Language Selection

English French German Italian Portuguese Spanish

LWN

Syndicate content
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Updated: 3 hours 16 min ago

Security updates for Monday

7 hours 17 min ago
Security updates have been issued by CentOS (firefox, gnupg2, kernel, python, and qemu-kvm), Debian (389-ds-base, cups, imagemagick, kernel, mailman, ruby2.1, sssd, thunderbird, and znc), Fedora (glpi, hadoop, kernel, rubygem-sprockets, singularity, thunderbird, wordpress, xapian-core, and xen), Mageia (cantata and flash-player-plugin), openSUSE (exiv2, libvorbis, nodejs6, nodejs8, openslp, singularity, slurm, and tiff), and SUSE (kernel-azure and openssl).

Kernel prepatch 4.18-rc5

Sunday 15th of July 2018 08:49:30 PM
The 4.18-rc5 kernel prepatch has been released. "For some reason this week actually felt very busy, but the rc5 numbers show otherwise. It's all small and calm, and things are progressing nicely."

[$] Tracking pressure-stall information

Friday 13th of July 2018 09:51:00 PM
All underutilized systems are essentially the same, but each overutilized system tends to be overloaded in its own way. If one's goal is to maximize the use of the available computing resources, overutilization tends not to be too far away, but when it happens, it can be hard to tell where the problem is. Sometimes, even the fact that there is a problem at all is not immediately apparent. The pressure-stall information patch set from Johannes Weiner may make life easier for system administrators by exposing more information about the real utilization state of the system.

Security updates for Friday

Friday 13th of July 2018 01:50:01 PM
Security updates have been issued by Debian (cinnamon), Fedora (docker, firefox, jetty, and knot-resolver), Oracle (gnupg2), Scientific Linux (gnupg2), SUSE (gdk-pixbuf, java-1_8_0-openjdk, libopenmpt, php7, and rsyslog), and Ubuntu (dns-root-data, dnsmasq, and thunderbird).

Guido van Rossum resigns as Python leader

Thursday 12th of July 2018 06:00:38 PM
Python creator and Benevolent Dictator for Life Guido van Rossum has decided, in the wake of the difficult PEP 572 discussion, to step down from his leadership of the project. "Now that PEP 572 is done, I don't ever want to have to fight so hard for a PEP and find that so many people despise my decisions. I would like to remove myself entirely from the decision process. I'll still be there for a while as an ordinary core dev, and I'll still be available to mentor people -- possibly more available. But I'm basically giving myself a permanent vacation from being BDFL, and you all will be on your own."

[$] Six (or seven) new system calls for filesystem mounting

Thursday 12th of July 2018 03:00:51 PM
Mounting filesystems is a complicated business. The kernel supports a wide variety of filesystem types, and each has its own, often extensive set of options. As a result, the mount() system call is complex, and the list of mount options is a rather long read. But even with all of that complexity, mount() does not do everything that users would like. For example, the options for a mount operation must all fit within a single 4096-byte page — the fact that this is a problem for some users is illustrative in its own right. The problems with mount() have come up at various meetings, including at the 2018 Linux Storage, Filesystem, and Memory-Management Summit. A set of patches implementing a new approach is getting closer to being ready, but it features some complexity of its own and there are some remaining concerns about the proposed system-call API.

Security updates for Thursday

Thursday 12th of July 2018 01:16:56 PM
Security updates have been issued by Arch Linux (qutebrowser), CentOS (firefox), Debian (ruby-sprockets), Fedora (botan2, git-annex, kernel, kernel-tools, and visualboyadvance-m), Mageia (chromium-browser-stable, graphviz, mailman, nikto, perl-Archive-Zip, redis, and w3m), openSUSE (nextcloud), Oracle (gnupg2), Red Hat (flash-plugin, gnupg2, and kernel), Slackware (bind and curl), SUSE (java-1_8_0-openjdk, php7, rsyslog, slurm, and ucode-intel), and Ubuntu (cups, libpng, and libpng, libpng1.6).

[$] LWN.net Weekly Edition for July 12, 2018

Thursday 12th of July 2018 12:51:39 AM
The LWN.net Weekly Edition for July 12, 2018 is available.

[$] Signing and distributing Gentoo

Wednesday 11th of July 2018 06:55:44 PM

The compromise of the Gentoo's GitHub mirror was certainly embarrassing, but its overall impact on Gentoo users was likely fairly limited. Gentoo and GitHub responded quickly and forcefully to the breach, which greatly limited the damage that could be done; the fact that it was a mirror and not the master copy of Gentoo's repositories made it relatively straightforward to recover from. But the black eye that it gave the project has led some to consider ways to make it even harder for an attacker to add malicious content to Gentoo—even if the distribution's own infrastructure were to be compromised.

A set of stable kernel updates

Wednesday 11th of July 2018 04:44:31 PM
Greg Kroah-Hartman has released stable kernels 4.17.6, 4.14.55, 4.9.112, 4.4.140, and 3.18.115. As usual, they contain important fixes and users should upgrade.

[$] Emacs & TLS

Wednesday 11th of July 2018 03:35:58 PM

A recent query about the status of network security (TLS settings in particular) in Emacs led to a long thread in the emacs-devel mailing list. That thread touched on a number of different areas, including using OpenSSL (or other TLS libraries) rather than GnuTLS, what kinds of problems should lead to complaints out of the box, what settings should be the default, and when those settings could change for Emacs so as not to discombobulate users. The latter issue is one that lots of projects struggle with: what kinds of changes are appropriate for a bug-fix release versus a feature release. For Emacs, its lengthy development cycle, coupled with the perceived urgency of security changes, makes that question even more difficult.

Security updates for Wednesday

Wednesday 11th of July 2018 03:12:01 PM
Security updates have been issued by Debian (cups), Oracle (kernel and qemu-kvm), Red Hat (ansible, kernel, kernel-rt, and qemu-kvm), Scientific Linux (kernel and qemu-kvm), Slackware (thunderbird), and Ubuntu (curl, firefox, imagemagick, and xapian-core).

Malware found in the Arch Linux AUR repository

Tuesday 10th of July 2018 10:09:28 PM
Here's a report in Sensors Tech Forum on the discovery of a set of hostile packages in the Arch Linux AUR repository system. AUR contains user-contributed packages, of course; it's not a part of the Arch distribution itself. "The security investigation shows that shows that a malicious user with the nick name xeactor modified in June 7 an orphaned package (software without an active maintainer) called acroread. The changes included a curl script that downloads and runs a script from a remote site. This installs a persistent software that reconfigures systemd in order to start periodically. While it appears that they are not a serious threat to the security of the infected hosts, the scripts can be manipulated at any time to include arbitrary code. Two other packages were modified in the same manner." This thread in the aur-general list shows the timeline of the discovery and response.

[$] Spectre V1 defense in GCC

Tuesday 10th of July 2018 08:48:52 PM
In many ways, Spectre variant 1 (the bounds-check bypass vulnerability) is the ugliest of the Meltdown/Spectre set, despite being relatively difficult to exploit. Any given code base could be filled with V1 problems, but they are difficult to find and defend against. Static analysis can help, but the available tools are few, mostly proprietary, and prone to false positives. There is also a lack of efficient, architecture-independent ways of addressing Spectre V1 in user-space code. As a result, only a limited effort (at most) to find and fix Spectre V1 vulnerabilities has been made in most projects. An effort to add some defenses to GCC may help to make this situation better, but it comes at a cost of its own.

Security updates for Tuesday

Tuesday 10th of July 2018 03:07:50 PM
Security updates have been issued by Debian (ruby-sprockets), Red Hat (ansible and rh-git29-git), Scientific Linux (firefox), SUSE (ceph), and Ubuntu (libjpeg-turbo, ntp, and openslp-dfsg).

[$] IR decoding with BPF

Monday 9th of July 2018 03:46:19 PM
In the 4.18 kernel, a new feature was merged to allow infrared (IR) decoding to be done using BPF. Infrared remotes use many different encodings; if a decoder were to be written for each, we would end up with hundreds of decoders in the kernel. So, currently, the kernel only supports the most widely used protocols. Alternatively, the lirc daemon can be run to decode IR. Decoding IR can usually be expressed in a few lines of code, so a more lightweight solution without many kernel-to-userspace context switches would be preferable. This article will explain how IR messages are encoded, the structure of a BPF program, and how a BPF program can maintain state between invocations. It concludes with a look at the steps that are taken to end up with a button event, such as a volume-up key event.

Security updates for Monday

Monday 9th of July 2018 03:31:32 PM
Security updates have been issued by Debian (bouncycastle and ca-certificates), Fedora (cantata, cinnamon, php-symfony3, and transifex-client), openSUSE (ghostscript, openssl, openvpn, php7, rubygem-yard, thunderbird, ucode-intel, and unzip), and SUSE (libqt4, nodejs8, and openslp).

Kernel prepatch 4.18-rc4

Monday 9th of July 2018 11:06:32 AM
The 4.18-rc4 kernel prepatch has been released. "Things look pretty normal here, and size-wise this looks good too, so it's another of those 'solid progress to release' weeks. Boring is good."

A pair of stable kernel updates

Sunday 8th of July 2018 03:06:13 PM
The 4.17.5 and 4.14.54 stable kernels have been released with yet another set of important fixes.

An interview with Jonathan Corbet

Friday 6th of July 2018 08:17:01 PM
For those with a significant chunk of spare time and nothing better to do: Swapnil Bhartiya interviewed LWN editor Jonathan Corbet in February has now posted the resulting video on the Patreon site.

More in Tux Machines

Type Title Author Replies Last Postsort icon
Story Compact, rugged box computer runs Ubuntu on Jetson TX2 Rianne Schestowitz 16/07/2018 - 10:08pm
Story Yum Won't Be Dropped For Fedora 29 Roy Schestowitz 16/07/2018 - 8:08pm
Story GNOME: GUADEC, GSoC, GitLab Roy Schestowitz 16/07/2018 - 7:50pm
Story OSS: Apache Cassandra, Jib,WSO2 and More Roy Schestowitz 16/07/2018 - 7:44pm
Story Kernel and Graphics: PDS, VKMS and Nouveau Roy Schestowitz 16/07/2018 - 7:39pm
Story DistroWatch The Best Website For Distro Hoppers Roy Schestowitz 16/07/2018 - 7:25pm
Story Ubuntu 18.04 LTS and 16.04 LTS Amazon Linux AMIs Now Support Amazon's SSM Agent Rianne Schestowitz 16/07/2018 - 7:04pm
Story today's howtos Roy Schestowitz 16/07/2018 - 6:07pm
Story Android Leftovers Rianne Schestowitz 16/07/2018 - 5:47pm
Story How to play Windows games in Linux Rianne Schestowitz 16/07/2018 - 5:37pm