Linux Weekly News
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Frissült: 10 perc 30 másodperc
Debian has updated mysql-5.5 (multiple unspecified vulnerabilities).
Debian-LTS has updated libphp-swiftmailer (code execution).
Red Hat has updated java-1.8.0-openjdk (RHEL7&6: MV), openstack-cinder (OSP6.0 for RHEL7; OSP5.0 for RHEL7; OSP5.0 for RHEL6: denial of service from 2015), and python-XStatic-jquery-ui (OSP7.0 for RHEL7: cross-site scripting).
SUSE has updated gstreamer-0_10-plugins-good (SLE12SP2: MV).
Daniel Vetter has posted the text of his linux.conf.au talk on kernel maintenance. "At least for me, review isn’t just about ensuring good code quality, but also about diffusing knowledge and improving understanding. At first there’s maybe one person, the author (and that’s not a given), understanding the code. After good review there should be at least two people who fully understand it, including corner cases. And that’s also why I think that group maintainership is the only way to run any project with more than one regular contributor."
On his blog, Alexander Larsson begins a description of flatpak security. "Long story short, flatpak uses bubblewrap to create a filesystem namespace for the sandbox. This starts out with a tmpfs as the root filesystem, and in this we bind-mount read-only copies of the runtime on /usr and the application data on /app. Then we mount various system things like a minimal /dev, our own instance of /proc and symlinks into /usr from /lib and /bin. We also enable all the available namespaces so that the sandbox cannot see other processes/users or access the network. On top of this we use seccomp to filter out syscalls that are risky. For instance ptrace, perf, and recursive use of namespaces, as well as weird network families like DECnet. In order for the application to be able to write data anywhere we bind mount $HOME/.var/app/$APPID/ into the sandbox, but this is the only persistent writable location."
CentOS has updated kernel (C7: three vulnerabilities).
Debian has updated mapserver (code execution).
Slackware has updated mariadb (multiple unspecified vulnerabilities).
Ubuntu has updated mysql-5.5, mysql-5.7 (multiple unspecified vulnerabilities).
The LWN.net Weekly Edition for January 19, 2017 is available.
Nobody starts a free-software project hoping that it will fail, so it is a rare project indeed that plans for its eventual demise. But not all projects succeed, and a project that doesn't plan for failure risks is doing its users harm. Dan Callahan joined Mozilla to work on the Persona authentication project, and he was there for its recent shutdown. At the 2017 linux.conf.au in Hobart, Tasmania, he used his keynote slot to talk about the lessons that have been learned about designing a project for failure.
Arch Linux has updated webkit2gtk (multiple vulnerabilities).
CentOS has updated qemu-kvm (C7: denial of service).
Debian-LTS has updated icoutils (multiple vulnerabilities).
openSUSE has updated bind (42.2, 42.1; 13.2: three denial of service flaws), libgit2 (13.2: two vulnerabilities), openjpeg2 (13.2: multiple vulnerabilities), pdns (42.2, 42.1, 13.2: multiple vulnerabilities), qemu (42.2: multiple vulnerabilities), and squid (42.2: three vulnerabilities, one from 2014).
Red Hat has updated docker (RHEL7: privilege escalation), docker-latest (RHEL7: privilege escalation), kernel (RHEL7: three vulnerabilities), kernel-rt (RHEL7; RHEMRG2.5: three vulnerabilities), qemu-kvm (RHEL7: denial of service), and runc (RHEL7: privilege escalation).
SUSE has updated kernel (SLE12-SP2: multiple vulnerabilities).
Ubuntu has updated nvidia-graphics-drivers-304 and nvidia-graphics-drivers-340 (denial of service).
The Free Software Foundation has reworked its high-priority project list to reflect its view of computing in 2017. See the changelog for a list of the changes that were made. Among other things, the Gnash flash player has fallen off the list. "Smart phones are the most widely used form of personal computer today. Thus, the need for a fully free phone operating system is crucial to the proliferation of software freedom."
Debian-LTS has updated pdns-recursor (code execution).
Gentoo has updated file (multiple vulnerabilities), libxml2 (multiple vulnerabilities), miniupnpc (denial of service), pidgin (multiple vulnerabilities), vlc (code execution), and xdelta (code execution).
openSUSE has updated ark (42.2, 42.1; SPH for SLE12: code execution), encfs (42.2, 42.1, 13.2: code execution from 2014), gstreamer-0_10-plugins-bad (13.2: code execution), gstreamer-0_10-plugins-base (13.2: code execution), gstreamer-0_10-plugins-good (13.2: multiple vulnerabilities), gstreamer-plugins-bad (42.1; 13.2: three vulnerabilities), gstreamer-plugins-base (42.1; 13.2: code execution), gstreamer-plugins-good (42.1; 13.2: multiple vulnerabilities), icinga (14.2, 14.1: two vulnerabilities), icoutils (42.2; 42.1; 13.2: multiple vulnerabilities), openjpeg2 (42.2: multiple vulnerabilities), pcsc-lite (42.2, 42.1, 13.2: privilege escalation), and python-pycrypto (14.2, 14.1, 13.2: denial of service).
Red Hat has updated kernel (RHEL6.5: code execution).
Keith Packard is the chief architect for The Machine project at HPE; we covered his talk on this project back in 2015. At the 2017 linux.conf.au Kernel Miniconf, Packard focused on one specific aspect of The Machine's hardware and software configuration: how storage is managed and presented to applications. Like much that is being done with this project, its storage architecture is an interesting combination of new ideas and long-established techniques.
Alexandre Prokoudine looks at user-visible changes for the GNU Image Manipulation Program (GIMP) over 2016. Changes include better handling of layers, channels, masks, and paths, remembering defaults across sessions, improved configurability, color management, and more.
Calligra 3.0 has been released. The Calligra Suite includes office, graphics, and project management applications. "We have chosen to cut back on the number of applications. Krita has left us to be independent and although it was emotional it was also done with complete support from both sides. We are saying goodbye to Author, which never differentiated itself from Words. We also removed Brainstorm the purpose of which will be better fitted by a new application (nothing planned from our side). Flow and Stage has gone in this release but we intend to bring them back in the future." The 3.x series updates the applications to use KDE Frameworks 5 and Qt5.
The Linux Test Project test suite stable release for January 2017 is out. There are new test cases, a new shell test library and many tests rewritten to make use of it, and much more. LWN looked at LTP last December.
Debian has updated icoutils (three vulnerabilities), pdns (multiple vulnerabilities), pdns-recursor (denial of service), python-bottle (regression in previous update), and tiff (multiple vulnerabilities).
Debian-LTS has updated botan1.10 (integer overflow), gcc-mozilla (update to GCC 4.8), icedove (multiple vulnerabilities), libx11 (denial of service), otrs2 (code execution), python-bottle (regression in previous update), wireless-regdb (radio regulations updates), and xen (two vulnerabilities).
Fedora has updated bind (F25: three denial of service flaws), bind99 (F25: three denial of service flaws), ca-certificates (F25; F24: certificate update), docker-latest (F25: privilege escalation), gnutls (F24: multiple vulnerabilities), libgit2 (F25: multiple vulnerabilities), and onionshare (F25; F24: file injection).
Gentoo has updated apache (multiple vulnerabilities, one from 2014).
Scientific Linux has updated java-1.6.0-openjdk (SL5,6,7: multiple vulnerabilities).
SUSE has updated qemu (SLE12-SP2: multiple vulnerabilities).
The 4.10-rc4 kernel prepatch is out for testing. "Things are still looking fairly normal, and this is the usual weekly Sunday rc release. We're up to rc4, and people are clearly starting to find the regressions. Good, good."
The 4.9.4 and 4.4.43 stable kernel updates are available; each contains a relatively large set of important fixes.
Google has posted an overview of its infrastructure security. It includes information about low-level details, such as physical security and secure boot, encryption of data at rest as well as communications between services and to users, keeping employee devices and credentials safe, and more. Undoubtedly there are lessons here for many different organizations. "This document gives an overview of how security is designed into Google’s technical infrastructure. This global scale infrastructure is designed to provide security through the entire information processing lifecycle at Google. This infrastructure provides secure deployment of services, secure storage of data with end user privacy safeguards, secure communications between services, secure and private communication with customers over the internet, and safe operation by administrators. Google uses this infrastructure to build its internet services, including both consumer services such as Search, Gmail, and Photos, and enterprise services such as G Suite and Google Cloud Platform."
Wired covers the release of Qbsolv as open-source software (under the Apache License v2) by D-Wave, which is a company that makes quantum computing hardware. Qbsolv is "designed to help developers program D-Wave machines without needing a background in quantum physics". Further:
Qbsolv joins a small but growing pool of tools for would-be quantum computer programmers. Last year Scott Pakin of Los Alamos National Laboratory–and one of Qbsolv’s first users–released another free tool called Qmasm, which also eases the burden of writing code for D-Wave machines by freeing developers from having to worry about addressing the underlying hardware. The goal, Ewald says, is to kickstart a quantum computing software tools ecosystem and foster a community of developers working on quantum computing problems. In recent years, open source software has been the best way to build communities of both independent developers and big corporate contributors.
Of course to actually run the software you create with these tools, you’ll need access to one of the very few existing D-Wave machines. In the meantime, you can download a D-Wave simulator that will let you test the software on your own computer. Obviously this won’t be the same as running it on a piece of hardware that uses real quantum particles, but it’s a start.
Arch Linux has updated ark (code execution), bind (multiple vulnerabilities), docker (privilege escalation), flashplugin (multiple vulnerabilities), irssi (multiple vulnerabilities), lib32-flashplugin (multiple vulnerabilities), and libvncserver (two vulnerabilities).
Debian has updated rabbitmq-server (authentication bypass).
Debian-LTS has updated asterisk (two vulnerabilities, one from 2014).
Oracle has updated java-1.6.0-openjdk (OL7; OL6; OL5: multiple vulnerabilities) kernel 2.6.39 (OL6; OL5:multiple vulnerabilities), kernel 3.8.13 (OL7; OL6: multiple vulnerabilities), and kernel 4.1.12 (OL7; OL6: multiple vulnerabilities).
Red Hat has updated java-1.6.0-openjdk (multiple vulnerabilities).
Scientific Linux has updated kernel (SL6: three vulnerabilities).
Over at Techdirt, Mike Masnick writes about a libel suit filed against the site: "As you may have heard, last week we were sued for $15 million by Shiva Ayyadurai, who claims to have invented email. We have written, at great length, about his claims and our opinion — backed up by detailed and thorough evidence — that email existed long before Ayyadurai created any software. We believe the legal claims in the lawsuit are meritless, and we intend to fight them and to win. There is a larger point here. Defamation claims like this can force independent media companies to capitulate and shut down due to mounting legal costs. Ayyadurai's attorney, Charles Harder, has already shown that this model can lead to exactly that result. His efforts helped put a much larger and much more well-resourced company than Techdirt completely out of business."
HUP napi hírlevél