Post Syndicated from corbet original https://lwn.net/Articles/941744/

On August 16, 1993, Ian Murdock announced
a new distribution to the comp.os.linux.development Usenet newsgroup:

This is just to announce the imminent completion of a brand-new
Linux release, which I’m calling the Debian Linux Release. This is
a release that I have put together basically from scratch; in other
words, I didn’t simply make some changes to SLS and call it a new
release. I was inspired to put together this release after running
SLS and generally being dissatisfied with much of it, and after
much altering of SLS I decided that it would be easier to start
from scratch. The base system is now virtually complete (though I’m
still looking around to make sure that I grabbed the most recent
sources for everything), and I’d like to get some feedback before I
add the “fancy” stuff.

After 30 years, Debian is still going strong.

Post Syndicated from corbet original https://lwn.net/Articles/941743/

The Debian project has added
the LoongArch architecture to its ports collection.

After an initial manual bootstrap of roughly 200 packages, two
buildds are now building packages for the newly added “loong64”
port with the help of qemu-user. After enough packages have been
built for the port to be self-hosting, we’re planning to replace
these two buildds with real hardware hosted at Loongson.

Post Syndicated from corbet original https://lwn.net/Articles/941722/

Security updates have been issued by Debian (datatables.js and openssl), Fedora (ghostscript, java-11-openjdk, java-latest-openjdk, microcode_ctl, and xen), Red Hat (redhat-ds:11), SUSE (java-1_8_0-openj9, kernel, krb5, pcre2, and perl-HTTP-Tiny), and Ubuntu (gstreamer1.0, mysql-8.0, tiff, and webkit2gtk).

Post Syndicated from corbet original https://lwn.net/Articles/941672/

Version
5.0 (“Daedalus”) of the Debian-based Devuan distribution has been
released. “This is the result of many months of painstaking work by the
Team and detailed testing by the wider Devuan community.” The
announcement lists a couple of new features but mostly defers to the
Debian 12 (“bookworm”) release notes.

Post Syndicated from corbet original https://lwn.net/Articles/941660/

The 2023 Maintainers Summit will be held on November 16 in Richmond, VA,
immediately after the Linux Plumbers
Conference.

As in previous years, the Maintainers Summit is invite-only, where
the primary focus will be process issues around Linux Kernel
Development. It will be limited to 30 invitees and a handful of
sponsored attendees.

The call for
topics has just gone out, with the first invitations to be sent within
a couple of weeks or so.

Post Syndicated from corbet original https://lwn.net/Articles/941658/

Security updates have been issued by Debian (samba), Red Hat (.NET 6.0, .NET 7.0, rh-dotnet60-dotnet, rust, rust-toolset-1.66-rust, and rust-toolset:rhel8), and SUSE (kernel and opensuse-welcome).

Post Syndicated from corbet original https://lwn.net/Articles/941591/

For those who find the 6.x kernel intimidating, Seiya Nuta has written a look at the 0.01
kernel, which reflects a simpler time.

By the way, there’s an interesting comment about the scheduler:

    *  'schedule()' is the scheduler function. This is GOOD CODE! There
    * probably won't be any reason to change this, as it should work well
    * in all circumstances (ie gives IO-bound processes good response etc).

Yes it’s indeed good code. Unfortunately (or fortunately), this
prophecy is false. Linux became one of most practical and
performant kernel which has introduced many new scheduling
improvements and algorithms over the years, like Completely Fair
Scheduler (CFS).

Post Syndicated from corbet original https://lwn.net/Articles/940944/

The Linux fast user-space mutex (“futex”) subsystem debuted with the 2.6.0
kernel; it provides a mechanism that can be used to implement user-space
locking. Since futexes avoid calling into the kernel whenever possible,
they can indeed be fast, especially in the uncontended case. The API used
to access futexes has never been seen as one of Linux’s strongest points,
though, so there has long been a desire to improve it. This patch
series from Peter Zijlstra shows what the future of futexes may look
like.

Post Syndicated from corbet original https://lwn.net/Articles/941405/

The 6.5-rc6 kernel prepatch is out for
testing.

So apart from the regularly scheduled hardware mitigation patches,
everything looks fairly normal. And I guess the hw mitigation is to
be considered normal too, apart from the inevitable fixup patches
it then causes because the embargo keeps us from testing it widely
and keeps it from all our public automation. Sigh.

Post Syndicated from corbet original https://lwn.net/Articles/940808/

LWN recently covered a discussion on
file-position locking that demonstrated the hazards that can result
from unexpected concurrency. It turns out that this discussion had not yet
fully run its course. Since that article was written, additional changes
intended to address a performance regression evolved into a core virtual
filesystem (VFS) layer API change to carry out some much-delayed housecleaning.

Post Syndicated from corbet original https://lwn.net/Articles/941091/

The Open Enterprise Linux Association
has announced its
existence. It is a collaboration between CIQ (Rocky Linux), Oracle,
and SUSE to provide an RHEL-compatible distribution.

Starting later this year, OpenELA will provide sources necessary
for downstreams compatible with RHEL to exist, with initial focus
on RHEL versions EL8, EL9 and possibly EL7. The project is
committed to ensuring the continued availability of OpenELA sources
to the community indefinitely.

OpenELA’s core tenets, reflecting the spirit of the project,
include full compliance with this existing standard, swift updates
and secure fixes, transparency, community, and ensuring the
resource remains free and redistributable for all.

Post Syndicated from corbet original https://lwn.net/Articles/940704/

It is the kernel’s business to know when a process’s memory has been
written to; among other things, this knowledge is needed to determine which
pages can
be immediately reclaimed or to properly write dirty pages to backing store.
Sometimes, though, user space also needs access to this information in a
reliable and fast manner. This
patch series from Muhammad Usama Anjum adds a new ioctl() call
for this purpose; using it requires repurposing an existing system call in
an unusual way, though.

Post Syndicated from corbet original https://lwn.net/Articles/941083/

OpenSSH 9.4 has been released. Changes this time include the ability to
forward Unix-domain sockets, a tags mechanism for more flexible
configuration, and more.

Post Syndicated from corbet original https://lwn.net/Articles/940290/

The LWN.net Weekly Edition for August 10, 2023 is available.

Post Syndicated from corbet original https://lwn.net/Articles/940912/

Security updates have been issued by Debian (cjose, hdf5, and orthanc), Fedora (java-17-openjdk and seamonkey), Red Hat (curl, dbus, iperf3, kernel, kpatch-patch, libcap, libxml2, nodejs:16, nodejs:18, postgresql:10, postgresql:12, postgresql:13, and python-requests), SUSE (bluez, cjose, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly, keylime, openssl-1_1, openssl-3, pipewire, poppler, qemu, rubygem-actionpack-4_2, rubygem-actionpack-5_1, rust1.71, tomcat, webkit2gtk3, and wireshark), and Ubuntu (binutils, dotnet6, dotnet7, openssh, php-dompdf, and unixodbc).

Post Syndicated from corbet original https://lwn.net/Articles/940798/

The
6.4.9,
6.1.44,
5.15.125,
5.10.189,
5.4.252,
4.19.290, and
4.14.321
stable kernel updates have all been released; they are dominated by fixes
for the latest round of
speculative-execution vulnerabilities.

Do note the warning attached to each of these releases:

Note, PLEASE TEST this kernel if you are on the 6.4.y tree before
using it in a real workload. This was a quick release due to the
obvious security fixes in it, and as such, it has not had very much
testing “in the wild”. Please let us know of any problems seen.
Also note that the user/kernel api for the new security mitigations
might be changing over time, so do not get used to them being fixed
in stone just yet.

Post Syndicated from corbet original https://lwn.net/Articles/940783/

There is a newly disclosed set of vulnerabilities in Intel processors that
have been given the name Downfall
attacks.

Downfall attacks targets a critical weakness found in billions of
modern processors used in personal and cloud computers. This
vulnerability, identified as CVE-2022-40982, enables a user to
access and steal data from other users who share the same
computer. For instance, a malicious app obtained from an app store
could use the Downfall attack to steal sensitive information like
passwords, encryption keys, and private data such as banking
details, personal emails, and messages. Similarly, in cloud
computing environments, a malicious customer could exploit the
Downfall vulnerability to steal data and credentials from other
customers who share the same cloud computer.

A series of patches has landed in the mainline kernel, including one for gather data sampling
mitigation and one to disable the AVX
extension on CPUs where microcode mitigation is not available.
“This is a *big* hammer. It is known to break buggy userspace that
uses incomplete, buggy AVX enumeration.”

Not to be left out, AMD processors suffer from a return-stack overflow
vulnerability, again exploitable via speculative execution; this patch, also just
merged, describes the problem and its mitigation.

Post Syndicated from corbet original https://lwn.net/Articles/940755/

Security updates have been issued by Debian (libhtmlcleaner-java and thunderbird), Red Hat (dbus, kernel, kernel-rt, kpatch-patch, and thunderbird), Scientific Linux (thunderbird), SUSE (chromium, gstreamer-plugins-bad, gstreamer-plugins-base, gstreamer-plugins-good, gstreamer-plugins-ugly, kernel-firmware, libqt5-qtbase, libqt5-qtsvg, librsvg, pcre2, perl-Net-Netmask, qt6-base, and thunderbird), and Ubuntu (firefox).

Post Syndicated from corbet original https://lwn.net/Articles/940683/

Sourceware, the development home for
the GNU toolchain and more, is about to celebrate its 25th anniversary and
is looking
forward to the next 25 years:

That is why in the last couple of years we have started to
diversify our hardware partners, setup new services using
containers and isolated VMs, investigated secure supply chain
issues, added redundant mirrors, created a non-profit home,
collected funds, invested in open communication, open office hours
and introduced community oversight by a Sourceware Project
Leadership Committee with the help from the Software Freedom
Conservancy.

Post Syndicated from corbet original https://lwn.net/Articles/940403/

Return-oriented
programming (ROP) has, for some years now, been a valuable tool for
those who would subvert a system’s security. It is thus not surprising
that a lot of effort has gone into thwarting ROP attacks, which depend on
corrupting the call stack with a carefully chosen set of return addresses,
at both the hardware and software levels. One result of this work is
shadow stacks, which can detect corruption of the call stack, allowing the
operating system to react accordingly. The 64-bit Arm implementation of
shadow stacks is called “guarded control stack” (GCS); patches implementing
support for this feature are currently under discussion.