All posts by jzb

Security updates for Thursday

Post Syndicated from jzb original https://lwn.net/Articles/1066972/

Security updates have been issued by Debian (firefox-esr, postgresql-13, and tiff), Fedora (bind, bind-dyndb-ldap, cef, opensc, python-biopython, python-pydicom, and roundcubemail), Slackware (mozilla), SUSE (ckermit, cockpit-repos, dnsdist, expat, freerdp, git-cliff, gnutls, heroic-games-launcher, libeverest, openssl-1_1, openssl-3, polkit, python-poetry, python-requests, python311-social-auth-app-django, and SDL2_image-devel), and Ubuntu (dogtag-pki, gdk-pixbuf, linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gke,
linux-gkeop, linux-ibm, linux-ibm-5.15, linux-intel-iotg,
linux-intel-iotg-5.15, linux-kvm, linux-lowlatency,
linux-lowlatency-hwe-5.15, linux-nvidia, linux-nvidia-tegra,
linux-nvidia-tegra-igx, linux-oracle, linux-oracle-5.15, linux-raspi,
linux-xilinx-zynqmp, linux-aws-6.8, linux-gcp-6.8, linux-hwe-6.8, linux-ibm-6.8,
linux-lowlatency-hwe-6.8, linux-fips, linux-aws-fips, linux-gcp-fips, linux-oracle, linux-oracle-6.17, linux-raspi, linux-realtime, openssl, and squid).

[$] Ripping CDs and converting audio with fre:ac

Post Syndicated from jzb original https://lwn.net/Articles/1062141/

It has been a little while since LWN last surveyed tools for managing a digital
music collection. In the intervening decades, many Linux users have moved on to
music streaming services, found them wanting, and are looking to curate their own
collection once again. There are plenty of choices when it comes to
ripping, managing, and playing digital audio; so many, in fact, that it can be a
bit daunting. After years of tinkering, I’ve found a few tools that work well for
managing my digital library: the first I’d like to cover is the fre:ac free audio encoder for ripping music from
CDs and converting between audio formats.

Nix privilege escalation security advisory

Post Syndicated from jzb original https://lwn.net/Articles/1066813/

The NixOS project has announced
a critical vulnerability in many versions of the Nix package
manager’s daemon. The flaw was introduced as part of a fix for a
prior vulnerability in 2024. According to the advisory,
all default configurations of NixOS and systems building untrusted derivations
are impacted.

A bug in the fix for CVE-2024-27297
allowed for arbitrary overwrites of files writable by the Nix process
orchestrating the builds (typically the Nix daemon running as root in
multi-user installations) by following symlinks during fixed-output
derivation output registration. This affects sandboxed Linux builds –
sandboxed macOS builds are unaffected. The location of the temporary
output used for the output copy was located inside the build chroot. A
symlink, pointing to an arbitrary location in the filesystem, could be
created by the derivation builder at that path. During output
registration, the Nix process (running in the host mount namespace)
would follow that symlink and overwrite the destination with the
derivation’s output contents.

In multi-user installations, this allows all users able to submit
builds to the Nix daemon (allowed-users – defaulting to all users) to
gain root privileges by modifying sensitive files.

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/1066809/

Security updates have been issued by Debian (openssl), Fedora (corosync, goose, kea, pspp, and rauc), Mageia (python-pygments, roundcubemail, and tigervnc), SUSE (bind, gimp, google-cloud-sap-agent, govulncheck-vulndb, ignition, ImageMagick, python, python-PyJWT, and python-pyOpenSSL), and Ubuntu (adsys, juju-core, lxd, python-django, and salt).

Security updates for Tuesday

Post Syndicated from jzb original https://lwn.net/Articles/1066665/

Security updates have been issued by AlmaLinux (crun, kernel, and kernel-rt), Debian (dovecot), Fedora (calibre and nextcloud), Mageia (freerdp, polkit-122, python-nltk, python-pyasn1, vim, and xz), Red Hat (edk2 and openssl), SUSE (avahi, cockpit, python-pyOpenSSL, python311, and tar), and Ubuntu (lambdaisland-uri-clojure, linux-gcp, linux-gcp-4.15, linux-gcp-fips, linux-oem-6.17, and linux-realtime-6.17).

Introducing the FreeBSD laptop integration testing project

Post Syndicated from jzb original https://lwn.net/Articles/1066593/

Recently, the FreeBSD Foundation has been making
progress on improving the operating system’s support for modern
laptop hardware. The foundation is now looking to expand testing to
encompass a wider range of hardware; it has announced
a laptop integration testing project to allow the community to easily
test FreeBSD’s compatibility with laptops and submit the results.

With limited access to testing systems, there’s only so much we can
do! We hope to work together with volunteers from the community who
want FreeBSD to work well on their laptops.

While we expect device hardware and software enumeration to be a
fully automated process, we feel that manually-submitted comments
about personal experience with FreeBSD are equally valuable. We plan
to highlight this commentary on our “matrix of compatibility” webpage
for each tested laptop.

We are striving to make it as easy as possible to submit your
results. You won’t have to worry about environment setup, submission
formatting, or any repo-specific details!

See the project
repository and testing
instructions for more.

Security updates for Monday

Post Syndicated from jzb original https://lwn.net/Articles/1066505/

Security updates have been issued by AlmaLinux (freerdp, grafana, grafana-pcp, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free, kernel, libpng12, libpng15, perl-YAML-Syck, python3, and rsync), Debian (dovecot, libxml-parser-perl, pyasn1, python-tornado, roundcube, tor, trafficserver, and valkey), Fedora (bind9-next, chromium, cmake, domoticz, freerdp, giflib, gst-devtools, gst-editing-services, gstreamer1, gstreamer1-doc, gstreamer1-plugin-libav, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-rtsp-server, gstreamer1-vaapi, libgsasl, libinput, libopenmpt, mapserver, mingw-binutils, mingw-gstreamer1, mingw-gstreamer1-plugins-bad-free, mingw-gstreamer1-plugins-base, mingw-gstreamer1-plugins-good, mingw-libpng, mingw-python3, nginx-mod-modsecurity, openbao, python-gstreamer1, python3.12, python3.13, python3.14, python3.9, rust, rust-sccache, tcpflow, and vim), Red Hat (ncurses), Slackware (infozip and krita), SUSE (chromium, corosync, keybase-client, libinput-devel, osslsigncode, python-pillow, python311-Flask-Cors, python313, and python314), and Ubuntu (libarchive and spip).

[$] Ubuntu’s GRUBby plans

Post Syndicated from jzb original https://lwn.net/Articles/1065420/

GNU GRUB 2, mostly just
referred to as GRUB these days, is the most widely used boot loader
for x86_64 Linux systems. It supports reading
from a vast selection of filesystems, handles booting modern systems
with UEFI or legacy systems with a BIOS, and even allows users to customize the
“splash” image displayed when a system boots. Alas, all of those features come with
a price; GRUB has had a parade
of security vulnerabilities over the years. To mitigate some of those
problems, Ubuntu
core developer and Canonical employee Julian Andres Klode has proposed removing
a number of features from GRUB in Ubuntu 26.10 to improve GRUB’s
security profile. His proposal has not been met with universal acclaim; many of the
features Klode would like to remove have vocal proponents.

No kidding: Gentoo GNU/Hurd

Post Syndicated from jzb original https://lwn.net/Articles/1066241/

On April 1, the Gentoo Linux project published a blog post
announcing that it was switching to GNU Hurd as its primary
kernel as an April Fool’s joke. While that is not true, the project
has followed up with an announcement
of a new Gentoo port to the Hurd:

Our crack team has been working hard to port Gentoo to the Hurd and
can now share that they’ve succeeded, though it remains still in a
heavily experimental stage. You can try Gentoo GNU/Hurd using a
pre-prepared disk image. The easiest way to do this is with QEMU
[…]

We have developed scripts to build this image locally and
conveniently work on further development of the Hurd port. Release
media like stages and automated image builds are future goals, as is
feature parity on x86-64. Further contributions are welcome,
encouraged, and needed. Be patient, expect to get your hands dirty,
anticipate breakage, and have fun!

Oh, and Gentoo GNU/Hurd also works on real hardware!

Text for the April Fool’s post is available at the bottom of the
real announcement.

Security updates for Friday

Post Syndicated from jzb original https://lwn.net/Articles/1066236/

Security updates have been issued by AlmaLinux (freerdp, grafana, kernel, rsync, and thunderbird), Debian (chromium, inetutils, and libpng1.6), Fedora (bind9-next, nginx-mod-modsecurity, and openbao), Mageia (firefox, nss and thunderbird), Red Hat (container-tools:rhel8), SUSE (conftest, dnsdist, ignition, libsoup, libsoup2, LibVNCServer, libXvnc-devel, opensc, ovmf-202602, perl-Crypt-URandom, python-tornado, python311-ecdsa, python311-Pygments, python315, tar, and wireshark), and Ubuntu (cairo, jpeg-xl, linux, linux-aws, linux-aws-6.17, linux-gcp, linux-gcp-6.17,
linux-hwe-6.17, linux-realtime, linux, linux-aws, linux-aws-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-gcp, linux-gke, linux-gkeop, linux-ibm,
linux-lowlatency, linux-nvidia, linux-raspi, linux-fips, linux-fips, linux-aws-fips, linux-fips, linux-aws-fips, linux-gcp-fips, and linux-realtime, linux-realtime-6.8, linux-raspi-realtime).

SFC: What the FCC router ban means for FOSS

Post Syndicated from jzb original https://lwn.net/Articles/1066162/

Denver Gingerich of the Software Freedom Conservancy (SFC) has published
an article
on the impact of the ban on
the sale of all new home routers not made in the United States
issued by the Federal Communications Commission (FCC). The SFC, of
course, is the organization
behind the OpenWrt One router.

Since software updates to already-FCC-approved devices do not
require a new FCC approval, it appears the FCC is trying to move
beyond its usual authorization procedures to restrict what
manufacturers are allowed to push to existing routers. However, the
FCC notably does not restrict software changes made by owners of
routers in the U.S. In particular, there is no indication that updates
people make to their own routers, using software they have sourced
themselves, would run afoul of any past or present FCC rule.

As a result, we do not believe that this new FCC decision affects
whether and how people can run OpenWrt or other user-selected firmware
updates on routers they have already purchased. Not only is this an
important right in relation to our ownership and control of our own
devices, it also ensures that people can keep their routers secure for
far longer than the manufacturer may choose to provide security
updates, by allowing them to install up-to-date community software
that supports routers for 10, 15, or even more years after their
initial release date, as OpenWrt does for many devices.

He also notes that, as the OpenWrt One is already FCC-approved,
there should be no impact on its availability in the US. The SFC has
asked the FCC for clarification and plans to provide updates when they
receive a reply.

OpenSSH 10.3 released

Post Syndicated from jzb original https://lwn.net/Articles/1065991/

OpenSSH 10.3
has been released. Among the many changes in this release are a
security fix to address late validation of metacharacters in user
names, removal of bug compatibility for SSH implementations that do
not support rekeying,
and a fix to ensure that scp clears setuid/setgid bits from downloaded
files when operating as root in legacy (-O) mode. See the
release announcement for a full list of new features, bug fixes, and
potentially incompatible changes.

Security updates for Thursday

Post Syndicated from jzb original https://lwn.net/Articles/1066084/

Security updates have been issued by AlmaLinux (python3.11, python3.12, squid, and thunderbird), Debian (gst-plugins-bad1.0 and gst-plugins-ugly1.0), Fedora (bpfman, crun, gnome-remote-desktop, polkit, python3.14, rust-rustls-webpki, rust-sccache, rust-scx_layered, rust-scx_rustland, rust-scx_rusty, and scap-security-guide), Oracle (freerdp, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free, kernel, libxslt, python3.11, python3.12, squid, and thunderbird), SUSE (389-ds, busybox, chromium, cosign, curl, docker-compose, exiv2, expat, firefox, freerdp, freerdp2, gstreamer-plugins-ugly, harfbuzz, heroic-games-launcher, ImageMagick, kea, keylime, libjxl, librsvg, libsodium, libsoup, net-snmp, net-tools, netty, nghttp2, poppler, postgresql13, postgresql16, postgresql17, postgresql18, protobuf, python-black, python-orjson, python-pyasn1, python-pyOpenSSL, python-tornado, python-tornado6, python311-nltk, thunderbird, tomcat10, tomcat11, vim, and xen), and Ubuntu (kernel, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-raspi, linux-raspi, linux-raspi-realtime, rust-cargo-c, rust-tar, and undertow).

Security updates for Wednesday

Post Syndicated from jzb original https://lwn.net/Articles/1065814/

Security updates have been issued by AlmaLinux (freerdp, libxslt, python3.11, and python3.12), Debian (libpng1.6, lxd, netty, and python-tornado), Fedora (chunkah, cpp-httplib, firefox, freerdp, gst-devtools, gst-editing-services, gstreamer1, gstreamer1-doc, gstreamer1-plugin-libav, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-rtsp-server, gstreamer1-vaapi, insight, python-gstreamer1, python3.14, rust, rust-cargo-rpmstatus, rust-cargo-vendor-filterer, rust-resctl-bench, rust-scx_layered, rust-scx_rustland, rust-scx_rusty, and xen), Mageia (freeipmi, python-openssl, python-ply, ruby-rack, vim, and zlib), Oracle (firefox, freerdp, kernel, libpng, thunderbird, uek-kernel, and virt:ol and virt-devel:ol), Red Hat (golang), SUSE (bind, expat, fetchmail, ffmpeg-7, freerdp, gsl, incus, kernel, libjavamapscript, libjxl, libpng16-16, libpolkit-agent-1-0-127, net-snmp, net-tools, openexr, perl-XML-Parser, python-ldap, python-pyasn1, python-PyJWT, python311-requests, tailscale, thunderbird, tinyproxy, and ucode-intel), and Ubuntu (golang-golang-x-net-dev and ruby2.3, ruby2.5, ruby2.7, ruby3.0, ruby3.2, ruby3.3).

[$] Objections to systemd age-attestation changes go overboard

Post Syndicated from jzb original https://lwn.net/Articles/1064706/

In early March, Dylan M. Taylor submitted a pull request to add a field
to store a user’s birth date in systemd’s JSON user records. This was done to allow
applications to store the date to facilitate compliance with age-attestation and
-verification laws. It was to be expected that some members of the community would
object; the actual response, however, has been shockingly hostile. Some of this has
been fueled by a misinformation campaign that has targeted the systemd project and
Taylor specifically, resulting in Taylor being doxxed and receiving death
threats. Such behavior is not just problematic; it is also deeply misguided given the
actual nature of the changes.