Tag Archives: kernel

[$] Process tagging with ptags

Post Syndicated from corbet original https://lwn.net/Articles/741261/rss

For various reasons related to accounting and security, there is recurring
interest in having the kernel identify the container that holds any given
process. Attempts to implement that functionality tend to run into the
same roadblock, though: the kernel has no concept of what a “container” is,
and there is seemingly little desire to change that state of affairs. A
solution to this problem may exist in the form of a neglected
patch called “ptags”, which enables the attachment of arbitrary tags to
processes.

Security updates for Tuesday

Post Syndicated from ris original https://lwn.net/Articles/741257/rss

Security updates have been issued by Debian (chromium-browser, evince, pdns-recursor, and simplesamlphp), Fedora (ceph, dhcp, erlang, exim, fedora-arm-installer, firefox, libvirt, openssh, pdns-recursor, rubygem-yard, thunderbird, wordpress, and xen), Red Hat (rh-mysql57-mysql), SUSE (kernel), and Ubuntu (openssl).

[$] Toward better CPU load estimation

Post Syndicated from corbet original https://lwn.net/Articles/741171/rss

“Load tracking” refers to the kernel’s attempts to track how much load each
running process will put on the system’s CPUs. Good load tracking can
yield reasonable predictions about the near-future demands on the system;
those, in turn, can be used to optimize the placement of processes and the
selection of CPU-frequency parameters. Obviously, poor load tracking will
lead to less-than-optimal results. While achieving perfection in load tracking
seems unlikely for now, it appears that it is possible to to do better than
current kernels do. The utilization estimation
patch set
from Patrick Bellasi is the latest in a series of efforts to
make the scheduler’s load tracking work well with a wider variety of
workloads.

Security updates for Monday

Post Syndicated from ris original https://lwn.net/Articles/741158/rss

Security updates have been issued by CentOS (postgresql), Debian (firefox-esr, kernel, libxcursor, optipng, thunderbird, wireshark, and xrdp), Fedora (borgbackup, ca-certificates, collectd, couchdb, curl, docker, erlang-jiffy, fedora-arm-installer, firefox, git, linux-firmware, mupdf, openssh, thunderbird, transfig, wildmidi, wireshark, xen, and xrdp), Mageia (firefox and optipng), openSUSE (erlang, libXfont, and OBS toolchain), Oracle (kernel), Slackware (openssl), and SUSE (kernel and OBS toolchain).

Kernel prepatch 4.15-rc3

Post Syndicated from corbet original https://lwn.net/Articles/741066/rss

The 4.15-rc3 kernel prepatch is out.
I’m not thrilled about how big the early 4.15 rc’s are, but rc3 is
often the biggest rc because it’s still fairly early in the
calming-down period, and yet people have had some time to start
finding problems. That said, this rc3 is big even by rc3 standards.
Not good.
” 489 changesets were merged since 4.15-rc2.

Security updates for Friday

Post Syndicated from jake original https://lwn.net/Articles/740997/rss

Security updates have been issued by Arch Linux (chromium and vlc), Debian (erlang), Mageia (ffmpeg, tor, and wireshark), openSUSE (chromium, opensaml, openssh, openvswitch, and php7), Oracle (postgresql), Red Hat (chromium-browser, postgresql, rh-postgresql94-postgresql, rh-postgresql95-postgresql, and rh-postgresql96-postgresql), SUSE (firefox, java-1_6_0-ibm, opensaml, and xen), and Ubuntu (kernel, linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon, linux, linux-raspi2, linux-azure, linux-gcp, linux-hwe, linux-lts-trusty, linux-lts-xenial, linux-aws, and rsync).

[$] Kernel support for HDCP

Post Syndicated from corbet original https://lwn.net/Articles/740916/rss

High-bandwidth
Digital Content Protection
(or HDCP) is an Intel-designed
copy-protection mechanism for video and audio streams. It is a digital
rights management (DRM)
system of the type disliked by many in the Linux community. But does
that antipathy mean that Linux should not support HDCP? That question is
being answered — probably in favor of support — in a conversation underway
on the kernel mailing lists.

Security updates for Thursday

Post Syndicated from jake original https://lwn.net/Articles/740883/rss

Security updates have been issued by CentOS (firefox, java-1.7.0-openjdk, kernel, liblouis, qemu-kvm, sssd, and thunderbird), Debian (heimdal and nova), openSUSE (shibboleth-sp), Oracle (java-1.7.0-openjdk), Red Hat (Red Hat OpenShift Enterprise), Scientific Linux (openafs), SUSE (kernel), and Ubuntu (rsync).

[$] Container IDs for the audit subsystem

Post Syndicated from jake original https://lwn.net/Articles/740621/rss

Linux containers are something of an amorphous beast, at least with
respect to the kernel. There are lots of facilities that the kernel
provides (namespaces, control groups, seccomp, and so on) that can be
composed by user-space tools into containers of various shapes and
colors; the kernel is blissfully unaware of how user space views that
composition. But there is interest in having the kernel be more aware of
containers and for it to be able to distinguish what user space considers
to be a single container. One particular use case for the kernel managing
container identifiers is the audit
subsystem
, which needs unforgeable IDs for containers that can be
associated with
audit trails.

Security updates for Tuesday

Post Syndicated from ris original https://lwn.net/Articles/740721/rss

Security updates have been issued by Debian (libextractor), Fedora (java-9-openjdk, kernel, python, and qt5-qtwebengine), Oracle (sssd and thunderbird), Red Hat (firefox, liblouis, and sssd), Scientific Linux (firefox, liblouis, and sssd), and Ubuntu (libxml2).

[$] Restricting automatic kernel-module loading

Post Syndicated from corbet original https://lwn.net/Articles/740455/rss

The kernel’s module mechanism allows the building of a kernel with a wide
range of hardware and software support without requiring that all of that
code actually be loaded into any given running system. The availability of all of
those modules in a typical distributor kernel means that a lot of features
are available — but also, potentially, a lot of exploitable bugs. There
have been numerous cases where the kernel’s automatic module loader has
been used to bring buggy code into a running system. An attempt to reduce
the kernel’s exposure to buggy modules shows how difficult some kinds of
hardening work can be.

Security updates for Monday

Post Syndicated from ris original https://lwn.net/Articles/740605/rss

Security updates have been issued by Arch Linux (cacti, curl, exim, lib32-curl, lib32-libcurl-compat, lib32-libcurl-gnutls, lib32-libxcursor, libcurl-compat, libcurl-gnutls, libofx, libxcursor, procmail, samba, shadowsocks-libev, and thunderbird), Debian (tor), Fedora (kernel, moodle, mupdf, python-sanic, qbittorrent, qpid-cpp, and rb_libtorrent), Mageia (git, lame, memcached, nagios, perl-Catalyst-Plugin-Static-Simple, php-phpmailer, shadowsocks-libev, and varnish), openSUSE (binutils, libressl, lynx, openssl, tor, wireshark, and xen), Red Hat (thunderbird), Scientific Linux (kernel, qemu-kvm, and thunderbird), SUSE (kernel, ncurses, openvpn-openssl1, and xen), and Ubuntu (curl, evince, and firefox).

Kernel prepatch 4.15-rc2

Post Syndicated from corbet original https://lwn.net/Articles/740516/rss

The second 4.15 kernel prepatch is out for
testing. “One thing I’ll point out is that I’m trying to get some kernel ASLR
leaks plugged, and as part of that we now hash any pointers printed by
‘%p’ by default. That won’t affect a lot of people, but where it is a
debugging problem (rather than leaking interesting kernel pointers),
we will have to fix things up.

[$] A thorough introduction to eBPF

Post Syndicated from corbet original https://lwn.net/Articles/740157/rss

In his linux.conf.au
2017 talk [YouTube]
on the eBPF in-kernel virtual machine, Brendan Gregg
proclaimed that “super powers have finally come to Linux”. Getting
eBPF to that point has been a long road of evolution and design. While
eBPF was originally used for network packet filtering, it turns out
that running user-space code inside a sanity-checking virtual machine
is a powerful tool for kernel developers and production engineers.

Over time, new eBPF users have appeared to take advantage of its
performance and convenience. This article explains how eBPF evolved
how it works, and how it is used in the kernel.

Security updates for Friday

Post Syndicated from jake original https://lwn.net/Articles/740431/rss

Security updates have been issued by Debian (curl, libxml2, optipng, and sox), Fedora (kernel, mediawiki, moodle, nodejs-balanced-match, nodejs-brace-expansion, and python-werkzeug), openSUSE (optipng), Oracle (kernel and qemu-kvm), Red Hat (kernel, kernel-rt, qemu-kvm, and qemu-kvm-rhev), SUSE (kernel), and Ubuntu (thunderbird).

Announcing FreeRTOS Kernel Version 10 (AWS Open Source Blog)

Post Syndicated from jake original https://lwn.net/Articles/740372/rss

Amazon has announced the release of FreeRTOS kernel version 10, with a new license: “FreeRTOS was created in 2003 by Richard Barry. It rapidly became popular, consistently ranking very high in EETimes surveys on embedded operating systems. After 15 years of maintaining this critical piece of software infrastructure with very limited human resources, last year Richard joined Amazon.

Today we are releasing the core open source code as FreeRTOS kernel version 10, now under the MIT license (instead of its previous modified GPLv2 license). Simplified licensing has long been requested by the FreeRTOS community. The specific choice of the MIT license was based on the needs of the embedded systems community: the MIT license is commonly used in open hardware projects, and is generally whitelisted for enterprise use.” While the modified GPLv2 was removed, it was replaced with a slightly modified MIT license that adds: “If you wish to use our Amazon FreeRTOS name, please do so in a
fair use way that does not cause confusion.
” There is concern that change makes it a different license; the Open Source Initiative and Amazon open-source folks are working on clarifying that.