Címlap » hírolvasó » Források

Linux Weekly News

Tartalom átvétel
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Webcím: http://lwn.net
Frissült: 8 perc 2 másodperc

Kügler: Next means Focus on the Core

p, 2014-02-21 20:27
Sebastian Kügler looks at the "Plasma Next" project on his blog. Plasma is the workspace portion of the KDE environment, and Next is the new version that will be released separately from KDE applications and the underlying libraries. It is based on KDE Frameworks 5 and Qt5; the first stable release is planned for June. "One of my favourite new features that has recently landed is Marco [Martin]'s work on contrast behind translucent dialogs, which hugely improves readability in many cases, and make "the old Plasma" almost look bland in comparison. We've cleaned up quite a lot of workflows, not by making them any different, but by removing visual noise in between. The idea is to polish common elements to feel fresh and like an upgrade to users, but not entirely different. In the UI, known behavioral patterns are kept in place, with more pronounced core functions, and less fuzz around them. We're aiming at keeping all the functionality and adaptability in place. To the user, the migration to Plasma Next should feel like an upgrade, not something completely new, but trusted after a bigger step in its evolution, yet recognizably true to its values."
Kategóriák: Linux

LXC 1.0 released

p, 2014-02-21 17:13
The LXC (Linux Containers) development team has announced the release of LXC 1.0. It comes with lots of new features including fully unprivileged containers, a stable API (with a five-year commitment for security and bug fix updates), official bindings for Python, Lua, Go, and Ruby, support for cloning and snapshotting containers, and more. "LXC 1.0 features a wide variety of improvements to container security, a consistent set of tools, updated documentation and an API with multiple bindings. We are confident that this is the best LXC release yet and that our users will find it reliable and easy to use. A series of blog posts on LXC and LXC 1.0 features is also available: https://www.stgraber.org/2013/12/20/lxc-1-0-blog-post-series"
Kategóriák: Linux

Security advisories for Friday

p, 2014-02-21 16:57

Debian has updated postgresql-8.4 (multiple vulnerabilities) and postgresql-9.1 (multiple vulnerabilities).

Gentoo has updated libtar (code execution).

Mandriva has updated phpmyadmin (cross-site scripting).

Red Hat has updated flash-plugin (multiple vulnerabilities).

SUSE has updated IBM Java 6 (SLE11SP2; SLE10SP3: multiple vulnerabilities).

Kategóriák: Linux

PostgreSQL releases security and bug fix update

p, 2014-02-21 00:12
The PostgreSQL project has released minor versions of all supported series (9.3.3, 9.2.7, 9.1.12, 9.0.16, and 8.4.20) for a number of privilege escalation flaws in the database along with some replication and data integrity fixes. The project also announced a privilege escalation that can occur while running the regression tests using "make check" (which has not been fixed yet). "This update fixes CVE-2014-0060, in which PostgreSQL did not properly enforce the WITH ADMIN OPTION permission for ROLE management. Before this fix, any member of a ROLE was able to grant others access to the same ROLE regardless if the member was given the WITH ADMIN OPTION permission. It also fixes multiple privilege escalation issues, including: CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064, CVE-2014-0065, and CVE-2014-0066." More information is available on the release-specific wiki page and on the general security page. "All users are urged to update their installations at the earliest opportunity, especially those using binary replication or running a high-security application."
Kategóriák: Linux

Ruby community mourns Jim Weirich

cs, 2014-02-20 23:45
The Ruby community is mourning the passing of Jim Weirich, who was a well-known Rubyist and the creator of Rake (Ruby make). A thread on Hacker News has some remembrances of Weirich, as does his last commit on GitHub (fittingly, it was a change to a Rakefile).
Kategóriák: Linux

Stable kernels 3.13.4, 3.12.12, 3.10.31, and 3.4.81

cs, 2014-02-20 22:37
Greg Kroah-Hartman has announced the release of a new batch of stable kernels: 3.13.4, 3.12.12, 3.10.31, and 3.4.81. Each contains fixes throughout the tree and users of those series should upgrade.
Kategóriák: Linux

Peres: Wayland Compositors - Why and How to Handle Privileged Clients!

cs, 2014-02-20 21:32
On his blog, Martin Peres has a lengthy discourse on security in Wayland, which is targeted at replacing X some day. He looks at security properties, the current state of security in Wayland, and has recommendations for Wayland compositor authors on handling privileged clients. "While I think the user-intent method has a higher security than static privilege assignation, I think both should be implemented with the latter used as a way for users to specify they are OK with potentially reducing the security of the desktop environment to let the application he/she wants to run properly. This will lower users’ dissatisfaction and should result in a better security than bypassing some security properties for all applications. I am however worried that some stupid applications may be OK with creating snapshot capabilities from the command line, without requiring the user’s input. A packager would then grant the privileges to this application by default and thus, the mere fact of having this application installed will make your desktop non-confidential anymore." (Thanks to Patrick Guignot.)
Kategóriák: Linux

LPC 2014 Call for Microconference Proposals

cs, 2014-02-20 20:25
The Linux Plumbers Conference has put out its "Call for Microconference Proposals" for the 2014 edition of the conference. It will be held in Düsseldorf, Germany on October 15-17, co-located with LinuxCon Europe. "A microconference is a collection of collaborative sessions focused on problems in a particular area of the Linux plumbing, which includes the kernel, libraries, utilities, UI, and so forth, but can also focus on cross-cutting concerns such as security, scaling, energy efficiency, and so forth. Good microconferences result in solutions to these problems and concerns, while the very best microconferences of course result in patches that implement those solutions. Topics that require significant slideware are probably better candidates for the refereed track than for a microconference." More information can be found on the LPC Participate page. The call for refereed-track proposals went out on January 29.
Kategóriák: Linux

systemd 209

cs, 2014-02-20 18:42
Lennart Poettering has announced the release of systemd 209. In the roughly five months since 208, systemd has seen a lot of changes including support for kdbus (albeit with an unstable API for now). Two new tools, systemd-networkd and systemd-socket-proxyd, have been added. Several libraries have been combined into a single libsystemd to reduce code duplication. Lots more changes are listed in the announcement. Unlike earlier releases, it is not yet available for Fedora Rawhide due to an ARM build problem. "This is a massive new release, it includes a lot of new code. You probably don't want to base your LTS release on this. We hope to return to a shorter release cycle now to stabilize the new code. Expect a couple of bugfix releases over the next weeks."
Kategóriák: Linux

Thursday's security updates

cs, 2014-02-20 17:51

CentOS has updated mysql55-mysql (C6: multiple vulnerabilities).

Fedora has updated chrony (F19: distributed denial of service via amplification).

Gentoo has updated mc (code execution from 2012).

Mageia has updated puppet & puppet3 (M3: insecure tmp file use) and python & python3 (multiple vulnerabilities).

Mandriva has updated libtar (file overwrite) and zarafa (BS1.0: denial of service).

Red Hat has updated mariadb55-mariadb (RHEL6: multiple vulnerabilities).

Slackware has updated gnutls (certificate verification error), kernel (privilege escalation), and mariadb (code execution).

SUSE has updated firefox (SLE11SP2, SLE11SP1: multiple vulnerabilities).

Ubuntu has updated thunderbird (13.10, 12.10, 12.04:) and firefox (13.10, 12.10, 12.04: regression from previous security fix).

Kategóriák: Linux

[$] LWN.net Weekly Edition for February 20, 2014

cs, 2014-02-20 03:36
The LWN.net Weekly Edition for February 20, 2014 is available.
Kategóriák: Linux

Security advisories for Wednesday

sze, 2014-02-19 19:28

CentOS has updated mysql55-mysql (C5: multiple vulnerabilities) and openswan (C6; C5: denial of service).

Debian has updated libtar (directory traversal).

Mandriva has updated gnutls (certificate verification error), python (code execution), and tomcat6 (multiple vulnerabilities).

openSUSE has updated poppler (11.4: multiple vulnerabilities).

Oracle has updated mysql55-mysql (OL5: multiple vulnerabilities) and openswan (OL6; OL5: denial of service).

Red Hat has updated mysql55-mysql (RHEL5: multiple vulnerabilities) and openswan (RHEL5&6: denial of service).

Scientific Linux has updated mysql55-mysql (SL5: multiple vulnerabilities) and openswan (SL5&6: denial of service).

Ubuntu has updated EC2 kernel (10.04 LTS: multiple vulnerabilities), kernel (10.04 LTS; 12.04 LTS; 12.10; 13.10: multiple vulnerabilities), linux-lts-quantal (12.04 LTS: multiple vulnerabilities), linux-lts-raring (12.04 LTS: multiple vulnerabilities), linux-lts-saucy (12.04 LTS: multiple vulnerabilities), and linux-ti-omap4 (12.04 LTS; 12.10; 13.10: multiple vulnerabilities).

Kategóriák: Linux

[$] C11 atomic variables and the kernel

sze, 2014-02-19 00:18
The C11 standard added a number of new features for the C and C++ languages. One of those features — built-in atomic types — seems like it would naturally be of interest to the kernel development community; for the first time, the language standard tries to address concurrent access to data on contemporary hardware. But, as recent discussions show, it may be a while before C11 atomics are ready for use with the kernel — if they ever are — and the kernel community may not feel any great need to switch.

Click below (subscribers only) for the full article from this week's Kernel Page.

Kategóriák: Linux

Tuesday's security updates

k, 2014-02-18 19:17

Fedora has updated apache-commons-fileupload (F20; F19: denial of service), gnutls (F20: certificate verification error), and kernel (F20; F19: multiple vulnerabilities).

Gentoo has updated xpdf (multiple vulnerabilities from 2009 and 2010).

Mageia has updated mongodb (MG3: denial of service) and tomcat6 (MG3: multiple vulnerabilities).

Mandriva has updated ffmpeg (multiple unspecified vulnerabilities), kernel (multiple vulnerabilities), libgadu (buffer overflow), puppet (insecure temporary files), and varnish (denial of service).

openSUSE has updated chromium (13.1, 12.3: multiple vulnerabilities), kernel (11.4: multiple vulnerabilities), and xtrabackup (13.1: poor encryption).

SUSE has updated firefox (multiple vulnerabilities) and IBM Java (multiple vulnerabilities).

Kategóriák: Linux

grep-2.17 released

k, 2014-02-18 16:44
Version 2.17 of the GNU grep utility is out. "This release is notable for its performance improvements: we don't often see a 10x speed-up in a tool like grep." Other changes include the removal of the long-deprecated --mmap option.
Kategóriák: Linux

Security advisories for Monday

h, 2014-02-17 20:58

Debian has updated chromium-browser (multiple vulnerabilities) and file (denial of service).

Fedora has updated curl (F19: information disclosure), imapsync (F19: TLS botch), numpy (F20: insecure temp files), python3 (F20: code execution), xen (F19; F20: multiple vulnerabilities), and zarafa (F19; F20: denial of service).

Mageia has updated cxxtols (MG4: denial of service), denyhosts (MG3: denial of service), gnutls (certificate verification error), libgadu (buffer overflow), libpng (MG3: denial of service), libpng12 (MG4: denial of service), maradns (MG3; MG4: denial of service), pacemaker (MG3: denial of service), rawtherapee (denial of service), socat (denial of service), tntnet (information leak), and xbmc (denial of service).

Mandriva has updated drupal (multiple vulnerabilities), flite (insecure temporary files), libpng (denial of service), socat (denial of service), and yaml (code execution).

openSUSE has updated pidgin, (13.1, 12.3: multiple vulnerabilities).

Kategóriák: Linux

Kernel prepatch 3.14-rc3

h, 2014-02-17 00:06
Linus has released 3.14-rc3, and he's on the verge of getting grumpy. "When I made the rc2 announcement, I mentioned how nice and small it was. I also mentioned that I mistrusted you guys, and that I suspected that some people were giggling to themselves and holding back their pull requests, evil little creatures like you are. And I hate being right." One assumes that the subsystem maintainers, having been warned, will be careful about what they send for the rest of the development cycle.
Kategóriák: Linux

Ubuntu Community Council statement on Canonical package licensing

szo, 2014-02-15 01:31
The Ubuntu Community Council has issued a statement regarding Canonical's requirement that binary redistributors (such as Linux Mint) obtain a license from Canonical. "We believe there is no ill-will against Linux Mint, from either the Ubuntu community or Canonical and that Canonical does not intend to prevent them from continuing their work, and that this license is to help ensure that. What Linux Mint does is appreciated, and we want to see them succeed." There is no real discussion on what is being licensed; it would appear to be a fairly mundane trademark issue stemming from the fact that Linux Mint distributes binary packages taken directly from the Ubuntu repository.
Kategóriák: Linux

Chinese software pioneer Red Flag bites the dust (South China Morning Post)

szo, 2014-02-15 01:29
The South China Morning Post is reporting the demise of Red Flag, which is a government-backed Linux distribution by and for the Chinese people. "China’s best hope for a home-grown computer operating system to take on global giants like Microsoft lay in tatters after state-backed Red Flag Software was forced to close its doors for business. Founded in 2000 during the dot-com boom, Red Flag was once the world’s second-largest Linux distributor, providing desktop and server software built on top of the free and open-source Linux program. Despite its lofty goals and early success, Beijing-based Red Flag has gone out of business and terminated all its employment contracts on Monday, according to a report on the Sina news portal on Thursday."
Kategóriák: Linux

How OpenStack parallels the adoption of Linux (opensource.com)

szo, 2014-02-15 01:24
Over at opensource.com, Red Hat's cloud evangelist Gordon Haff looks at the adoption of OpenStack through the lens of the adoption of Linux (and surrounding projects). "Early Linux success didn’t come about because it was better technology than Unix. For the most part it wasn’t. Rather it often won because it was less expensive than proprietary Unix running on proprietary hardware. It also gave users a choice of both distributions and hardware vendors as well as the ability to customize the code should they so choose. However, what has truly distinguished Linux and open source broadly over time is the power of the open source development models and the innovation that comes from communities around projects."
Kategóriák: Linux
« első‹ előző…5678910111213…következő ›utolsó »