All posts by corbet

Kernel prepatch 7.0-rc4

Post Syndicated from corbet original https://lwn.net/Articles/1062952/

Linus has released 7.0-rc4 for testing.

Then Thursday hit with the networking pull. And then on Friday
everybody else decided to send in their work for the week, with a
few more trickling in over the weekend. End result: what had for a
short few days looked like a nice calm week turned into another
“bigger than usual” release candidate.

To be fair, that “almost everything comes in at the end of the
week” is 100% normal, and none of this is surprising. I was
admittedly hoping that things would start to calm down, but that
was not to be.

I no longer really believe that it was the one extra week we had
last release cycle: I’m starting to suspect it’s the psychological
result of “hey, new major number”, and people are just being a bit
more active as a result.

An investigation of the forces behind the age-verification bills

Post Syndicated from corbet original https://lwn.net/Articles/1062779/

Reddit user “Ok_Lingonberry3296” has posted the
results of an extensive investigation
into the companies that are
pushing US state legislatures to enact age-verification bills.

I’ve been pulling public records on the wave of “age verification”
bills moving through US state legislatures. IRS 990 filings, Senate
lobbying disclosures, state ethics databases, campaign finance
records, corporate registries, WHOIS lookups, Wayback Machine
archives. What started as curiosity about who was pushing these
bills turned into documenting a coordinated influence operation
that, from a privacy standpoint, is building surveillance
infrastructure at the operating system level while the company
behind it faces zero new requirements for its own platforms.

(See also this article for a look at the
California law.)

A set of AppArmor vulnerabilities

Post Syndicated from corbet original https://lwn.net/Articles/1062778/

Qualys has sent out a
somewhat breathless advisory
describing a number of vulnerabilities in
the AppArmor security module, which is used in a number of Debian-based
distributions (among others).

This “CrackArmor” advisory exposes a confused-deputy flaw allowing
unprivileged users to manipulate security profiles via
pseudo-files, bypass user-namespace restrictions, and execute
arbitrary code within the kernel. These flaws facilitate local
privilege escalation to root through complex interactions with
tools like Sudo and Postfix, alongside denial-of-service attacks
via stack exhaustion and Kernel Address Space Layout Randomization
(KASLR) bypasses via out-of-bounds reads.

[$] Practical uses for a null filesystem

Post Syndicated from corbet original https://lwn.net/Articles/1062163/

One of the first changes merged for the upcoming 7.0 release was nullfs,
an empty filesystem that cannot actually contain any files. One might
logically wonder why the kernel would need such a thing. It turns out,
though, that there are places where a null filesystem can come in handy.
For 7.0, nullfs will be used to make life a bit easier for init
programs; future releases will likely use nullfs to increase the isolation
of kernel threads from the init process.

Huston: Revisiting time

Post Syndicated from corbet original https://lwn.net/Articles/1061930/

Geoff Huston looks at the network
time protocol
, and efforts to secure it, in detail.

NTP operates in the clear, and it is often the case that the
servers used by a client are not local. This provides an
opportunity for an adversary to disrupt an NTP session, by
masquerading as a NTP server, or altering NTP payloads in an effort
to disrupt a client’s time-of-day clock. Many application-level
protocols are time sensitive, including TLS, HTTPS, DNSSEC and
NFS. Most Cloud applications rely on a coordinated time to
determine the most recent version of a data object. Disrupting time
can cause significant chaos in distributed network environments.

While it can be relatively straightforward to secure a TCP-based
protocol by adding an initial TLS handshake and operating a TLS
shim between TCP and the application traffic, it’s not so
straightforward to use TLS in place of a UDP-based protocol for
NTP. TLS can add significant jitter to the packet exchange. Where
the privacy of the UDP payload is essential, then DTLS might
conceivably be considered, but in the case of NTP the privacy of
the timestamps is not essential, but the veracity and authenticity
of the server is important.

NTS, a secured version of NTP, is designed to address this
requirement relating to the veracity and authenticity of packets
passed from a NTS server to an NTS client. The protocol adds a NTS
Key Establishment protocol (NTS-KE) in additional to a conventional
NTPv4 UDP packet exchange (RFC 8915).

A GitHub Issue Title Compromised 4,000 Developer Machines (grith.ai)

Post Syndicated from corbet original https://lwn.net/Articles/1061548/

The grith.ai blog reports
on an LLM prompt-injection vulnerability that led to 4,000 installations of
a compromised version of the Cline utility.

For the next eight hours, every developer who installed or updated
Cline got OpenClaw – a separate AI agent with full system access –
installed globally on their machine without consent. Approximately
4,000 downloads occurred before the package was pulled.

The interesting part is not the payload. It is how the attacker got
the npm token in the first place: by injecting a prompt into a
GitHub issue title, which an AI triage bot read, interpreted as an
instruction, and executed.

[$] The relicensing of chardet

Post Syndicated from corbet original https://lwn.net/Articles/1061534/

Chardet
is a Python module that attempts to determine which character set was used
to encode a text string. It was originally written by Mark Pilgrim, who is
also the author of a number of Python books; the 1.0 release happened in
2006. For many years, this module has been under the maintainership of
Dan Blanchard. Chardet has always been licensed under the LGPL, but, with
the 7.0.0
release
, Blanchard changed the terms to the permissive MIT license.
That has led to an extensive (and ongoing) discussion on when code can be
relicensed against the wishes of its original author, and whether using a
large language model to rewrite code is a legitimate way to strip copyleft
requirements from code.

[$] Reconsidering the multi-generational LRU

Post Syndicated from corbet original https://lwn.net/Articles/1060967/

The multi-generational LRU (MGLRU) is an
alternative memory-management algorithm that was merged for the 6.1 kernel
in late 2022. It brought a promise of much-improved performance and
simplified code. Since then, though, progress on MGLRU has stalled, and it
still is not enabled on many systems. As the 2026 Linux Storage,
Filesystem, Memory-Management and BPF Summit
(LSFMM+BPF) approaches,
several memory-management developers have indicated a desire to talk about
the future of MGLRU. While some developers are looking for ways to improve
the subsystem, another has called for it to be removed entirely.

CBP Tapped Into the Online Advertising Ecosystem To Track Peoples’ Movements (404 Media)

Post Syndicated from corbet original https://lwn.net/Articles/1061085/

This
404 Media article
looks at how the US Customs and Border Protection
agency (CBP) is using location data from phones to track the location of
people of interest.

Specifically, CBP says the data was in part sourced via real-time
bidding, or RTB. Whenever an advertisement is displayed inside an
app, a near instantaneous bidding process happens with companies
vying to have their advert served to a certain demographic. A side
effect of this is that surveillance firms, or rogue advertising
companies working on their behalf, can observe this process and
siphon information about mobile phones, including their
location. All of this is essentially invisible to an ordinary phone
user, but happens constantly.

We should note that the minimal advertising shown on LWN is not delivered
via this bidding system.

Garrett: To update blobs or not to update blobs

Post Syndicated from corbet original https://lwn.net/Articles/1061048/

Matthew Garrett examines
the factors
that go into the decision about whether to install a
firmware update or not.

I trust my CPU vendor. I don’t trust my CPU vendor because I want
to, I trust my CPU vendor because I have no choice. I don’t think
it’s likely that my CPU vendor has designed a CPU that identifies
when I’m generating cryptographic keys and biases the RNG output so
my keys are significantly weaker than they look, but it’s not
literally impossible. I generate keys on it anyway, because what
choice do I have? At some point I will buy a new laptop because
Electron will no longer fit in 32GB of RAM and I will have to make
the same affirmation of trust, because the alternative is that I
just don’t have a computer.

[$] The ongoing quest for atomic buffered writes

Post Syndicated from corbet original https://lwn.net/Articles/1060063/

There are many applications that need to be able to write multi-block
chunks of data to disk with the assurance that the operation will either
complete successfully or fail altogether — that the write will not be
partially completed (or “torn”), in other words. For years, kernel
developers have worked on providing atomic writes as a way of satisfying
that need; see, for example, sessions from the Linux Storage, Filesystem,
Memory Management, and BPF (LSFMM+BPF) Summit from 2023, 2024,
and 2025 (twice). While atomic direct I/O is now supported by some filesystems, atomic
buffered I/O still is not. Filling
that gap seems certain to be a 2026 LSFMM+BPF topic but, thanks to an early
discussion, the shape of a solution might already be coming into focus.

Høiland-Jørgensen: The inner workings of TCP zero-copy

Post Syndicated from corbet original https://lwn.net/Articles/1060953/

Toke Høiland-Jørgensen has posted an
overview of how zero-copy networking works
in the Linux kernel.

Since the memory is being copied directly from userspace to the
network device, the userspace application has to keep it around
unmodified, until it has finished sending. The sendmsg()
syscall itself is asynchronous, and will return without waiting for
this. Instead, once the memory buffers are no longer needed by the
stack, the kernel will return a notification to userspace that the
buffers can be reused.

Motorola announces a partnership with the GrapheneOS Foundation

Post Syndicated from corbet original https://lwn.net/Articles/1060913/

Motorola has announced
that it will be working with the GrapheneOS Foundation, a producer of a
security-enhanced Android distribution. “Together, Motorola and the
GrapheneOS Foundation will work to strengthen smartphone security and
collaborate on future devices engineered with GrapheneOS
compatibility.
“. LWN looked at
GrapheneOS
last July.

[$] IIIF: images and visual presentations for the web

Post Syndicated from corbet original https://lwn.net/Articles/1059565/

The International Image Interoperability
Framework
, or IIIF (“triple-eye eff”), is a small set of standards that
form a basis for serving, displaying, and reusing image data on the web. It
consists of a number of API definitions that compose with each other to
achieve a standard for providing, for example, presentations of
high-resolution images at multiple zoom levels, as well as bundling multiple images
together. Presentations may include metadata about details like authorship,
dates, references to other representations of the same work, copyright
information, bibliographic identifiers, etc. Presentations can be further
grouped into collections, and metadata can be added in the form of
transcriptions, annotations, or captions. IIIF is most popular with
cultural-heritage organizations, such as libraries, universities, and
archives.