Linux Weekly News

Security updates have been issued by CentOS (kernel), Debian (dojo, firefox-esr, sleuthkit, and wpa), Fedora (cacti, cacti-spine, and python-psutil), Oracle (kernel), Red Hat (kernel), Scientific Linux (kernel), SUSE (ardana-ansible, ardana-cinder, ardana-cobbler, ardana-db, ardana-horizon, ardana-input-model, ardana-monasca, ardana-mq, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, ardana-tls, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, openstack-barbican, openstack-ceilometer, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, openstack-designate, openstack-heat, openstack-horizon-plugin-designate-ui, openstack-horizon-plugin-ironic-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-octavia-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-monasca-agent, openstack-neutron, openstack-neutron-fwaas, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-sahara, openstack-swift, python-amqp, python-ironic-lib, python-keystoneauth1, python-keystoneclient, python-keystonemiddleware, python-ovs, supportutils-plugin-suse-openstack-cloud, rubygem-crowbar-client, rubygem-puma, venv-openstack-horizon, ardana-cinder, ardana-cobbler, ardana-designate, ardana-extensions-example, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-input-model, ardana-ironic, ardana-keystone, ardana-logging, ardana-monasca, ardana-monasca-transform, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, keepalived, mariadb, openstack-cinder, openstack-dashboard, openstack-dashboard-theme-SUSE, openstack-heat, openstack-heat-templates, openstack-horizon-plugin-designate-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-ironic, openstack-keystone, openstack-monasca-agent, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vsphere, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-resource-agents, openstack-sahara, openstack-trove, python-cinderlm, python-congressclient, python-designateclient, python-ironic-lib, python-ne tworking-cisco, python-osc-lib, python-oslo.context, python-oslo.rootwrap, python-oslo.serialization, python-oslo.service, python-stevedore, python-taskflow, rubygem-crowbar-client, rubygem-pumavenv-openstack-swift, firefox, ipmitool, kernel, and php72), and Ubuntu (firefox).

The LWN.net Weekly Edition for March 12, 2020 is available.

A recent message to the debian-project mailing list by Debian project leader (DPL) Sam Hartman is about a proposal to moderate the mailing list. There have been repeated attacks on various project members and the distribution itself posted to the list over the last few years, many from sock-puppet, throwaway email accounts, which spawned a recent discussion on the debian-private mailing list; Hartman was summarizing that discussion for those who are not on the private list. But the problems on debian-project (and other Debian public lists) are kind of just the tip of the iceberg; there is an ongoing, persistent effort to roil the distribution and its community.

Version 3.36 of the GNOME desktop environment is out. "This release brings a new lock screen and a new app for managing shell extensions, among other things. Once again, the shell has received many performance improvements. Improvements to core GNOME applications include better support for metered networks and parental controls in GNOME Software, a new look for the initial setup assistant, a redesigned GNOME Clocks, and many more." See the release notes for details and screenshots.

For those who are interested in the details of graphics synchronization: Jason Ekstrand describes in detail the value of explicit synchronization, the reason why we can't have it now, and a proposal for eventually making it possible to go explicit. "Explicit synchronization is the future of graphics and media. At least, that seems to be the consensus among all the graphics people I've talked to. I had a chat with one of the lead Android graphics engineers recently who told me that doing explicit sync from the start was one of the best engineering decisions Android ever made. It's also the direction being taken by more modern APIs such as Vulkan."

Security updates have been issued by CentOS (qemu-kvm and sudo), Debian (chromium), Mageia (gpac, libseccomp, and tomcat), openSUSE (gd and postgresql10), Oracle (qemu-kvm), Red Hat (chromium-browser), Scientific Linux (qemu-kvm), Slackware (firefox), and SUSE (ipmitool, java-1_7_0-openjdk, librsvg, and tomcat).

The Let's Encrypt project has made real strides in helping to ensure that every web site can use the encrypted HTTPS protocol; it has provided TLS certificates at no charge that are accepted by most or all web browsers. Free certificates accepted by the browsers are something that was difficult to find prior to the advent of the project in 2014; as of the end of February, the project has issued over a billion certificates. But a bug that was recently found in the handling of Certificate Authority Authorization (CAA) by the project put roughly 2.6% of the active certificates—roughly three million—at risk of immediate revocation. As might be expected, that caused a bit of panic in some quarters, but it turned out that the worst outcome was largely averted.

The latest release of Firefox features some login management improvements, the ability to add custom sites to the Facebook Container, better privacy for web voice and video calls, and better add-on management. See the release notes for more information.

Security updates have been issued by Debian (libvpx and network-manager-ssh), Fedora (cacti, cacti-spine, and podman), openSUSE (chromium and python-bleach), Oracle (curl), Red Hat (ansible and qemu-kvm), SUSE (gd, ipmitool, and php7), and Ubuntu (runc and sqlite3).

The Linux development community is spread out over the planet and interacts primarily through email and online systems. It is widely felt, though, that there is great value in getting people together in person occasionally to talk about current issues and get to know each other as people. This year, though, the coronavirus pandemic is disrupting the conference schedule to an extent that won't be known for some time. But there are longer-term concerns as well, to the point that the head organizer for one of the kernel community's most successful events is questioning whether it should continue to exist.

LibrePlanet was scheduled for March 14-15 but it has been canceled. "However, just because we won't be holding a conference in person this year doesn't mean that we've given up our fight to "free the future." Instead, LibrePlanet will be a fully free (as in freedom) virtual conference and livestream. We had an extremely exciting program planned, and we're going to try and maintain as much of that schedule as possible with all of the speakers who are willing and able to participate remotely. The resulting livestream will be run on and entirely accessible via free software, so that you can enjoy these amazing talks from the comfort of your home."

The Chemnitzer Linux-Tage that was to take place March 14-15 has been canceled. "Whether we meet later this year or first in March 2021, we will discuss within the organization team in the next few days."

The openSUSE Summit in Dublin, Ireland was scheduled for March 27-28. The event has been canceled due to travel bans. SUSECON is still scheduled for March 23-27, however it will be a digital event. The in-person meeting in Dublin has been canceled.

Security updates have been issued by Fedora (seamonkey), Mageia (apache-mod_auth_openidc, binutils, chromium-browser-stable, dojo, firejail, gcc, glib2.0, glibc, http-parser, ilmbase, libarchive, libgd, libsolv, mbedtls, pcre, pdfresurrect, php, proftpd, pure-ftpd, python-bleach, ruby-rake, transfig, weechat, and xen), openSUSE (chromium, ovmf, python-bleach, and yast2-rmt), Oracle (curl, http-parser, kernel, sudo, and xerces-c), Red Hat (chromium-browser and kernel-alt), Scientific Linux (sudo), and SUSE (gimp, kernel, and librsvg).

Linus has put out a high-altitude 5.6-rc5 prepatch release. "That said, everything looks mostly fine. I say 'mostly', because while nothing in particular looks worrisome, this rc5 is bigger than I'd have liked. In fact, it's not only bigger than rc4 was, but it's bigger than we historically are at this point."

Systemd 245 is out. As usual, the list of new features is long; perhaps the one that has gained the most attention is systemd-homed:

A small new service systemd-homed.service has been added, that may be used to securely manage home directories with built-in encryption. The complete user record data is unified with the home directory, thus making home directories naturally migratable.

There is also a new database for holding user and group data and a systemd-repart tool for the management of partitions on storage-devices at boot time.

DNF, the Fedora package manager, is going to be significantly rewritten; it seems it is truly "development not finished" for now. "We've managed to drop a lot of redundant code across the whole DNF stack in the past years, but we have reached a point when it's nearly impossible to consolidate the code any further without breaking the API/ABI. Especially with PackageKit being dead, we can't move with the old 'libhif' API in libdnf, because making any bigger changes to PackageKit is clearly out of scope."

System calls on Linux are relatively cheap, though the mitigations for speculative-execution vulnerabilities have made them more expensive than they once were. But even cheap system calls add up if one has to make a large number of them. Thus, developers have been working on ways to avoid system calls for a long time. Currently under discussion is a pair of ways to reduce the number of system calls required to read a file's contents, one of which is rather simpler than the other.

Security updates have been issued by Arch Linux (chromium, opensc, opensmtpd, and weechat), Debian (jackson-databind and pdfresurrect), Fedora (sudo), openSUSE (openfortivpn and squid), Red Hat (virt:8.1 and virt-devel:8.1), Scientific Linux (http-parser and xerces-c), and SUSE (gd, kernel, postgresql10, and tomcat).

Over on the Collabora blog, Julian Bouzas writes about PipeWire, which is a relatively new multimedia server for the Linux desktop and beyond. "PipeWire was originally created to only handle access to video resources and co-exist with PulseAudio. Earlier versions have already been shipping in Fedora for a while, allowing Flatpak applications to access video cameras and to implement screen sharing on Wayland. Eventually, PipeWire has ended up handling any kind of media, to the point of planning to completely replace PulseAudio in the future. The new 0.3 version is marked as a preview for audio support. But why replace PulseAudio? Although PulseAudio already provides a working intermediate layer to access audio devices, PipeWire has to offer more features that PulseAudio was not designed to deliver, starting with a better security model, which allows isolation between applications and secure access from within containers. Another interesting feature of PipeWire is that it unifies the two audio systems used on the desktop, JACK for low-latency professional audio and PulseAudio for normal desktop use-cases. PipeWire was designed to be able to accommodate both use cases, delivering very low latency, while at the same time not wasting CPU resources. This design also makes PipeWire a much more efficient solution than PulseAudio in general, making it a perfect fit for embedded use cases too."