[$] Tracing the source of filesystem errors
There are lots of places in the kernel where an EINVAL can be
returned to user space, but it is often unclear what the actual underlying
problem is because the https://man7.org/linux/man-pages/man3/errno.3.html
error codes are too generic. That is the problem that Miklos Szeredi
wanted to discuss in a filesystem session that he led remotely at the 2024 <a href="https://events.linuxfoundation.org/lsfmmbpf/" rel="nofollow">Linux Storage,
Filesystem, Memory Management, and BPF Summit</a>. He would like to help
those who are trying to debug problems trace where in the kernel a
particular error code is being generated.
https://lwn.net/Articles/984556/
Security updates for Wednesday
Security updates have been issued by Debian (firefox-esr, openjdk-17, and wpa), Gentoo (aiohttp, Bitcoin, Cairo, Go, json-c, Levenshtein, libXpm, nghttp2, PostgreSQL, and Redis), Red Hat (kernel, kernel-rt, python-setuptools, python-urllib3, python3.11-setuptools, and wget), Slackware (mozilla), SUSE (bind, curl, docker, ffmpeg, ffmpeg-4, kernel, kernel-firmware, libnbd, patch, shadow, and thunderbird), and Ubuntu (python-django and wpa).
https://lwn.net/Articles/984702/
Security updates for Tuesday
Security updates have been issued by Debian (libreoffice), Gentoo (containerd and firefox), Red Hat (httpd), SUSE (ca-certificates-mozilla, ksh, openssl-3-livepatches, podman, python-Twisted, and skopeo), and Ubuntu (imagemagick).
https://lwn.net/Articles/984598/
[$] Handling filesystem interruptibility
David Howells wanted to discuss changing the way filesystem code handles
the ability to interrupt or kill operations, in order to fix some
longstanding problems with network
(and other) filesystems, in a session at
the 2024 <a href="https://events.linuxfoundation.org/lsfmmbpf/" rel="nofollow">Linux
Storage, Filesystem, Memory Management, and BPF Summit</a>. As noted in
his <a href="https://lwn.net/ml/all/2701318.1706863882%40warthog.procyon.org.uk/" rel="nofollow">session
proposal</a>, some filesystems may be expecting to not be interruptible,
but are calling code can take locks and mutexes that are interruptible (or
killable), which are effectively
changing the state of the task incorrectly.
He would like to find a solution for that problem.
https://lwn.net/Articles/983714/
[$] The complexity of BUSL transformation
The <a href="https://spdx.org/licenses/BUSL-1.1.html" rel="nofollow">Business
Source License</a> (BUSL) is a source-available license that "converts"
to an open-source license after a period of time. In theory, this
means that a few years after a version of a product is released under
the BUSL, it becomes open source and is fair game for Linux
distributions to package along with regular open-source projects. In
practice, the license throws a few curveballs that require special
consideration and caution, as the Fedora Project recently discussed.
https://lwn.net/Articles/984249/
GNU Binutils 2.43 released
Version 2.43 of the GNU Binutils package is out. Changes include some
improvements to the assembler and the linker, better support for hardware
event counters in the Gprofng profiler, and more.
https://lwn.net/Articles/984539/
Security updates for Monday
Security updates have been issued by Debian (openjdk-11), Fedora (bind, bind-dyndb-ldap, chromium, ffmpeg, hostapd, trafficserver, and wpa_supplicant), and Ubuntu (curl and linux-oem-6.5).
https://lwn.net/Articles/984552/
[$] Pulling Linux up by its bootstraps
A <a href="https://lwn.net/Articles/841797/" rel="nofollow">
bootstrappable build</a> is one that builds existing
software from scratch — for example, building GCC without relying on an existing
copy of GCC. In 2023, the Guix project
https://lwn.net/Articles/930650/
that the project had reduced the size
of the binary bootstrap seed needed to build its operating system to just 357-bytes —
not counting the Linux kernel required to run the build process. Now, the
https://github.com/fosslinux/live-bootstrap
project
has gone a step further and removed the need for an existing kernel at all.
https://lwn.net/Articles/983340/
[$] Large folios, swap, and FS-Cache
David Howells wanted to discuss swap handling in light of multi-page folios
in a combined storage, filesystem, and memory-management session at
the 2024 <a href="https://events.linuxfoundation.org/lsfmmbpf/" rel="nofollow">Linux Storage,
Filesystem, Memory Management, and BPF Summit</a>. Swapping has always been
done with a one-to-one mapping of memory pages to swap slots, he said, but
swapping multi-page folios breaks that assumption. He wondered if it would
make sense to use filesystem techniques to track swapped-out folios.
https://lwn.net/Articles/982887/
[$] Lessons from the death and rebirth of Thunderbird
Ryan Sipes told the audience during his keynote at
https://events.gnome.org/event/209/
mail client
"probably shouldn't still be alive". Thunderbird, however, is not only
alive—it is arguably in better shape than ever
before. According to Sipes, the project's turnaround is a result of
governance, storytelling, and learning to be comfortable asking users
for money. He would also like it quite a bit if Linux distributions stopped
turning off telemetry.
https://lwn.net/Articles/982610/
GNOME Foundation Announces Transition of Executive Director
The https://foundation.gnome.org/
that executive director Holly Million is stepping down at the end of
July, and will be replaced by Richard Littauer as interim executive
director:
On behalf of the whole GNOME community, the Board of Directors
would like to give our utmost thanks to Holly for her achievements
during the past 10 months, including drafting a bold five-year
strategic plan for the Foundation, securing two important fiscal
sponsorship agreements with GIMP and Black Python Devs, writing our
first funding proposal that will now enable the Foundation to apply
for more grants, vastly improving our financial operations, and
implementing a break-even budget to preserve our financial
reserves.
The Foundation's Interim Executive Director, Richard Littauer,
brings years of open source leadership as part of his work as an
organizer of SustainOSS and CURIOSS, as a sustainability coordinator
at the Open Source Initiative, and as a community development manager
at Open Source Collective, and through open source contributions to
many projects, such as Node.js and IPFS. The Board appointed Richard
in June and is confident in his ability to guide the Foundation during
this transitional period.
Million says she is leaving to pursue a PhD in psychology. The
board plans to announce its search plan for a permanent executive
directory after https://events.gnome.org/event/209/
, which takes
place July 19 through 24.
https://lwn.net/Articles/981850/
Kernel prepatch 6.9-rc6
The https://lwn.net/Articles/971413/
kernel prepatch is out for
testing.
Things continue to look pretty normal, and nothing here really
stands out. The biggest single change that stands out in the
diffstat is literally a documentation update, everything else looks
pretty small and spread out.
https://lwn.net/Articles/971414/
[$] Support for the TSO memory model on Arm CPUs
At the CPU level, a memory model describes, among other things, the amount
of freedom the processor has to reorder memory operations. If low-level
code does not take the memory model into account, unpleasant surprises are
likely to follow. Naturally, different CPUs offer different memory models,
complicating the portability of certain types of concurrent software. To
make life easier, some Arm CPUs offer the ability to emulate the x86 memory
model, but efforts to make that feature available in the kernel are running
into opposition.
https://lwn.net/Articles/970907/
Security updates for Friday
Security updates have been issued by Debian (knot-resolver, pdns-recursor, and putty), Fedora (xen), Mageia (editorconfig-core-c, glibc, mbedtls, webkit2, and wireshark), Oracle (buildah), Red Hat (buildah and yajl), Slackware (libarchive), SUSE (dcmtk, openCryptoki, php7, php74, php8, python-gunicorn, python-idna, qemu, and thunderbird), and Ubuntu (cryptojs, freerdp2, nghttp2, and zabbix).
https://lwn.net/Articles/971289/
Security updates for Thursday
Security updates have been issued by Fedora (curl, filezilla, flatpak, kubernetes, libfilezilla, thunderbird, and xen), Oracle (go-toolset:ol8, kernel, libreswan, shim, and tigervnc), Red Hat (buildah, gnutls, libreswan, tigervnc, and unbound), SUSE (cockpit-wicked, nrpe, and python-idna), and Ubuntu (dnsmasq, freerdp2, linux-azure-6.5, and thunderbird).
https://lwn.net/Articles/971140/
[$] A change in direction for security-module stacking?
The long-running effort to complete the work on stacking (or composing) the
Linux security modules (LSMs) recently encountered a barrier—in the form of
a "suggestion" to discontinue it from Linus Torvalds. His complaint
revolved around the indirect function calls that are used to implement
LSMs, but he also did not think much of the effort to switch away from
those calls. While it does not appear that a major course-change is in store
for LSMs, it is clear that Torvalds is not happy with the direction of that
subsystem.
https://lwn.net/Articles/970070/
Security updates for Tuesday
Security updates have been issued by Debian (glibc and samba), Fedora (chromium, cjson, mingw-python-idna, and pgadmin4), Mageia (kernel, kmod-xtables-addons, kmod-virtualbox, kernel-linus, and perl-Clipboard), Red Hat (go-toolset:rhel8, golang, java-11-openjdk, kpatch-patch, and shim), Slackware (freerdp), SUSE (apache-commons-configuration, glibc, jasper, polkit, and qemu), and Ubuntu (google-guest-agent, google-osconfig-agent, linux-lowlatency-hwe-6.5, pillow, and squid).
https://lwn.net/Articles/970889/
[$] Linus and Dirk chat about AI, XZ, hardware, and more
One of the mainstays of the the Linux Foundation's Open Source Summit is the "fireside chat"
(sans fire) between Linus Torvalds and Dirk Hohndel to discuss open source and
Linux kernel topics of the day. On April 17, at <a href="https://events.linuxfoundation.org/open-source-summit-north-america/" rel="nofollow">Open Source Summit
North America</a> (OSSNA) in Seattle, Washington, they held with tradition
and discussed a range of topics including proper whitespace parsing,
security, and the current AI craze.
https://lwn.net/Articles/970293/
Kernel prepatch 6.9-rc5
Linus has https://lwn.net/Articles/970666/
for testing.
But if you ignore those oddities, it all looks pretty normal and
things appear fairly calm. Which is just as well, since the first
part of the week I was on a quick trip to Seattle, and the second
part of the week I've been doing a passable imitation of the
Fontana di Trevi, except my medium is mucus.
https://lwn.net/Articles/970667/
Security updates for Friday
Security updates have been issued by AlmaLinux (gnutls, java-17-openjdk, mod_http2, and squid), Debian (firefox-esr), Fedora (editorconfig, perl-Clipboard, php, rust, and wordpress), Mageia (less, libreswan, puppet, and x11-server, x11-server-xwayland, and tigervnc), Slackware (aaa_glibc), and SUSE (firefox, graphviz, kernel, nodejs12, pgadmin4, tomcat, and wireshark).
https://lwn.net/Articles/970508/
Security updates for Thursday
Security updates have been issued by Debian (firefox-esr, jetty9, libdatetime-timezone-perl, tomcat10, and tzdata), Fedora (cockpit, filezilla, and libfilezilla), Red Hat (firefox, gnutls, java-1.8.0-openjdk, java-17-openjdk, kernel, kernel-rt, less, mod_http2, nodejs:18, rhc-worker-script, and shim), Slackware (mozilla), SUSE (kernel), and Ubuntu (apache2, glibc, and linux-xilinx-zynqmp).
https://lwn.net/Articles/970324/
[$] Managing to-do lists on the command line with Taskwarrior
Managing to-do lists is something of a universal necessity. While some
people handle them mentally or on paper, others resort to a web-based tool or
a mobile
application. For those preferring the command line, the MIT-licensed https://taskwarrior.org
offers a flexible solution
with a healthy community and lots of extensions.
https://lwn.net/Articles/969904/
[$] Cleaning up after BPF exceptions
Kumar Kartikeya Dwivedi has been working to add support for exceptions to BPF
since mid-2023. In July, Dwivedi posted
<a href="https://lwn.net/Articles/938435/" rel="nofollow">
the first patch set</a> in this effort, which adds support for basic stack unwinding.
In February 2024, he posted
<a href="https://lwn.net/ml/bpf/20240201042109.1150490-1-memxor@gmail.com/" rel="nofollow">
the second patch set</a>
aimed at letting the kernel release resources held by the BPF program when an
exception occurs. This makes exceptions usable in many more contexts.
https://lwn.net/Articles/969185/
Security updates for Monday
Security updates have been issued by AlmaLinux (bind, bind and dhcp, bind9.16, gnutls, httpd:2.4/mod_http2, squid:4, and unbound), Debian (kernel, trafficserver, and xorg-server), Fedora (chromium, kernel, libopenmpt, and rust-h2), Mageia (apache-mod_jk, golang, indent, openssl, perl-HTTP-Body, php, rear, ruby-rack, squid, varnish, and xfig), Oracle (bind, squid, unbound, and X.Org server), Red Hat (bind and dhcp and unbound), Slackware (less and php), SUSE (gnutls, python-Pillow, webkit2gtk3, xen, xorg-x11-server, and xwayland), and Ubuntu (yard).
https://lwn.net/Articles/969873/
Kernel prepatch 6.9-rc4
The https://lwn.net/Articles/969790/
kernel prepatch is out for
testing. "Nothing particularly unusual going on this week - some new hw
mitigations may stand out, but after a decade of this I can't really call
it 'unusual' any more, can I?"
https://lwn.net/Articles/969791/
Security updates for Thursday
Security updates have been issued by AlmaLinux (kernel, less, libreoffice, nodejs:18, nodejs:20, rear, thunderbird, and varnish), Debian (pillow), Fedora (dotnet7.0), SUSE (sngrep, texlive-specs-k, tomcat, tomcat10, and xorg-x11-server), and Ubuntu (nss, squid, and util-linux).
https://lwn.net/Articles/969468/
[$] Book review: Practical Julia
A recent book by <a href="https://lwn.net/Archives/GuestIndex/#Phillips_Lee" rel="nofollow">LWN guest
author Lee Phillips</a> provides a nice introduction to the https://julialang.org/
programming language.
https://nostarch.com/practical-julia
does more than that, however. As its subtitle ("A Hands-On Introduction
for Scientific Minds") implies, the book focuses on bringing Julia to
scientists, rather than programmers, which gives it something of a
different feel from most other books of this sort.
https://lwn.net/Articles/966684/
[$] Continued attacks on HTTP/2
On April 3 security researcher Bartek Nowotarski
<a href="https://nowotarski.info/http2-continuation-flood-technical-details/" rel="nofollow">
published</a> the details of a new denial-of-service (DoS)
attack, called a "continuation flood", against many
https://en.wikipedia.org/wiki/HTTP/2
-capable web
servers. While the attack is not terribly complex, it affects many independent
implementations of the HTTP/2 protocol, even though multiple
similar vulnerabilities over the years have given implementers plenty of warning.
https://lwn.net/Articles/968600/
OpenSSL 3.3.0 released
Version 3.3.0 of the OpenSSL SSL/TLS implementation has been released.
Changes include a number of additions to its QUIC protocol support, some
year-2038 improvements for 32-bit systems, and a lot of cryptographic
features with descriptions like "Added a new EVP_DigestSqueeze()
API. This allows SHAKE to squeeze multiple times with different output
sizes." See <a href="https://www.openssl.org/news/openssl-3.3-notes.html" rel="nofollow">the release
notes</a> for details.
https://lwn.net/Articles/969172/
[$] Diagnosing workqueues
There are many mechanisms for deferred work in the Linux kernel. One of them,
<a href="https://docs.kernel.org/core-api/workqueue.html" rel="nofollow">
workqueues</a>, has seen increasing use as part of
the move away from software interrupts. Alison Chaiken gave a talk
at https://www.socallinuxexpo.org/scale/21x
about how they compare to software interrupts, the new challenges they pose for
system administrators, and what tools are available to
kernel developers wishing to diagnose problems with workqueues as they become
increasingly prevalent.
https://lwn.net/Articles/967016/
Security updates for Tuesday
Security updates have been issued by Debian (expat), Oracle (less and nodejs:20), Slackware (libarchive), SUSE (kubernetes1.23, nghttp2, qt6-base, and util-linux), and Ubuntu (python-django).
https://lwn.net/Articles/969141/
Kernel prepatch 6.9-rc3
The https://lwn.net/Articles/968936/
kernel prepatch is out for
testing.
Ok, so this rc3 looks a bit different than the usual ones, because
there's a large series to bcachefs to do filesystem repair after
corruption. Not normally something we'd see in an rc kernel, but
hey, if you had a corrupted bcachefs filesystem you'd probably want
this, and if you thought bcachefs was stable already, I have a
bridge to sell you. Special deal only for you, real cheap.
https://lwn.net/Articles/968937/
FFmpeg 7.0 released
https://ffmpeg.org//index.html#pr7.0
of the
FFmpeg audio/video toolkit is out. "The most noteworthy changes for
most users are a native VVC decoder (currently experimental, until more
fuzzing is done), IAMF support, or a multi-threaded ffmpeg CLI tool".
There's also the usual list of new formats and codecs, and a few deprecated
features have been removed.
https://lwn.net/Articles/968565/
Security updates for Friday
Security updates have been issued by Debian (cockpit), Mageia (python-pygments), Red Hat (nodejs), Slackware (httpd and nghttp2), SUSE (avahi, gradle, gradle-bootstrap, and squid), and Ubuntu (xorg-server, xwayland).
https://lwn.net/Articles/968561/
AlmaLinux OS - CVE-2024-1086 and XZ (AlmaLinux blog)
https://almalinux.org/
updated kernels for AlmaLinux 8 and 9 to address CVE-2024-1086, a
use-after-free vulnerability in the kernel that could be exploited to
gain local privilege escalation. This is notable because the fix
marks a divergence between AlmaLinux and Red Hat Enterprise Linux (RHEL):
In January of this year, a kernel flaw was disclosed and named https://nvd.nist.gov/vuln/detail/CVE-2024-1086
.
This flaw is trivially exploitable on most RHEL-equivalent
systems. There are many proof-of-concept posts available now,
including one from our Infrastructure team lead, Jonathan Wright (<a href="https://jonathanspw.com/posts/2024-03-31-dealing-with-cve-2024-1086/" rel="nofollow">Dealing
with CVE-2024-1086</a>). In multi-user scenarios, this flaw is
especially problematic.
Though this was flagged as something to be fixed in Red Hat
Enterprise Linux, Red Hat has only rated this as a <a href="https://access.redhat.com/security/cve/CVE-2024-1086" rel="nofollow">moderate
impact</a>.
The AlmaLinux project would also like to note that it is not
impacted by the XZ backdoor. "Because enterprise Linux takes a bit
longer to adopt those updates (sometimes to the chagrin of our users),
the version of XZ that had the back door inserted hadn't made it
further than Fedora in our ecosystem."
https://lwn.net/Articles/968299/
Security updates for Wednesday
Security updates have been issued by Debian (py7zr), Fedora (biosig4c++ and podman), Oracle (kernel, kernel-container, and ruby:3.1), Red Hat (.NET 7.0, bind9.16, curl, expat, grafana, grafana-pcp, kernel, kernel-rt, kpatch-patch, less, opencryptoki, and postgresql-jdbc), and Ubuntu (cacti).
https://lwn.net/Articles/968218/
Security updates for Thursday
Security updates have been issued by Fedora (perl-Data-UUID, python-pygments, and thunderbird), Mageia (clojure, grub2, kernel,kmod-xtables-addons,kmod-virtualbox, kernel-linus, nss firefox, nss, python3, python, tcpreplay, and thunderbird), Oracle (nodejs:18), Red Hat (.NET 6.0 and dnsmasq), SUSE (avahi and python39), and Ubuntu (curl, linux-intel-iotg, linux-intel-iotg-5.15, unixodbc, and util-linux).
https://lwn.net/Articles/966961/
[$] Cranelift code generation comes to Rust
https://cranelift.dev/
is an Apache-2.0-licensed
code-generation backend being developed as part
of the https://wasmtime.dev/
runtime for
https://webassembly.org/
.
In October 2023, the Rust project made Cranelift available as an optional
component in its nightly toolchain.
Users can now use Cranelift as the code-generation backend for debug builds of
projects written in Rust,
making it an opportune time to look at what makes Cranelift different.
Cranelift is designed to compete with existing compilers by generating
code more quickly than they can, thanks to a stripped-down design that prioritizes
only the most important optimizations.
https://lwn.net/Articles/964735/
[$] Untangling the Open Collectives
Name collisions aren't just a problem for software
development—organizations, projects, and software that have the
same or similar names can cause serious confusion. That was certainly
the case on February 28 when the <a href="https://opencollective.com/foundation" rel="nofollow">Open Collective
Foundation</a> (OCF) began to notify its hosted projects that it would
be shutting down by the end of 2024. The announcement surprised
projects hosted with OCF, as one might expect. It also worried and
confused users of the Open Collective software platform from https://opencollective.com/
(OCI), as
well as organizations hosted by the <a href="https://opencollective.com/opensource" rel="nofollow">Open Source
Collective</a> (OSC) and <a href="https://docs.opencollective.com/oceurope/" rel="nofollow">Open Collective
Europe</a> (OC Europe). There is enough confusion about the names,
relationships between the organizations, and impact on projects like
https://opencollective.com/flatpak
hosted by OCF, that a
deeper look is warranted.
https://lwn.net/Articles/964402/
[$] A look at dynamic linking
The dynamic linker is a critical component of modern Linux systems, being
responsible for setting up the address space of most processes. While statically
linked binaries have become more popular over time as the tradeoffs that
originally led to dynamic linking become less relevant, dynamic linking is still
the default. This article looks at what steps the dynamic linker takes to
prepare a program for execution.
https://lwn.net/Articles/961117/
[$] So you think you understand IP fragmentation?
What is IP fragmentation, why is it important, and do people understand
it? The answer to that last question is "not as well as they think". This
article will also answer the rest of those
questions and introduce https://valerieaurora.org/fragquiz.html
, a game that I
wrote to allow players to guess how IP packets will behave when they are
too large for the network. As evidence that IP fragmentation is not
well-understood, a room full of networking experts played fragquiz and got
a score that was
nowhere close to perfect. In addition, I will describe a new algorithm for
fragmentation avoidance, which some colleagues and I
developed, that helped motivate development of fragquiz.
https://lwn.net/Articles/960913/
Security updates for Wednesday
Security updates have been issued by Red Hat (gimp) and Ubuntu (firefox, linux-oracle, linux-oracle-5.15, and python-django).
https://lwn.net/Articles/961173/
[$] GNU C Library version 2.39
The GNU C Library (glibc)
<a href="https://sourceware.org/pipermail/libc-alpha/2024-January/154363.html" rel="nofollow">
released version 2.39</a> on January 31, including
several new features. Notable highlights include new functions for spawning
child processes, support for shadow stacks on x86_64, new security features, and
the removal of libcrypt. The glibc maintainers had also hoped to include
improvements to qsort(), which ended up not making it into this
release. Glibc releases are made every six months.
https://lwn.net/Articles/960309/
Security updates for Tuesday
Security updates have been issued by CentOS (firefox, gstreamer1-plugins-bad-free, and tigervnc), Debian (ruby-sanitize), Fedora (kernel, kernel-headers, qt5-qtwebengine, and runc), Oracle (gnutls, kernel, libssh, rpm, runc, and tigervnc), Red Hat (runc), and SUSE (bouncycastle, jsch, python, and runc).
https://lwn.net/Articles/961083/
Security updates for Monday
Security updates have been issued by Debian (rear, runc, sudo, and zbar), Fedora (chromium, grub2, libebml, mingw-python-pygments, and python-aiohttp), Gentoo (FreeType, GNAT Ada Suite, Microsoft Edge, NBD Tools, OpenSSL, QtGui, SDDM, Wireshark, and Xen), Mageia (dracut, glibc, nss and firefox, openssl, packages, perl, and thunderbird), Slackware (libxml2), SUSE (java-11-openjdk, java-17-openjdk, perl, python-uamqp, slurm, and xerces-c), and Ubuntu (libssh and openssl).
https://lwn.net/Articles/960952/
[$] Zig 2024 roadmap
The https://ziglang.org/https://www.youtube.com/watch?v=5eL_LcxwwHg
was presented in a talk last week on
https://zig.show/
(a show covering
Zig news). Andrew Kelley, the benevolent dictator for life of the Zig project,
presented his goals
for the language, largely focusing on compiler performance and continuing
progress toward stabilization for the language. He discussed details of his plan
for incremental compilation, and addressed the sustainability of the project in
terms of both code contributions and financial support.
https://lwn.net/Articles/959915/
Phipps: The European regulators listened to the Open Source communities
Simon Phipps <a href="https://blog.opensource.org/the-european-regulators-listened-to-the-open-source-communities/" rel="nofollow">writes
on the Open Source Initiative blog</a> that the latest version of the
European Cyber Resilience Act is much improved: "As a result of all this
effort from so many people, the final text of the CRA mitigated pretty much
all the risks we had identified to individual developers and to Open Source
foundations."
https://lwn.net/Articles/960606/
Security updates for Friday
Security updates have been issued by Debian (chromium, man-db, and openjdk-17), Fedora (chromium, indent, jupyterlab, kernel, and python-notebook), Gentoo (glibc), Oracle (firefox, thunderbird, and tigervnc), Red Hat (rpm), SUSE (cpio, gdb, gstreamer, openconnect, slurm, slurm_18_08, slurm_20_02, slurm_20_11, slurm_22_05, slurm_23_02, squid, webkit2gtk3, and xerces-c), and Ubuntu (imagemagick and xorg-server, xwayland).
https://lwn.net/Articles/960604/
[$] The hard life of a virtual-filesystem developer
Filesystem development is not an easy task; the performance demands are
typically high, and the consequences for mistakes usually involve lost data
and irate users. The implementation of a virtual (or "pseudo") filesystem
— a filesystem implemented within the kernel and lacking a normal backing
store — can also be challenging, but for different reasons. A series of
conversations around the eventfs virtual filesystem has turned a spotlight
on the difficulty of creating a virtual filesystem for Linux.
https://lwn.net/Articles/960088/
Damn Small Linux 2024 released
A new version of the <a href="https://www.damnsmalllinux.org/" rel="nofollow">Damn Small
Linux</a> distribution has come out with an updated definition of "damn
small":
The new goal of DSL is to pack as much usable desktop distribution
into an image small enough to fit on a single CD, or a hard limit
of 700MB. This project is meant to service older computers and have
them continue to be useful far into the future. Such a notion sits
well with my values. I think of this project as my way of keeping
otherwise usable hardware out of landfills.
https://lwn.net/Articles/960446/
Security updates for Tuesday
Security updates have been issued by Debian (pillow, postfix, and redis), Fedora (python-templated-dictionary and selinux-policy), Red Hat (gnutls, kpatch-patch, libssh, and tomcat), and Ubuntu (amanda, ceph, linux-azure, linux-azure-4.15, linux-kvm, and tinyxml).
https://lwn.net/Articles/960008/
[$] The things nobody wants to pay for
The free-software community has managed to build a body of software that is
worth, by most estimates, many billions of dollars; all of this code is
freely available to anybody who wants to use or modify it. It is an
unparalleled example of independent actors working cooperatively on a
common resource. Free software is certainly a success story, but all is
not perfect. One of the community's greatest strengths — convincing
companies to contribute to this common resource — is also part of one of
its biggest weaknesses.
https://lwn.net/Articles/959069/
Security updates for Thursday
Security updates have been issued by Debian (chromium, firefox-esr, php-phpseclib, phpseclib, thunderbird, and zabbix), Fedora (dotnet7.0, firefox, fonttools, and python-jinja2), Mageia (avahi and chromium-browser-stable), Oracle (java-1.8.0-openjdk, java-11-openjdk, LibRaw, openssl, and python-pillow), Red Hat (gnutls, kpatch-patch, php:8.1, and squid:4), SUSE (apache-parent, apache-sshd, bluez, cacti, cacti-spine, erlang, firefox, java-11-openjdk, opera, python-Pillow, tomcat, tomcat10, and xwayland), and Ubuntu (paramiko and puma).
https://lwn.net/Articles/959455/
Security updates for Monday
Security updates have been issued by Debian (keystone and subunit), Fedora (dotnet6.0, golang, kernel, sos, and tigervnc), Mageia (erlang), Red Hat (openssl), SUSE (bluez, python-aiohttp, and seamonkey), and Ubuntu (postfix and xorg-server).
https://lwn.net/Articles/959006/
Security updates for Friday
Security updates have been issued by Fedora (chromium, golang-github-facebook-time, podman, and xorg-x11-server-Xwayland), Oracle (.NET 6.0, java-1.8.0-openjdk, java-11-openjdk, and python3.11-cryptography), Red Hat (java-11-openjdk, python-requests, and python-urllib3), SUSE (chromium, kernel, libcryptopp, libuev, perl-Spreadsheet-ParseExcel, suse-module-tools, and xwayland), and Ubuntu (filezilla and xerces-c).
https://lwn.net/Articles/958760/
Security updates for Thursday
Security updates have been issued by CentOS (ImageMagick), Debian (chromium), Fedora (golang-x-crypto, golang-x-mod, golang-x-net, golang-x-text, gtkwave, redis, and zbar), Mageia (tinyxml), Oracle (.NET 7.0, .NET 8.0, java-1.8.0-openjdk, java-11-openjdk, python3, and sqlite), Red Hat (gstreamer-plugins-bad-free, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, and java-21-openjdk), SUSE (kernel, libqt5-qtbase, libssh, pam, rear23a, and rear27a), and Ubuntu (pam and zookeeper).
https://lwn.net/Articles/958676/
Wine 9.0 released
<a href="https://gitlab.winehq.org/wine/wine/-/releases/wine-9.0" rel="nofollow">Version
9.0</a> of the Wine Windows-compatibility system has been released.
"This release represents a year of development effort and over 7,000
individual changes. It contains a large number of improvements that are
listed below. The main highlights are the new WoW64 architecture and the
experimental Wayland driver."
https://lwn.net/Articles/958443/
A glitch in the merge window
On January 13, Linus Torvalds <a href="https://lwn.net/ml/linux-kernel/CAHk-=wjMWpmXtKeiN__vnNO4TcttZR-8dVvd_oBq+hjeSsWUwg@mail.gmail.com/" rel="nofollow">let
it be known</a> that he had lost power due to the bad weather in the US
Pacific Northwest. As of this writing, he has not yet resurfaced, so the
6.8 merge window has ground to a halt.
There's apparently about 100k people without power, and I doubt our
neighborhood is the priority, so I expect to be without power for
some time still. I hope I'm wrong, but a few years ago it took more
than a week to restore power due to all the downed trees. It's
hopefully nowhere near that, but..
https://lwn.net/Articles/958424/
Security updates for Tuesday
Security updates have been issued by Gentoo (KTextEditor, libspf2, libuv, and Nettle), Mageia (hplip), Oracle (container-tools:4.0, gnutls, idm:DL1, squid, squid34, and virt:ol, virt-devel:rhel), Red Hat (.NET 6.0, krb5, python3, rsync, and sqlite), SUSE (chromium, perl-Spreadsheet-ParseXLSX, postgresql, postgresql15, postgresql16, and rubygem-actionpack-5_1), and Ubuntu (binutils, libspf2, libssh2, mysql-5.7, w3m, webkit2gtk, and xerces-c).
https://lwn.net/Articles/958416/
[$] The first half of the 6.8 merge window
The 6.8 merge window has gotten off to a relatively slow start; reasons for
that include a significant scheduler performance regression that Linus
Torvalds <a href="https://lwn.net/ml/linux-kernel/CAHk-=wgWcYX2oXKtgvNN2LLDXP7kXkbo-xTfumEjmPbjSer2RQ@mail.gmail.com/" rel="nofollow">stumbled
into</a> and has spent time tracking down. Even so, 4,282 non-merge
changesets have found their way into the mainline repository for the 6.8
release as of this writing. These commits have brought a number of
significant changes and new features.
https://lwn.net/Articles/957188/
Security updates for Friday
Security updates have been issued by Debian (kernel, linux-5.10, php-phpseclib, php-phpseclib3, and phpseclib), Fedora (openssh and tinyxml), Gentoo (FreeRDP and Prometheus SNMP Exporter), Mageia (packages), Red Hat (openssl), SUSE (gstreamer-plugins-rs and python-django-grappelli), and Ubuntu (dotnet6, dotnet7, dotnet8, openssh, and xerces-c).
https://lwn.net/Articles/958124/
OpenSSH announces DSA-removal timeline
For those of you still using DSA keys with SSH: the project has announced
its plans to remove support for that algorithm around the beginning of
2025.
The only remaining use of DSA at this point should be deeply legacy
devices. As such, we no longer consider the costs of maintaining
DSA in OpenSSH to be justified. Moreover, we hope that OpenSSH's
final removal of this insecure algorithm accelerates its
deprecation in other SSH implementations and allows maintainers of
cryptography libraries to remove it too.
https://lwn.net/Articles/958048/
[$] The kernel "closure" API
The data structure known as a "closure" first found its way into the
mainline kernel with the addition of https://bcache.evilpiepirate.org/
in the 3.10 development
cycle. With the advent of https://bcachefs.org/
in
6.7, though, it acquired a second user and was moved to the kernel's
lib directory, making it available to other kernel users as well.
The documentation of closures in the source is better than that of many
things in the kernel, but there is still room for a gentler introduction.
https://lwn.net/Articles/957187/
Stable kernel 4.14.336
The https://lwn.net/Articles/957350/
stable kernel update has been
released with a small handful of fixes; this is the end of the line for the
4.14 stable series:
This is the LAST 4.14.y kernel to be released. It is now
officially end-of-life. Do NOT use this kernel version anymore,
please move to a newer one, as shown on the kernel.org releases
page.
All users of the 4.14 kernel series must upgrade. But then, move
to a newer release. If you are stuck at this version due to a
vendor requiring it, go get support from that vendor for this
obsolete kernel tree, as that is what you are paying them for :)
https://lwn.net/Articles/957351/
[$] LWN's guide to 2024
The calendar has flipped over into 2024 — another year has begun. Here at
LWN, we do not have a better idea of what this year will bring than anybody
else does, but that doesn't keep us from going out on a shaky limb and
making predictions anyway. Here, for the curious, are a few things that we
think may be in store for 2024.
https://lwn.net/Articles/954544/
Oddbean new post about login | logout
Notes by LWN.net (RSS Feed) | export