All posts by corbet

Security updates for Wednesday

Post Syndicated from corbet original https://lwn.net/Articles/951480/

Security updates have been issued by Debian (libclamunrar and ruby-sanitize), Fedora (frr, roundcubemail, and webkitgtk), Mageia (freerdp and tomcat), Red Hat (avahi, bind, c-ares, cloud-init, container-tools:4.0, container-tools:rhel8, cups, dnsmasq, edk2, emacs, flatpak, fwupd, ghostscript, grafana, java-21-openjdk, kernel, kernel-rt, libfastjson, libmicrohttpd, libpq, librabbitmq, libreoffice, libreswan, libX11, linux-firmware, mod_auth_openidc:2.3, nodejs:20, opensc, perl-HTTP-Tiny, procps-ng, protobuf-c, python-cryptography, python-pip, python27:2.7, python3, python3.11, python3.11-pip, python38:3.8, python38-devel:3.8, python39:3.9, python39-devel:3.9, qt5-qtbase, qt5-qtsvg, rhc, ruby:2.5, shadow-utils, squid:4, sysstat, tang, tomcat, tpm2-tss, virt:rhel, virt-devel:rhel, webkit2gtk3, wireshark, xorg-x11-server, xorg-x11-server-Xwayland, and yajl), Slackware (mariadb), SUSE (chromium, connman, exfatprogs, ucode-intel, and w3m), and Ubuntu (cobbler, ffmpeg, linux-oem-6.5, procps, and traceroute).

Security updates for Tuesday

Post Syndicated from corbet original https://lwn.net/Articles/951311/

Security updates have been issued by Debian (postgresql-11, postgresql-13, and postgresql-15), Fedora (chromium, optipng, and radare2), Scientific Linux (plexus-archiver and python), Slackware (tigervnc), SUSE (apache2, containerized-data-importer, kernel-firmware-nvidia-gspx-G06, nvidia-open- driver-G06-signed, postgresql, postgresql15, postgresql16, postgresql12, postgresql13, python-Django1, squashfs, and xterm), and Ubuntu (firefox and memcached).

[$] The rest of the 6.7 merge window

Post Syndicated from corbet original https://lwn.net/Articles/949957/

By the time that the 6.7 merge window closed on November 12, 15,418
non-merge changesets had been pulled into the mainline kernel. That makes
this one of the busiest merge windows ever; if one discounts the lengthy
bcachefs development history (some 2,800 commits), though, then the patch
volume is roughly in line with other recent kernels. Over 5,000 of those
commits were merged after our first-half
merge-window summary was written.

Security updates for Monday

Post Syndicated from corbet original https://lwn.net/Articles/951237/

Security updates have been issued by Debian (audiofile and ffmpeg), Fedora (keylime, python-pillow, and tigervnc), Mageia (quictls and vorbis-tools), Oracle (grub2), Red Hat (galera, mariadb, plexus-archiver, python, squid, and squid34), and SUSE (clamav, kernel, mupdf, postgresql14, tomcat, tor, and vlc).

[$] listmount() and statmount()

Post Syndicated from corbet original https://lwn.net/Articles/950569/

Years ago, the list of mounted filesystems on a Unix or Linux machine was
relatively short and static. Adding a filesystem, which typically involved
buying a new drive, happened rarely. In contrast, contemporary systems
with a large number of containers can have a long and dynamic list of
mounted filesystems. As was discussed at
the 2023 LSFMM+BPF Summit, the Linux
kernel’s mechanism for providing information about mounted filesystems has
not kept up with this change, leading to system-management headaches. Now,
two new system calls proposed
by Miklos Szeredi look set to provide some much-needed pain relief.

[$] The push to save Itanium

Post Syndicated from corbet original https://lwn.net/Articles/950466/

It is (relatively) easy to add code to the kernel; it tends to be much
harder to remove that code later. The most recent example of this dynamic
can be seen in the story of the ia64 (“Itanium”) architecture, support for
which was removed during the 6.7 merge window. That removal has left a
small group of dedicated ia64 users unhappy and clinging to a faint hope
that this support could return in a year’s time.

Chamberlain v. Home Assistant

Post Syndicated from corbet original https://lwn.net/Articles/950696/

The developers of Home Assistant, which has recently been covered here, have announced
that they will be removing support for Chamberlain and Liftmaster
garage-door openers after being locked out by the company.

Because we cannot continue to work around Chamberlain Group if they
keep blocking access to third parties, the MyQ integration will be
removed from Home Assistant in the upcoming 2023.12 release on
December 6, 2023. We are very disappointed that it has come to this
and sincerely hope that Chamberlain Group is willing to reconsider
its position.

Longtime readers may remember that Chamberlain tried to use the DMCA to block the use of
third-party remotes nearly 20 years ago.

Canonical reveals more details about Ubuntu Core Desktop (Register)

Post Syndicated from corbet original https://lwn.net/Articles/950695/

The Register attended
a talk about Ubuntu’s upcoming Core Desktop immutable distribution.

We suspect that Core Desktop might yet be the tool that validates
Canonical’s Snap format and helps to overcome some of the
resistance it faces. Snap’s single-file distribution format is
simple and enables transactional installation – including,
critically, rollback – without a fancy filesystem underneath, or
elaborate distribution methods such as libostree.

Security updates for Wednesday

Post Syndicated from corbet original https://lwn.net/Articles/950694/

Security updates have been issued by Debian (python-urllib3 and tang), Fedora (chromium, mlpack, open-vm-tools, and salt), Red Hat (avahi, binutils, buildah, c-ares, cloud-init, containernetworking-plugins, cups, curl, dnsmasq, edk2, flatpak, frr, gdb, ghostscript, glib2, gmp, grafana, haproxy, httpd, mod_http2, java-21-openjdk, kernel, krb5, libfastjson, liblouis, libmicrohttpd, libpq, libqb, librabbitmq, LibRaw, libreoffice, libreswan, libssh, libtiff, libvirt, libX11, linux-firmware, mod_auth_openidc, ncurses, nghttp2, opensc, pcs, perl-CPAN, perl-HTTP-Tiny, podman, procps-ng, protobuf-c, python-cryptography, python-pip, python-tornado, python-wheel, python3.11, python3.11-pip, python3.9, qemu-kvm, qt5 stack, runc, samba, samba, evolution-mapi, openchange, shadow-utils, skopeo, squid, sysstat, tang, tomcat, toolbox, tpm2-tss, webkit2gtk3, wireshark, xorg-x11-server, xorg-x11-server-Xwayland, and yajl), Slackware (sudo), SUSE (squid), and Ubuntu (python-urllib3).

Sponsorship for the Openwall lists

Post Syndicated from corbet original https://lwn.net/Articles/950538/

Alexander “Solar Designer” Peslyak, the longtime maintainer of the
oss-security and linux-distros mailing lists, has announced
that this work has gained a sponsor:

After 15+ years of being a 100% volunteer effort, Openwall’s
maintenance of oss-security and (linux-)distros is finally
sponsored by the OpenSSF, a project of the Linux Foundation. This
sponsorship does not provide the Linux Foundation with the ability
to set policies for community resources managed by Openwall. I am
grateful for the support, which will help ensure continued
operation of these resources on a new level while retaining
independence.

As part of this arrangement, Peslyak is now producing statistics on
vulnerability handling; the first
set for 2023 has been posted.

Fedora 39 released

Post Syndicated from corbet original https://lwn.net/Articles/950524/

Fedora
39 has been released, one day after the Fedora project’s 20th
anniversary. See the list of
approved changes and this Fedora
Magazine article for more information.

As always, we’ve updated many, many other packages as we work to
bring you the best of everything the free and open source software
world has to offer. Fedora Linux 39 includes gcc 13.2, binutils
2.40, glibc 2.38, gdb 13.2, and rpm 4.19. It also has updates to
popular programming language stacks, including Python 3.12 and Rust
1.73.

Security updates for Tuesday

Post Syndicated from corbet original https://lwn.net/Articles/950523/

Security updates have been issued by Debian (trapperkeeper-webserver-jetty9-clojure), Mageia (libsndfile, packages, thunderbird, and x11-server), Oracle (.NET 6.0), SUSE (kernel, kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools- container, virt-operator-container, redis, and squid), and Ubuntu (gsl).

[$] The BPF-programmable network device

Post Syndicated from corbet original https://lwn.net/Articles/949960/

Containers and virtual machines on Linux communicate with the world via
virtual network devices. This arrangement makes the full power of the
Linux networking stack available, but it imposes the full overhead of that
stack as well. Often, the routing of this networking traffic can be
handled with relatively simple logic; the BPF-programmable network device,
which was merged for the 6.7 kernel release, makes it possible to avoid
expensive network processing, in at least some cases.

First handset with MTE on the market (Project Zero)

Post Syndicated from corbet original https://lwn.net/Articles/950123/

The Google Project Zero blog celebrates
the launch of the Pixel 8 handset, the first to make use of Arm’s
Memory Tagging Extension (MTE). Linux has supported MTE since the 5.10 release in 2020,
but that support has only now shown up (in experimental form) in an
available handset.

I think this is a huge improvement for the general security of the
device – many zero-click attack surfaces involve large amounts of
unsafe C/C++ code, whether that’s WebRTC for calling, or one of the
many media or image file parsing libraries. MTE is not a silver
bullet for memory safety – but the release of the first production
device with the ability to run almost all user-mode applications
with synchronous-MTE is a huge step forward, and something that’s
worth celebrating!

The article includes detailed instructions for how to turn the MTE feature
on.

OpenELA’s first code drop

Post Syndicated from corbet original https://lwn.net/Articles/950104/

The Open Enterprise Linux Association, a
joint venture founded by CIQ, Oracle, and SUSE, has announced
its first code release.

OpenELA is excited to announce that the source code for all
packages necessary for anyone to build a derivative Enterprise
Linux operating system is now available. The initial focus is on
EL8 and EL9, and packages for EL7 are forthcoming. The project is
committed to ensuring the continued availability of EL sources to
the community indefinitely.

The organization has also announced a technical
steering committee made up of “highly experienced individuals from
the founding companies“.