Post Syndicated from daroc original https://lwn.net/Articles/996196/

Security updates have been issued by Debian (exim4) and SUSE (chromium, openssl-1_1, and openssl-3).

Post Syndicated from daroc original https://lwn.net/Articles/995125/

Sparrow Li presented virtually at

RustConf 2024 about the current state of and
future plans for the Rust compiler’s performance. The compiler is relatively slow to compile
large programs, although it has been getting better over time. The next big
performance improvement to come will be parallelizing the compiler’s parsing,
type-checking, and related operations, but even after that, the project has
several avenues left to explore.

Post Syndicated from daroc original https://lwn.net/Articles/995768/

Security updates have been issued by Debian (distro-info-data), Fedora (libtiff), Mageia (firefox and oath-toolkit), Red Hat (krb5), and SUSE (openssl-1_1).

Post Syndicated from daroc original https://lwn.net/Articles/994334/

Currently in Rust, there is no efficient and safe way to turn an array of bytes
into a structure that corresponds to the array. Changing that was the topic of
Jack Wrenn’s talk this year at

RustConf:

“Safety Goggles for Alchemists”. The goal is to be able to “transmute” —
Rust’s name for this kind of conversion — values into arbitrary user-defined
types in a safer way. Wrenn justified the approach that the project has taken to
accomplish this, and spoke about the future work required to stabilize it.

Post Syndicated from daroc original https://lwn.net/Articles/994704/

The Image-Based Linux Summit has by now established itself as a yearly event.
Following on from last year’s edition,
the third edition was held in Berlin on September 24, the
day before

All Systems Go! 2024 (ASG). The purpose of this event is to gather
stakeholders from various engineering groups and hold friendly but lively
discussions around the topic of image-based Linux — that is, Linux distributions
based around immutable images, instead of mutable root filesystems.

Post Syndicated from daroc original https://lwn.net/Articles/994865/

The

Guix project has

disclosed a security vulnerability in the build daemon that the distribution uses to build and install software locally. The vulnerability allows an existing unprivileged user to get access to a

setuid binary, and from there potentially interfere with any other software built or installed on the computer. The project recommends upgrading the guix daemon now, to avoid the issue.

This exploit requires the ability to start a derivation build and the
ability to run arbitrary code with access to the store in the root PID
namespace on the machine the build occurs on. As such, this represents
an increased risk primarily to multi-user systems and systems using
dedicated privilege-separation users for various daemons: without
special sandboxing measures, any process of theirs can take advantage
of this vulnerability.

Post Syndicated from daroc original https://lwn.net/Articles/994703/

Security updates have been issued by AlmaLinux (java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, java-21-openjdk, and webkit2gtk3), Debian (apache2), Red Hat (expat), SUSE (cups-filters, jetty-minimal, OpenIPMI, and python-starlette), and Ubuntu (linux-azure, linux-azure, linux-azure-5.15, linux-azure, linux-azure-5.4, and oath-toolkit).

Post Syndicated from daroc original https://lwn.net/Articles/993785/

Rust, like C, has its own memory model describing how concurrent access to the
same data by multiple threads can behave.
The Linux kernel, however, has its own
ideas. The

Linux kernel memory model (LKMM) is subtly different from both the
standard C memory model and Rust’s model.
At Kangrejos, Boqun Feng gave a presentation about the
need to reconcile the memory models used by Rust and the kernel,
including a few potential avenues for doing so. While
no consensus was reached, it is an area of active discussion.

Post Syndicated from daroc original https://lwn.net/Articles/993484/

Paul McKenney gave a presentation at Kangrejos this year that wasn’t (directly)
related to Rust. Instead, he spoke about the work he has been doing in concert
with many other contributors on improving the handling of subtle concurrency
problems in C++.
Although he cautioned that his talk was only an overview, and not a
substitute for reading the relevant papers, he hoped that the things the C++
community is working on would be of interest to the Rust developers present as
well, and potentially inform future work on the language. McKenney’s talk was,
as is his style, full of subtle examples of weird multithreaded behavior.
Interested readers may wish to refer to

his slides in an attempt to follow along.

Post Syndicated from daroc original https://lwn.net/Articles/993163/

At Kangrejos, Gary Guo wanted to discuss three problems with the way
Rust and C code in the kernel interact: mismatched types, too many type casts,
and the overhead of helper functions. To fix the first two problems, Guo proposed
changing the way the kernel maps C types into Rust types. The last problem was a
bit trickier, but he has a clever workaround for that, based on tricking
the compiler into inlining the helper functions across language boundaries.

Post Syndicated from daroc original https://lwn.net/Articles/993778/

Security updates have been issued by AlmaLinux (.NET 6.0, .NET 8.0, and openssl), Debian (firefox-esr), Fedora (firefox), Mageia (php, quictls, and vim), Red Hat (buildah, container-tools:rhel8, containernetworking-plugins, firefox, podman, skopeo, and tomcat), Slackware (mozilla), SUSE (apache-commons-io, kernel, and xen), and Ubuntu (golang-1.17, libgsf, and linux-aws-6.8, linux-oracle-6.8).

Post Syndicated from daroc original https://lwn.net/Articles/992693/

Bindgen is a widely used tool that automatically generates Rust bindings from C
headers. The

Rust-for-Linux project uses it to create some of
the bindings between Rust code and the rest of the kernel. John Baublitz
presented at Kangrejos about the improvements that he has made to the tool in
order to make the generated bindings easier to use, including improved support
for macros, bitfields, and enums.

Post Syndicated from daroc original https://lwn.net/Articles/993436/

The Julia project has

released version 1.11.0. A separate

blog post covers some of the highlights. The release includes a number of helpful features.

In previous Julia versions, there was no “programmatic way” of knowing if an unexported name was considered part of the public API or not. Instead, the guideline was basically that if it was not in the manual then it was not public which was a bit underwhelming. To remedy that, there is now a public keyword in Julia that can be used to indicate that an unexported name is part of the public API.

Post Syndicated from daroc original https://lwn.net/Articles/992455/

Alice Ryhl has been working to enable

tracepoints — which are widely used
throughout the kernel — to be seamlessly placed in Rust code as well. She spoke
about her approach at Kangrejos. Her

patch set
enables efficient use of static
tracepoints, but supporting dynamic tracepoints will take some additional effort.

Post Syndicated from daroc original https://lwn.net/Articles/993044/

Akamai

released a report pointing out that the

recently-reported CUPS vulnerability
(original disclosure)
could be used to drive distributed denial-of-service (DDoS) attacks as well. Even if an attacker cannot gain remote control over a computer, they can still cause it to fetch a URL of their choice — potentially getting free DDoS amplification.

The Akamai Security Intelligence and Response Team (SIRT) found that more than 198,000 devices are vulnerable to this attack vector and are accessible on the public internet; roughly 34% of those could be used for DDoS abuse (58,000+).

Post Syndicated from daroc original https://lwn.net/Articles/992055/

Rust has a plethora of smart-pointer types, including reference-counted
pointers, which have special support in the compiler to make them
easier to use. The Rust-for-Linux project would like to reap those same benefits
for its smart pointers, which need to be written by hand to conform to
the

Linux kernel
memory model. Xiangfei Ding
presented at Kangrejos about the work to enable custom
smart pointers to function the same as built-in smart pointers.

Post Syndicated from daroc original https://lwn.net/Articles/992977/

The
6.11.2,
6.10.13,
and
6.6.54 stable kernels have been released.
They contain important fixes, and upgrading is, as always, recommended.

Post Syndicated from daroc original https://lwn.net/Articles/992936/

Security updates have been issued by AlmaLinux (firefox, golang, linux-firmware, and thunderbird), Debian (kernel and zabbix), Fedora (firefox, pgadmin4, and php), Mageia (chromium-browser-stable, cjson, hostapd and wpa_supplicant, and openjpeg2), Oracle (firefox, flatpak, and go-toolset:ol8), Red Hat (cups-filters, firefox, grafana, linux-firmware, python3, python3.11, and python3.9), SUSE (expat, firefox, libpcap, and opensc), and Ubuntu (freeradius, imagemagick, and unzip).

Post Syndicated from daroc original https://lwn.net/Articles/991719/

BPF Type Format (BTF),
BPF’s debugging information format, has undergone rapid evolution to match
the evolving needs of BPF programs. José Marchesi spoke at Kangrejos about some
of that work — and how it could impact Rust, specifically. He discussed debug
information, kernel-specific relocations, and the planned changes to kernel
stack unwinding. Each of these will require some amount of work to fully
support in Rust, but preliminary signs look promising.

Post Syndicated from daroc original https://lwn.net/Articles/991399/

Tathagata Roy has been working to make the

Coccinelle tool that is used (among other things)
to automate the refactoring of C code work on Rust
code as well. Roy gave a
presentation at Kangrejos about that work,
including the creative approaches necessary to work with Rust’s more complicated
control flow and syntax.