Language Selection

English French German Italian Portuguese Spanish

Fedora and Red Hat Leftovers

Submitted by Roy Schestowitz on Thursday 21st of January 2021 10:02:03 PM Filed under
Red Hat

  • A possible step toward integrity measurement for Fedora

    The Fedora 34 release is planned for April 20 — a plan that may well come to fruition, given that the Fedora project appears to have abandoned its tradition of delayed releases. As part of that schedule, any proposals for system-wide changes were supposed to be posted by December 29. That has not stopped the arrival of a late proposal to add file signatures to Fedora's RPM packages, though. This proposal, meant to support the use of the integrity measurement architecture (IMA) in Fedora, has not been met with universal acclaim.
    The purpose of IMA is to measure whether the integrity of the system is intact, where "integrity" means that the important files in the system have not been corrupted. At its core, this measurement is carried out by reading a file's contents, computing a hash, and comparing that hash to the expected value; if the values match, the file has not been altered. This measurement can be used to prevent the execution (or reading) of corrupted files; it can also be used as part of a remote attestation scheme to convince a remote party that the local system has not been subjected to unauthorized modifications.

    To perform this measurement, IMA clearly must know what the expected hash for each file is; those hashes are signed with a key trusted by the kernel and stored as extended attributes. Generally, the private key used to sign these hashes is kept in some secure location, while the public key is either stored in a device like a trusted platform module (TPM) or built into the kernel binary. If all works as intended, IMA can thus be used to ensure that systems only run executables that have been blessed by some central authority, that those executables only read configuration files that have been similarly blessed, and so on. It is a mechanism for ensuring that the owner of a system keeps control of it; whether this is a good thing or not depends entirely on who the "owner" is defined to be.

    The actual proposal does not go so far as to implement IMA on Fedora systems; it is limited to including signatures with every file that is shipped in Fedora packages. These signatures "will be made with a key that’s kept by the Fedora Infrastructure team, and installed on the sign vaults". Fedora users would then be able to use IMA to keep their systems from using files that have been modified since they were packaged. An actual IMA setup for Fedora can be expected to come at some future time.

  • Fedora Loves Python 2020 report – Fedora Community Blog

    Inspired by a similar report from the Copr team, I’ve decided to look back at 2020 from the perspective of Python in Fedora (and little bit in RHEL/CentOS+EPEL as well). Here are the things we have done in Fedora (and EL) in 2020. By we I usually mean the Python Maint team at Red Hat and/or the Fedora’s Python SIG.

  • Introducing the Red Hat build of Eclipse Vert.x 4.0 - Red Hat Developer

    If you are interested in reactive, non-blocking, and asynchronous Java development, you are likely familiar with Eclipse Vert.x. The project started in 2011 and successfully moved to the Eclipse Foundation in 2013. Since then, Vert.x has undergone nine years of rigorous development and grown into a thriving community. It is one of the most widely used reactive frameworks, with support for multiple extensions, including extensions for messaging or streaming with Kafka or Artemis, developing applications with gRPC and GraphQL, and so much more.

    The Red Hat build of Eclipse Vert.x 4.0 is now generally available. This release improves Vert.x’s core APIs and handling. Developers who migrate can expect enhancements to futures and promises, distributed tracing, and deployment on Red Hat OpenShift. In this article, I introduce these updates and offer tips for migrating and deploying your Eclipse Vert.x 4.0 applications on OpenShift.

  • Implementing the ACSC "Essential Eight" baseline for security automation in Red Hat Enterprise Linux

    Achieving compliance with a security policy and maintaining compliance can be tedious. At Red Hat, we believe that such things should be automated and not become an unnecessary burden. To this end, we offer a whole ecosystem of services that automate security compliance.

    We ship several widely used security policies with our products. Today, we will go over the "Essential Eight" baseline in a bit more detail.

    The "Essential Eight" is a set of mitigation strategies created by the Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate (ASD) that leads the Australian Government’s efforts to improve cybersecurity.

  • Painless services: implementing serverless with rootless Podman and systemd

    Serverless is an event-driven computing paradigm where applications are allocated dynamically to serve a request or consume events. When the application is not in use, there are no computing resources allocated.

    The serverless ecosystem offers a large number of runtimes, which start/stop/monitor software (e.g., Knative, Kubeless and many others). They come with different features, and they can trigger applications based on different kind of events (e.g., HTTP requests, messages, etc.).

    Even if systemd cannot be considered a real serverless runtime, the socket activation feature provides a foundation for a serverless architecture.

  • Convert your Windows install into a VM on Linux | Opensource.com

    I use VirtualBox frequently to create virtual machines for testing new versions of Fedora, new application programs, and lots of administrative tools like Ansible. I have even used VirtualBox to test the creation of a Windows guest host.

    Never have I ever used Windows as my primary operating system on any of my personal computers or even in a VM to perform some obscure task that cannot be done with Linux. I do, however, volunteer for an organization that uses one financial program that requires Windows. This program runs on the office manager's computer on Windows 10 Pro, which came preinstalled.

    This financial application is not special, and a better Linux program could easily replace it, but I've found that many accountants and treasurers are extremely reluctant to make changes, so I've not yet been able to convince those in our organization to migrate.

  • Red Hat's StackRox Acquisition Bolsters Its Hybrid Multi-Cloud Strategy

    The startup has container security capabilities that are missing in Red Hat's OpenShift Kubernetes platform.

    [...]

    "We are working on looking at a few things, and that will have to be run through them because they're the bank now," he said. "They're a partner, but they're also our shareholders."

    It's doubtful that Red Hat would have to go to the IBM bank to finance this purchase. Although no details of the deal were made public, most media reports are putting the price tag at just north of $100 million, far less than the $250 million it paid for CoreOS in 2018.

    As to be expected from Red Hat, which has traditionally insisted that all of its software be open source, Red Hat plans to open source StackRox’s proprietary software after the acquisition closes sometime in the first quarter of 2021. Red Hat said it will continue to support the existing KubeLinter open source community, as well as the new communities that form around StackRox’s other offerings as soon as they are open sourced.

»

More in Tux Machines

Now you can make video calls on a PinePhone (but it’s very much a work in progress)

When the PinePhone began shipping to early adopters, it had all the hardware you’d expect from a smartphone, but it lacked the software needed to make some of that hardware work. If you were one of the first people to get your hands on a PinePhone, you had a Linux-friendly phone with a camera that couldn’t be used to take pictures or record video. But over time kernel and app developers got the phone’s front and rear cameras working, and now most Linux distributions for the PinePhone allow you to take pictures (of mediocre quality). One thing you couldn’t do until recently though? Video calls. But now it looks like that’s possible too… soft of. The process looks rather painful at the moment, but it should get better over time. Read more Also: Plasma Mobile tarball release: bugfixes and new releases

A warning about 5.12-rc1

  • A warning about 5.12-rc1
    Hey peeps - some of you may have already noticed that in my public git
tree, the "v5.12-rc1" tag has magically been renamed to
"v5.12-rc1-dontuse". It's still the same object, it still says
"v5.12-rc1" internally, and it is still is signed by me, but the
user-visible name of the tag has changed.




The reason is fairly straightforward: this merge window, we had a very
innocuous code cleanup and simplification that raised no red flags at
all, but had a subtle and very nasty bug in it: swap files stopped
working right.  And they stopped working in a particularly bad way:
the offset of the start of the swap file was lost.




Swapping still happened, but it happened to the wrong part of the
filesystem, with the obvious catastrophic end results.




Now, the good news is even if you do use swap (and hey, that's nowhere
near as common as it used to be), most people don't use a swap *file*,
but a separate swap *partition*. And the bug in question really only
happens for when you have a regular filesystem, and put a file on it
as a swap.




And, as far as I know, all the normal distributions set things up with
swap partitions, not files, because honestly, swapfiles tend to be
slower and have various other complexity issues.




The bad news is that the reason we support swapfiles in the first
place is that they do end up having some flexibility advantages, and
so some people do use them for that reason. If so, do not use rc1.
Thus the renaming of the tag.




Yes, this is very unfortunate, but it really wasn't a very obvious
bug, and it didn't even show up in normal testing, exactly because
swapfiles just aren't normal. So I'm not blaming the developers in
question, and it also wasn't due to the odd timing of the merge
window, it was just simply an unusually nasty bug that did get caught
and is fixed in the current tree.




But I want everybody to be aware of because _if_ it bites you, it
bites you hard, and you can end up with a filesystem that is
essentially overwritten by random swap data. This is what we in the
industry call "double ungood".




Now, there's a couple of additional reasons for me writing this note
other than just "don't run 5.12-rc1 if you use a swapfile". Because
it's more than just "ok, we all know the merge window is when all the
new scary code gets merged, and rc1 can be a bit scary and not work
for everybody". Yes, rc1 tends to be buggier than later rc's, we are
all used to that, but honestly, most of the time the bugs are much
smaller annoyances than this time.




And in fact, most of our rc1 releases have been so solid over the
years that people may have forgotten that "yeah, this is all the new
code that can have nasty bugs in it".




One additional reason for this note is that I want to not just warn
people to not run this if you have a swapfile - even if you are
personally not impacted (like I am, and probably most people are -
swap partitions all around) - I want to make sure that nobody starts
new topic branches using that 5.12-rc1 tag. I know a few developers
tend to go "Ok, rc1 is out, I got all my development work into this
merge window, I will now fast-forward to rc1 and use that as a base
for the next release". Don't do it this time. It may work perfectly
well for you because you have the common partition setup, but it can
end up being a horrible base for anybody else that might end up
bisecting into that area.




And the *final* reason I want to just note this is a purely git
process one: if you already pulled my git tree, you will have that
"v5.12-rc1" tag, and the fact that it no longer exists in my public
tree under that name changes nothing at all for you. Git is
distributed, and me removing that tag and replacing it with another
name doesn't magically remove it from other copies unless you have
special mirroring code.




So if you have a kernel git tree (and I'm here assuming "origin"
points to my trees), and you do




     git fetch --tags origin




you _will_ now see the new "v5.12-rc1-dontuse" tag. But git won't
remove the old v5.12-rc1 tag, because while git will see that it is
not upstream, git will just assume that that simply means that it's
your own local tag. Tags, unlike branch names, are a global namespace
in git.




So you should additionally do a "git tag -d v5.12-rc1" to actually get
rid of the original tag name.




Of course, having the old tag doesn't really do anything bad, so this
git process thing is entirely up to you. As long as you don't _use_
v5.12-rc1 for anything, having the tag around won't really matter, and
having both 'v5.12-rc1' _and_ 'v5.12-rc1-dontuse' doesn't hurt
anything either, and seeing both is hopefully already sufficient
warning of "let's not use that then".




Sorry for this mess,
             Linus
  • A warning about 5.12-rc1

    Linus Torvalds has sent out a note telling people not to install the recent 5.12-rc1 development kernel; this is especially true for anybody running with swap files. "But I want everybody to be aware of because _if_ it bites you, it bites you hard, and you can end up with a filesystem that is essentially overwritten by random swap data. This is what we in the industry call 'double ungood'." Additionally, he is asking maintainers to not start branches from 5.12-rc1 to avoid future situations where people land in the buggy code while bisecting problems.

    •  
  • Linux 5.12-rc2 Likely Coming Early Due To That Nasty File-System Corruption Bug

    Linus Torvalds has now warned developers over using Linux 5.12-rc1 as a basis for their future branches and is looking to release 5.12-rc2 ahead of schedule as a result of that problematic file-system corruption bug stemming from a swap file bug. 

Games: Godot, Artifact, Loop Hero, and Urtuk: The Desolation

  • Godot Showcase - Primal Light developer interview

    Welcome to the fourth developer interview following the introduction of the Godot Showcase page! This week, we are interviewing the studio Fat Gem about their first game Primal Light.

  • Valve gives up on Artifact setting it free with Artifact Classic and Artifact Foundry | GamingOnLinux

    Valve's Dota themed card game Artifact has now well and truly failed, as they've now stopped the 2.0 redevelopment which is now named Artifact Foundry with the original as Artifact Classic and both now free to play. In a post titled "The Future of Artifact", Valve mentioned how the player count fell off dramatically and it was pretty much dead shortly after being released. Even though the big 2.0 revamp was far along in development, they've now formally and totally shelved it as they "haven't managed to get the active player numbers to a level that justifies further development at this time".

  • Loop Hero is out now and I'm going to need help to tear myself away from it | GamingOnLinux

    Loop Hero, probably the only titles I've pre-ordered in the last few years is officially out now and I really will need some help to pull myself away from running just one more loop. It's such a strange and beautifully intoxicating mix of genres. For each loop through you're placed into a world full of nothing but a path and it's up to you to build up the world each time. You do this through your deck of cards, while the hero automatically loops around the path and fights enemies along the way without your input. Even though you don't have direct control, there's quite a lot of strategy involved in it.

  • Dark low-fantasy tactical survival RPG 'Urtuk: The Desolation' is out now | GamingOnLinux

    Urtuk: The Desolation from David Kaleta presents you with a dark world in a low-fantasy settings where you guide a team of survivors through a ruined world. Note: key provided by the developer. Hitting nearly one thousand user reviews and a Very Positive rating on Steam overall, Urtuk: The Desolation seems to have managed to hit a sweet spot. Giving you tough turn-based combat, with a character progression system that sees you extracting skills and traits from fallen enemies. It's a bit of a gross world and the main character, Urtuk, is an escaped subject of experimentation with a severe mutation and worsening health. The idea is to eventually find a cure but getting there will be tough.

today's howtos

  • How to find duplicate files in Linux? Help is here with the fdupes command! - Webleit.info

    Fdupes is a command line tool that allows you to find all duplicate files through the console. The advantage over using graphical tools like fslint is of course the speed. At the end of the day, there is nothing faster and more convenient than the Linux console. Why should we look for duplicate files in Linux? No matter what operating system you use sooner or later, your computer will contain many files of different sizes, and if you’re not careful enough, repeating them can cost you disk space that you need. For example, you inadvertently downloaded the same ultra HD movie with 40 giga bytes twice.

  • How to Install Moodle with Nginx and Let's Encrypt SSL on Ubuntu 20.04

    Moodle is a free and open-source Learning Management System written in PHP. It provides a way for tutors and instructors to create courses for their students or learners. Moodle provides a robust and secure integrated system and comes with a custom dashboard that helps users to access current, past or future courses, as well as review pending work. It is used by many schools, universities, and organizations across the globe and provides a better learning experience. It provides a rich set of features including, wiki, grading, assignment submission, online quizzes, discussion boards, and more. In this tutorial, we will show you how to install Moodle with Nginx web server and Let's Encrypt SSL on Ubuntu 20.04.

  • Install WordPress Automatically on Ubuntu 20.04 using WordOps

    WordOps is a simple tool that provides the ability to deploy WordPress sites from the command line using an optimized LEMP stack. The LEMP software stack consists of a group of software that describes a Linux Operating System, an Nginx web server (pronounced engine-x), a MySQL database with the dynamic processing being handled by PHP. LEMP is an acronym for Linux, Engine-x (Nginx), MySQL and PHP. WordOps simplifies so much of the process of installing and configuring all the packages from the LEMP stack needed to deploy a site while taking care of creating virtual hosts in Nginx, installing WordPress, and even gets you a SSL certificate. It also installs some components that allow you to see statistics about the server’s workload. In this tutorial we’ll use WordOps to quickly and easily install WordPress on an Ubuntu 20.04 machine, and we’ll check out and explain some of the extra features that WordOps offers.

  • How to Find Out When a Webpage Was Published - Make Tech Easier

    When you’re doing research on a topic, it’s vital to ensure your sources are up to date. If you’re writing an academic paper, dates of publication are often required in the citations. The majority of the time, getting the date is easy: simply look on the site and find the published date to find how recent it was. Things get a little more complicated when there is no date listed on the webpage. When this happens, how do you know when a webpage was published?

  • How to install Wireshark 3.4.3 on a Chromebook

    Today we are looking at how to install Wireshark 3.4.3 on a Chromebook. Please follow the video/audio guide as a tutorial where we explain the process step by step and use the commands below.

  • Another Piece For The Home Network Puzzle – A Return To Cisco IOS! – Jon's FOSS Blog

    I’ve missed the good old days of configuring and setting up good quality switching hardware (like the big, huge Cisco switches and routers I used to experiment on with their IOS command line interface). I recently ordered this newer, smaller Cisco switch which can also provide power to a new “prosumer” WiFi AP (no power cables needed).

  • Making environment variables accessible in front-end containers - Red Hat Developer

    When building a container for a single-page application using any modern JavaScript framework (such as Angular, React, or Vue.js), you might find that the configuration settings are different depending on where the container will run. A typical case would be the base URL for your API, which will differ depending on whether you are testing the application or deploying it into production. Developers usually solve this problem using environment variables. Environment variables typically work on the backend because that is where code runs. But what if your application lives in the user’s browser? There are many ways around this limitation. In some cases, you might build a server whose endpoint holds the necessary parameters. Another workaround is to use PHP to inject the environment variables as globals in the JavaScript code. Both of these options work, but it would be ideal to inject the environment variables as part of the container build process. That way, you don’t have to change the codebase, and you can still deliver the application content using a static web server like NGINX. This article shows you how to inject environment variables directly into your codebase as you build your container.

  • The Strange Case of How We Escaped the Docker Default Container

    TL;DR During an internal container-based Red Team engagement, the Docker default container spontaneously and silently changed cgroups overnight, which allowed us to escalate privileges and gain...

  • How to copy and paste between host and VM

More on Tux Machines: About ● Gallery ● Forum ● Blogs ● Search ● News ● RSS Feed

Part of Bytes Media ● Sister sites below.

TechBytes Techrights button

Powered by Drupal, an open source content management system

Content available under CC-BY-SA CC

© by original authors

Powered by CentOS 6.5 (GNU/Linux), Varnish, and Drupal 6