Language Selection

English French German Italian Portuguese Spanish

LWN

Syndicate content
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Updated: 1 hour 28 min ago

Backdoors in Webmin

2 hours 12 min ago
Anybody using Webmin, a web-based system-administration tool, will want to update now, as it turns out that the system has been backdoored for over a year. "At some time in April 2018, the Webmin development build server was exploited and a vulnerability added to the password_change.cgi script. Because the timestamp on the file was set back, it did not show up in any Git diffs. This was included in the Webmin 1.890 release."

Backdoor code found in 11 Ruby libraries (ZDNet)

2 hours 17 min ago
ZDNet reports on the discovery of a set of malicious libraries in the RubyGems repository. "The individual behind this scheme was active for more than a month, and their actions were not detected. Things changed when the hacker managed to gain access to the RubyGems account of one of the rest-client developers, which he used to push four malicious versions of rest-client on RubyGems. However, by targeting such a high-profile project that has over 113 million total downloads on RubyGems, the hacker also brought a lot of light to their operation, which was taken down within a few hours after users first spotted the malicious code in the rest-client library."

Security updates for Thursday

2 hours 26 min ago
Security updates have been issued by Fedora (nginx), openSUSE (ImageMagick and putty), Red Hat (Ansible, atomic-openshift-web-console, ceph, and qemu-kvm-rhev), SUSE (kvm, libssh2_org, postgresql96, qemu, and wavpack), and Ubuntu (libzstd and openjpeg2).

[$] LWN.net Weekly Edition for August 22, 2019

Thursday 22nd of August 2019 12:30:07 AM
The LWN.net Weekly Edition for August 22, 2019 is available.

[$] OpenPOWER opens further

Wednesday 21st of August 2019 08:25:11 PM
In what was to prove something of a theme throughout the morning, Hugh Blemings said that he had been feeling a bit like a kid waiting for Christmas recently, but that the day when the presents can be unwrapped had finally arrived. He is the executive director of the OpenPOWER Foundation and was kicking off the keynotes for the second day of the 2019 OpenPOWER Summit North America; the keynotes would reveal the "most significant and impressive announcements" in the history of the project, he said. Multiple presentations outlined a major change in the openness of the OpenPOWER instruction set architecture (ISA), along with various related hardware and software pieces; in short, OpenPOWER can be used by compliant products without paying royalties and with a grant of the patents that IBM holds on it. In addition, the foundation will be moving under the aegis of the Linux Foundation.

[$] Making containers safer

Wednesday 21st of August 2019 02:24:10 PM
On day one of the Linux Security Summit North America (LSS-NA), Stéphane Graber and Christian Brauner gave a presentation on the current state and the future of container security. They both work for Canonical on the LXD project; Graber is the project lead and Brauner is the maintainer. They looked at the different kernel mechanisms that can be used to make containers more secure and provided some recommendations based on what they have learned along the way.

Security updates for Wednesday

Wednesday 21st of August 2019 01:13:32 PM
Security updates have been issued by Fedora (ghostscript, pango, and squirrelmail), openSUSE (libcryptopp, squid, tcpdump, and wireshark), SUSE (flatpak), and Ubuntu (giflib and NLTK).

Announcing notqmail

Tuesday 20th of August 2019 11:17:21 PM
The notqmail project has announced its existence and shipped an initial release. It's a new fork of the venerable qmail mail transport system. "Our first release is informed, conservative, and careful — but bold. It reflects our brand-new team’s rapid convergence on where we’re going and how we’ll get there."

Open source POWER ISA takes aim at Intel and Arm (TechRepublic)

Tuesday 20th of August 2019 11:11:12 PM
TechRepublic reports on the opening of the POWER instruction-set architecture. "While the POWER ISA was itself licensable following the creation of the OpenPOWER Foundation in 2013, that came at a cost. Now, the POWER ISA is available royalty-free, inclusive of patent rights." The OpenPOWER Foundation is also being folded into the Linux Foundation.

Security updates for Tuesday

Tuesday 20th of August 2019 01:17:52 PM
Security updates have been issued by Debian (flask), openSUSE (clementine, dkgpg, libTMCG, openexr, and zstd), Oracle (kernel, mysql:8.0, redis:5, and subversion:1.10), SUSE (nodejs6, python-Django, and rubygem-rails-html-sanitizer), and Ubuntu (cups, docker, docker-credential-helpers, kconfig, kde4libs, libreoffice, nova, and openldap).

[$] On-disk format robustness requirements for new filesystems

Monday 19th of August 2019 11:17:00 PM
The "Extendable Read-Only File System" (or "EROFS") was first posted by Gao Xiang in May 2018; it was merged into the staging tree for the 4.19 release. There has been a steady stream of work on EROFS since then, and its author now thinks that it is ready to move out of staging and join the other official filesystems in the kernel. It would seem, though, that there is one final hurdle that it may have to clear: robustness in the face of a corrupted on-disk filesystem image. That raises an interesting question: to what extent do new filesystems have to exhibit a level of robustness that is not met by the filesystems that are currently in heavy use?

Stapelberg: distri: a Linux distribution to research fast package management

Monday 19th of August 2019 01:46:11 PM
Michael Stapelberg has announced the first release of "distri", a distribution focused on simplifying and accelerating package management. "distri’s package manager is extremely fast. Its main bottleneck is typically the network link, even at high speed links (I tested with a 100 Gbps link). Its speed comes largely from an architecture which allows the package manager to do less work."

Security updates for Monday

Monday 19th of August 2019 01:39:31 PM
Security updates have been issued by CentOS (kernel and openssl), Debian (ffmpeg, golang-1.11, imagemagick, kde4libs, openldap, and python3.4), Fedora (gradle, hostapd, kdelibs3, and mgetty), Gentoo (adobe-flash, hostapd, mariadb, patch, thunderbird, and vlc), Mageia (elfutils, mariadb, mythtv, postgresql, and redis), openSUSE (chromium, kernel, LibreOffice, and zypper, libzypp and libsolv), Oracle (ghostscript), Red Hat (rh-php71-php), SUSE (bzip2, evince, firefox, glib2, glibc, java-1_8_0-openjdk, polkit, postgresql10, python3, and squid), and Ubuntu (firefox).

A new chair for the openSUSE board

Monday 19th of August 2019 01:21:45 PM
Richard Brown has announced that he is stepping down as the chair of the openSUSE board. "I have absolute confidence in the openSUSE Board; Indeed, I don't think I would be able to make this decision at this time if I wasn't certain that I was leaving openSUSE in good hands. On that note, SUSE has appointed Gerald Pfeifer as my replacement as Chair. Gerald is SUSE's EMEA-based CTO, with a long history as a Tumbleweed user, an active openSUSE Member, and upstream contributor/maintainer in projects like GCC and Wine."

Kernel prepatch 5.3-rc5

Monday 19th of August 2019 01:17:34 PM
Linus has released the 5.3-rc5 kernel prepatch, saying: "It's been calm, and nothing here stands out, except perhaps some of the VM noise where we un-reverted some changes wrt node-local vs hugepage allocations."

Git v2.23.0 released

Sunday 18th of August 2019 03:06:10 PM
Version 2.23.0 of the Git source-code management system is out. There's a lot of new features, including a new "git merge --quit" option, new "git switch" and "git restore" commands, and more.

[$] Reconsidering unprivileged BPF

Friday 16th of August 2019 03:11:47 PM
The BPF virtual machine within the kernel has seen a great deal of work over the last few years; as that has happened, its use has expanded to many different kernel subsystems. One of the objectives of that work in the past has been to make it safe to allow unprivileged users to load at least some types of BPF programs into the kernel. A recent discussion has made it clear, though, that the goal of opening up BPF to unprivileged users has been abandoned as unachievable, and that further work in that direction will not be accepted by the BPF maintainer.

kdevops: a devops framework for Linux kernel development

Friday 16th of August 2019 02:58:56 PM
Luis Chamberlain has announced the "kdevops" kernel-development framework. "I'm announcing the release of kdevops which aims at making setting up and testing the Linux kernel for any project as easy as possible. Note that setting up testing for a subsystem and testing a subsystem are two separate operations, however we strive for both. This is not a new test framework, it allows you to use existing frameworks, and set those frameworks up as easily can humanly be possible. It relies on a series of modern hip devops frameworks, it relies on ansible, vagrant and terraform, ansible roles through the Ansible Galaxy, and terraform modules."

Stable kernels 5.2.9, 4.19.67, and 4.14.139

Friday 16th of August 2019 02:43:55 PM
Three new stable kernels have been announced by Greg Kroah-Hartman: 5.2.9, 4.19.67, and 4.14.139. There are important fixes in each; users should upgrade.

Security updates for Friday

Friday 16th of August 2019 01:52:52 PM
Security updates have been issued by Debian (freetype, libreoffice, and openjdk-7), Fedora (edk2, mariadb, mariadb-connector-c, mariadb-connector-odbc, python-django, and squirrelmail), Gentoo (chromium, cups, firefox, glibc, kconfig, libarchive, libreoffice, oracle-jdk-bin, polkit, proftpd, sqlite, wget, zeromq, and znc), openSUSE (bzip2, chromium, dosbox, evince, gpg2, icedtea-web, java-11-openjdk, java-1_8_0-openjdk, kconfig, kdelibs4, mariadb, mariadb-connector-c, nodejs8, pdns, polkit, python, subversion, and vlc), Oracle (ghostscript and kernel), Red Hat (mysql:8.0 and subversion:1.10), SUSE (389-ds, libvirt and libvirt-python, and openjpeg2), and Ubuntu (nginx).

More in Tux Machines

Android Leftovers

Intel SoC, Mesa Driver, and Quad Core Cortex-A35

  • Linux Begins Preparing For Intel's New "Lightning Mountain" SoC

    Linux kernel development activity has shown light on a new Intel SoC we haven't anything about to date... Lightning Mountain.  We haven't seen Intel Lightning Mountain referenced elsewhere yet but in our original monitoring of the various Linux kernel patch flow, this is a new Atom SoC on the way. 

  • ARB_gl_spirv and ARB_spirv_extension support for i965 landed Mesa master

    And something more visible thanks to that: now the Intel Mesa driver exposes OpenGL 4.6 support, the most recent version of OpenGL. As perhaps you could recall, the i965 Intel driver became 4.6 conformant last year. You have more details about that, and what being conformant means in this Iago blog post. On that blog post Iago mentioned that it was passing with an early version of the ARB_gl_spirv support, that we were improving and interating during this time so it could be included on Mesa master. At the same time, the CTS tests were only testing the specifics of the extensions, and we wanted a more detailed testing, so we also were adding more tests on the piglit test suite, written manually for ARB_gl_spirv or translated from existing GLSL tests.

  • Compulab CL-SOM-iMX8X SoM & SBC Feature NXP i.MX 8QuadXPlus Quad Core Cortex-A35 Processor

    NXP i.MX 8X Cortex-A35 processor designed for automotive infotainment and a variety of industrial applications was officially announced in early 2017...

Red Hat/Fedora: Flock’19 Budapest, Cockpit 201 and Systemd 243 RC2

  • Flock’19 Budapest

    This was the first occurrence of the conference for me to attend. Its an annual Fedora Community gathering, which happens in a new city of Europe every year. This time it was in Budapest, the capital of Hungary, last year it was hosted in Dresden. Dates for the same were: 8th Aug through 11th Aug 2019. Also I got an opportunity to present there on my proposal: “Getting Started with Fedora QA”. Day 1 Started with a Keynote by Mathew Miller (mattdm). In here he spoke about where we as a community are and where we need to go further. It was a knowledgeable discussion for a first timer like me who was always looking out for the Vision and Mission of Fedora community. There are people who are with Fedora since its first release and you get to meet them here at the annual gathering. [...] Groups were formed and people decided for themselves where they wanted to go for the evening hangout on the Day 1. We were 7 people who decided to hangout at the Atmosphere Klub near the V.Kerulet and left at around 9:00 pm by walk. Day 2 started with a keynote by Denise Dumas, Vice President, Operating System Platform, Red Hat. She spoke on “Fedora, Red Hat and IBM”. I woke up late, 20 minutes before the first session as I went to bed late last night and had walked for around 11 kms the day before.

  • Fedora 30 : Set up the Linux Malware Detect.
  • Cockpit 201

    It’s now again possible to stop a service, without disabling it. Reloading is now available only when the service allows it. Furthermore, disabling or masking a service removes any lingering “failed” state, reducing noise.

  • Systemd 243 RC2 Released

    Released nearly one month ago was the systemd 243 release candidate while the official update has yet to materialize. It looks though like it may be on the horizon with a second release candidate being posted today. Red Hat's Zbigniew Jędrzejewski-Szmek has just tagged systemd 243-RC2 as the newest test release for this new version of this de facto Linux init system. Over the past month have been new hardware database (HWDB) additions, various fixes, new network settings, resolvectl zsh shell completion support, bumping timedated to always run at the highest priority, and other changes.

Announcing Qt for MCUs

  • Announcing Qt for MCUs

    Today we announce the launch of Qt for MCUs – a comprehensive toolkit to deliver smartphone-like user experience on displays powered by microcontrollers. What started as a research project is now in the final leg of its journey to being released as a product. Connected devices found in vehicles, wearables, smart home, industrial and healthcare often have requirements that include real-time processing capabilities, low power consumption, instant boot time and low bill of materials. These requirements can be fulfilled by a microcontroller architecture. However, as devices get smarter and offer more features and capabilities, users expect an enhanced and intuitive experience on par with today’s smartphones. Qt for MCUs delivers an immersive and enriching user interface by utilizing a new runtime specifically developed for ARM Cortex-M microcontrollers and leveraging on-chip 2D graphics accelerators such as PxP on NXP’s i.MX RT series, Chrom-Art Accelerator on STM32 series and RGL on Renesas RH850.

  • Qt for MCUs – Qt Announces support for Microcontrollers

    About Qt for MCUs Qt- The well known opensource toolkit for creating graphical interface announced their new release: Qt for MCUs, targeting MCU’s.

  • The Qt Company Is Now Working On Qt For Microcontrollers

    There have been a lot of announcements pertaining to Qt as of late, most of which have been about forthcoming efforts around Qt 6 development. A new announcement out of The Qt Company catching us off-guard is their plans for the tool-kit on micro-controllers. Qt for MCUs is the company's newest commercial endeavour. In particular, they are working on the Qt tool-kit for displays powered by micro-controllers for smartphone-like user experiences. Qt for MCUs has been a research project at the company but is now being worked out as a new commercial offering. Considering how well though Qt works on mobile devices, it's only another step down catering it to low-power micro-controllers.