Language Selection

English French German Italian Portuguese Spanish

LWN

Syndicate content
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Updated: 6 days 6 hours ago

Garrett: Making hibernation work under Linux Lockdown

Monday 22nd of February 2021 03:25:40 PM
Matthew Garrett recently posted a patch set enabling hibernation on systems that are running in the UEFI secure-boot lockdown mode. This blog entry gets into the details of how it all works. "When we encrypt material with the TPM, we can ask it to record the PCR state. This is given back to us as metadata accompanying the encrypted secret. Along with the metadata is an additional signature created by the TPM, which can be used to prove that the metadata is both legitimate and associated with this specific encrypted data. In our case, that means we know what the value of PCR 23 was when we encrypted the key. That means that if we simply extend PCR 23 with a known value in-kernel before encrypting our key, we can look at the value of PCR 23 in the metadata. If it matches, the key was encrypted by the kernel - userland can create its own key, but it has no way to extend PCR 23 to the appropriate value first. We now know that the key was generated by the kernel."

Kodi 19 released

Monday 22nd of February 2021 03:11:36 PM
Version 19 of the Kodi "entertainment center" application is out with a long list of new features.

For audio and music lovers, there are significant improvements across the board to metadata handling: library improvements, new tags, new displays, improvements to how Kodi handles release dates, album durations, multi-disc sets, and more. There's a new, Matrix-inspired visualisation, there are improvements to display when fetching files from a web server, and several changes to how audio decoder addons can pass information through to the Kodi player.

For video, most of the changes are more technical, and may depend on your hardware: AV1 software decoding, HLG HDR and static HDR10 playback on Windows 10, static HDR10 and dynamic Dolby Vision HDR support on Android, and more OpenGL bicubic scalers.

Security updates for Monday

Monday 22nd of February 2021 02:41:37 PM
Security updates have been issued by Debian (chromium, libzstd, openldap, openvswitch, screen, and wpa), Fedora (dotnet5.0, subversion, and wpa_supplicant), openSUSE (mumble, python-djangorestframework, and tor), Oracle (container-tools:ol8, kernel, nodejs:10, nodejs:12, nodejs:14, subversion:1.10, and xterm), Red Hat (stunnel and xterm), and SUSE (ImageMagick, java-1_8_0-openjdk, kernel, krb5-appl, python3, tomcat, and webkit2gtk3).

[$] An introduction to lockless algorithms

Friday 19th of February 2021 06:33:32 PM
Lockless algorithms are of interest for the Linux kernel when traditional locking primitives either cannot be used or are not performant enough. For this reason they come up every now and then on LWN; one of the last mentions, which prompted me to write this article series, was last July. Topics that arise even more frequently are read-copy-update (RCU — these articles from 2007 are still highly relevant), reference counting, and ways of wrapping lockless primitives into higher-level, more easily understood APIs. These articles will delve into the concepts behind lockless algorithms and how they are used in the kernel.

Security updates for Friday

Friday 19th of February 2021 03:18:40 PM
Security updates have been issued by Debian (bind9, libbsd, openssl1.0, php-horde-text-filter, qemu, and unrar-free), Fedora (kiwix-desktop and libntlm), Mageia (coturn, mediawiki, privoxy, and veracrypt), openSUSE (buildah, libcontainers-common, podman), Oracle (kernel, nss, and perl), Red Hat (xterm), SUSE (java-1_7_1-ibm, php74, python-urllib3, and qemu), and Ubuntu (libjackson-json-java and shiro).

[$] How useful should copy_file_range() be?

Thursday 18th of February 2021 03:20:32 PM
The copy_file_range() system call looks like a relatively straightforward feature; it allows user space to ask the kernel to copy a range of data from one file to another, hopefully applying some optimizations along the way. In truth, this call has never been as generic as it seems, though some changes made during 5.3 helped in that regard. When the developers of the Go language ran into problems with copy_file_range(), there ensued a lengthy discussion on how this system call should work and whether the kernel needs to do more to make it useful.

Security updates for Thursday

Thursday 18th of February 2021 02:46:04 PM
Security updates have been issued by Debian (mumble, openssl, php7.3, and webkit2gtk), openSUSE (jasper, php7, and screen), SUSE (bind, php7, and php72), and Ubuntu (bind9, openssl, openssl1.0, and webkit2gtk).

Google's effort to mitigate memory-safety issues

Thursday 18th of February 2021 02:19:22 PM
The Google Security Blog carries an announcement of a heightened effort to reimplement security-critical software in memory-safe languages. "The new Rust-based HTTP and TLS backends for curl and now this new TLS library for Apache httpd are an important starting point in this overall effort. These codebases sit at the gateway to the internet and their security is critical in the protection of data for millions of users worldwide."

[$] LWN.net Weekly Edition for February 18, 2021

Thursday 18th of February 2021 01:11:04 AM
The LWN.net Weekly Edition for February 18, 2021 is available.

[$] What goes into default Debian?

Wednesday 17th of February 2021 08:22:23 PM
The venerable locate file-finding utility has long been available for Linux systems, though its origins are in the BSD world. It is a generally useful tool, but does have a cost beyond just the disk space it occupies in the filesystem; there is a periodic daemon program (updatedb) that runs to keep the file-name database up to date. As a recent debian-devel discussion shows, though, people have differing ideas of just how important the tool is—and whether it should be part of the default installation of Debian.

Another pair of stable kernels

Wednesday 17th of February 2021 03:18:55 PM
The 5.10.17 and 5.4.99 stable kernel updates have been released; they both contain another set of important fixes.

Security updates for Wednesday

Wednesday 17th of February 2021 02:53:37 PM
Security updates have been issued by Debian (openssl and ruby-mechanize), Fedora (chromium, jasper, roundcubemail, spice-vdagent, and webkit2gtk3), openSUSE (python-bottle), Oracle (dotnet, kernel, and kernel-container), Red Hat (redhat-ds:11, RHDM, and RHPAM), SUSE (jasper, kernel, and screen), and Ubuntu (thunderbird and wpa).

Go 1.16 released

Wednesday 17th of February 2021 02:30:58 PM
Version 1.16 of the Go language is available. New features include an "embed" package, Apple Arm64 support, use of modules by default, and build-performance improvements; see the release notes for details.

[$] Malware in open-source web extensions

Tuesday 16th of February 2021 08:45:48 PM
On February 4, millions of browser tabs were suddenly terminated. Not everyone was surprised; the dozen people who spent the last four months waiting for this tragedy to occur watched in relief as the first in a rapid stream of GitHub comments began pouring in. The Great Suspender, a Chrome extension that suspended inactive tabs, with around two-million users, had been forcibly uninstalled because it contained malware. This was a serious problem for users, in part due to the difficulty in recovering the lost tabs, but the extension's malevolence had been painfully obvious to anyone who cared to investigate it.

5.12 Merge window delayed

Tuesday 16th of February 2021 08:41:38 PM
Those of us who are watching the mainline kernel repository may have been wondering why it appears that no pull requests for the 5.12 merge window have yet been acted upon. The problem, it seems, is power outages caused by the severe winter weather in the US Pacific northwest. Until that gets resolved, which could take a few days, the 5.12 merge window is likely to remain on hold.

Security updates for Tuesday

Tuesday 16th of February 2021 04:17:40 PM
Security updates have been issued by Debian (spip), Mageia (chromium-browser, kernel, kernel-linus, and trojita), openSUSE (mumble and opera), Red Hat (container-tools:rhel8, java-1.8.0-ibm, kernel, kernel-rt, net-snmp, nodejs:10, nodejs:12, nodejs:14, nss, perl, python, and rh-nodejs10-nodejs), and SUSE (jasper, python-bottle, and python-urllib3).

[$] Development statistics for the 5.11 kernel

Monday 15th of February 2021 07:48:14 PM
The 5.11 kernel was released on February 14 — the most romantic sort of Valentine's day gift one could hope for. This kernel saw the merging of 14,340 changesets from 1,912 developers; it is certainly not the busiest development cycle we have seen recently, but it still saw a lot of activity. Read on for our traditional look at where the code merged for 5.11 came from.

Security updates for Monday

Monday 15th of February 2021 03:37:35 PM
Security updates have been issued by Debian (busybox, linux-4.19, openvswitch, subversion, unbound1.9, and xterm), Fedora (audacity, community-mysql, kernel, libzypp, mysql-connector-odbc, python-django, python3.10, and zypper), openSUSE (librepo, openvswitch, subversion, and wpa_supplicant), Red Hat (subversion:1.10), SUSE (kernel, openvswitch, perl-File-Path, and wpa_supplicant), and Ubuntu (postgresql-12).

The 5.11 kernel is out

Sunday 14th of February 2021 10:57:24 PM
Linus has released the 5.11 kernel, as expected. "I know it's Valentine's Day here in the US - maybe give this release a good testing before you go back and play with development kernels. All right? Because I'm sure your SO will understand." Headline features in 5.11 include Intel SGX support, a new system-call interception mechanism, the seccomp() constant-action bitmap optimization, the internal kmap_local() API, the epoll_pwait2() system call, and much more. See the LWN merge-window articles (part 1, part 2) and the (under development) KernelNewbies 5.11 page for more information.

Saturday stable kernels

Saturday 13th of February 2021 04:25:58 PM
The 5.10.16, 5.4.98, and 4.19.176 stable kernel updates have been released; each contains another set of important fixes.

More in Tux Machines

today's leftovers

  • Snapcraft Clinic Successes

    On Thursday I mentioned we were restarting the Snapcraft Clinic. Basically we stand up a regular video call with engineers from the snap and snapcraft team & us from Snap Advocacy. Developers of applications and publishers of snaps are invited to join to troubleshoot. There was nothing especially secret or private discussed, but as we don’t record or stream the calls, and I don’t have direct permission to mention the applications or people involved, so I’ll keep this a little vague. In future I think we should ask permission and record the outcomes of the calls. We had a few productive discussions. One developer brought an application which they’d requested classic confinement for, and wished to discuss the options for confinement. We had a rather lengthy open discussion about the appropriateness of the available options. The developer was offered some choices, including making changes to their application to accomodate confinement, and another was (as always) not to snap the application. They appreciated our openness in terms of accepting that there are limitations with all software, and not everything always makes sense to be packaged as a snap, at the moment. We also had a productive discusison with a representative of a group responsible for publishing multiple snaps. They had difficulties with a graphical snapped application once it had been updated to use core20. The application would launch and almost immediately segfault. As the application was already published in the Snap Store, in a non-stable channel, we were all able to install it to test on our own systems.

  • Kraft Version 0.96

    Ich freue mich, heute das Release Version 0.96 von Kraft herauszugeben. Die neue Version kann über die Homepage heruntergeladen werden.

  • A new data format has landed in the upcoming GTG 0.5

    Diego’s changes are major, invasive technological changes, and they would benefit from extensive testing by everybody with “real data” before 0.5 happens (very soon). I’ve done some pretty extensive testing & bug reporting in the last few months; Diego fixed all the issues I’ve reported so far, so I’ve pretty much run out of serious bugs now, as only a few remain targetted to the 0.5 milestone… But I’m only human, and it is possible that issues might remain, even after my troll-testing. Grab GTG’s git version ASAP, with a copy of your real data (for extra caution, and also because we want you to test with real data); see the instructions in the README, including the “Where is my user data and config stored?” section. Please torture-test it to make sure everything is working properly, and report issues you may find (if any). Look for anything that might seem broken “compared to 0.4”, incorrect task parenting/associations, incorrect tagging, broken content, etc.

  • MAS ‘Ocean strainer’ technology to be open source

    Inspired by the success of its ‘Ocean Strainer’ floating trash trap, a pilot project launched in the Dehiwala Canal last year, MAS Holdings will make the ‘Ocean Strainer’ technology available to interested parties, to replicate and scale up the solution.

  • Notes on Addressing Supply Chain Vulnerabilities

    One of the unsung achievements of modern software development is the degree to which it has become componentized: not that long ago, when you wanted to write a piece of software you had to write pretty much the whole thing using whatever tools were provided by the language you were writing in, maybe with a few specialized libraries like OpenSSL. No longer. The combination of newer languages, Open Source development and easy-to-use package management systems like JavaScript’s npm or Rust’s Cargo/crates.io has revolutionized how people write software, making it standard practice to pull in third party libraries even for the simplest tasks; it’s not at all uncommon for programs to depend on hundreds or thousands of third party packages. [...] Even packages which are well maintained and have good development practices routinely have vulnerabilities. For example, Firefox recently released a new version that fixed a vulnerability in the popular ANGLE graphics engine, which is maintained by Google. Both Mozilla and Google follow the practices that this blog post recommends, but it’s just the case that people make mistakes. To (possibly mis)quote Steve Bellovin, “Software has bugs. Security-relevant software has security-relevant bugs”. So, while these practices are important to reduce the risk of vulnerabilities, we know they can’t eliminate them. Of course this applies to inadvertant vulnerabilities, but what about malicious actors (though note that Brewer et al. observe that “Taking a step back, although supply-chain attacks are a risk, the vast majority of vulnerabilities are mundane and unintentional—honest errors made by well-intentioned developers.”)? It’s possible that some of their proposed changes (in particular forbidding anonymous authors) might have an impact here, but it’s really hard to see how this is actionable. What’s the standard for not being anonymous? That you have an e-mail address? A Web page? A DUNS number?[3] None of these seem particularly difficult for a dedicated attacker to fake and of course the more strict you make the requirements the more it’s a burden for the (vast majority) of legitimate developers. I do want to acknowledge at this point that Brewer et al. clearly state that multiple layers of protection needed and that it’s necessary to have robust mechanisms for handling vulnerability defenses. I agree with all that, I’m just less certain about this particular piece.

  • 26 Firefox Quantum About:Config Tricks You Need to Learn - Make Tech Easier

    “Here be dragons,” reads the ominous disclaimer when you type about:config into Firefox’s URL bar, warning you that tweaking things in this area is largely experimental and can cause instability to your browser. Sounds exciting, right? And even though it sounds a little scary, the fact is you will almost certainly be okay when you start playing around in this area and can actually use the features here to improve and speed up your browser. These are Make Tech Easier’s favorite Firefox about:config tricks, freshly updated for Firefox Quantum.

  • Attackers collaborate to exploit CVE-2021-21972 and CVE-2021-21973 - Blueliv

Programming Leftovers

  • The HTTP Referer header is fading away (at least as a useful thing)

    The HTTP Referer header on requests is famously misspelled (it should be Referrer), and also famously not liked because of privacy and security concerns. The privacy and security concerns are especially strong with external ('cross-origin') Referers, which is also the ones that many people find most useful because they tell you where visitors to your pages are coming from and let you find places where people have linked to you or are mentioning you.

  • Top 10 Natural Language Processing (NLP) Trends To Look Forward

    AI and Machine Learning have gifted us marvelous things. NLP or Natural Language Processing is one of them. It is one of the most prominent applications of AI. We are using this technology in our day-to-day life without even knowing. Translators, speech recognition apps, chatbots are actually NLP-powered products. Tech giants like Google and Microsoft are making new developments in NLP every year. If you are an AI enthusiast, you should go deep inside NLP. Chill! We got you covered. Just go through the article, and know about the top NLP trends that most data scientists are talking about.

  • Russ Allbery: DocKnot 4.01

    DocKnot is my software documentation and release management tool. This release adds support for a global user configuration file separate from the metadata for any given project and adds support for signing generated distribution tarballs with GnuPG. Currently, the only configuration options for the global configuration file are to set the destination location of generated distributions and the PGP key to use when signing them.

  • horizonator: terrain renderer based on SRTM DEMs

    I just resurrected and cleaned up an old tool I had lying around. It's now nice and usable by others. This tool loads terrain data, and renders it from the ground, simulating what a human or a camera would see. This is useful for armchair exploring or for identifying peaks. This was relatively novel when I wrote it >10 years ago, but there are a number of similar tools in existence now. This implementation is still useful in that it's freely licensed and contains APIs, so fancier processing can be performed on its output.

  • Happy birthday, Python, you're 30 years old this week: Easy to learn, and the right tool at the right time

    The 30th anniversary of Python this week finds the programming language at the top of its game, but not without challenges. "I do believe that Python just doesn’t have the right priorities these days," said Armin Ronacher, director of engineering at software monitoring biz Sentry and creator of Flask, the popular Python web app framework, in an email interview with The Register. Ronacher, a prolific Python contributor, remains a fan of the language. He credits Python's success to being both easy to learn and having an implementation that was easy to hack. And in its early years, Python didn't have a lot of competitors with those same characteristics, he said.

  • Google fires 150 game developers hired for Stadia: Report

    In about two years, Google has announced to shut down the in-house Stadia game development division, as it sees a great adoption of its technology by third-party developers and publishers to create world-class games.

    Google has said that it will not be investing further in bringing exclusive content from its internal development team SG&E, beyond any near-term planned games.

Benchmarks at Phoronix and Phoronix Test Suite

  • Vulkan Ray-Tracing Along With Other New/Updated Benchmarks For February - Phoronix

    Below is a look at all of the updates now available via OpenBenchmarking.org for Phoronix Test Suite users or if simply wanting to go to the test profile pages to gauge the CPU/GPU performance in the different real-world workloads. All these updates are available to Phoronix Test Suite users automatically if on an Internet connection when the metadata automatically updates or by running phoronix-test-suite openbenchmarking-refresh to force refresh.

  • The Phoronix Test Suite Gains Vulkan Ray-Tracing Benchmarks

    The versatile Phoronix Test Suite, developed and used by the Linux news website Phoronix, has gained profiles for benchmarking Vulkan ray-tracing performance using two different benchmarks as well as the JPEG XL benchmarks. There's also updates to many of the existing tests as well as a new 10.2.2 release of the Phoronix Test Suite software. [...] Michael Larabel has also updated many existing benchmarks, including the ones for the commercial closed-source games Portal 2, Insurgency and Civilization VI, blender, the libavif AVIF image encoder, the dav1d AV1 video encoder, GROMACS (GROningen MAchine for Chemical Simulations), ParaView, V-RAY (commercial), Pennant (OpenMP benchmark), NWChem and the free software platform game DDraceNetwork.

today's howtos

  • How To Use chmod and chown Command in Linux

    How do I use chmod and chown command under Linux / Unix operating systems? Use the chown command to change file owner and group information. we run the chmod command command to change file access permissions such as read, write, and access. This page explains how to use chmod and chown command on Linux or Unix-like systems.

  • How To Add Route on Linux – devconnected

    As a network engineer, you probably spend a lot of time thinking and planning your network infrastructure. You plan how computers will be linked, physically using specific cables but also logically using routing tables. When your network plan is built, you will have to implement every single link that you theorized on paper. In some cases, if you are using Linux computers, you may have to add some routes in order to link it to other networks in your company. Adding routes on Linux is extremely simple and costless : you can use the Network Manager daemon (if you are running a recent distribution) or the ifconfig one. In this tutorial, you will learn how you can easily add new routes on a Linux machine in order to link it to your physical network.

  • syncing subtitles in freedom

    The topic of creating subtitles with Free Software has often come up in my circles of Emacs-oriented users, and I haven't had a good recommendation to share, until this idea hit me the other day. Subtitle files are largely blocks of start/end time associated with blocks of text. I figured, once you got a transcript, existing Emacs Org Mode features could be used, perhaps along with keyboard macros, to turn the transcript into a synced subtitle file.

  • How To Install Minecraft on Ubuntu 20.04 LTS [Ed: Proprietary and Microsoft; not an attractive option as Free/libre alternatives exist]

    In this tutorial, we will show you how to install Minecraft on Ubuntu 20.04 LTS. For those of you who didn’t know, Minecraft is the most popular sandbox video game developed by Mojang studios but later purchased by Microsoft. It can be used with all major platforms like Linux, macOS, and Windows. Most Minecraft players would agree that the secrete to the game’s success lies in its creativity-inspiring design. Players are free to explore a large, procedurally generated world made of blocks, each of which can be interacted with, moved, or transformed into resources for crafting. This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you through the step-by-step installation of Minecraft on Ubuntu 20.04 (Focal Fossa). You can follow the same instructions for Ubuntu 18.04, 16.04, and any other Debian-based distribution like Linux Mint.

  • Ubuntu: format SD card [Guide]

    Are you new to Ubuntu? Do you need to format your SD card but can’t figure out how to do it? If so, this guide is for you! Follow along as we go over a few ways you can format SD cards on Linux.

  • How to remove a remove apt repository from Debian

    Do you have an Apt repository on your Debian Linux PC that you want to delete? Can’t figure out how to do it? We can help! Follow along as we go over two ways you can remove Apt repositories from Debian!

  • The Raspberry PI Cheat Sheet – Raspberry PI User

    The Raspberry PI cheat sheet gives a quick overview of common commands, installation tips and links to guides to help you set up your Raspberry PI as a desktop computer.

  • Do a Kernel Upgrade the Easy Way in Linux Mint

    Upgrading the Linux kernel can be difficult, especially for new Linux users. In Linux Mint, however, it's possible to upgrade to a newer kernel with zero hassle. Today we'll find out how to do it, and what to do if you experience problems.