Linux Weekly News

From Sage Sharp comes the sad news that Marina Zhurakhinskaya, the founder of the Outreach Program for Women (now known as Outreachy), has passed away. "Marina died on Saturday after winning her struggle with cancer for three years. We would like to elevate Marina's message to encourage people to test themselves for genetic markers for breast cancer".

See this Software Freedom Conservancy post for more information her life and work.

At the 2022 Linux Storage, Filesystem, Memory-management and BPF Summit (LSFMM), Amir Goldstein and Miklos Szeredi led a discussion on a new interface for extracting information from kernel objects using the filesystem extended-attributes (xattr) interface. Since Szeredi was not present in Palm Springs, he co-led the session virtually over Zoom audio, which was the only filesystem session with a virtual leader at LSFMM this year. Szeredi's proposal for an interface of that sort had been posted just the day before the session.

The 2022 sambaXP conference was held online at the beginning of June. Videos of the talks given at that event have now been posted on YouTube. Topics covered include Samba in containers, certificate auto-enrollment, symlink races, and more.

For those who would like to know more about how GCC works, David Malcolm has enhanced his GCC for new contributors guide with a section on GCC internals. It includes a good overview of the various GCC passes and the internal representations used to describe a program at various stages.

The userfaultfd() system call allows one thread to handle page faults for another in user space. It has a number of interesting use cases, including the live migration of virtual machines. There are also some less appealing use cases, though, most of which are appreciated by attackers trying to take control of a machine. Attempts have been made over the years to make userfaultfd() less useful as an exploit tool, but this patch set from Axel Rasmussen takes a different approach by circumventing the system call entirely.

The Thunderbird project's announcement of its plans for an Android client contain a bit of a surprise:

To that end, we’re thrilled to announce that today, K-9 Mail officially joins the Thunderbird family. And [K9 maintainer Christian Ketterer] has already joined the full-time Thunderbird staff, bringing along his valuable expertise and experience with mobile platforms.

Ultimately, K-9 Mail will transform into Thunderbird on Android.

That means the name itself will change and adopt Thunderbird branding. Before that happens, we need to reach certain development milestones that will bring K-9 Mail into alignment with Thunderbird’s feature set and visual appearance.

Security updates have been issued by Debian (chromium, containerd, kernel, ntfs-3g, and vlc), Fedora (buildah and logrotate), Red Hat (xz), and SUSE (google-gson, netty3, rubygem-sinatra, and u-boot).

The second 5.19 kernel prepatch is out for testing.

And yes, because I expected the rc2 week to be fairly quiet, I did a system update on my workstation, and as a result I spent a day or two then sorting out most of the fallout from the resulting compiler upgrade to gcc-12. Some of it ended up being a bit heavy-handed, and we'll be tweaking things further. And some of it ends up being an actual compiler misfeature.

Modern language environments make it easy to discover and incorporate externally written libraries into a program. These same mechanisms can also make it easy to inadvertently incorporate security vulnerabilities or overtly malicious code, which is rather less gratifying. The stream of resulting vulnerabilities seems like it will never end, and it afflicts relatively safe languages like Rust just as much as any other language. In an effort to avoid the embarrassment that comes with shipping vulnerabilities (or worse) by way of its dependencies, the Mozilla project has come up with a new supply-chain management tool known as "cargo vet".

Security updates have been issued by Debian (python-bottle), Fedora (grub2 and kernel), Mageia (python-pypdf2, python-ujson, and vim), and SUSE (fribidi, grub2, mozilla-nss, and webkit2gtk3).

Stable kernels 5.18.3, 5.17.14, 5.15.46, and 5.10.121 have been released. Typically, the stable kernels released right after the merge window closes contain a large number of changes and these updates certainly fit the bill.

Linux distributors are famously averse to shipping packages with bundled libraries; they would rather ship a single version of each library to be shared by all packages that need it. Many upstream projects, instead, are fond of bundling (or "vendoring") libraries; this leads to tension that has been covered here numerous times in the past (examples: 1, 2 3, 4, 5, ...). The recent Fedora discussion on bundling libraries with its Java implementation would look like just another in a long series, but it also shines a light on the unique challenges of shipping Java in a fast-moving community distribution.

Security updates have been issued by Debian (mailman and python-bottle), Red Hat (java-1.7.1-ibm, java-1.8.0-ibm, subversion:1.14, and xz), Scientific Linux (python-twisted-web), Slackware (httpd), and Ubuntu (ca-certificates, ffmpeg, ghostscript, and varnish).

The LWN.net Weekly Edition for June 9, 2022 is available.

In a combined storage and filesystem session at the 2022 Linux Storage, Filesystem, Memory-management and BPF Summit (LSFMM), Luis Chamberlain and James Bottomley led a discussion about the use of ioctl() as a mechanism for configuration. There are plenty of downsides to the use of ioctl() commands, and alternatives exist, but in general kernel developers have chosen to continue using this multiplexing system call. While there is interest in changing things, at least in some quarters, the discussion did not seem to indicate major changes on the horizon.

Version 15.4 of the openSUSE Leap distribution has been released. "Leap 15.4 is a feature release version and provides a significant amount of updates from previous Leap 15.x versions along with new offerings". Changes include the addition of openSUSE Leap Micro, improved codec support, KDE Plasma 5.24, and more. This release also deprecates Python 2 support.

Security updates have been issued by Debian (avahi), Fedora (firefox), Oracle (grub2, python-twisted-web, shim, shim-signed, and thunderbird), Red Hat (kernel and python-twisted-web), SUSE (gcc48, go1.17, go1.18, and mariadb), and Ubuntu (e2fsprogs, linux, linux-aws, linux-aws-5.13, linux-azure, linux-azure-5.13, linux-gcp, linux-gcp-5.13, linux-hwe-5.13, linux-intel-5.13, linux-kvm, linux-oracle, linux-oracle-5.13, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-azure-fde, linux-gcp, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon, linux, linux-aws, linux-azure, linux-gcp, linux-gke, linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-oem-5.14, linux-oem-5.17, and ntfs-3g).

As a followup to a session on testing challenges earlier in the day, Josef Bacik led a discussion on best practices for testing in a combined storage and filesystem session at the 2022 Linux Storage, Filesystem, Memory-management and BPF Summit (LSFMM). There are a number of ways that developers can collaborate on improving the testing landscape using fstests and blktests, starting with gathering and sharing information about which tests are expected to pass and fail. That information depends on a lot of different factors, including kernel version and configuration, fstest options, and more.

The Fedora 34 distribution release has gone out of the supported mode: "No further updates, including security updates, will be available for Fedora 34". Users should update to the Fedora 35 or 36 release.

Security updates have been issued by Debian (glib2.0, librecad, and php-horde-mime-viewer), Fedora (vim), and Ubuntu (freerdp2, ruby2.3, ruby2.5, ruby2.7, ruby3.0, and vim).