Language Selection

English French German Italian Portuguese Spanish

LWN

Syndicate content
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Updated: 2 hours 57 min ago

Videos from linux.conf.au 2017

Sunday 22nd of January 2017 11:18:06 PM
The linux.conf.au 2017 organizers have put up videos of the talks in near-record time. There's a lot of good stuff there, some of which will be written up for LWN in the near future.

Kernel prepatch 4.10-rc5

Sunday 22nd of January 2017 09:37:00 PM
Linus has released the 4.10-rc5 kernel prepatch for testing, noting that "everything looks nominal". He also changed the codename from the short-lived "Roaring Lionus" to "Anniversary Edition".

Clasen: Debugging a Flatpak application

Friday 20th of January 2017 10:13:17 PM
Matthias Clasen looks at how to debug an application built into a Flatpak. Since the runtime environment for a Flatpak application is quite different than normal, even running GDB requires taking some different steps. "Now for the last trick: I was complaining about stacktraces without symbols at the beginning. In rpm-based distributions, the debug symbols are split off into debuginfo packages. Flatpak does something similar and splits all the debug information of runtimes and apps into separate ”runtime extensions”, which by convention have .Debug appended to their name. So the debug info for org.gnome.Recipes is in the org.gnome.Recipes.Debug extension. When you use the –devel option, flatpak automatically includes the Debug extensions for the application and runtime, if they are available. So, for the most useful stacktraces, make sure that you have the Debug extensions for the apps and runtimes in question installed."

Stable kernels 4.9.5 and 4.4.44

Friday 20th of January 2017 04:23:57 PM
The 4.9.5 and 4.4.44 stable kernels have been announced by Greg Kroah-Hartman. As usual, users of those kernel series should upgrade.

Friday's security updates

Friday 20th of January 2017 03:59:50 PM

Arch Linux has updated php (three vulnerabilities), powerdns (MV), and powerdns-recursor (three vulnerabilities).

Debian has updated mysql-5.5 (multiple unspecified vulnerabilities).

Debian-LTS has updated libphp-swiftmailer (code execution).

Gentoo has updated curl (MV, two from 2014), cvs (code execution from 2012), icedtea-bin (MV), irssi (MV), and nss (MV, three from 2015).

openSUSE has updated pdns-recursor (42.2, 42.1: denial of service) and squid (42.1: two vulnerabilities, one from 2014).

Red Hat has updated java-1.8.0-openjdk (RHEL7&6: MV), openstack-cinder (OSP6.0 for RHEL7; OSP5.0 for RHEL7; OSP5.0 for RHEL6: denial of service from 2015), and python-XStatic-jquery-ui (OSP7.0 for RHEL7: cross-site scripting).

SUSE has updated gstreamer-0_10-plugins-good (SLE12SP2: MV).

Vetter: Maintainers don't scale

Friday 20th of January 2017 02:53:06 AM
Daniel Vetter has posted the text of his linux.conf.au talk on kernel maintenance. "At least for me, review isn’t just about ensuring good code quality, but also about diffusing knowledge and improving understanding. At first there’s maybe one person, the author (and that’s not a given), understanding the code. After good review there should be at least two people who fully understand it, including corner cases. And that’s also why I think that group maintainership is the only way to run any project with more than one regular contributor."

Larsson: The flatpak security model – part 1: The basics

Thursday 19th of January 2017 07:14:41 PM
On his blog, Alexander Larsson begins a description of flatpak security. "Long story short, flatpak uses bubblewrap to create a filesystem namespace for the sandbox. This starts out with a tmpfs as the root filesystem, and in this we bind-mount read-only copies of the runtime on /usr and the application data on /app. Then we mount various system things like a minimal /dev, our own instance of /proc and symlinks into /usr from /lib and /bin. We also enable all the available namespaces so that the sandbox cannot see other processes/users or access the network. On top of this we use seccomp to filter out syscalls that are risky. For instance ptrace, perf, and recursive use of namespaces, as well as weird network families like DECnet. In order for the application to be able to write data anywhere we bind mount $HOME/.var/app/$APPID/ into the sandbox, but this is the only persistent writable location."

Security updates for Thursday

Thursday 19th of January 2017 06:38:35 PM

CentOS has updated kernel (C7: three vulnerabilities).

Debian has updated mapserver (code execution).

Debian-LTS has updated libav (multiple vulnerabilities) and mapserver (code execution).

Fedora has updated ark (F25: code execution), chicken (F25; F24: two vulnerabilities), and runc (F25: privilege escalation).

openSUSE has updated libgit2 (42.1; SPH for SLE12: two vulnerabilities), openjpeg2 (42.1: multiple vulnerabilities), and v8 (42.2: code execution).

Red Hat has updated java-1.6.0-sun (multiple vulnerabilities), java-1.7.0-oracle (multiple vulnerabilities), and java-1.8.0-oracle (RHEL7&6: multiple vulnerabilities).

Slackware has updated mariadb (multiple unspecified vulnerabilities).

Ubuntu has updated mysql-5.5, mysql-5.7 (multiple unspecified vulnerabilities).

[$] LWN.net Weekly Edition for January 19, 2017

Thursday 19th of January 2017 02:01:12 AM
The LWN.net Weekly Edition for January 19, 2017 is available.

[$] Designing for failure

Wednesday 18th of January 2017 09:06:47 PM
Nobody starts a free-software project hoping that it will fail, so it is a rare project indeed that plans for its eventual demise. But not all projects succeed, and a project that doesn't plan for failure risks is doing its users harm. Dan Callahan joined Mozilla to work on the Persona authentication project, and he was there for its recent shutdown. At the 2017 linux.conf.au in Hobart, Tasmania, he used his keynote slot to talk about the lessons that have been learned about designing a project for failure.

Wednesday's security updates

Wednesday 18th of January 2017 05:17:41 PM

Arch Linux has updated webkit2gtk (multiple vulnerabilities).

CentOS has updated qemu-kvm (C7: denial of service).

Debian-LTS has updated icoutils (multiple vulnerabilities).

Fedora has updated icoutils (F25; F24: three vulnerabilities), mingw-libgsf (F25: denial of service), and php-PHPMailer (F24: three vulnerabilities).

openSUSE has updated bind (42.2, 42.1; 13.2: three denial of service flaws), libgit2 (13.2: two vulnerabilities), openjpeg2 (13.2: multiple vulnerabilities), pdns (42.2, 42.1, 13.2: multiple vulnerabilities), qemu (42.2: multiple vulnerabilities), and squid (42.2: three vulnerabilities, one from 2014).

Oracle has updated kernel (OL7: three vulnerabilities) and qemu-kvm (OL7: denial of service).

Red Hat has updated docker (RHEL7: privilege escalation), docker-latest (RHEL7: privilege escalation), kernel (RHEL7: three vulnerabilities), kernel-rt (RHEL7; RHEMRG2.5: three vulnerabilities), qemu-kvm (RHEL7: denial of service), and runc (RHEL7: privilege escalation).

Scientific Linux has updated kernel (SL7: three vulnerabilities) and qemu-kvm (SL7: denial of service).

SUSE has updated kernel (SLE12-SP2: multiple vulnerabilities).

Ubuntu has updated nvidia-graphics-drivers-304 and nvidia-graphics-drivers-340 (denial of service).

An updated FSF high-priority project list

Tuesday 17th of January 2017 09:10:37 PM
The Free Software Foundation has reworked its high-priority project list to reflect its view of computing in 2017. See the changelog for a list of the changes that were made. Among other things, the Gnash flash player has fallen off the list. "Smart phones are the most widely used form of personal computer today. Thus, the need for a fully free phone operating system is crucial to the proliferation of software freedom."

Security advisories for Tuesday

Tuesday 17th of January 2017 04:57:25 PM

Arch Linux has updated python-crypto (code execution) and python2-crypto (code execution).

CentOS has updated bind (C7; C6; C5: denial of service) and bind97 (C5: denial of service).

Debian-LTS has updated pdns-recursor (code execution).

Fedora has updated bind (F24: three denial of service flaws), bind99 (F24: three denial of service flaws), and SimGear (F25: file overwrites).

Gentoo has updated file (multiple vulnerabilities), libxml2 (multiple vulnerabilities), miniupnpc (denial of service), pidgin (multiple vulnerabilities), vlc (code execution), and xdelta (code execution).

openSUSE has updated ark (42.2, 42.1; SPH for SLE12: code execution), encfs (42.2, 42.1, 13.2: code execution from 2014), gstreamer-0_10-plugins-bad (13.2: code execution), gstreamer-0_10-plugins-base (13.2: code execution), gstreamer-0_10-plugins-good (13.2: multiple vulnerabilities), gstreamer-plugins-bad (42.1; 13.2: three vulnerabilities), gstreamer-plugins-base (42.1; 13.2: code execution), gstreamer-plugins-good (42.1; 13.2: multiple vulnerabilities), icinga (14.2, 14.1: two vulnerabilities), icoutils (42.2; 42.1; 13.2: multiple vulnerabilities), openjpeg2 (42.2: multiple vulnerabilities), pcsc-lite (42.2, 42.1, 13.2: privilege escalation), and python-pycrypto (14.2, 14.1, 13.2: denial of service).

Oracle has updated bind (OL7; OL6; OL5: denial of service), bind97 (OL5: denial of service), and docker-engine docker-engine-selinux (OL7; OL6: two vulnerabilities).

Red Hat has updated kernel (RHEL6.5: code execution).

Scientific Linux has updated bind (SL7; SL5,6: denial of service) and bind97 (SL5: denial of service).

[$] The Machine: Controlling storage with a filesystem

Tuesday 17th of January 2017 01:58:23 AM
Keith Packard is the chief architect for The Machine project at HPE; we covered his talk on this project back in 2015. At the 2017 linux.conf.au Kernel Miniconf, Packard focused on one specific aspect of The Machine's hardware and software configuration: how storage is managed and presented to applications. Like much that is being done with this project, its storage architecture is an interesting combination of new ideas and long-established techniques.

Prokoudine: GIMP 2016 in review

Monday 16th of January 2017 11:37:15 PM
Alexandre Prokoudine looks at user-visible changes for the GNU Image Manipulation Program (GIMP) over 2016. Changes include better handling of layers, channels, masks, and paths, remembering defaults across sessions, improved configurability, color management, and more.

Calligra 3.0 released

Monday 16th of January 2017 10:00:18 PM
Calligra 3.0 has been released. The Calligra Suite includes office, graphics, and project management applications. "We have chosen to cut back on the number of applications. Krita has left us to be independent and although it was emotional it was also done with complete support from both sides. We are saying goodbye to Author, which never differentiated itself from Words. We also removed Brainstorm the purpose of which will be better fitted by a new application (nothing planned from our side). Flow and Stage has gone in this release but we intend to bring them back in the future." The 3.x series updates the applications to use KDE Frameworks 5 and Qt5.

The Linux Test Project has been released

Monday 16th of January 2017 07:27:32 PM
The Linux Test Project test suite stable release for January 2017 is out. There are new test cases, a new shell test library and many tests rewritten to make use of it, and much more. LWN looked at LTP last December.

Monday's security updates

Monday 16th of January 2017 05:44:49 PM

Arch Linux has updated libgit2 (multiple vulnerabilities), nginx (privilege escalation), nginx-mainline (privilege escalation), and wordpress (multiple vulnerabilities).

Debian has updated icoutils (three vulnerabilities), pdns (multiple vulnerabilities), pdns-recursor (denial of service), python-bottle (regression in previous update), and tiff (multiple vulnerabilities).

Debian-LTS has updated botan1.10 (integer overflow), gcc-mozilla (update to GCC 4.8), icedove (multiple vulnerabilities), libx11 (denial of service), otrs2 (code execution), python-bottle (regression in previous update), wireless-regdb (radio regulations updates), and xen (two vulnerabilities).

Fedora has updated bind (F25: three denial of service flaws), bind99 (F25: three denial of service flaws), ca-certificates (F25; F24: certificate update), docker-latest (F25: privilege escalation), gnutls (F24: multiple vulnerabilities), libgit2 (F25: multiple vulnerabilities), and onionshare (F25; F24: file injection).

Gentoo has updated apache (multiple vulnerabilities, one from 2014).

Mageia has updated golang (denial of service) and irssi (multiple vulnerabilities).

Red Hat has updated bind (RHEL7; RHEL5,6: denial of service) and bind97 (RHEL5: denial of service).

Scientific Linux has updated java-1.6.0-openjdk (SL5,6,7: multiple vulnerabilities).

SUSE has updated qemu (SLE12-SP2: multiple vulnerabilities).

Kernel prepatch 4.10-rc4

Monday 16th of January 2017 01:52:54 AM
The 4.10-rc4 kernel prepatch is out for testing. "Things are still looking fairly normal, and this is the usual weekly Sunday rc release. We're up to rc4, and people are clearly starting to find the regressions. Good, good."

Stable kernels 4.9.4 and 4.4.43

Sunday 15th of January 2017 09:22:50 PM
The 4.9.4 and 4.4.43 stable kernel updates are available; each contains a relatively large set of important fixes.

More in Tux Machines

Latest Linux For All Release Is Based on Ubuntu 16.04.1 LTS and Linux 4.9.5

GNU/Linux developer Arne Exton is informing us about the availability of a new stable build of his Linux For All (LFA) open-source computer operating system, versioned 170121. Based on the Ubuntu 16.04.1 LTS (Xenial Xerus) and Debian GNU/Linux 8 "Jessie" operating systems, Linux For All (LFA) Build 170121 appears to be a total rebuilt of the GNU/Linux distribution, having nothing in common with any of the previous releases. It now uses the newest Linux 4.9.5 kernel and latest package versions. Read more

Arch Anywhere ISO Lets You Install a Fully Custom Arch Linux System in Minutes

Meet Arch Anywhere, a new open-source project created by developer Dylan Schacht to help Arch Linux newcomers install the powerful and modern Linux-based operating system on their personal computers, or a virtual machine. Read more

Ubuntu Developers Now Tracking Linux Kernel 4.10 for Ubuntu 17.04 (Zesty Zapus)

The Ubuntu devs are preparing to move to a new kernel version for the upcoming release of the popular Linux-based operating system, and they are announcing the initial availability of a kernel based on the last RC of Linux 4.10. Read more

Applications 16.12.1 and Frameworks 5.30.0 by KDE available in Chakra

The latest updates for KDE's Applications and Frameworks series are now available to all Chakra users, together with some other package upgrades. Applications 16.12.1 include more than 40 recorded bugfixes and improvements, including a data loss bug in iCal resource for kdepim-runtime. kdelibs got updated to 4.14.28. Frameworks 5.30.0 ship with the usual bugfixes and improvements, mostly found in breeze icons, kio and plasma-framework. Read more