LWN
LWN.net is a comprehensive source of news and opinions from
and about the Linux community. This is the main LWN.net feed,
listing all articles which are posted to the site front page.
URL: https://lwn.net
Updated: 1 hour 35 min ago
[$] Finding bugs with sanitizers
Andrey Konovalov began his 2022 Linux
Security Summit Europe (LSS EU) talk with a bold statement: "fuzzing is
useless". As might be guessed, he qualified that assertion quickly by
adding "without dynamic bug detectors". These bug detectors include
"sanitizers" of various sorts, such as the Kernel Address
Sanitizer (KASAN), but there are others. Konovalov looked in detail at KASAN
and gave an overview of the
sanitizer landscape along with some ideas of ways to push these bug
detectors further—to find even more kernel bugs.
LXD 5.6 released
Version
5.6 of the LXD container manager is out. Changes include the ability
to stream log messages to a Grafana Loki server, Infiniband support for
virtual machines, a restricted network access mode, and more.
Bash 5.2 released
Version 5.2 of the Bash shell has been released.
The most notable new feature is the rewritten command substitution parsing code, which calls the bison parser recursively. This replaces the ad-hoc parsing used in previous versions, and allows better syntax checking and catches syntax errors much earlier. The shell attempts to do a much better job of parsing and expanding array subscripts only once; this has visible effects in the `unset' builtin, word expansions, conditional commands, and other builtins that can assign variable values as a side effect.
Wuyts: Why async Rust
Yoshua Wuyts gives an overview of async
Rust and why it is interesting.
Conversations around "why async" often focus on performance - a topic which is highly dependent on workloads, and results with people wholly talking past each other. While performance is not a bad reason to choose async Rust, we often we only notice performance when we experience a lack of it. So I want to instead on which features async Rust provides which aren't present in non-async Rust.
Security updates for Tuesday
Security updates have been issued by Debian (dovecot and firefox-esr), Fedora (firefox and grafana), Red Hat (firefox and thunderbird), Slackware (dnsmasq and vim), SUSE (dpdk, firefox, kernel, libarchive, libcaca, mariadb, openvswitch, opera, permissions, podofo, snakeyaml, sqlite3, unzip, and vsftpd), and Ubuntu (expat, libvpx, linux-azure-fde, linux-oracle, squid, squid3, and webkit2gtk).
[$] Supporting CHERI capabilities in GCC and glibc
The CHERI
architecture is the product of a research program to extend common
CPU architectures
in a way that prevents many types of memory-related bugs (and
vulnerabilities). At the 2022 GNU Tools Cauldron,
Alex Coplan and Szabolcs Nagy described the work that has been done to
bring GCC and the GNU C Library (glibc) to this architecture. CHERI is a fundamentally
different approach to how memory is accessed, and supporting it properly is anything
but a trivial task.
[$] BPF for HID drivers
The Human
Interface Device (HID) standard dates back to the Windows 95 era.
It describes how devices like mice and keyboards present themselves to the
host computer, and has created a world where a single driver can handle a
wide variety of devices from multiple manufacturers. Or it would have, if
there weren't actual device manufacturers involved. In the real world,
devices stretch and break the standard, each in its own special way. At
the 2022 Linux Plumbers Conference,
Benjamin Tissoires described how BPF can be used to simplify the
task of supporting HID devices.
Security updates for Monday
Security updates have been issued by Debian (expat and poppler), Fedora (dokuwiki), Gentoo (fetchmail, grub, harfbuzz, libaacplus, logcheck, mrxvt, oracle jdk/jre, rizin, smarty, and smokeping), Mageia (tcpreplay, thunderbird, and webkit2), SUSE (dpdk, permissions, postgresql14, puppet, and webkit2gtk3), and Ubuntu (linux-gkeop and sosreport).
Kernel prepatch 6.0-rc7
The 6.0-rc7 kernel prepatch is out for
testing.
So I was thinking rc7 might end up larger than usual due to travel hitting rc6, but it doesn't really seem to have happened.
Yeah, maybe it's marginally bigger than the historical average for this time of the release cycle, but it definitely isn't some outlier, and it looks fairly normal. Which is all good, and makes me think that the final release will happen right on schedule next weekend, unless something unexpected happens. Knock wood.
Arch Linux drops Python 2
Arch Linux has announced
that Python 2 is being removed from the distribution's repositories.
"If you still require the python2 package you can keep it around, but
please be aware that there will be no security updates."
[$] BPF as a safer kernel programming environment
For better or worse, C is the lingua franca in the world of kernel
engineering. The core logic of the Linux kernel is written entirely in
C (with a bit of assembly), as are its drivers and modules. While C is
rightfully celebrated for
its powerful yet simple semantics, it is an older language that lacks
many of the features present in modern languages such as
Rust. The
BPF subsystem, on the other hand,
provides a programming environment that allows engineers to write
programs that can run safely in kernel space. At the 2022 Linux Plumbers
Conference in Dublin, Ireland, Alexei Starovoitov presented an overview
of how BPF has evolved over the years to provide a new model for kernel
programming.
Security updates for Friday
Security updates have been issued by Debian (bind9, expat, firefox-esr, mediawiki, and unzip), Fedora (qemu and thunderbird), Oracle (webkit2gtk3), SUSE (ardana-ansible, ardana-cobbler, ardana-tempest, grafana, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-neutron-gbp, openstack-nova, python-Django1, rabbitmq-server, rubygem-puma, ardana-ansible, ardana-cobbler, grafana, openstack-heat-templates, openstack-murano, python-Django, rabbitmq-server, rubygem-puma, dpdk, freetype2, rubygem-rack, and virtualbox), and Ubuntu (etcd, libjpeg-turbo, linux-gcp, linux-gke, linux-raspi, linux-oem-5.17, linux-raspi-5.4, python-oauthlib, and python3.5).
[$] Safer flexible arrays for the kernel
At the 2022 Linux
Security Summit Europe (LSS EU), Gustavo A. R. Silva reported in on
work he has been doing on "flexible" arrays in the kernel. While these
arrays provide some ... flexibility ... they are also a source of bugs,
which
can often result in security vulnerabilities. He has been working on ways
to make the use of flexible arrays safer in the kernel.
Rust 1.64.0 released
Version
1.64.0 of the Rust language has been released. Changes include the
stabilization of the IntoFuture
trait, easier access to C-compatible types, the availability of
rust-analyzer via
rustup, and more.
Security updates for Thursday
Security updates have been issued by Debian (e17, fish, mako, and tinygltf), Fedora (mingw-poppler), Mageia (firefox, google-gson, libxslt, open-vm-tools, redis, and sofia-sip), Oracle (dbus-broker, kernel, kernel-container, mysql, and nodejs and nodejs-nodemon), Slackware (bind), SUSE (cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer, go1.18, go1.19, kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, libconfuse0, and oniguruma), and Ubuntu (bind9 and pcre2).
[$] LWN.net Weekly Edition for September 22, 2022
The LWN.net Weekly Edition for September 22, 2022 is available.
[$] Two visions for the future of sourceware.org
Public hosting systems for free software have come and gone over the years
but one of them, Sourceware, has been
supporting the development of most of the GNU toolchain for nearly
25 years.
Recently, an application was made to bring
Sourceware under the umbrella of the Software Freedom Conservancy (SFC), at least for
fundraising purposes. It turns out that there is a separate initiative,
developed in secret until now, with a different vision for the future of
Sourceware. The 2022 GNU
Tools Cauldron was the site of an intense discussion on how this
important community resource should be managed in the coming years.
GNOME 43 released
Version 43 of the GNOME desktop environment has been released; see the release notes for details.
This latest GNOME release comes with improvements across the board, ranging from a new quick settings menu, a redesigned Files app, and hardware security integration. GNOME 43 continues the trend of GNOME apps migrating from GTK 3 to GTK 4, and includes many other smaller enhancements.
Rendered linux-next documentation on kernel.org
Konstantin Ryabitsev has announced
the availability of rendered
documentation from linux-next on kernel.org. This will be useful for
anybody wanting to see what the documentation for the next kernel release
will look like.
More in Tux Machines
- Highlights
- Front Page
- Latest Headlines
- Archive
- Recent comments
- All-Time Popular Stories
- Hot Topics
- New Members
today's howtos
| Red Hat Hires a Blind Software Engineer to Improve Accessibility on Linux Desktop
Accessibility on a Linux desktop is not one of the strongest points to highlight. However, GNOME, one of the best desktop environments, has managed to do better comparatively (I think).
In a blog post by Christian Fredrik Schaller (Director for Desktop/Graphics, Red Hat), he mentions that they are making serious efforts to improve accessibility.
Starting with Red Hat hiring Lukas Tyrychtr, who is a blind software engineer to lead the effort in improving Red Hat Enterprise Linux, and Fedora Workstation in terms of accessibility.
|
Today in Techrights
| Android Leftovers |
.svg_.png)
Content (where original) is available under CC-BY-SA, copyrighted by original author/s.
Recent comments
13 weeks 1 day ago
13 weeks 1 day ago
13 weeks 1 day ago
13 weeks 2 days ago
13 weeks 2 days ago
13 weeks 2 days ago
13 weeks 2 days ago
13 weeks 2 days ago
13 weeks 2 days ago
13 weeks 2 days ago