Post Syndicated from daroc original https://lwn.net/Articles/980430/

The

PSP security protocol (PSP) is a way to transparently encrypt packets by
efficiently offloading encryption and decryption to the network
interface cards (NICs) that Google uses for connections inside its data centers. The
protocol is similar to

IPsec, in that it allows for wrapping arbitrary traffic
in a layer of encryption. The difference is that PSP is encapsulated in UDP, and
designed from the beginning to reduce the amount of state that NICs
have to track in order to send and receive encrypted traffic, allowing for more
simultaneous connections. Jakub Kicinski

wants to add support for the protocol to the Linux kernel.

Post Syndicated from daroc original https://lwn.net/Articles/979870/

ISO releases new C++
language standards on a three-year cadence; now that it’s been
more than a year since the finalization of
C++23, we have a good idea of what

features could be adopted for
C++26 — although proposals can
still be submitted until January 2025. Of particular interest is the addition of
support for

hazard pointers and

user-space read-copy-update (RCU).
Even though C++26 is not yet a standard, many of the proposed features are already
available to experiment with in GCC or Clang.

Post Syndicated from daroc original https://lwn.net/Articles/980856/

Greg Kroah-Hartman has announced the release of seven more stable kernels.
Versions 6.9.8,
6.9.37,
6.1.97,
5.15.162,
5.10.221,
5.4.279,
and 4.19.317 are now available.

Post Syndicated from daroc original https://lwn.net/Articles/980855/

Security updates have been issued by Fedora (cockpit, python-astropy, python3-docs, and python3.12), Gentoo (BusyBox, GNU Coreutils, GraphicsMagick, podman, PuTTY, Sofia-SIP, TigerVNC, and WebKitGTK+), Mageia (chromium-browser-stable and openvpn), SUSE (cockpit, krb5, and netatalk), and Ubuntu (kopanocore, libreoffice, linux-aws, linux-oem-6.8, linux-aws-5.15, linux-azure, linux-azure-4.15, linux-lowlatency, linux-lowlatency-hwe-6.5, linux-oracle, linux-starfive-6.5, and virtuoso-opensource).

Post Syndicated from daroc original https://lwn.net/Articles/979747/

On May 7, Kees Cook sent

a proposal to the linux-kernel mailing list, asking for the kernel
developers to start
working on a way to mitigate unintentional arithmetic overflow, which has been a
source of many bugs. This is not the first time Cook has made a request along
these lines; he sent a related patch set in
January 2024.
Several core developers objected to the plan for different
reasons. After receiving their feedback,
Cook modified his approach to tackle the problem
in a series of smaller steps.

Post Syndicated from daroc original https://lwn.net/Articles/980003/

The Free Software Foundation Europe has

submitted a joint position to the European Commission (EC), claiming that Apple
has failed to comply with the EU’s Digital Markets Act (DMA). This is the law
that requires Apple to support alternative application stores on the devices it
makes.

Apple’s unfair behaviour against Free Software highlights the critical need to
monitor the implementation of the DMA. The FSFE collaborated with F-Droid, the
AppFair project, and other interoperability experts to scrutinize Apple’s DMA
compliance, and it’s impact on Free Software. Since then, we coordinated several
expert workshops with stakeholders,

discussed with regulators in FOSDEM, had

official meetings with the EC’s DMA team, and submitted a

comprehensive position
to the EC detailing several problematic elements in the Apple compliance that
will harm the Free Software.

Post Syndicated from daroc original https://lwn.net/Articles/979524/

With the

Rust-for-Linux project starting to gain some ground, it is worth
looking at other operating systems that use Rust in their kernels. There
are
many attempts to use
Rust for operating system development, but Redox
may be the most complete.
Redox is an MIT-licensed microkernel and corresponding user space, designed
around concepts taken from

Plan 9. While nowhere near being usable as a
replacement for Linux, it already provides a graphical user interface and

the ability to run many POSIX programs.

Post Syndicated from daroc original https://lwn.net/Articles/979999/

Security updates have been issued by AlmaLinux (pki-core), Debian (dlt-daemon and plasma-workspace), Fedora (emacs and kernel), Mageia (erofs-utils, libheif, libopenmpt, and wget), Red Hat (pki-core and python3), SUSE (frr), and Ubuntu (fontforge, sqlite3, and squid3).

Post Syndicated from daroc original https://lwn.net/Articles/978955/

Unison is a
MIT-licensed programming language, in development since 2013, that
explores the ramifications of making code immutable and stored in a database,
instead of a set of text files.
Unison supports a greatly simplified model for distributed
programming — one that describes the configuration of and communication between
programs in the same language as the programs themselves. Along the way, it
introduces a new approach to interfacing with programming languages, which is tailored to
its design.

Post Syndicated from daroc original https://lwn.net/Articles/979259/

The
6.9.6,
6.6.35,
6.1.95, and
5.10.220
stable kernels have all been released; as usual, users are advised to update
immediately.

Post Syndicated from daroc original https://lwn.net/Articles/979257/

Security updates have been issued by AlmaLinux (firefox, ghostscript, idm:DL1, and thunderbird), Debian (php8.2 and putty), Mageia (chromium-browser-stable), Oracle (ghostscript and thunderbird), Red Hat (thunderbird), and SUSE (containerd, kernel, php-composer2, podofo, python-cryptography, and rmt-server).

Post Syndicated from daroc original https://lwn.net/Articles/978727/

Arnaldo Carvalho de Melo spoke at the 2024
Linux Storage,
Filesystem, Memory Management, and BPF Summit
about his work on

Poke-a-hole (pahole),
a program that has expanded greatly over the years, but which was relevant to the
BPF track because it produces BPF Type Format (BTF) information from DWARF
debugging information. He covered some small changes to the program, and then
went into detail about the new support for data-type profiling. His
slides include
several examples.

Post Syndicated from daroc original https://lwn.net/Articles/978736/

Andrii Nakryiko led a session at
the 2024
Linux Storage,
Filesystem, Memory Management, and BPF Summit giving
a look into the APIs for capturing stack traces
using BPF, and how the APIs could be made more useful. BPF programs can capture the
current stack trace of a running process, including the portion in the kernel
during execution of a system call, which can be useful for diagnosing
performance problems, among other things. But there are substantial problems with
the existing API.

Post Syndicated from daroc original https://lwn.net/Articles/978335/

On the final day of the 2024
Linux Storage,
Filesystem, Memory Management, and BPF Summit, the BPF track
opened with a series of sessions on improving the performance and
flexibility of probes and other performance-monitoring tools, in the kernel and in
user space. Jiri Olsa led two sessions about different aspects of probes:
making the API for BPF programs attached to a probe more flexible, and making
user-space probes more efficient.

Post Syndicated from daroc original https://lwn.net/Articles/977993/

The kernel has a lot of code paths that are normally disabled: debugging print
statements, tracepoints, etc. To support these efficiently, there
is a common mechanism called

static keys that provides a way to enable or disable a
code path at run time, with effectively no overhead for disabled
branches. BPF programs have not been able to take advantage of static keys so far,
because they aren’t compiled into the kernel.
Now, it looks like BPF may be getting support for a similar mechanism —
and the design could also provide one of the components needed to support

jump tables, another missing feature.
Anton Protopovov presented his plans to add static keys to BPF at the 2024
Linux Storage,
Filesystem, Memory Management, and BPF Summit.

Post Syndicated from daroc original https://lwn.net/Articles/978418/

Security updates have been issued by CentOS (389-ds-base, bind, bind-dyndb-ldap, and dhcp, firefox, glibc, ipa, less, libreoffice, and thunderbird), Debian (cups), Fedora (chromium and cyrus-imapd), Mageia (golang and poppler), Oracle (bind, bind-dyndb-ldap, and dhcp, gvisor-tap-vsock, python-idna, and ruby), Red Hat (dnsmasq and expat), SUSE (libaom, php8, podman, python-pymongo, python-scikit-learn, and tiff), and Ubuntu (h2database and vte2.91).

Post Syndicated from daroc original https://lwn.net/Articles/977815/

The BPF verifier is a complex program. This has the unfortunate effect of making
it simultaneously more difficult for contributors to work on, and more likely
to harbor unknown bugs. Shung-Hsi Yu had two concrete proposals for how to
simplify the verifier to make it easier to maintain that he presented at the 2024
Linux Storage,
Filesystem, Memory Management, and BPF Summit. Yu proposed changing how the
verifier tracks partially known values and cleaning up the interface to
hide the details of the value-tracker’s internal representation.

Post Syndicated from daroc original https://lwn.net/Articles/977394/

BPF is in a unique position in terms of security. It runs in a privileged
context, within the kernel, and can have access to many sensitive details of the
kernel’s operation. At the same time, unlike kernel modules, BPF programs aren’t signed.
Additionally, the mechanisms behind BPF present challenges to implementing
signing or other security features. Three nearly back-to-back sessions at the
2024
Linux Storage,
Filesystem, Memory Management, and BPF Summit
addressed some of the potential security problems.

Post Syndicated from daroc original https://lwn.net/Articles/977583/

According to CrowdStrike, a

vulnerability in the Linux kernel’s nftables code
that was discovered earlier this
year is being actively exploited in the wild. The vulnerability allows for
local privilege escalation. Most distributions have already released a fix.

As noted by the exploit developer, leveraging this POC is dependent on the
kernel’s unprivileged user namespaces feature accessing nf_tables. This access
is enabled by default on Debian, Ubuntu and kernel capture-the-flag (CTF)
distributions. An attacker can then trigger the double-free vulnerability, scan
the physical memory for the kernel base address, bypass kernel address-space
layout randomization (KASLR) and access the modprobe_path kernel variable with
read/write privileges. After overwriting the modprobe_path, the exploit drops a
root shell.

Post Syndicated from daroc original https://lwn.net/Articles/977013/

BPF was first

generalized beyond packet filtering more than a decade ago. In that time, it
has changed a lot, becoming much more capable.
Alexei Starovoitov kicked off the second day of the BPF track at the 2024
Linux Storage,
Filesystem, Memory Management, and BPF Summit by leading a session
discussing which changes to BPF are going to come in the next ten years as it
continues evolving. He proposed several ideas, including expanding the number of
registers available to BPF programs, dynamic deadlock detection, and relaxing
some existing limits of the verifier.