Hírolvasó

Security updates for Friday

3 év 1 hónap óta
Security updates have been issued by Fedora (direnv, golang-github-mattn-colorable, matrix-synapse, pypy3.7, pypy3.8, and pypy3.9), Oracle (squid), SUSE (curl, openssl-1_1, pcre, python-ipython, resource-agents, and rsyslog), and Ubuntu (nss, php7.2, and vim).
jake

Matthew Garrett: Lenovo shipping new laptops that only boot Windows by default

3 év 1 hónap óta
I finally managed to get hold of a Thinkpad Z13 to examine a functional implementation of Microsoft's Pluton security co-processor. Trying to boot Linux from a USB stick failed out of the box for no obvious reason, but after further examination the cause became clear - the firmware defaults to not trusting bootloaders or drivers signed with the Microsoft 3rd Party UEFI CA key. This means that given the default firmware configuration, nothing other than Windows will boot. It also means that you won't be able to boot from any third-party external peripherals that are plugged in via Thunderbolt.

There's no security benefit to this. If you want security here you're paying attention to the values measured into the TPM, and thanks to Microsoft's own specification for measurements made into PCR 7, switching from booting Windows to booting something signed with the 3rd party signing key will change the measurements and invalidate any sealed secrets. It's trivial to detect this. Distrusting the 3rd party CA by default doesn't improve security, it just makes it harder for users to boot alternative operating systems.

Lenovo, this isn't OK. The entire architecture of UEFI secure boot is that it allows for security without compromising user choice of OS. Restricting boot to Windows by default provides no security benefit but makes it harder for people to run the OS they want to. Please fix it.

comments

[$] The trouble with symbolic links

3 év 1 hónap óta
At the 2022 sambaXP conference, Jeremy Allison gave a talk titled "The UNIX Filesystem API is profoundly broken: What to do about it?". LWN regulars may recall hints of these talks in a recent comment thread. He started his talk with the problems that symbolic links ("symlinks") cause for application developers, then discussed how the solutions to the problems posed by symlinks led to substantial increases in the complexity of the APIs involved in working with pathnames.
corbet

Vegard Nossum: Stigmergy in programming

3 év 1 hónap óta

Ants are known to leave invisible pheromones on their paths in order to inform both themselves and their fellow ants where to go to find food or signal that a path leads to danger. In biology, this phenomenon is known as stigmergy: the act of modifying your environment to manipulate the future behaviour of yourself or others. From the Wikipedia article:

Stigmergy (/ˈstɪɡmərdʒi/ STIG-mər-jee) is a mechanism of indirect coordination, through the environment, between agents or actions. The principle is that the trace left in the environment by an individual action stimulates the performance of a succeeding action by the same or different agent. Agents that respond to traces in the environment receive positive fitness benefits, reinforcing the likelihood of these behaviors becoming fixed within a population over time.

For ants in particular, stigmergy is useful as it alleviates the need for memory and more direct communication; instead of broadcasting a signal about where a new source of food has been found, you can instead just leave a breadcrumb trail of pheromones that will naturally lead your community to the food.

We humans also use stigmergy in a lot of ways: most notably, we write things down. From post-it notes posted on the fridge to remind ourselves to buy more cheese to writing books that can potentially influence the behaviour of a whole future generation of young people.

Let's face it: We don't have infinite brains and we need to somehow alleviate the need to remember everything. If you remember the movie Memento, the protagonist Leonard has lost his ability to form new long-term memories and relies on stigmergy to inform his future actions; everything that's important he writes down in a place he's sure to come across it again when needed. His most important discoveries he turns into tattoos that he cannot lose or avoid seeing when he wakes up in the morning.

Perhaps a biologist would object and say this is stretching the definition of stigmergy, but I contest that it fits: leaving a trace in the environment in order to stimulate a future action.

For stigmergy to be effective, it must be placed in the right location so that whoever comes across it will perform the correct action at that time. If we return briefly to the shopping list example, we typically keep the list close to the fridge because that is often where we are when we need to write something down -- or when we go to check what we need to buy.

Let's take an example from computing: Have you ever seen a line at the top of a file that says "AUTOMATICALLY GENERATED; DON'T MODIFY THIS"? Well, that's stigmergy. Somebody made sure that line would be there in order to influence the behaviour of whomever came across that file. A little note from the past placed in the environment to manipulate future actions.

In programming, stigmergy mainly manifests as comments scattered throughout the code -- the most common form is perhaps leaving a comment to explain what a piece of code is there to do, where we know somebody will find it and, hopefully, be able to make use of it. Another one is leaving a "TODO" comment where something isn't quite finished -- you may not know that a piece of code isn't handling some corner case just by glancing at it, but a "TODO" comment stands out and may even contain enough information to complete the implementation. In other cases, we see the opposite: "here be dragons"-type comments instructing the reader not to change something, perhaps because the code is known to be complicated, complex, brittle, or prone to breaking.

Stigmergy is a powerful idea, and once you are aware of it you can consciously make use of it to help yourself and others down the line. We're not robotic ants and we can make deliberate choices regarding when, where, and how we modify our environment in order to most effectively influence future behaviour.

Security updates for Thursday

3 év 1 hónap óta
Security updates have been issued by Debian (intel-microcode), Fedora (dotnet3.1 and gnupg2), Oracle (grub2, kernel, php:7.4, php:8.0, and qemu-kvm), SUSE (389-ds, apache2, crash, curl, expat, firefox, fwupd, fwupdate, ImageMagick, ldb, samba, liblouis, librttopo, openssl, openssl-1_0_0, openssl-1_1, openssl-3, oracleasm, php7, php8, python-Twisted, python310, rsyslog, s390-tools, salt, thunderbird, and xen), and Ubuntu (linux-lts-xenial, linux-kvm and openssl).
jake

[$] The 2022 embedded Linux update

3 év 1 hónap óta
A regular feature of the Embedded Linux Conference (ELC) has been an update on the state of embedded Linux from conference organizer Tim Bird. It has been quite a few years since I had the opportunity to sit in on one, so I took one at the 2022 Open Source Summit North America (OSSNA) in Austin, Texas. OSSNA is an umbrella conference that contains ELC and a whole lot more these days. Bird gave a look at recent kernel features from an embedded perspective, talked a bit about some different technology areas and their impact on embedded Linux, and also tried to answer a question that Andrew Morton posed in a keynote at ELC in 2008.
jake

Linux Plumbers Conference: Microconferences at Linux Plumbers Conference: Power Management and Thermal Control

3 év 1 hónap óta

Linux Plumbers Conference 2022 is pleased to host the Power Management and Thermal Control Microconference

The Power Management and Thermal Control microconference focuses on frameworks related to power management and thermal control, CPU and device power-management mechanisms, and thermal-control methods. In particular, we are interested in extending the energy-efficient scheduling concept beyond the energy-aware scheduling (EAS), improving the thermal control framework in the kernel to cover more use cases and making system-wide suspend (and power management in general) more robust.

The goal is to facilitate cross-framework and cross-platform discussions that can help improve energy-awareness and thermal control in Linux.

Suggested topics:

  • Energy-efficient scheduling beyond EAS
  • Per-CPU idle injection from user space for thermal control
  • A generic energy model description
  • Extending the DTPM framework by adding more supported devices to it
  • Thermal control core code improvements
  • Combining DTPM with the thermal control framework
  • Generic DVFS support for SCMI-based platforms
  • Improving the genpd governor for CPUs
  • More integration between PM-runtime and system-wide PM

Please come and join us in the discussion about keeping your systems cool.

We hope to see you there!

Security updates for Wednesday

3 év 1 hónap óta
Security updates have been issued by Debian (ldap-account-manager), Fedora (openssl1.1, thunderbird, and yubihsm-connector), Mageia (curl, cyrus-imapd, firefox, ruby-git, ruby-rack, squid, and thunderbird), Oracle (firefox, kernel, and thunderbird), Slackware (openssl), SUSE (dpdk, haproxy, and php7), and Ubuntu (gnupg2 and openssl).
corbet

[$] An Ubuntu kernel bug causes container crashes

3 év 1 hónap óta
Some system administrators running Ubuntu 20.04 had a rough time on June 8, when Ubuntu published kernel packages containing a particularly nasty bug that was caused by an Ubuntu-specific patch to the kernel. The bug led to a kernel panic whenever a Docker container was started. Fixed packages were made available on June 10, but there are questions about what went wrong with handling the patch; in particular, it is surprising that kernel 5.13, which has been beyond its end-of-life for months, made it onto machines running Ubuntu 20.04, which is supposed to be a long-term support release.
jake

Amazon's CodeWhisperer

3 év 1 hónap óta
There has been a fair amount of concern recently about Microsoft's Copilot system, which many see as possibly putting its users in violation of free-software licenses. But, naturally, Copilot is not the only offering of this type; Amazon has put out a preview version of "CodeWhisperer", which is also a machine-learning-based coding tool that was trained on (unspecified) open-source code. From the FAQ:

CodeWhisperer’s reference tracker detects whether a code recommendation may be similar to particular CodeWhisperer training data, and can provide those references to you. This allows you to easily find and review that reference code and how it is used in the context of another project.

corbet

[$] The end of CONFIG_ANDROID

3 év 1 hónap óta
The kernel has thousands of configuration options, many of which can change the kernel's behavior in subtle or surprising ways. Among those options is CONFIG_ANDROID, which one might expect to be relatively straightforward; its description reads, in its entirety: "Enable support for various drivers needed on the Android platform". It turns out that this option does more than that, to the surprise of some users. That has led to a plan to remove this option, but that has brought a surprise or two of its own — and some disagreement — as well.
corbet

Debian 9 Long Term Support reaching end-of-life

3 év 1 hónap óta
The Debian Long Term Support (LTS) team has announced that Debian 9 ("stretch") has "reached its end-of-life on July 1, 2022, five years after its initial release on June 17, 2017". There will be further updates for a subset of the packages in the release through the Extended LTS project. Meanwhile, the LTS team is moving on to Debian 10 ("buster"): The LTS Team will prepare the transition to Debian 10 buster, which is the current oldstable release. The LTS team will take over support from the Security Team during August, while the final point update for buster will be released during that month.

Debian 10 will also receive Long Term Support for five years after its initial release with support ending on June 30, 2024. The supported architectures will be announced at a later date.

jake

Security updates for Monday

3 év 1 hónap óta
Security updates have been issued by Debian (gnupg2 and kernel), Fedora (golang-github-apache-beam-2, golang-github-etcd-io-gofail, golang-github-intel-goresctrl, golang-github-spf13-cobra, golang-k8s-pod-security-admission, and vim), Oracle (.NET 6.0, compat-openssl10, compat-openssl11, cups, curl, expat, firefox, go-toolset:ol8, grub2,, gzip, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, kernel, libarchive, libgcrypt, libinput, libxml2, pcre2, postgresql, python, rsync, rsyslog, ruby:2.6, subversion, thunderbird, vim, xz, and zlib), Scientific Linux (firefox and thunderbird), SUSE (python-nltk and salt), and Ubuntu (linux, linux-aws, linux-hwe-5.13, and linux-oem-5.14).
jake

Kernel prepatch 5.19-rc5

3 év 1 hónap óta
The 5.19-rc5 kernel prepatch is out for testing. "So everything looks ok - we certainly have some issues still being looked at, but on the whole 5.19 looks normal, and nothing particularly bad seems to be going on".
corbet

Linux Plumbers Conference: Microconferences at Linux Plumbers Conference: System Boot and Security

3 év 1 hónap óta

Linux Plumbers Conference 2022 is pleased to host the System Boot and Security Microconference

In the fourth year in a row, System Boot and Security microconference is are going to bring together people interested in the firmware, bootloaders, system boot, security, etc., and discuss all these topics. This year we would particularly like to focus on better communication and closer cooperation between different Free Software and Open Source projects. In the past we have seen that the lack of cooperation’s between projects very often delays introduction of very interesting and important features with TrenchBoot being very prominent example.

The System Boot and Security MC is very important to improve such communication and cooperation, but it is not limited to this kind of problems. We would like to encourage all stakeholders to bring and discuss issues that they encounter in the broad sense of system boot and security.

Expected topics:

  • TPMs, HSMs, secure elements
  • Roots of Trust: SRTM and DRTM
  • Intel TXT, SGX, TDX
  • AMD SKINIT, SEV
  • ARM DRTM
  • Growing Attestation ecosystem,
  • IMA
  • TrenchBoot, tboot
  • UEFI, coreboot, U-Boot, LinuxBoot, hostboot
  • Measured Boot, Verified Boot, UEFI Secure Boot, UEFI Secure Boot Advanced Targeting (SBAT)
  • shim
  • boot loaders: GRUB2, SeaBIOS, network boot, PXE, iPXE,
  • u-root
  • OpenBMC, u-bmc
  • legal, organizational and other similar issues relevant for people interested in system boot and security.

Please come and join us in the discussion about how to keep your system secure from the very boot.

We hope to see you there!

In -current, dhclient(8) now just logs warnings and executes ifconfig(8)

3 év 1 hónap óta

Theo de Raadt (deraadt@) committed the change:

CVSROOT: /cvs Module name: src Changes by: deraadt@cvs.openbsd.org 2022/07/02 11:21:32 Modified files: sbin/dhclient : dhclient.c Log message: dhclient(8) has been undergoing replacement with "ifconfig xxx inet auto" for a couple of years, backed by dhcpleased(8), which provides much better dns handling. The next step is to make the dhclient simply execve ifconfig in that way, and provide syslog warnings about deprecated options along the way. This way, we can find the last few dhclient users, and what they are missing. ok florian krw

Darktable 4.0.0 released

3 év 1 hónap óta
Version 4.0.0 of the darktable raw photo editor has been released. "The UI has been completely revamped again to improve look and consistency. Padding, margins, color, contrast, alignment, and icons have been reworked throughout". Other changes include new exposure and color-calibration modules, a reworked "filmic" color-mapping module, guided laplacian highlight reconstruction, and more. (LWN looked at darktable in January).
corbet