastructure works.  While genksyms has
quietly done its job for decades, that period may soon be coming to an end.
It would seem that genksyms is not up to the task of handling Rust
code, so Sami Tolvanen is proposing
a new tool to handle this task going forward.

https://lwn.net/Articles/986892/


Security updates for Monday

Security updates have been issued by Debian (chromium, python-html-sanitizer, and trafficserver), Fedora (nginx, nginx-mod-fancyindex, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts, python-webob, python3-docs, python3.11, python3.12, python3.9, and zabbix), Red Hat (bind, bind and bind-dyndb-ldap, bind9.16, httpd, kernel, kernel-rt, and nodejs:20), SUSE (caddy, chromium, chromium, gn, rust-bindgen, cockpit, fetchmail, gdcm, gh, keybase-client, libhtp, libofx, nano, plasma5-workspace, python-nltk, python-notebook, xen, and znc), and Ubuntu (linux-azure, linux-azure-4.15, linux-azure-5.4, and linux-oracle-5.15).

https://lwn.net/Articles/987309/


Kernel prepatch 6.11-rc5

The https://lwn.net/Articles/987163/
 kernel prepatch is out for
testing.  "Other than the timing, there's not a whole lot unusual
here. The diffstat looks fairly flat, which means 'mostly pretty small
changes'." Linus Torvalds added a
note that today marks the 33rd anniversary of the first Linux
announcement; "A third of a century. And it *still* isn't ready".

https://lwn.net/Articles/987164/


[$] The history, status, and plans for reproducible builds

On the second day of https://debconf24.debconf.org/

in Busan, South Korea, Holger Levsen provided a history lesson on the
"first 11 years" of the https://reproducible-builds.org/
.
He has been involved in the project for most of that time and has been a
Debian user since the mid-1990s, contributor since 2001, and a Debian
member since 2007; "I love Debian".  Meanwhile, his aim is to make all free
software be reproducible, so that anyone can check that a binary program
comes from the source code it purports to.

https://lwn.net/Articles/985739/


Forgejo changes license to GPLv3+

The

Forgejo project has https://forgejo.org/2024-08-gpl/
 that, starting from version 9.0, Forgejo will be released under the GPLv3 license (or a later version). Older versions of the software forge remain MIT-licensed.

A copyleft license makes reusing other copyleft software easier. Recently, we discovered that

some of the dependencies we used were incompatible with the license Forgejo was distributed with, and they had to be removed for now. Choosing copyleft licenses enables us to reuse more work, and saves us precious time to focus on improving Forgejo itself.

https://lwn.net/Articles/986998/


Security updates for Friday

Security updates have been issued by Fedora (community-mysql, iaito, and radare2), Oracle (python3.12-setuptools and tomcat), Red Hat (krb5 and podman), Slackware (ffmpeg), SUSE (apache2, expat, firefox, webkit2gtk3, and xen), and Ubuntu (imagemagick and libxstream-java).

https://lwn.net/Articles/986997/


LibreOffice 24.8 released

Version
24.8 of the LibreOffice office suite has been released.  Changes
include the ability to filter identifying information from exported files,
easier creation of cross reference, better control over hyphenation, a
number of new spreadsheet functions, accessibility improvements, and more.

https://lwn.net/Articles/986906/


[$] A review of file descriptor memory safety in the kernel

On July 30, Al Viro sent

a patch set to the linux-fsdevel mailing list with a
comprehensive cover letter explaining his
recent work on ensuring that the kernel's internal representation of
file descriptors are used correctly in the kernel.
File descriptors are ubiquitous; many system calls
need to handle them. Viro's review
identified a few existing bugs, and may prevent more in the future. He also had
suggestions for ways to keep uses consistent throughout the kernel.

https://lwn.net/Articles/985853/


Garrett: What is an SBAT and why does everyone suddenly care

Matthew Garrett describes
the role of the Secure Boot Advanced Targeting mechanism and how it
played into the recent Windows upgrade problems.

	So why is this suddenly relevant? SBAT was developed
	collaboratively between the Linux community and Microsoft, and
	Microsoft chose to push a Windows update that told systems not to
	trust versions of grub with a security generation below a certain
	level. This was because those versions of grub had genuine security
	vulnerabilities that would allow an attacker to compromise the
	Windows secure boot chain, and we've seen real world examples of
	malware wanting to do that.

https://lwn.net/Articles/986844/


Security updates for Thursday

Security updates have been issued by AlmaLinux (.NET 8.0, bind, bind9.16, curl, edk2, firefox, gnome-shell, grafana, jose, krb5, libreoffice, mod_auth_openidc:2.3, orc, pcs, poppler, python-setuptools, python-urllib3, python3.11-setuptools, python3.12-setuptools, thunderbird, tomcat, and wget), Fedora (webkitgtk), SUSE (apache2, glib2, and roundcubemail), and Ubuntu (kernel, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15,
 linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15,
 linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm,
 linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm,
 linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle,
 linux-raspi, linux, linux-aws, linux-azure, linux-bluefield, linux-gcp, linux-gcp-5.4,
 linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm,
 linux-oracle, linux-oracle-5.4, linux-raspi, linux-xilinx-zynqmp, linux, linux-aws, linux-azure, linux-gcp, linux-gke, linux-ibm,
 linux-lowlatency, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency,
 linux-oem-6.8, linux-oracle, linux-raspi, linux, linux-aws, linux-kvm, linux-lts-xenial, linux, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-aws, linux-aws-hwe, linux-bluefield, linux-hwe-5.15, linux-raspi-5.4, and qemu).

https://lwn.net/Articles/986841/


[$] LWN.net Weekly Edition for August 22, 2024

The LWN.net Weekly Edition for August 22, 2024 is available.

https://lwn.net/Articles/985783/


“Something has gone seriously wrong,” dual-boot systems warn after Microsoft update (ars technica)

Ars technica https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-linux-users/

a recent https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-2601

that is causing problems for users with systems that dual-boot Windows
and Linux.

"Note that Windows says this update won't apply to systems that
dual-boot Windows and Linux," one frustrated person wrote. "This
obviously isn't true, and likely depends on your system configuration
and the distribution being run. It appears to have made some linux efi
shim bootloaders incompatible with microcrap efi bootloaders (that's
why shifting from MS efi to 'other OS' in efi setup works). It appears
that Mint has a shim version that MS SBAT doesn't recognize."

The reports indicate that multiple distributions, including Debian,
Ubuntu, Linux Mint, Zorin OS, and Puppy Linux, are all
affected. Microsoft has yet to acknowledge the error publicly, explain
how it wasn't detected during testing, or provide technical guidance
to those affected. Company representatives didn't respond to an email
seeking answers.

https://lwn.net/Articles/986659/


Górny: Gentoo: profiles and keywords rather than releases

Gentoo developer Michał Górny has written a lengthy blog
post that explains how Gentoo approaches releases:

Gentoo is something of a hybrid, as it combines the best of both
worlds. It is a rolling release distribution with a single shared
repository that is available to all users. However, within this
repository we use a keywording system to provide a choice between
stable and testing packages, to facilitate both production and
development systems (with some extra flexibility), and versioned
profiles to tackle major lock-step upgrades.

https://lwn.net/Articles/986655/


[$] Python subinterpreters and free-threading

At
https://us.pycon.org/2024/
 in Pittsburgh,
Pennsylvania, Anthony Shaw looked at the various kinds of parallelism
available to Python programs.  There have been two major developments on
the parallel-execution front over the last few years, with the effort to
provide https://lwn.net/Articles/820424/
, each with its own
global interpreter lock (GIL), along with the work to https://lwn.net/Articles/940780/
.  In the talk, he
explored the two approaches to try to give attendees a sense of how to make
the right choice for their applications.

https://lwn.net/Articles/985041/


uv 0.3.0 released

https://github.com/astral-sh/uv/releases/tag/0.3.0

Python package and project manager has been released. https://astral.sh/blog/uv
 in
February, uv is written in Rust and aims to be "Cargo for
Python".  Notable changes in this release include the addition of
interfaces for https://docs.astral.sh/uv/concepts/projects/
, installing
Python, https://docs.astral.sh/uv/guides/scripts/
,
and https://docs.astral.sh/uv/
. See the
accompanying https://astral.sh/blog/uv-unified-python-packaging
 for more information.

https://lwn.net/Articles/986528/


[$] Per-call-site slab caches for heap-spraying protection

One tactic often used by attackers set on compromising a system is https://en.wikipedia.org/wiki/Heap_spraying
; in
short, the attacker fills as much of the heap as possible with crafted data
in the hope of getting the target system to use that data in a bad way.  If
heap spraying can be blocked, attackers will lose an important tool.  The
kernel has some heap-spraying defenses now, including the https://lwn.net/Articles/965837/
 merged for the
upcoming 6.11 release, but its author, Kees Cook, thinks that more can be
done.

https://lwn.net/Articles/986174/


Security updates for Tuesday

Security updates have been issued by Debian (squid), Fedora (putty), Mageia (quictls), Oracle (bind, curl, python-setuptools, python3.11-setuptools, and python3.12-setuptools), Red Hat (kernel, kpatch-patch-4_18_0-305_120_1, kpatch-patch-4_18_0-372_87_1 and kpatch-patch-4_18_0-372_91_1, kpatch-patch-4_18_0-477_43_1, kpatch-patch-4_18_0-553, kpatch-patch-5_14_0-284_48_1 and kpatch-patch-5_14_0-284_52_1, kpatch-patch-5_14_0-427_13_1, and libreoffice), SUSE (cosign, dri3proto, presentproto, wayland-protocols, xwayland, freerdp, fwupdate, git, gnome-settings-daemon, hdf5, jasper, java-17-openjdk, java-1_8_0-ibm, java-1_8_0-openjdk, kernel, kernel-firmware, libaom, libqt5-qt3d, libqt5-qtquick3d, ntfs-3g_ntfsprogs, osc, python, python-aiohttp, python-azure-core, python-azure-storage-blob, python- azure-storage-queue, python-typing, python-typing_extensions, python-Jinja2, python-PyMySQL, python-requests, python-tqdm, python-WebOb, python3-sqlparse, python310, python311, qemu, sssd, thunderbird, tiff, unixODBC, uriparser, and wireshark), and Ubuntu (intel-microcode, linux-azure-5.4, and postgresql-12, postgresql-14, postgresql-16).

https://lwn.net/Articles/986450/


[$] FreeBSD considers Rust in the base system

The https://www.freebsd.org/
 is, for the second
time this year, engaging in a long-running discussion about the
possibility of including Rust in its base
system. The sequel to the first discussion included some work by
Alan Somers to show what it might look like to use Rust code in the
base tree. Support for Rust code does not appear much closer to being
included in FreeBSD's base system, but the conversation has been
enlightening.

https://lwn.net/Articles/985210/


Seven new stable kernels

Today's crop of new stable kernels consists of seven new versions: https://lwn.net/Articles/986230/
.  As usual, each contains important
fixes throughout the kernel tree.

https://lwn.net/Articles/986229/


Security updates for Monday

Security updates have been issued by Debian (python-asyncssh), Fedora (bind, bind-dyndb-ldap, httpd, and tor), SUSE (cosign, cpio, curl, expat, java-11-openjdk, ncurses, netty, netty-tcnative, opera, python-Django, python-Pillow, shadow, sudo, and wpa_supplicant), and Ubuntu (firefox).

https://lwn.net/Articles/986225/


Formatted Rust kernel documentation available

The Rust code being added to the kernel is documented using the usual https://doc.rust-lang.org/rustdoc/what-is-rustdoc.html

conventions; that documentation is now https://rust.docs.kernel.org/kernel/
 in
formatted form.  There is also the linux-next version of
the documentation for Rust code that will land in the kernel soon.

https://lwn.net/Articles/986167/


Kernel prepatch 6.11-rc4

The https://lwn.net/Articles/986162/
 is out for
testing.  According to Linus:

	But it all looks fairly normal. rc4 is bigger than either rc2 or
	rc3 were, but not hugely so, and it's actually a normal pattern,
	where it takes a while before people find some issues. So nothing
	feels all that odd.

https://lwn.net/Articles/986163/


Gentoo Linux drops IA-64 (Itanium) support

The https://www.gentoo.org/
 project has
https://www.gentoo.org/news/2024/08/14/Gentoo-drops-IA-64-support.html

that it is dropping support for Itanium:

Following the removal of https://en.wikipedia.org/wiki/Itanium

support in the https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cf8e8658100d4eae80ce9b21f7a81cb024dd5057

and https://sourceware.org/git/?p=glibc.git;a=commit;h=460860f457e2a889785c506e8c77d4a7dff24d3e
,
and https://public-inbox.gentoo.org/gentoo-dev/75654daa-c5fc-45c8-a104-fae43b9ca490@gentoo.org/T/
, as well as
a https://projects.gentoo.org/council/meeting-logs/20240721-summary.txt
, Gentoo will discontinue all ia64
profiles and keywords. The primary reason for this decision is the
inability of the Gentoo IA-64 team to support this architecture
without kernel support, glibc support, and a functional development
box (or even a well-established emulator). In addition, there have
been only very few users interested in this type of hardware.

https://lwn.net/Articles/986030/


[$] Custom string formatters in Python

Python has had
https://lwn.net/Articles/656898/

(f-strings), a syntactic shorthand for building
strings, since 2015. Recently, Jim Baker, Guido van Rossum, and Paul Everitt have
proposed

PEP 750 ("Tag Strings For Writing Domain-Specific Languages") which would
generalize and expand that mechanism to provide Python library writers with additional
flexibility. Reactions to the proposed change were somewhat positive, although
there was a good deal of discussion of (and opposition to)
the PEP's inclusion of lazy evaluation of template parameters.

https://lwn.net/Articles/985346/


Security updates for Friday

Security updates have been issued by Fedora (389-ds-base, dotnet8.0, python3.13, roundcubemail, thunderbird, and tor), Mageia (roundcubemail), Oracle (.NET 8.0, bind and bind-dyndb-ldap, bind9.16, container-tools:ol8, edk2, firefox, gnome-shell, grafana, httpd:2.4, jose, kernel, krb5, mod_auth_openidc:2.3, orc, poppler, python-urllib3, python3.11-setuptools, thunderbird, and wget), Red Hat (kernel), SUSE (apptainer, curl, kernel, kernel-firmware, libqt5-qtbase, python-aiosmtpd, and ucode-intel), and Ubuntu (bind9, gnome-shell, libreoffice, and orc).

https://lwn.net/Articles/985980/


[$] Memory-management: tiered memory, huge pages, and EROFS

The kernel's memory-management developers have been busy in recent times;
it can be hard to keep up with all that has been happening in this core
area.  In an attempt to catch up, here is a look at recent work
affecting tiered-memory systems, underutilized huge pages, and duplicated
file data in the Enhanced Read-Only Filesystem (EROFS).

https://lwn.net/Articles/984839/


Security updates for Thursday

Security updates have been issued by AlmaLinux (container-tools:rhel8), Debian (flatpak), Fedora (389-ds-base, dotnet8.0, and roundcubemail), Red Hat (bind9.16, firefox, python-setuptools, and thunderbird), Slackware (dovecot), SUSE (389-ds, curl, kernel, kernel-firmware, kubernetes1.25, openssl-1_1, openssl-3, python-Pillow, and zziplib), and Ubuntu (busybox, linux-azure, and ruby-rmagick).

https://lwn.net/Articles/985845/


[$] LWN.net Weekly Edition for August 15, 2024

The LWN.net Weekly Edition for August 15, 2024 is available.

https://lwn.net/Articles/984770/


Stable kernels 6.10.5, 6.6.46, and 6.1.105

Three new stable kernels have been released: https://lwn.net/Articles/985670/
. As usual, they contain important
fixes all over the kernel tree.

https://lwn.net/Articles/985669/


[$] Standards for use of unsafe Rust in the kernel

Rust is intended to let programmers write safer code.
But compilers are
not omniscient, and writing Rust code that interfaces with hardware (or that
works with memory outside of Rust's lifetime paradigm) requires, at
some point, the programmer's assurance that some operations are permissible. Benno Lossin

suggested adding
some more documentation to

the Rust-for-Linux project clarifying the
standards for commenting uses of unsafe in kernel code. There's general
agreement that such standards are necessary, but less agreement on exactly when
it is appropriate to use unsafe.

https://lwn.net/Articles/982868/


Security updates for Wednesday

Security updates have been issued by AlmaLinux (389-ds-base), Debian (ffmpeg), Fedora (chromium), Red Hat (.NET 8.0, container-tools:rhel8, edk2, firefox, gnome-shell, grafana, jose, kernel, kernel-rt, krb5, open-vm-tools, orc, pcs, poppler, python-urllib3, and wget), SUSE (gtk2, gtk3, kernel, python-setuptools, python310-setuptools, python312-setuptools, python39-setuptools, and webkit2gtk3), and Ubuntu (dotnet8, libcroco, linux-azure, linux-lowlatency, linux-raspi, and linux-oracle).

https://lwn.net/Articles/985654/


[$] Zettlr: note-taking and publishing with Markdown

https://daringfireball.net/projects/markdown/
 editors are a dime a dozen. Cheaper than that, actually,
since many of them are open‑source software. Despite the sheer number of
options, finding an editor that has all of the features that one might want can
be tricky. For some users, https://www.zettlr.com/

might the right tool. It is a What You See is What You
Mean (WYSIWYM) editor that stores its work locally as plain Markdown
files. The project is billed as a "one-stop publication
workbench", and is suitable for writing anything from blog posts to
academic papers, maintaining a personal journal, or keeping notes in a https://en.wikipedia.org/wiki/Zettelkasten
. It
is simple to get started with, but rewards deeper exploration and
customization.

https://lwn.net/Articles/984502/


[$] Changes coming in PostgreSQL 17

The

PostgreSQL project has

released beta
versions of PostgreSQL 17 containing several interesting security and usability
improvements, alongside the usual performance improvements and bug fixes. If the
release proceeds according to the usual timeline, the full release of version 17
is expected in September or October.
The most important changes are in what PostgreSQL does when a database
supervisor has their credentials revoked, and added
support for incremental database backups.

https://lwn.net/Articles/984599/


Lix makes its second release

https://lix.systems
 since forking. This one includes substantial changes to the backend code, including removing a dependency on Bison, and getting a change to the Nix language back upstream.

The general theme of Lix 2.91 is to perform another wave of
refactorings and design improvements in preparation for our evolution
plans.

Nevertheless, there are a few exciting user facing changes[.]

https://lwn.net/Articles/985484/


Incus 6.4 released

Version 6.4 of the Incus container manager is out.

	This release builds upon the recently added OCI support from Incus
	6.3, making it even easier to run application containers. It also
	adds a number of useful new features for clustered and larger
	environments with more control on the virtual CPU used when live
	migrating VMs and finer grained resource constraints within
	projects.

See this
announcement for details.

https://lwn.net/Articles/985482/


Security updates for Tuesday

Security updates have been issued by Debian (kernel and roundcube), Fedora (microcode_ctl, pypy, python2.7, and python3.6), Oracle (389-ds-base, httpd, kernel, kernel-container, and linux-firmware), Red Hat (kernel-rt), SUSE (firefox, kubernetes1.23, libqt5-qtbase, openssl-1_1, python-gunicorn, python-Twisted, python-urllib3, and qt6-base), and Ubuntu (linux-aws-5.15, linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-raspi, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-oem-6.8, linux-oracle-5.15, and qemu).

https://lwn.net/Articles/985481/


Rust Project goals for 2024

The Rust project has developed a
set of goals for the latter half of 2024.

	Rust
	for Linux. The experimental support for Rust
	development in the Linux kernel is a watershed moment for Rust,
	demonstrating to the world that Rust is indeed capable of targeting
	all manner of low-level systems applications. And yet today that
	support rests on a number of
	unstable features, blocking the effort from ever going beyond
	experimental status. For 2024H2 we will work to close the largest
	gaps that block support.

Other goals include completing the 2024 Rust
Edition and improving the language's async support.

https://lwn.net/Articles/985296/


Security updates for Monday

Security updates have been issued by AlmaLinux (httpd:2.4), Fedora (chromium, firefox, frr, neatvnc, nss, python-setuptools, and python3.13), Gentoo (AFLplusplus, Bundler, dpkg, GnuPG, GPAC, libde265, matio, MuPDF, PHP, protobuf, protobuf-python, protobuf-c, rsyslog, Ruby on Rails, and runc), Red Hat (389-ds-base, container-tools:rhel8, and httpd:2.4), SUSE (bind and ca-certificates-mozilla), and Ubuntu (linux-azure).

https://lwn.net/Articles/985336/


Kernel prepatch 6.11-rc3

Linus has released https://lwn.net/Articles/985232/
 right on
schedule.  "Nothing particularly strange or interesting going on, things
look normal".

https://lwn.net/Articles/985233/


[$] Meeting the Debian Technical Committee

It is something of a DebConf tradition that members of the Debian Technical
Committee (TC) take the stage to talk about the work that the committee
does—and more.  https://debconf24.debconf.org/
 in
Busan, South Korea was no exception, as TC chair Sean Whitton, who
will complete his term at the end of the year, and one
of its newest members, Stefano Rivera, described the constitutional
underpinnings of the TC, how it tries to make decisions when it needs to,
and the constant process of recruiting new members.  After that, they took
a few questions from the audience.  The session provided a nice overview of
the TC and its role in Debian, but it may well be of interest further afield.

https://lwn.net/Articles/984720/


A new kernel-version policy for Ubuntu

The Canonical Kernel Team has https://discourse.ubuntu.com/t/kernel-version-selection-for-ubuntu-releases/47007

a new policy regarding the version of the kernel that will ship with each
Ubuntu release; the result will generally be the shipping of newer
releases.

	To provide users with the absolute latest in features and hardware
	support, Ubuntu will now ship the absolute latest available version
	of the upstream Linux kernel at the specified Ubuntu release freeze
	date, even if upstream is still in Release Candidate (RC) status.

The post goes on to acknowledge that "there are issues with this
approach"; there are a lot of policy details that will apply depending
on just how raw the shipped kernel is.

https://lwn.net/Articles/985043/


[$] Distinguishing Debian testing from unstable

Sometimes, the smallest changes create the longest discussions.  As a case
in point, a proposal to make a one-line change in an informational text
file on systems running the Debian unstable distribution has blown up into
an interminable and sometimes unfriendly debate.  At its core, though, this
discussion comes down to a seemingly simple question: should a program be
able to determine whether it is running on a Debian testing or unstable
system?

https://lwn.net/Articles/984635/


New attack against the SLUB allocator

Researchers from Graz University of Technology have
https://www.stefangast.eu/papers/slubstick.pdf
 details of a new attack
on the Linux kernel called SLUBstack. The attack uses timing information to turn an ability to trigger use-after-free or double-free bugs into the ability to overwrite page tables, and thence into the ability to read and write arbitrary areas of memory. The good news is that this attack does require an existing bug to be usable; the bad news is that the kernel regularly sees bugs of this kind.

We assume that an unprivileged user has code execution.
Additionally, we consider the presence of a heap vulnerability
in the Linux kernel. We assume that the Linux kernel
incorporates all defense mechanisms available in version 6.4, the
most recent Linux kernel version when we started our work.
These mechanisms include features such as WˆX, KASLR,
SMAP, and kCFI. We do not assume any microarchitectural
vulnerabilities, e.g., transient execution, fault
injection, or hardware side channels.

https://lwn.net/Articles/984984/


Security updates for Friday

Security updates have been issued by AlmaLinux (httpd, kernel, kernel-rt, and libtiff), Debian (postgresql-13, postgresql-15, and thunderbird), Fedora (frr, thunderbird, vim, and xrdp), Gentoo (Librsvg, Nautilus, ncurses, Percona XtraBackup, QEMU, and re2c), Red Hat (httpd, kernel, kernel-rt, openssl, and python-setuptools), SUSE (bind, ffmpeg-4, kubernetes1.23, kubernetes1.24, python-Django, and python3-Twisted), and Ubuntu (linux, linux-aws, linux-aws-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-raspi, linux-xilinx-zynqmp, linux, linux-aws, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-nvidia, linux-nvidia-6.8, linux-oem-6.8, linux-nvidia-lowlatency, linux-oracle, linux-oracle, linux-oracle-5.4, and salt).

https://lwn.net/Articles/984966/


0.0.0.0 Day: Exploiting Localhost APIs From the Browser (Oligo Security)

The Oligo Security blog https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser

a web-browser vulnerability that has been named "0.0.0.0 day".  In short,
browsers will allow JavaScript code to open connections to the all-zeroes
IPv4 address; the result is that any port that is open on the local host
can be accessed by a remote site.  "When services use localhost, they
assume a constrained environment. This assumption, which can (as in the
case of this vulnerability) be faulty, results in insecure server
implementations."

https://lwn.net/Articles/984838/


[$] Endless OS aimed at educational and offline environments

Endless OS is a Linux distribution with a focus on improving access to
educational tools by providing a simple-to-manage, full-featured desktop for
educators and students — one that works offline, with minimal maintenance. The
distribution also aims to be suitable for older devices, in order to promote access to
computers by ensuring those systems remain usable.
In pursuit of those goals, it makes some unusual technical
choices. But what makes the distribution really shine is its curated collection
of software and educational resources.

https://lwn.net/Articles/984086/


Security updates for Thursday

Security updates have been issued by AlmaLinux (freeradius and freeradius:3.0), Debian (chromium, odoo, and roundcube), Fedora (microcode_ctl, mingw-qt5-qtbase, mingw-qt6-qtbase, opentofu, orc, python-setuptools, and vim), Gentoo (Nokogiri), Oracle (kernel), Red Hat (go-toolset:rhel8, golang, kernel, krb5, libtiff, python-setuptools, and python39:3.9 and python39-devel:3.9), SUSE (python-Django), and Ubuntu (krb5).

https://lwn.net/Articles/984807/


[$] LWN.net Weekly Edition for August 8, 2024

The LWN.net Weekly Edition for August 8, 2024 is available.

https://lwn.net/Articles/984216/


Firefox support added to Puppeteer

Mozilla has https://hacks.mozilla.org/2024/08/puppeteer-support-for-firefox/
, a browser automation and testing library, now has first-class support for Firefox using the
https://w3c.github.io/webdriver-bidi/
 protocol. Puppeteer can be used to drive headless browser instances, and is commonly used for automated end-to-end web site tests.

Whilst the features offered by Puppeteer won't be a surprise,
bringing support to multiple browsers has been a significant
undertaking. The Firefox support is not based on a Firefox-specific
automation protocol, but on WebDriver BiDi, a cross browser protocol
that's undergoing standardization at the W3C, and currently has
implementation in both Gecko and Chromium. This use of a
cross-browser protocol should make it much easier to support many
different browsers going forward.

https://lwn.net/Articles/984733/


[$] CRIB: checkpoint/restore in BPF

The desire for the ability to checkpoint a process — to record its state in
a form that can be restarted at a future time — on Linux is almost as old as
Linux itself.  See, for example, https://lwn.net/1998/0528/a/checkpoint.html
 of a checkpoint
project that appeared in LWN in 1998.  While working solutions exist, they
can be somewhat fragile and difficult to use; it is not surprising that
some people are interested in finding a better alternative.  A current
effort goes by the name CRIB,
for Checkpoint/Restore in (naturally) BPF.  It is far from clear that CRIB
will replace the existing solutions, but it is an interesting look at a
different way of solving the problem.

https://lwn.net/Articles/984313/


[$] Tracing the source of filesystem errors

There are lots of places in the kernel where an EINVAL can be
returned to user space, but it is often unclear what the actual underlying
problem is because the https://man7.org/linux/man-pages/man3/errno.3.html

error codes are too generic.  That is the problem that Miklos Szeredi
wanted to discuss in a filesystem session that he led remotely at the 2024 Linux Storage,
Filesystem, Memory Management, and BPF Summit.  He would like to help
those who are trying to debug problems trace where in the kernel a
particular error code is being generated.

https://lwn.net/Articles/984556/


Security updates for Wednesday

Security updates have been issued by Debian (firefox-esr, openjdk-17, and wpa), Gentoo (aiohttp, Bitcoin, Cairo, Go, json-c, Levenshtein, libXpm, nghttp2, PostgreSQL, and Redis), Red Hat (kernel, kernel-rt, python-setuptools, python-urllib3, python3.11-setuptools, and wget), Slackware (mozilla), SUSE (bind, curl, docker, ffmpeg, ffmpeg-4, kernel, kernel-firmware, libnbd, patch, shadow, and thunderbird), and Ubuntu (python-django and wpa).

https://lwn.net/Articles/984702/


[$] CircuitPython: Python for microcontrollers, simplified

https://circuitpython.org/
 is an open-source
implementation of the Python programming language for microcontroller
boards.  The project, which is sponsored by https://www.adafruit.com/
, is designed with
new programmers in mind, but it also has many features that may be of
interest to more-experienced developers. The recent https://blog.adafruit.com/2024/07/10/circuitpython-9-1-0-released/

adds a few minor features, but it follows just a few months after https://blog.adafruit.com/2024/03/18/circuitpython-9-0-0-released/
,
which brings some more significant changes, including improved graphics and
USB support.

https://lwn.net/Articles/983870/


Firefox 129.0 released

Version
129.0 of the Firefox browser has been released.  Changes include some
improvements to the reader mode, tab previews, and use of HTTPS by default.

https://lwn.net/Articles/984617/


Security updates for Tuesday

Security updates have been issued by Debian (libreoffice), Gentoo (containerd and firefox), Red Hat (httpd), SUSE (ca-certificates-mozilla, ksh, openssl-3-livepatches, podman, python-Twisted, and skopeo), and Ubuntu (imagemagick).

https://lwn.net/Articles/984598/


[$] Handling filesystem interruptibility

David Howells wanted to discuss changing the way filesystem code handles
the ability to interrupt or kill operations, in order to fix some
longstanding problems with network
(and other) filesystems, in a session at
the 2024 Linux
Storage, Filesystem, Memory Management, and BPF Summit.   As noted in
his session
proposal, some filesystems may be expecting to not be interruptible,
but are calling code can take locks and mutexes that are interruptible (or
killable), which are effectively
changing the state of the task incorrectly.
He would like to find a solution for that problem.

https://lwn.net/Articles/983714/


[$] The complexity of BUSL transformation

The Business
Source License (BUSL) is a source-available license that "converts"
to an open-source license after a period of time. In theory, this
means that a few years after a version of a product is released under
the BUSL, it becomes open source and is fair game for Linux
distributions to package along with regular open-source projects. In
practice, the license throws a few curveballs that require special
consideration and caution, as the Fedora Project recently discussed.

https://lwn.net/Articles/984249/


GNU Binutils 2.43 released

Version 2.43 of the GNU Binutils package is out.  Changes include some
improvements to the assembler and the linker, better support for hardware
event counters in the Gprofng profiler, and more.

https://lwn.net/Articles/984539/


Security updates for Monday

Security updates have been issued by Debian (openjdk-11), Fedora (bind, bind-dyndb-ldap, chromium, ffmpeg, hostapd, trafficserver, and wpa_supplicant), and Ubuntu (curl and linux-oem-6.5).

https://lwn.net/Articles/984552/


[$] Pulling Linux up by its bootstraps

A
bootstrappable build is one that builds existing
software from scratch — for example, building GCC without relying on an existing
copy of GCC. In 2023, the Guix project
https://lwn.net/Articles/930650/
 that the project had reduced the size
of the binary bootstrap seed needed to build its operating system to just 357-bytes —
not counting the Linux kernel required to run the build process. Now, the
https://github.com/fosslinux/live-bootstrap
 project
has gone a step further and removed the need for an existing kernel at all.

https://lwn.net/Articles/983340/


Stable kernel updates for Saturday

The
https://lwn.net/Articles/983653/
,
https://lwn.net/Articles/983654/
,
https://lwn.net/Articles/983655/
,
https://lwn.net/Articles/983656/
,
https://lwn.net/Articles/983657/
,
https://lwn.net/Articles/983658/
,
https://lwn.net/Articles/983659/
, and
https://lwn.net/Articles/983660/

stable kernel updates have all been released; each contains a relatively
small set of important fixes, at
least one of which appears to close a security hole.

https://lwn.net/Articles/983652/


[$] Large folios, swap, and FS-Cache

David Howells wanted to discuss swap handling in light of multi-page folios
in a combined storage, filesystem, and memory-management session at
the 2024 Linux Storage,
Filesystem, Memory Management, and BPF Summit.  Swapping has always been
done with a one-to-one mapping of memory pages to swap slots, he said, but
swapping multi-page folios breaks that assumption.  He wondered if it would
make sense to use filesystem techniques to track swapped-out folios.

https://lwn.net/Articles/982887/


[$] Lessons from the death and rebirth of Thunderbird

Ryan Sipes told the audience during his keynote at
https://events.gnome.org/event/209/
 mail client
"probably shouldn't still be alive". Thunderbird, however, is not only
alive—it is arguably in better shape than ever
before. According to Sipes, the project's turnaround is a result of
governance, storytelling, and learning to be comfortable asking users
for money. He would also like it quite a bit if Linux distributions stopped
turning off telemetry.

https://lwn.net/Articles/982610/


GNOME Foundation Announces Transition of Executive Director

The https://foundation.gnome.org/

that executive director Holly Million is stepping down at the end of
July, and will be replaced by Richard Littauer as interim executive
director:

On behalf of the whole GNOME community, the Board of Directors
would like to give our utmost thanks to Holly for her achievements
during the past 10 months, including drafting a bold five-year
strategic plan for the Foundation, securing two important fiscal
sponsorship agreements with GIMP and Black Python Devs, writing our
first funding proposal that will now enable the Foundation to apply
for more grants, vastly improving our financial operations, and
implementing a break-even budget to preserve our financial
reserves.

The Foundation's Interim Executive Director, Richard Littauer,
brings years of open source leadership as part of his work as an
organizer of SustainOSS and CURIOSS, as a sustainability coordinator
at the Open Source Initiative, and as a community development manager
at Open Source Collective, and through open source contributions to
many projects, such as Node.js and IPFS. The Board appointed Richard
in June and is confident in his ability to guide the Foundation during
this transitional period.

Million says she is leaving to pursue a PhD in psychology. The
board plans to announce its search plan for a permanent executive
directory after https://events.gnome.org/event/209/
, which takes
place July 19 through 24.

https://lwn.net/Articles/981850/


Kernel prepatch 6.9-rc6

The https://lwn.net/Articles/971413/
 kernel prepatch is out for
testing.

	Things continue to look pretty normal, and nothing here really
	stands out. The biggest single change that stands out in the
	diffstat is literally a documentation update, everything else looks
	pretty small and spread out.

https://lwn.net/Articles/971414/


Four weekend stable kernel releases

The
https://lwn.net/Articles/971362/
,
https://lwn.net/Articles/971363/
,
https://lwn.net/Articles/971364/
, and
https://lwn.net/Articles/971365/

stable kernels have been released; each contains another set of important
fixes.

https://lwn.net/Articles/971361/


[$] Support for the TSO memory model on Arm CPUs

At the CPU level, a memory model describes, among other things, the amount
of freedom the processor has to reorder memory operations.  If low-level
code does not take the memory model into account, unpleasant surprises are
likely to follow.  Naturally, different CPUs offer different memory models,
complicating the portability of certain types of concurrent software.  To
make life easier, some Arm CPUs offer the ability to emulate the x86 memory
model, but efforts to make that feature available in the kernel are running
into opposition.

https://lwn.net/Articles/970907/


Security updates for Friday

Security updates have been issued by Debian (knot-resolver, pdns-recursor, and putty), Fedora (xen), Mageia (editorconfig-core-c, glibc, mbedtls, webkit2, and wireshark), Oracle (buildah), Red Hat (buildah and yajl), Slackware (libarchive), SUSE (dcmtk, openCryptoki, php7, php74, php8, python-gunicorn, python-idna, qemu, and thunderbird), and Ubuntu (cryptojs, freerdp2, nghttp2, and zabbix).

https://lwn.net/Articles/971289/


Security updates for Thursday

Security updates have been issued by Fedora (curl, filezilla, flatpak, kubernetes, libfilezilla, thunderbird, and xen), Oracle (go-toolset:ol8, kernel, libreswan, shim, and tigervnc), Red Hat (buildah, gnutls, libreswan, tigervnc, and unbound), SUSE (cockpit-wicked, nrpe, and python-idna), and Ubuntu (dnsmasq, freerdp2, linux-azure-6.5, and thunderbird).

https://lwn.net/Articles/971140/


[$] LWN.net Weekly Edition for April 25, 2024

The LWN.net Weekly Edition for April 25, 2024 is available.

https://lwn.net/Articles/970328/


QEMU 9.0 released

https://www.qemu.org/2024/04/23/qemu-9-0-0/
 of
the QEMU emulator has been released.  "This release contains 2700+
commits from 220 authors."  The list of improvements is long; see the
announcement and the
changelog for details.

https://lwn.net/Articles/971007/


[$] A change in direction for security-module stacking?

The long-running effort to complete the work on stacking (or composing) the
Linux security modules (LSMs) recently encountered a barrier—in the form of
a "suggestion" to discontinue it from Linus Torvalds.  His complaint
revolved around the indirect function calls that are used to implement
LSMs, but he also did not think much of the effort to switch away from
those calls.  While it does not appear that a major course-change is in store
for LSMs, it is clear that Torvalds is not happy with the direction of that
subsystem.

https://lwn.net/Articles/970070/


Fedora 40 released

The Fedora 40 distribution has been
released.  See the "what's new" pages for Fedora
Workstation and Fedora
KDE to learn more about the desktop spins, along with https://lwn.net/Articles/969145/
, for more information.

https://lwn.net/Articles/970893/


Security updates for Tuesday

Security updates have been issued by Debian (glibc and samba), Fedora (chromium, cjson, mingw-python-idna, and pgadmin4), Mageia (kernel, kmod-xtables-addons, kmod-virtualbox, kernel-linus, and perl-Clipboard), Red Hat (go-toolset:rhel8, golang, java-11-openjdk, kpatch-patch, and shim), Slackware (freerdp), SUSE (apache-commons-configuration, glibc, jasper, polkit, and qemu), and Ubuntu (google-guest-agent, google-osconfig-agent, linux-lowlatency-hwe-6.5, pillow, and squid).

https://lwn.net/Articles/970889/


Andreas Tille elected as Debian project leader

The Debian project leader

https://lwn.net/Articles/970815/
 and Andreas Tille
https://www.debian.org/vote/2024/vote_001
.
In a fairly competitive vote, Tille beat Sruthi Chandran to fill the
position for
the coming year. We looked at the election and the
candidates a few weeks back.

https://lwn.net/Articles/970814/


[$] Linus and Dirk chat about AI, XZ, hardware, and more

One of the mainstays of the the Linux Foundation's Open Source Summit is the "fireside chat"
(sans fire) between Linus Torvalds and Dirk Hohndel to discuss open source and
Linux kernel topics of the day. On April 17, at Open Source Summit
North America (OSSNA) in Seattle, Washington, they held with tradition
and discussed a range of topics including proper whitespace parsing,
security, and the current AI craze.

https://lwn.net/Articles/970293/


Kernel prepatch 6.9-rc5

Linus has https://lwn.net/Articles/970666/
 for testing.

	But if you ignore those oddities, it all looks pretty normal and
	things appear fairly calm. Which is just as well, since the first
	part of the week I was on a quick trip to Seattle, and the second
	part of the week I've been doing a passable imitation of the
	Fontana di Trevi, except my medium is mucus.

https://lwn.net/Articles/970667/


Security updates for Friday

Security updates have been issued by AlmaLinux (gnutls, java-17-openjdk, mod_http2, and squid), Debian (firefox-esr), Fedora (editorconfig, perl-Clipboard, php, rust, and wordpress), Mageia (less, libreswan, puppet, and x11-server, x11-server-xwayland, and tigervnc), Slackware (aaa_glibc), and SUSE (firefox, graphviz, kernel, nodejs12, pgadmin4, tomcat, and wireshark).

https://lwn.net/Articles/970508/


Security updates for Thursday

Security updates have been issued by Debian (firefox-esr, jetty9, libdatetime-timezone-perl, tomcat10, and tzdata), Fedora (cockpit, filezilla, and libfilezilla), Red Hat (firefox, gnutls, java-1.8.0-openjdk, java-17-openjdk, kernel, kernel-rt, less, mod_http2, nodejs:18, rhc-worker-script, and shim), Slackware (mozilla), SUSE (kernel), and Ubuntu (apache2, glibc, and linux-xilinx-zynqmp).

https://lwn.net/Articles/970324/


[$] LWN.net Weekly Edition for April 18, 2024

The LWN.net Weekly Edition for April 18, 2024 is available.

https://lwn.net/Articles/969442/


[$] Managing to-do lists on the command line with Taskwarrior

Managing to-do lists is something of a universal necessity. While some
people handle them mentally or on paper, others resort to a web-based tool or
a mobile
application. For those preferring the command line, the MIT-licensed https://taskwarrior.org
 offers a flexible solution
with a healthy community and lots of extensions.

https://lwn.net/Articles/969904/


Four more stable kernels

The
https://lwn.net/Articles/970171/
,
https://lwn.net/Articles/970172/
,
https://lwn.net/Articles/970173/
, and
https://lwn.net/Articles/970174/
 stable kernel updates have all been
released.

https://lwn.net/Articles/970086/


[$] Fedora 40 firms up for release

Fedora 40 Beta was https://fedoramagazine.org/announcing-fedora-linux-40-beta/

on March 26, and the final release is nearing completion. So far,
the release is coming together nicely with major
updates for GNOME, KDE Plasma, and the usual cavalcade of
smaller updates and enhancements. As part of the release, the project also scuttled Delta
RPMs and https://fedoraproject.org/wiki/Changes/RemoveOpensslCompat
.

https://lwn.net/Articles/969145/


[$] Cleaning up after BPF exceptions

Kumar Kartikeya Dwivedi has been working to add support for exceptions to BPF
since mid-2023. In July, Dwivedi posted

the first patch set in this effort, which adds support for basic stack unwinding.
In February 2024, he posted

the second patch set
aimed at letting the kernel release resources held by the BPF program when an
exception occurs. This makes exceptions usable in many more contexts.

https://lwn.net/Articles/969185/


Security updates for Monday

Security updates have been issued by AlmaLinux (bind, bind and dhcp, bind9.16, gnutls, httpd:2.4/mod_http2, squid:4, and unbound), Debian (kernel, trafficserver, and xorg-server), Fedora (chromium, kernel, libopenmpt, and rust-h2), Mageia (apache-mod_jk, golang, indent, openssl, perl-HTTP-Body, php, rear, ruby-rack, squid, varnish, and xfig), Oracle (bind, squid, unbound, and X.Org server), Red Hat (bind and dhcp and unbound), Slackware (less and php), SUSE (gnutls, python-Pillow, webkit2gtk3, xen, xorg-x11-server, and xwayland), and Ubuntu (yard).

https://lwn.net/Articles/969873/


Kernel prepatch 6.9-rc4

The https://lwn.net/Articles/969790/
 kernel prepatch is out for
testing.  "Nothing particularly unusual going on this week - some new hw
mitigations may stand out, but after a decade of this I can't really call
it 'unusual' any more, can I?"

https://lwn.net/Articles/969791/


Saturday's stable kernel updates

The
https://lwn.net/Articles/969733/
,
https://lwn.net/Articles/969734/
,
https://lwn.net/Articles/969735/
,
https://lwn.net/Articles/969736/
,
https://lwn.net/Articles/969737/
,
https://lwn.net/Articles/969738/
, and
https://lwn.net/Articles/969739/

stable kernel updates have all been released; each contains a relatively
large number of important fixes.

https://lwn.net/Articles/969732/


Security updates for Thursday

Security updates have been issued by AlmaLinux (kernel, less, libreoffice, nodejs:18, nodejs:20, rear, thunderbird, and varnish), Debian (pillow), Fedora (dotnet7.0), SUSE (sngrep, texlive-specs-k, tomcat, tomcat10, and xorg-x11-server), and Ubuntu (nss, squid, and util-linux).

https://lwn.net/Articles/969468/


Four stable kernel updates

Greg Kroah-Hartman has announced another round of stable kernel
updates: https://lwn.net/Articles/969353/
 have all been released; each
contains another set of important fixes, including the mitigations for the
recently disclosed https://lwn.net/Articles/969210/

hardware vulnerability.

https://lwn.net/Articles/969352/


[$] Book review: Practical Julia

A recent book by LWN guest
author Lee Phillips provides a nice introduction to the https://julialang.org/
 programming language.
https://nostarch.com/practical-julia

does more than that, however.  As its subtitle ("A Hands-On Introduction
for Scientific Minds") implies, the book focuses on bringing Julia to
scientists, rather than programmers, which gives it something of a
different feel from most other books of this sort.

https://lwn.net/Articles/966684/


[$] Continued attacks on HTTP/2

On April 3 security researcher Bartek Nowotarski

published the details of a new denial-of-service (DoS)
attack, called a "continuation flood", against many
https://en.wikipedia.org/wiki/HTTP/2
-capable web
servers. While the attack is not terribly complex, it affects many independent
implementations of the HTTP/2 protocol, even though multiple
similar vulnerabilities over the years have given implementers plenty of warning.

https://lwn.net/Articles/968600/


OpenSSL 3.3.0 released

Version 3.3.0 of the OpenSSL SSL/TLS implementation has been released.
Changes include a number of additions to its QUIC protocol support, some
year-2038 improvements for 32-bit systems, and a lot of cryptographic
features with descriptions like "Added a new EVP_DigestSqueeze()
API. This allows SHAKE to squeeze multiple times with different output
sizes."  See the release
notes for details.

https://lwn.net/Articles/969172/


[$] Diagnosing workqueues

There are many mechanisms for deferred work in the Linux kernel. One of them,

workqueues, has seen increasing use as part of
the move away from software interrupts. Alison Chaiken gave a talk
at https://www.socallinuxexpo.org/scale/21x

about how they compare to software interrupts, the new challenges they pose for
system administrators, and what tools are available to
kernel developers wishing to diagnose problems with workqueues as they become
increasingly prevalent.

https://lwn.net/Articles/967016/


Security updates for Tuesday

Security updates have been issued by Debian (expat), Oracle (less and nodejs:20), Slackware (libarchive), SUSE (kubernetes1.23, nghttp2, qt6-base, and util-linux), and Ubuntu (python-django).

https://lwn.net/Articles/969141/


Kernel prepatch 6.9-rc3

The https://lwn.net/Articles/968936/
 kernel prepatch is out for
testing.

	Ok, so this rc3 looks a bit different than the usual ones, because
	there's a large series to bcachefs to do filesystem repair after
	corruption. Not normally something we'd see in an rc kernel, but
	hey, if you had a corrupted bcachefs filesystem you'd probably want
	this, and if you thought bcachefs was stable already, I have a
	bridge to sell you. Special deal only for you, real cheap.

https://lwn.net/Articles/968937/


OpenBSD 7.5 released

OpenBSD 7.5 has been released.  The list of changes and improvements is, as
usual, long; it includes the https://lwn.net/Articles/959562/
 functionality covered
here in January.

https://lwn.net/Articles/968584/


FFmpeg 7.0 released

https://ffmpeg.org//index.html#pr7.0
 of the
FFmpeg audio/video toolkit is out.  "The most noteworthy changes for
most users are a native VVC decoder (currently experimental, until more
fuzzing is done), IAMF support, or a multi-threaded ffmpeg CLI tool".
There's also the usual list of new formats and codecs, and a few deprecated
features have been removed.

https://lwn.net/Articles/968565/


Security updates for Friday

Security updates have been issued by Debian (cockpit), Mageia (python-pygments), Red Hat (nodejs), Slackware (httpd and nghttp2), SUSE (avahi, gradle, gradle-bootstrap, and squid), and Ubuntu (xorg-server, xwayland).

https://lwn.net/Articles/968561/


AlmaLinux OS - CVE-2024-1086 and XZ (AlmaLinux blog)

https://almalinux.org/

updated kernels for AlmaLinux 8 and 9 to address CVE-2024-1086, a
use-after-free vulnerability in the kernel that could be exploited to
gain local privilege escalation. This is notable because the fix
marks a divergence between AlmaLinux and Red Hat Enterprise Linux (RHEL):

In January of this year, a kernel flaw was disclosed and named https://nvd.nist.gov/vuln/detail/CVE-2024-1086
.
This flaw is trivially exploitable on most RHEL-equivalent
systems. There are many proof-of-concept posts available now,
including one from our Infrastructure team lead, Jonathan Wright (Dealing
with CVE-2024-1086). In multi-user scenarios, this flaw is
especially problematic.

Though this was flagged as something to be fixed in Red Hat
Enterprise Linux, Red Hat has only rated this as a moderate
impact.

The AlmaLinux project would also like to note that it is not
impacted by the XZ backdoor. "Because enterprise Linux takes a bit
longer to adopt those updates (sometimes to the chagrin of our users),
the version of XZ that had the back door inserted hadn't made it
further than Fedora in our ecosystem."

https://lwn.net/Articles/968299/


Security updates for Wednesday

Security updates have been issued by Debian (py7zr), Fedora (biosig4c++ and podman), Oracle (kernel, kernel-container, and ruby:3.1), Red Hat (.NET 7.0, bind9.16, curl, expat, grafana, grafana-pcp, kernel, kernel-rt, kpatch-patch, less, opencryptoki, and postgresql-jdbc), and Ubuntu (cacti).

https://lwn.net/Articles/968218/


Security updates for Thursday

Security updates have been issued by Fedora (perl-Data-UUID, python-pygments, and thunderbird), Mageia (clojure, grub2, kernel,kmod-xtables-addons,kmod-virtualbox, kernel-linus, nss firefox, nss, python3, python, tcpreplay, and thunderbird), Oracle (nodejs:18), Red Hat (.NET 6.0 and dnsmasq), SUSE (avahi and python39), and Ubuntu (curl, linux-intel-iotg, linux-intel-iotg-5.15, unixodbc, and util-linux).

https://lwn.net/Articles/966961/


Security updates for Thursday

Security updates have been issued by Debian (pdns-recursor and php-dompdf-svg-lib), Fedora (grub2, libreswan, rubygem-yard, and thunderbird), Mageia (libtiff and python-scipy), Red Hat (golang, nodejs, and nodejs:16), Slackware (python3), and Ubuntu (linux, linux-azure, linux-azure-5.15, linux-azure-fde,
 linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop,
 linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm,
 linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux, linux-azure, linux-gcp, linux-gcp-6.5, linux-hwe-6.5,
 linux-lowlatency, linux-lowlatency-hwe-6.5, linux-oem-6.5, linux-oracle,
 linux-oracle-6.5, linux-raspi, linux-starfive, linux-starfive-6.5, linux-aws, linux-aws-5.15, linux-aws, linux-aws-5.4, linux-gcp-5.4, linux-raspi, linux-raspi-5.4,
 linux-xilinx-zynqmp, linux-gcp, linux-gcp-4.15, linux-kvm, linux-laptop, linux-oem-6.1, and linux-raspi).

https://lwn.net/Articles/966246/


[$] Cranelift code generation comes to Rust

https://cranelift.dev/
 is an Apache-2.0-licensed
code-generation backend being developed as part
of the https://wasmtime.dev/
 runtime for
https://webassembly.org/
.
In October 2023, the Rust project made Cranelift available as an optional
component in its nightly toolchain.
Users can now use Cranelift as the code-generation backend for debug builds of
projects written in Rust,
making it an opportune time to look at what makes Cranelift different.
Cranelift is designed to compete with existing compilers by generating
code more quickly than they can, thanks to a stripped-down design that prioritizes
only the most important optimizations.

https://lwn.net/Articles/964735/


[$] Untangling the Open Collectives

Name collisions aren't just a problem for software
development—organizations, projects, and software that have the
same or similar names can cause serious confusion. That was certainly
the case on February 28 when the Open Collective
Foundation (OCF) began to notify its hosted projects that it would
be shutting down by the end of 2024. The announcement surprised
projects hosted with OCF, as one might expect. It also worried and
confused users of the Open Collective software platform from https://opencollective.com/
 (OCI), as
well as organizations hosted by the Open Source
Collective (OSC) and Open Collective
Europe (OC Europe). There is enough confusion about the names,
relationships between the organizations, and impact on projects like
https://opencollective.com/flatpak
 hosted by OCF, that a
deeper look is warranted.

https://lwn.net/Articles/964402/


Musl C library releases support for new architectures

On February 29, the musl project
https://www.openwall.com/lists/musl/2024/03/01/2
 release
1.2.5, including support for loongarch64 and riscv32. This
release also contains support for the
https://www.man7.org/linux/man-pages/man2/statx.2.html
,
preadv2,
and pwritev2 system calls.

https://lwn.net/Articles/964181/


NVK is now ready for prime time (Collabora blog)

Over on the Collabora blog, Faith Ekstrand has https://www.collabora.com/news-and-blog/news-and-events/nvk-is-now-ready-for-prime-time.html
 24.1 and is ready for real-world use.  It should be appearing in Linux distributions later this year.

Back in october, I announced that https://www.collabora.com/news-and-blog/news-and-events/nvk-reaches-vulkan-conformance.html
 GPUs. Not only have we jumped forward three Vulkan versions, but the new test runs were done with the GSP firmware enabled and includes Ampere and Ada GPUs. Also, unlike the initial 1.0 run, there are no hacks this time. Every test we passed in those conformance test runs also passes on upstream Mesa.

https://lwn.net/Articles/964090/


[$] LWN.net Weekly Edition for February 29, 2024

The LWN.net Weekly Edition for February 29, 2024 is available.

https://lwn.net/Articles/963168/


Exploring Agama's 2024 roadmap (openSUSE News)

The openSUSE News blog https://news.opensuse.org/2024/02/16/exploring-agamas-roadmap/
 development team) with releases planned for April and July:

The milestone in April is set to revolutionize Agama’s architecture. It will be moving away from its reliance on https://cockpit-project.org/
 toward a more autonomous framework that is coupled with a refined user interface that aims to streamline storage configurations.

The aim of the second milestone is to improve Agama’s flexibility and capabilities for unattended installations, which seeks to position Agama as a formidable alternative to https://github.com/yast/yast-autoinstallation
.

The Agama page https://github.com/openSUSE/agama?tab=readme-ov-file#why-a-new-installer
 why YaST is due for replacement.

https://lwn.net/Articles/962553/


[$] A look at dynamic linking

The dynamic linker is a critical component of modern Linux systems, being
responsible for setting up the address space of most processes. While statically
linked binaries have become more popular over time as the tradeoffs that
originally led to dynamic linking become less relevant, dynamic linking is still
the default. This article looks at what steps the dynamic linker takes to
prepare a program for execution.

https://lwn.net/Articles/961117/


Kernel prepatch 6.8-rc4

The https://lwn.net/Articles/961763/
 kernel prepatch is out for
testing.  "Commit counts and contents look normal for this phase of the
release, nothing here really stands out."

https://lwn.net/Articles/961764/


Introducing Fedora Atomic Desktops (Fedora Magazine)

Fedora Magazine has https://fedoramagazine.org/introducing-fedora-atomic-desktops/
, which is based on Fedora's rpm-ostree work, in December 2023.

https://lwn.net/Articles/961653/


[$] LWN.net Weekly Edition for February 8, 2024

The LWN.net Weekly Edition for February 8, 2024 is available.

https://lwn.net/Articles/960456/


Go 1.22 released

https://go.dev/blog/go1.22
 for further information.

https://lwn.net/Articles/961196/


[$] So you think you understand IP fragmentation?

What is IP fragmentation, why is it important, and do people understand
it? The answer to that last question is "not as well as they think". This
article will also answer the rest of those
questions and introduce https://valerieaurora.org/fragquiz.html
, a game that I
wrote to allow players to guess how IP packets will behave when they are
too large for the network. As evidence that IP fragmentation is not
well-understood, a room full of networking experts played fragquiz and got
a score that was
nowhere close to perfect.  In addition, I will describe a new algorithm for
fragmentation avoidance, which some colleagues and I
developed, that helped motivate development of fragquiz.

https://lwn.net/Articles/960913/


Security updates for Wednesday

Security updates have been issued by Red Hat (gimp) and Ubuntu (firefox, linux-oracle, linux-oracle-5.15, and python-django).

https://lwn.net/Articles/961173/


[$] GNU C Library version 2.39

The GNU C Library (glibc)

released version 2.39 on January 31, including
several new features. Notable highlights include new functions for spawning
child processes, support for shadow stacks on x86_64, new security features, and
the removal of libcrypt. The glibc maintainers had also hoped to include
improvements to qsort(), which ended up not making it into this
release. Glibc releases are made every six months.

https://lwn.net/Articles/960309/


Security updates for Tuesday

Security updates have been issued by CentOS (firefox, gstreamer1-plugins-bad-free, and tigervnc), Debian (ruby-sanitize), Fedora (kernel, kernel-headers, qt5-qtwebengine, and runc), Oracle (gnutls, kernel, libssh, rpm, runc, and tigervnc), Red Hat (runc), and SUSE (bouncycastle, jsch, python, and runc).

https://lwn.net/Articles/961083/


Three new stable kernels

Greg Kroah-Hartman has announced the release of the https://lwn.net/Articles/961010/
,
and https://lwn.net/Articles/961012/
 stable kernels.  As usual, they
contain important fixes all over the kernel tree.

https://lwn.net/Articles/961009/


Security updates for Monday

Security updates have been issued by Debian (rear, runc, sudo, and zbar), Fedora (chromium, grub2, libebml, mingw-python-pygments, and python-aiohttp), Gentoo (FreeType, GNAT Ada Suite, Microsoft Edge, NBD Tools, OpenSSL, QtGui, SDDM, Wireshark, and Xen), Mageia (dracut, glibc, nss and firefox, openssl, packages, perl, and thunderbird), Slackware (libxml2), SUSE (java-11-openjdk, java-17-openjdk, perl, python-uamqp, slurm, and xerces-c), and Ubuntu (libssh and openssl).

https://lwn.net/Articles/960952/


[$] Zig 2024 roadmap

The https://ziglang.org/

https://www.youtube.com/watch?v=5eL_LcxwwHg

was presented in a talk last week on
https://zig.show/
 (a show covering
Zig news). Andrew Kelley, the benevolent dictator for life of the Zig project,
presented his goals
for the language, largely focusing on compiler performance and continuing
progress toward stabilization for the language. He discussed details of his plan
for incremental compilation, and addressed the sustainability of the project in
terms of both code contributions and financial support.

https://lwn.net/Articles/959915/


Phipps: The European regulators listened to the Open Source communities

Simon Phipps writes
on the Open Source Initiative blog that the latest version of the
European Cyber Resilience Act is much improved: "As a result of all this
effort from so many people, the final text of the CRA mitigated pretty much
all the risks we had identified to individual developers and to Open Source
foundations."

https://lwn.net/Articles/960606/


Security updates for Friday

Security updates have been issued by Debian (chromium, man-db, and openjdk-17), Fedora (chromium, indent, jupyterlab, kernel, and python-notebook), Gentoo (glibc), Oracle (firefox, thunderbird, and tigervnc), Red Hat (rpm), SUSE (cpio, gdb, gstreamer, openconnect, slurm, slurm_18_08, slurm_20_02, slurm_20_11, slurm_22_05, slurm_23_02, squid, webkit2gtk3, and xerces-c), and Ubuntu (imagemagick and xorg-server, xwayland).

https://lwn.net/Articles/960604/


[$] The hard life of a virtual-filesystem developer

Filesystem development is not an easy task; the performance demands are
typically high, and the consequences for mistakes usually involve lost data
and irate users.  The implementation of a virtual (or "pseudo") filesystem
— a filesystem implemented within the kernel and lacking a normal backing
store — can also be challenging, but for different reasons.  A series of
conversations around the eventfs virtual filesystem has turned a spotlight
on the difficulty of creating a virtual filesystem for Linux.

https://lwn.net/Articles/960088/


Damn Small Linux 2024 released

A new version of the Damn Small
Linux distribution has come out with an updated definition of "damn
small":

	The new goal of DSL is to pack as much usable desktop distribution
	into an image small enough to fit on a single CD, or a hard limit
	of 700MB. This project is meant to service older computers and have
	them continue to be useful far into the future. Such a notion sits
	well with my values. I think of this project as my way of keeping
	otherwise usable hardware out of landfills.

https://lwn.net/Articles/960446/


Stable kernels 6.7.3, 6.6.15, and 6.1.76

The https://lwn.net/Articles/960440/
 stable kernels have been released.
These contain a large number of important fixes throughout the tree, as is
the norm.

https://lwn.net/Articles/960439/


[$] LWN.net Weekly Edition for February 1, 2024

The LWN.net Weekly Edition for February 1, 2024 is available.

https://lwn.net/Articles/959457/


GNU C Library 2.39 released

https://lwn.net/ml/libc-alpha/38790850.J2Yia2DhmK@pinacolada/

of the GNU C Library has been released.  Changes include integration with
the https://lwn.net/Articles/926649/
, a couple of
new posix_spawn() variants for working with control groups, pidfd_spawn() and
pidfd_spawnp(), the C2X stdbit.h header, the removal
of the libcrypt library, and more.  See https://sourceware.org/glibc/wiki/Release/2.39

for details.

https://lwn.net/Articles/960357/


LibreOffice 24.2 Community released

Version
24.2 of the LibreOffice office suite is available.  Changes include
AutoRecovery enabled by default, styling of comments, better floating-table
support, improved accessibility, and more.  See the release
notes for details.

https://lwn.net/Articles/960344/


Security updates for Tuesday

Security updates have been issued by Debian (pillow, postfix, and redis), Fedora (python-templated-dictionary and selinux-policy), Red Hat (gnutls, kpatch-patch, libssh, and tomcat), and Ubuntu (amanda, ceph, linux-azure, linux-azure-4.15, linux-kvm, and tinyxml).

https://lwn.net/Articles/960008/


Security updates for Monday

Security updates have been issued by CentOS (gstreamer-plugins-bad-free, java-1.8.0-openjdk, java-11-openjdk, kernel, LibRaw, python-pillow, and xorg-x11-server), Debian (gst-plugins-bad1.0, libspreadsheet-parsexlsx-perl, mariadb-10.3, and slurm-wlm), Fedora (atril, dotnet8.0, gnutls, prometheus-podman-exporter, python-jinja2, sudo, and vips), Oracle (frr, kernel, php:8.1, python-urllib3, python3.9, rpm, sqlite, and tomcat), Slackware (pam), SUSE (cpio, rear23a, rear27a, sevctl, and xorg-x11-server), and Ubuntu (exim4 and firefox).

https://lwn.net/Articles/959882/


Seven new stable kernels

Greg Kroah-Hartman has announced the release of the https://lwn.net/Articles/959511/
,
https://lwn.net/Articles/959513/
 stable kernels.  As usual, they
contain a long list of fixes throughout the kernel tree.

https://lwn.net/Articles/959509/


[$] The things nobody wants to pay for

The free-software community has managed to build a body of software that is
worth, by most estimates, many billions of dollars; all of this code is
freely available to anybody who wants to use or modify it.  It is an
unparalleled example of independent actors working cooperatively on a
common resource.  Free software is certainly a success story, but all is
not perfect.  One of the community's greatest strengths — convincing
companies to contribute to this common resource — is also part of one of
its biggest weaknesses.

https://lwn.net/Articles/959069/


Security updates for Thursday

Security updates have been issued by Debian (chromium, firefox-esr, php-phpseclib, phpseclib, thunderbird, and zabbix), Fedora (dotnet7.0, firefox, fonttools, and python-jinja2), Mageia (avahi and chromium-browser-stable), Oracle (java-1.8.0-openjdk, java-11-openjdk, LibRaw, openssl, and python-pillow), Red Hat (gnutls, kpatch-patch, php:8.1, and squid:4), SUSE (apache-parent, apache-sshd, bluez, cacti, cacti-spine, erlang, firefox, java-11-openjdk, opera, python-Pillow, tomcat, tomcat10, and xwayland), and Ubuntu (paramiko and puma).

https://lwn.net/Articles/959455/


[$] LWN.net Weekly Edition for January 25, 2024

The LWN.net Weekly Edition for January 25, 2024 is available.

https://lwn.net/Articles/958597/


Firefox 122.0 released

Version
122.0 of the Firefox browser it out.  Changes include improved search
suggestions, improvements to the in-browser
translation feature, better line-breaking compatibility, and a shiny
new .deb package.

https://lwn.net/Articles/959163/


Security updates for Monday

Security updates have been issued by Debian (keystone and subunit), Fedora (dotnet6.0, golang, kernel, sos, and tigervnc), Mageia (erlang), Red Hat (openssl), SUSE (bluez, python-aiohttp, and seamonkey), and Ubuntu (postfix and xorg-server).

https://lwn.net/Articles/959006/


Dave Mills RIP

Internet pioneer and Network Time Protocol (NTP) inventor Dave Mills has died, as https://elists.isoc.org/pipermail/internet-history/2024-January/009265.html
:

His daughter, Leigh, just sent me the news that Dave passed away peacefully
on January 17, 2024. He was such an iconic element of the early Internet.
Network Time Protocol, the Fuzzball routers of the early NSFNET, INARG
taskforce lead, COMSAT Labs and University of Delaware and so much more.

More information about Mills can be found on his https://en.wikipedia.org/wiki/David_L._Mills
.

https://lwn.net/Articles/958781/


Security updates for Friday

Security updates have been issued by Fedora (chromium, golang-github-facebook-time, podman, and xorg-x11-server-Xwayland), Oracle (.NET 6.0, java-1.8.0-openjdk, java-11-openjdk, and python3.11-cryptography), Red Hat (java-11-openjdk, python-requests, and python-urllib3), SUSE (chromium, kernel, libcryptopp, libuev, perl-Spreadsheet-ParseExcel, suse-module-tools, and xwayland), and Ubuntu (filezilla and xerces-c).

https://lwn.net/Articles/958760/


Security updates for Thursday

Security updates have been issued by CentOS (ImageMagick), Debian (chromium), Fedora (golang-x-crypto, golang-x-mod, golang-x-net, golang-x-text, gtkwave, redis, and zbar), Mageia (tinyxml), Oracle (.NET 7.0, .NET 8.0, java-1.8.0-openjdk, java-11-openjdk, python3, and sqlite), Red Hat (gstreamer-plugins-bad-free, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, and java-21-openjdk), SUSE (kernel, libqt5-qtbase, libssh, pam, rear23a, and rear27a), and Ubuntu (pam and zookeeper).

https://lwn.net/Articles/958676/


[$] LWN.net Weekly Edition for January 18, 2024

The LWN.net Weekly Edition for January 18, 2024 is available.

https://lwn.net/Articles/958030/


Wine 9.0 released

Version
9.0 of the Wine Windows-compatibility system has been released.
"This release represents a year of development effort and over 7,000
individual changes. It contains a large number of improvements that are
listed below. The main highlights are the new WoW64 architecture and the
experimental Wayland driver."

https://lwn.net/Articles/958443/


A glitch in the merge window

On January 13, Linus Torvalds let
it be known that he had lost power due to the bad weather in the US
Pacific Northwest.  As of this writing, he has not yet resurfaced, so the
6.8 merge window has ground to a halt.

	There's apparently about 100k people without power, and I doubt our
	neighborhood is the priority, so I expect to be without power for
	some time still. I hope I'm wrong, but a few years ago it took more
	than a week to restore power due to all the downed trees. It's
	hopefully nowhere near that, but..

https://lwn.net/Articles/958424/


Security updates for Tuesday

Security updates have been issued by Gentoo (KTextEditor, libspf2, libuv, and Nettle), Mageia (hplip), Oracle (container-tools:4.0, gnutls, idm:DL1, squid, squid34, and virt:ol, virt-devel:rhel), Red Hat (.NET 6.0, krb5, python3, rsync, and sqlite), SUSE (chromium, perl-Spreadsheet-ParseXLSX, postgresql, postgresql15, postgresql16, and rubygem-actionpack-5_1), and Ubuntu (binutils, libspf2, libssh2, mysql-5.7, w3m, webkit2gtk, and xerces-c).

https://lwn.net/Articles/958416/


Security updates for Monday

Security updates have been issued by CentOS (bind, cups, curl, firefox, ipa, iperf3, java-1.8.0-openjdk, java-11-openjdk, kernel, libssh2, linux-firmware, open-vm-tools, openssh, postgresql, python, python3, squid, thunderbird, tigervnc, and xorg-x11-server), Fedora (chromium, python-flask-security-too, and tkimg), Gentoo (libgit2, Opera, QPDF, and zlib), Mageia (chromium-browser-stable, gnutls, openssh, packages, and vlc), Oracle (.NET 6.0, fence-agents, frr, ipa, kernel, nss, pixman, and tomcat), and SUSE (gstreamer-plugins-bad).

https://lwn.net/Articles/958315/


Stable kernel 5.10.207

The https://lwn.net/Articles/958173/
 stable kernel update has been
released; it consists entirely of a handful of reverts of SCSI patches.

https://lwn.net/Articles/958174/


[$] The first half of the 6.8 merge window

The 6.8 merge window has gotten off to a relatively slow start; reasons for
that include a significant scheduler performance regression that Linus
Torvalds stumbled
into and has spent time tracking down.  Even so, 4,282 non-merge
changesets have found their way into the mainline repository for the 6.8
release as of this writing.  These commits have brought a number of
significant changes and new features.

https://lwn.net/Articles/957188/


Security updates for Friday

Security updates have been issued by Debian (kernel, linux-5.10, php-phpseclib, php-phpseclib3, and phpseclib), Fedora (openssh and tinyxml), Gentoo (FreeRDP and Prometheus SNMP Exporter), Mageia (packages), Red Hat (openssl), SUSE (gstreamer-plugins-rs and python-django-grappelli), and Ubuntu (dotnet6, dotnet7, dotnet8, openssh, and xerces-c).

https://lwn.net/Articles/958124/


OpenSSH announces DSA-removal timeline

For those of you still using DSA keys with SSH: the project has announced
its plans to remove support for that algorithm around the beginning of
2025.

	The only remaining use of DSA at this point should be deeply legacy
	devices. As such, we no longer consider the costs of maintaining
	DSA in OpenSSH to be justified. Moreover, we hope that OpenSSH's
	final removal of this insecure algorithm accelerates its
	deprecation in other SSH implementations and allows maintainers of
	cryptography libraries to remove it too.

https://lwn.net/Articles/958048/


[$] The kernel "closure" API

The data structure known as a "closure" first found its way into the
mainline kernel with the addition of https://bcache.evilpiepirate.org/
 in the 3.10 development
cycle.  With the advent of https://bcachefs.org/
 in
6.7, though, it acquired a second user and was moved to the kernel's
lib directory, making it available to other kernel users as well.
The documentation of closures in the source is better than that of many
things in the kernel, but there is still room for a gentler introduction.

https://lwn.net/Articles/957187/


[$] LWN.net Weekly Edition for January 11, 2024

The LWN.net Weekly Edition for January 11, 2024 is available.

https://lwn.net/Articles/956868/


Stable kernel 4.14.336

The https://lwn.net/Articles/957350/
 stable kernel update has been
released with a small handful of fixes; this is the end of the line for the
4.14 stable series:

	This is the LAST 4.14.y kernel to be released.  It is now
	officially end-of-life.  Do NOT use this kernel version anymore,
	please move to a newer one, as shown on the kernel.org releases
	page.

	All users of the 4.14 kernel series must upgrade.  But then, move
	to a newer release.  If you are stuck at this version due to a
	vendor requiring it, go get support from that vendor for this
	obsolete kernel tree, as that is what you are paying them for :)

https://lwn.net/Articles/957351/


[$] LWN's guide to 2024

The calendar has flipped over into 2024 — another year has begun.  Here at
LWN, we do not have a better idea of what this year will bring than anybody
else does, but that doesn't keep us from going out on a shaky limb and
making predictions anyway.  Here, for the curious, are a few things that we
think may be in store for 2024.

https://lwn.net/Articles/954544/


Security updates for Tuesday

Security updates have been issued by Red Hat (firefox and thunderbird), SUSE (gstreamer-plugins-bad, libssh2_org, and webkit2gtk3), and Ubuntu (firefox and thunderbird).

https://lwn.net/Articles/956568/


Stable kernels 6.6.9 and 6.1.70

Greg Kroah-Hartman has announced the release of the https://lwn.net/Articles/956525/
 stable kernels.  As usual, they contain
important fixes throughout the kernel tree.

https://lwn.net/Articles/956524/


[$] The trouble with MAX_ORDER

One might not think that much could be said about a simple macro defining a
constant integer value.  But the kernel is special, it seems.  A change to
the definition of MAX_ORDER has had a number of follow-on effects,
and the task of cleaning up after this change is not done yet.  So perhaps
a look at MAX_ORDER is in order.

https://lwn.net/Articles/956321/


Scribus 1.6.0 released

Version 1.6.0 of the Scribus
desktop-publishing application has been https://www.scribus.net/scribus-1-6-0-released/
.  The
list of new features is rather long and includes a user interface overhaul,
improvements for HiDPI screens, new scripting commands, lots of
typographical improvements and features, a new picture browser for
graphical asset management, support for more gradient types, and much more.

Scribus 1.6.0 is the long awaited release in the next stable series,
replacing 1.4.8 and development versions in the 1.5.x series. This version
has been in development for some years and contains thousands of
enhancements and fixes across all areas of the program. It has more
features, is faster, and is more stable.

https://lwn.net/Articles/956522/


Security updates for Monday

Security updates have been issued by Debian (ansible, asterisk, cjson, firefox-esr, kernel, libde265, libreoffice, libspreadsheet-parseexcel-perl, php-guzzlehttp-psr7, thunderbird, tinyxml, and xerces-c), Fedora (podman-tui, proftpd, python-asyncssh, squid, and xerces-c), Mageia (libssh and proftpd), and SUSE (deepin-compressor, gnutls, gstreamer, libreoffice, opera, proftpd, and python-pip).

https://lwn.net/Articles/956521/


Julia 1.10 released

The https://julialang.org/
.  It is mainly a performance release, with only two new language features mentioned in the release notes: "JuliaSyntax.jl is now used as the default parser, providing better diagnostics and faster parsing." and the addition of two Unicode symbols for use as binary operators: "⥺ (U+297A, \leftarrowsubset) and ⥷ (U+2977, \leftarrowless)".  Package-loading time has been improved further and the mark phase of garbage collection has been parallelized, among other improvements.

https://lwn.net/Articles/956456/


Gnuplot 6.0 released

Version 6.0 of the Gnuplot plotting system
has been released.

	Gnuplot has been supported and under active development since 1986.
	This is the first new major version of gnuplot since the release of
	version 5 in January 2015.  It introduces extensions to the gnuplot
	command language, an expanded collection of special and
	complex-valued functions, additional 2D and 3D plotting styles, and
	support for new output protocols.

See the
release notes for details.

https://lwn.net/Articles/956454/


Security updates for Thursday

Security updates have been issued by Debian (haproxy, libssh, and nodejs), Fedora (filezilla and minizip-ng), Gentoo (Git, libssh, and OpenSSH), and SUSE (gstreamer, postfix, webkit2gtk3, and zabbix).

https://lwn.net/Articles/956257/


Security updates for Tuesday

Security updates have been issued by Debian (curl, openssh, osslsigncode, and putty), Fedora (chromium, filezilla, libfilezilla, mingw-gstreamer1, mingw-gstreamer1-plugins-bad-free, mingw-gstreamer1-plugins-base, mingw-gstreamer1-plugins-good, opensc, thunderbird, unrealircd, and xorg-x11-server-Xwayland), Gentoo (Ceph, FFmpeg, Flatpak, Gitea, and SABnzbd), Mageia (chromium-browser-stable), Slackware (kernel and postfix), and SUSE (cppcheck, distribution, gstreamer-plugins-bad, jbigkit, and ppp).

https://lwn.net/Articles/956156/


Ruby 3.3.0 Released

As is the tradition for the https://www.ruby-lang.org/en/
 (Yet another Ruby JIT) just-in-time compiler. Ruby 3.3 adds a new Ruby-based JIT, RJIT, that targets x86_64, which is available for experimental purposes.  There are lots of other improvements and new features described in the announcement.

https://lwn.net/Articles/956115/


Kernel prepatch 6.7-rc7

The https://lwn.net/Articles/956091/
 kernel prepatch is out for
testing.

	Anyway, rc7 itself looks fairly normal. It's actually a bit bigger
	than rc6 was, but not hugely so, and nothing in here looks at all
	strange. Please do give it a whirl if you have the time and the
	energy, but let's face it, I expect things to be very quiet and
	this to be one of those "nothing happens" weeks. Because even if
	you aren't celebrating this time of year, you might take advantage
	of the peace and quiet.

https://lwn.net/Articles/956092/


Stable kernel 5.15.145

The https://lwn.net/Articles/956081/
 stable kernel has been
released.  It consists mostly of fixes to the ksmbd subsystem, which has
been marked as broken due to (until now) a lack of support for the 5.15.x
kernels.

https://lwn.net/Articles/956082/


Darktable 4.6.0 released

Version
4.6.0 of the darktable photo editor has been released.  Changes include
a new "rgb primaries" module that "can be used for delicate color
corrections as well as creative color grading", enhancements to the
sigmoid module, some performance improvements, and more.  (LWN https://lwn.net/Articles/881853/
 in 2022).

https://lwn.net/Articles/956017/


Security updates for Thursday

Security updates have been issued by Debian (firefox-esr), Fedora (kernel), Mageia (bluez), Oracle (fence-agents, gstreamer1-plugins-bad-free, opensc, openssl, postgresql:10, and postgresql:12), Red Hat (postgresql:15 and tigervnc), Slackware (proftpd), and SUSE (docker, rootlesskit, firefox, go1.20-openssl, go1.21-openssl, gstreamer-plugins-bad, libreoffice, libssh2_org, poppler, putty, rabbitmq-server, wireshark, xen, xorg-x11-server, and xwayland).

https://lwn.net/Articles/955914/


[$] LWN.net Weekly Edition for December 21, 2023

The LWN.net Weekly Edition for December 21, 2023 is available.

https://lwn.net/Articles/955132/


QEMU 8.2.0 released

https://www.qemu.org/2023/12/20/qemu-8-2-0/
 of
the QEMU emulator is out.  Changes include new emulations for virtio-sound
devices, universal flash storage devices, Xilinx Versai boards, and much
more.

https://lwn.net/Articles/955832/


LSFMM+BPF 2024 call for proposals

The 2024 Linux Storage, Filesystem, Memory-Management, and BPF Summit will
be held May 13 to 15 in Salt Lake City, Utah, USA.  The call
for proposals has already gone out, with a deadline of March 1.
"LSF/MM/BPF is an invitation-only technical workshop to map out
improvements to the Linux storage, filesystem, BPF, and memory management
subsystems that will make their way into the mainline kernel within the
coming years."

https://lwn.net/Articles/955827/


Firefox 121.0 released

Version
121.0 of the Firefox browser is out.  Along with the usual pile of
security fixes, this release add the ability to force links to be rendered
with underlines and use of Wayland by default if it is available: "This
brings support for touchpad & touchscreen gestures, swipe-to-nav,
per-monitor DPI settings, better graphics performance, and more."

https://lwn.net/Articles/955679/


Security updates for Tuesday

Security updates have been issued by Debian (webkit2gtk), Fedora (rdiff-backup and xorg-x11-server-Xwayland), Mageia (cjose and ghostscript), Oracle (avahi), Red Hat (postgresql:10), and SUSE (avahi, freerdp, libsass, and ncurses).

https://lwn.net/Articles/955678/


Security updates for Monday

Security updates have been issued by Debian (freeimage, ghostscript, intel-microcode, spip, and xorg-server), Fedora (chromium, perl, perl-Devel-Cover, perl-PAR-Packer, polymake, PyDrive2, seamonkey, and vim), Gentoo (Leptonica), Mageia (audiofile, gimp, golang, and poppler), Oracle (buildah, containernetworking-plugins, gstreamer1-plugins-bad-free, kernel, kernel-container, libxml2, pixman, podman, postgresql, postgresql:15, runc, skopeo, tracker-miners, and webkit2gtk3), and SUSE (fish).

https://lwn.net/Articles/955566/


Kernel prepatch 6.7-rc6

Linus has released https://lwn.net/Articles/955484/
 for testing.
" Please do give this a test in between the last-minute xmas shopping or
whatever else is going on ..."

https://lwn.net/Articles/955485/


[$] Progress toward a GCC-based Rust compiler

The https://rust-gcc.github.io/
 project is an ambitious
effort started in 2014 to implement a Rust compiler within The GNU Compiler
Collection (GCC).  Even though the task is far from complete, progress has
been made since LWN's https://lwn.net/Articles/909887/
,
according to reports from the project.  Meanwhile, another hybrid and more
mature approach to GCC Rust code generation is available in https://github.com/rust-lang/rustc_codegen_gcc
.

https://lwn.net/Articles/954787/


Security updates for Friday

Security updates have been issued by Debian (bluez and haproxy), Fedora (curl, dotnet6.0, dotnet7.0, tigervnc, and xorg-x11-server), Red Hat (avahi and gstreamer1-plugins-bad-free), Slackware (bluez), SUSE (cdi-apiserver-container, cdi-cloner-container, cdi- controller-container, cdi-importer-container, cdi-operator-container, cdi- uploadproxy-container, cdi-uploadserver-container, cont, cosign, curl, gstreamer-plugins-bad, haproxy, ImageMagick, kernel, kernel-firmware, libreoffice, tiff, traceroute, tracker-miners, webkit2gtk3, and xrdp), and Ubuntu (audiofile, budgie-extras, libreoffice, strongswan, vim, and yajl).

https://lwn.net/Articles/955336/


[$] Ext4 data corruption hits the stable kernels

The kernel's stable-update process is intended to produce kernels that are,
well, stable; when that promise is lived up to, users can update to newer
stable updates without fear.  By any account, a bug that corrupts data on
ext4 filesystems constitutes a failure to hold to that promise.  As is so
often the case, this problem is the result of a chain of failures in a
system that works well most of the time.

https://lwn.net/Articles/954770/


[$] LWN.net Weekly Edition for December 14, 2023

The LWN.net Weekly Edition for December 14, 2023 is available.

https://lwn.net/Articles/953980/


More stable kernel updates

The
https://lwn.net/Articles/954990/
,
https://lwn.net/Articles/954989/
,
https://lwn.net/Articles/954988/
,
https://lwn.net/Articles/954987/
,
https://lwn.net/Articles/954986/
,
https://lwn.net/Articles/954985/
, and
https://lwn.net/Articles/954984/

stable kernel updates have all been released; each contains another set of
important fixes.

https://lwn.net/Articles/954983/


Kernel prepatch 6.7-rc5

The https://lwn.net/Articles/954468/
 kernel prepatch is out for
testing.

	Nothing looks particularly scary, which is good, because if it had
	been, I wouldn't have had the capacity to deal with it last week.

	Let's hope it stays that way even as I am getting better. Because the
	holidays are almost upon us, and I'm woefully underprepared.

https://lwn.net/Articles/954469/


Two stable kernels

Greg Kroah-Hartman has announced the release of the https://lwn.net/Articles/954453/
 stable kernels.  Both contain a single
reversion of the "wifi: cfg80211: fix CQM for non-range use" patch.

https://lwn.net/Articles/954454/


Django 5.0 released

Version
5.0 of the Django web framework is out.  Significant changes include database-computed
default values, field groups in the templating system, and more; see the release
notes for details.

https://lwn.net/Articles/953736/


GDB 14.1 released

Version 14.1 of the GDB debugger is out.  Changes include initial support
for the debugger
adapter protocol, NO_COLOR support, the ability to work with
integer types larger than 64 bits, a number of enhancements to the
Python API, and more.

https://lwn.net/Articles/953732/


Bueso: LPC 2023: CXL Microconference

Davidlohr Bueso has posted a
summary of the CXL microconference at the recently concluded Linux
Plumbers Conference.  "The goals for the track were to openly discuss
current on-going development efforts around the core driver, as well as
experimental memory management topics which lead to accommodating kernel
infrastructure for new technology and use cases."

https://lwn.net/Articles/953706/


Security updates for Monday

Security updates have been issued by Debian (amanda, ncurses, nghttp2, opendkim, rabbitmq-server, and roundcube), Fedora (golang-github-openprinting-ipp-usb, kernel, kernel-headers, kernel-tools, and samba), Mageia (audiofile, galera, libvpx, and virtualbox), Oracle (kernel and postgresql:13), SUSE (openssl-3, optipng, and python-Pillow), and Ubuntu (firefox).

https://lwn.net/Articles/953702/


6.7-rc4 and stable kernels too

Linus has https://lwn.net/Articles/953646/
 for testing.
"And things look fine for now, with a fairly
small rc4".

Meanwhile, the
https://lwn.net/Articles/953647/
,
https://lwn.net/Articles/953648/
, and
https://lwn.net/Articles/953649/

stable kernel updates have been released; each contains another set of
important fixes.

https://lwn.net/Articles/953645/


A pile of stable kernel updates

The large
https://lwn.net/Articles/953135/
,
https://lwn.net/Articles/953133/
,
https://lwn.net/Articles/953132/
,
https://lwn.net/Articles/953130/
,
https://lwn.net/Articles/953129/
,
https://lwn.net/Articles/953128/
,
https://lwn.net/Articles/953131/
,
https://lwn.net/Articles/953127/

stable kernel updates have all been released; each contains another set of
important fixes.  Note that 6.5.13 is the final update for 6.5.

https://lwn.net/Articles/953126/


[$] Reducing kernel-maintainer burnout

Overstressed maintainers are a constant topic of conversation throughout
the open-source community.  Kernel maintainers have been complaining more
loudly than usual recently about overwork and stress.  The problems that
maintainers are facing are clear; what to do about them is rather less so.
A session at the 2023 Maintainers Summit took up the topic yet again with
the hope of finding some solutions; there may be answers, perhaps even
within the kernel community, but a general solution still seems distant.

https://lwn.net/Articles/952034/


Happy Thanksgiving

November 23 is the US Thanksgiving holiday; as is our tradition, we will
not be publishing an LWN Weekly Edition this week as we will be far too
busy eating.  We wish a good holiday to all of our readers (whether they
celebrate it or not); the weekly edition will return on November 30.

https://lwn.net/Articles/952354/


[$] Committing to Rust for kernel code

Rust has been a prominent topic at the Kernel Maintainers Summit for the
last couple of years, and the 2023 meeting continued that tradition.  As
Rust-for-Linux developer Miguel Ojeda noted at the beginning of the session
dedicated to the topic, the level of interest in using Rust for kernel
development has increased significantly over the last year.  But Rust was
explicitly added to Linux as an experiment; is the kernel community now
ready to say that the experiment has succeeded?

https://lwn.net/Articles/952029/


Git 2.43.0 released

https://lwn.net/ml/git/xmqqzfz8l5or.fsf@gitster.g/
 of the Git
source-code management system has been release.  It includes a long list of
improvements and minor new features.

https://lwn.net/Articles/952121/


Security updates for Tuesday

Security updates have been issued by Debian (activemq, strongswan, and wordpress), Mageia (u-boot), SUSE (avahi, frr, libreoffice, nghttp2, openssl, openssl1, postgresql, postgresql15, postgresql16, python-Twisted, ucode-intel, and xen), and Ubuntu (avahi, hibagent, nodejs, strongswan, tang, and webkit2gtk).

https://lwn.net/Articles/952088/


Eight new stable kernels

Greg Kroah-Hartman has announced the release of the https://lwn.net/Articles/952001/
,
https://lwn.net/Articles/952003/
 stable kernels.  They contain a
rather large number of important fixes throughout the kernel tree.

https://lwn.net/Articles/952000/


Kernel prepatch 6.7-rc2

The https://lwn.net/Articles/951906/
 is out for
testing.  "The most noticeable thing is probably the turbostat tool
update, which actually came in during the merge window, but was delayed by
just waiting for getting the pull request properly signed."

https://lwn.net/Articles/951907/


[$] Preventing atomic-context violations in Rust code with klint

One of the core constraints when programming in the kernel is the need to
avoid sleeping when running in atomic context.  For the most part, the
responsibility for adherence to this rule is placed on the developer's
shoulders;  Rust developers, though, want the compiler to ensure that code
is safe whenever possible.  At the 2023 Linux
Plumbers Conference, Gary Guo presented (via a remote link) the klint
tool, which can find
and flag many atomic-context violations before they turn into
user-affecting bugs.

https://lwn.net/Articles/951550/


Security updates for Friday

Security updates have been issued by Debian (webkit2gtk), Fedora (microcode_ctl, pack, and tigervnc), Slackware (gimp), SUSE (frr, gcc13, go1.20, go1.20-openssl, go1.21, go1.21-openssl, libnbd, libxml2, python-Pillow, python-urllib3, and xen), and Ubuntu (intel-microcode and openvpn).

https://lwn.net/Articles/951801/


Rust 1.74.0 released

Version
1.74.0 of the Rust language has been released.  New features include
better configuration for linters, authenticated cargo repositories, and
support for projections in opaque return types.

https://lwn.net/Articles/951750/


[$] The real realtime preemption end game

The addition of realtime support to Linux is a long story; it first
https://lwn.net/Articles/106010/
 in 2004.  For much of that
time, it has seemed like only a little more work was needed to get across
the finish line; thus we ran headlines like the
realtime preemption endgame — in 2009.  At the https://lpc.events/
, Thomas
Gleixner informed the group that, now, the end truly is near.  There is
really only one big problem left to be solved before all of that work can
land in the mainline.

https://lwn.net/Articles/951337/


Security updates for Thursday

Security updates have been issued by Debian (chromium and openvpn), Oracle (kernel, microcode_ctl, plexus-archiver, and python), Red Hat (.NET 6.0, dotnet6.0, dotnet7.0, dotnet8.0, kernel, linux-firmware, and open-vm-tools), SUSE (apache2, chromium, jhead, postgresql12, postgresql13, and qemu), and Ubuntu (dotnet6, dotnet7, dotnet8, frr, python-pip, quagga, and tidy-html5).

https://lwn.net/Articles/951681/


[$] LWN.net Weekly Edition for November 16, 2023

The LWN.net Weekly Edition for November 16, 2023 is available.

https://lwn.net/Articles/950829/


A GNU COBOL status update

For the COBOL users out there, James K. Lowden has posted
an update on the current status of the GNU COBOL compiler.

	When in November we turn back our clocks, then naturally do
	programmers' thoughts turn to Cobol, its promise, and future.

	At last post, nine months ago, we were working our way through the
	NIST CCVS/85 test suite.  I am pleased to report that process is
	complete.  As far as NIST is concerned, gcobol is a Cobol compiler.

https://lwn.net/Articles/951498/


Security updates for Tuesday

Security updates have been issued by Debian (postgresql-11, postgresql-13, and postgresql-15), Fedora (chromium, optipng, and radare2), Scientific Linux (plexus-archiver and python), Slackware (tigervnc), SUSE (apache2, containerized-data-importer, kernel-firmware-nvidia-gspx-G06, nvidia-open- driver-G06-signed, postgresql, postgresql15, postgresql16, postgresql12, postgresql13, python-Django1, squashfs, and xterm), and Ubuntu (firefox and memcached).

https://lwn.net/Articles/951311/


[$] The rest of the 6.7 merge window

By the time that the 6.7 merge window closed on November 12, 15,418
non-merge changesets had been pulled into the mainline kernel.  That makes
this one of the busiest merge windows ever; if one discounts the lengthy
bcachefs development history (some 2,800 commits), though, then the patch
volume is roughly in line with other recent kernels.  Over 5,000 of those
commits were merged after our first-half
merge-window summary was written.

https://lwn.net/Articles/949957/


Security updates for Monday

Security updates have been issued by Debian (audiofile and ffmpeg), Fedora (keylime, python-pillow, and tigervnc), Mageia (quictls and vorbis-tools), Oracle (grub2), Red Hat (galera, mariadb, plexus-archiver, python, squid, and squid34), and SUSE (clamav, kernel, mupdf, postgresql14, tomcat, tor, and vlc).

https://lwn.net/Articles/951237/


A documentary on the development of eBPF

For folks with an interest in how extended BPF came to be and a half-hour
to spare, the https://www.businesswire.com/news/home/20231108253883/en/Documentary-Film-%E2%80%9CeBPF-Unlocking-the-Kernel%E2%80%9D-Reveals-the-Unfolding-Revolution-of-eBPF

has gone out of a new film called "eBPF: Unlocking the kernel", released at
the KubeCon+CloudNativeCon event.  The documentary is available on
YouTube.

https://lwn.net/Articles/951093/


GNOME supported by the Sovereign Tech Fund

The GNOME Foundation has https://foundation.gnome.org/2023/11/09/gnome-recognized-as-public-interest-infrastructure/

the receipt of a €1 million award from the German https://sovereigntechfund.de/en/
.  The
funding will support work on accessibility, privacy, hardware support, and more.

https://lwn.net/Articles/951068/


Security updates for Friday

Security updates have been issued by Fedora (community-mysql, matrix-synapse, and xorg-x11-server-Xwayland), Mageia (squid and vim), Oracle (dnsmasq, python3, squid, squid:4, and xorg-x11-server), Red Hat (fence-agents, insights-client, kernel, kpatch-patch, mariadb:10.5, python3, squid, squid:4, tigervnc, and xorg-x11-server), Scientific Linux (bind, firefox, java-1.8.0-openjdk, java-11-openjdk, kernel, libssh2, python-reportlab, python3, squid, thunderbird, and xorg-x11-server), SUSE (go1.21), and Ubuntu (linux-gke and linux-iot).

https://lwn.net/Articles/951066/


The end of the Red Hat security-announcements list

Red Hat has https://listman.redhat.com/archives/rhsa-announce/2023-October/012854.html

that its longstanding "rhsa-announce" mailing list will be shut down on
October 10.  That is the list that receives security advisories for
Red Hat Enterprise Linux and a whole slew of related products.  Anybody who
was counting on that list for Red Hat security advisories will need to find
an alternative; a few options are listed in the announcement.

https://lwn.net/Articles/946851/


Stable kernels 6.5.6, 6.1.56, and 5.15.134

The latest round of stable kernels, https://lwn.net/Articles/946853/
,
https://lwn.net/Articles/946854/
, have been released.  Each contains a
fairly large collection of important fixes throughout the kernel tree.

https://lwn.net/Articles/946852/