LWN Weekly Edition
Leading itemsSecurity
Kernel development
Distributions
Development
Linux in the news
Announcements
->Multipage format
This page
Previous weekFollowing week
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
LWN.net Weekly Edition for September 11, 2008Waiting for Rockbox 3.0 - againRockbox is a GPL-licensed replacement firmware for a number of digital audio players. LWN published an article on the imminent Rockbox 3.0 release in May, 2006. Well over two years later, it is clear that some projects use a larger value of "imminent" than others. In this case, the Rockbox developers concluded that certain problems simply were not going to be resolved in any reasonable 3.0 time frame; rather than make a major release with known problems, they simply gave up on 3.0 at that time. As a result, the current stable Rockbox release is Rockbox 2.5, from September, 2005.It is probably safe to bet that few Rockbox users are running 2.5, which only had support for a handful of Archos players. Grabbing a daily build is a fact of life in the Rockbox community. Meanwhile, Rockbox has performed a valuable service for Debian developers who would otherwise have to struggle to find a project with longer release cycles than their own. Perhaps that state of affairs is about to change. Back in July, the project announced that, once again, an attempt was to be made for a 3.0 release. On August 15, Rockbox went into feature freeze, with the 3.0 release planned for "within a couple (as in two) weeks." That, of course, was a few (as in three) weeks ago, but this release is clearly getting closer. Now would seem like the time for the project to begin its hype campaign with lots of screenshot-heavy articles on all of the features this major release will bring. Evidently the Rockbox developers have some strange ideas about actually working on the code, though; they haven't gotten around to the promotional side of things yet. So, while the Rockbox manual is reasonably comprehensive and current, it's hard to come up with a list of changes for the 3.0 release. At the top of any list would have to be the list of supported players, which has expanded considerably since the 2.5 release. The Rockbox buyer's guide gives a good summary of the currently-supported players. Alas, none of these players are currently in production, though some can still be found on auction sites and elsewhere. There is progress toward support for some more contemporary players; early successes have been announced for the Cowon iAudio D2 and iAudio i7 devices. Those players will not be supported in the 3.0 release, of course, and the Rockbox developers have reserved the right to withhold support for other players as well if it is not stable enough. Beyond that, changes to Rockbox in recent times include the ever-growing list of codecs (including some video formats on suitable players), a five-band parametric equalizer, an increasingly powerful theme capability with many user-contributed themes, album art display, a highly capable tag database, Speex codec support for the voice-based interface, and a whole host of new plugins including the much-anticipated Lamp plugin which displays a blank screen at full intensity, turning your player into an expensive, short-lived flashlight. Rockbox 3.0, it seems, will have something for almost everybody. [PULL QUOTE: Given that installation can be a bit of a sweaty-palms experience overshadowed by the fear of turning that nice, new player into a brick, any help which can be given is more than welcome. END QUOTE] It also appears that 3.0 may include the hard-to-find RBUtil program - a Qt-based tool which automates the process of installing Rockbox. Given that installation can be a bit of a sweaty-palms experience overshadowed by the fear of turning that nice, new player into a brick, any help which can be given is more than welcome. Bricks, after all, are not known for high-fidelity sound. Another recent event in the Rockbox community is the creation of the Rockbox Steering Board, currently consisting of Daniel Stenberg, Linus Nielsen Feltzing, Dave Chapman, Paul Louden, and Jens Arnold. The mandate for this board is not particularly clear; it seems to be intended to help break deadlocks in technical discussions. There have been some concerns raised that the creation of this board is a sign that Rockbox is moving into a more bureaucratic, slow-moving mode, but those worries are probably premature. Rockbox developers also recently decided that all of the project's code would be licensed as "GPLv2 or later." While there is no plan for Rockbox to switch to GPLv3, the developers wanted their code to be available to other projects which are using that license. Since Rockbox does not require copyright assignments, this change will require an audit to find any GPLv2-only code and either relicense it or remove it. There have been no public announcements on how that process is going. The Rockbox project faces a number of challenges. Cooperation from vendors is essentially zero, so all ports require a reverse engineering effort. Target platforms go through their market lifecycle quickly, making it difficult to get a port stable before the target device disappears. Its programming environment is highly specialized and resource-constrained, limiting the pool of developers who can work on the project. And, someday, the whole effort may lose its relevance as platforms become more capable and it gets easier to just run Linux on them. For now, though, there is nothing better for those who want a dynamic and user-oriented operating system for their digital audio player, and it continues to improve.
Fedora distributes new keysThe Fedora project is back on track after its recent "infrastructure issues" with new package signing keys as well as packages and updates signed with the new keys. Fedora users should be able to pick up the new key and update their systems now, with a minimum of hassle—just verifying and accepting the new key. But, no further information has been released about exactly what went wrong, leading to more speculation and some worry in the Fedora community. When a user gets a package from their distribution—or, more likely, a mirror of their distribution repository—they need to have some way to determine that it is a valid package. Distributors sign packages using a private key; that signature can then be verified by using the distribution's public key. If the private key gets compromised somehow, malicious packages could be created that would be indistinguishable from the real versions. This is why private signing keys must be well guarded, usually by isolating them on separate machines and encrypting them with a password. According to one of the announcements about the problem, there is no evidence that the passphrase used to guard the Fedora private signing key has been compromised, though the clear implication is that the encrypted key file may have been captured. Out of an abundance of caution—and perhaps the concern that the passphrase might be guessed or brute-forced—the project decided to generate new keys. Along with new keys come various headaches: re-signing all of the packages as well as getting the keys installed on user's machines. Getting the keys to users is largely a matter of getting the new fedora-release package—along with PackageKit and friends for GUI-enabled updates—installed. That package contains the new key and repository name (updates-newkey). Of necessity, those updates are the last that will be signed with the old key, so they will install on existing Fedora systems. Once that package makes its way out to the mirrors, users can install it so that they can proceed with any needed updates using the new key. A yum clean metadata was helpful at the time of this writing to accelerate the process; depending on which mirror is being used and when it gets updated, that may not be needed. After fedora-release is installed, yum list updates gives a long list of updates available, all signed with the new key. All a user needs to do is verify the key and add it to the RPM key database. Verifying the key is a manual step as a user must check its fingerprint against that published on the web site. The method described requires importing the key into gpg, then doing gpg --fingerprint fedora@fedoraproject.org to see the key fingerprint; this is clearly something that could be made easier. As part of phase one of the re-signing, Fedora has re-signed all Fedora 8 and 9 package updates. Phase two is ongoing, re-signing each package that is distributed as part of the original release of Fedora 8 and 9. Fedora 10 already has a new signing key as well. From the perspective of a possible compromise of the signing keys, things are well on their way back to normal. But there is still the nagging issue of how this all came about to begin with. Several different questions about the intrusion were directed at the Fedora board from community members in their IRC meeting on September 9. Unfortunately, there was no new information forthcoming, nor was there any indication of when that information might be available. According to the board member Tom "spot" Callaway, information will be released "when we're told that we can by the parties running the investigation, not a second before, and not a second later." Red Hat is clearly holding all information about the intrusion as a closely guarded secret—whether that is at the behest of law enforcement or just lawyers is unclear. While there was no timeline given, the clear sense that one got from the meeting is that it might be weeks or months before clearance will be granted to even confirm that they know how the intrusion occurred. In addition, the Fedora board has not been officially briefed on the incident; some members have knowledge because of their Red Hat responsibilities, but the rest are in the dark. If one needed a reminder that Fedora is not an independent distribution, but instead is subject to the whims of Red Hat, this is a clear demonstration. The justification for secrecy is that Red Hat is a publicly traded company so intrusions into its systems need to be treated differently. Some board members believe that had there not been an intrusion into the servers that handle packages for Red Hat Enterprise Linux—that is if it had only been Fedora servers that were affected—the incident would have been handled much more transparently. Overall, the board is clearly unhappy about the situation but, perhaps because they are almost all Red Hat employees, don't see that there is much that can be done about it. That too should serve as a reminder. It should be noted that Debian has had several server compromises over the years (for example, 1 and 2), which is, perhaps, a poor record of server security, but it is an excellent example of transparency. Debian is rather well known for its independence, which is part of what allows it to be so open. Those incidents do serve as examples; perhaps they are not an exact fit for the current Fedora/RHEL intrusion but that remains to be seen. It may very well be that Red Hat is between a rock and a hard place here. As a friend to free software, Red Hat is unparalleled, but once in a while it shows that it is foremost a corporation with responsibilities to its shareholders. When those responsibilities conflict with the transparency we have come to expect from free software projects—especially with regard to security issues—that transparency must be set aside. One can argue that Red Hat is being overly protective of the details—confirmation that they either know or do not know how the intrusion occurred for example—but that argument really can't be made until all the facts are known. For that we must wait for the process to run its course.
Kernel security, year to dateEarlier this year, your editor asked a high-profile kernel developer, in a public discussion at a conference, about the seemingly large number of kernel-related security bugs. Was the number of these vulnerabilities of concern, and what was being done about it? The answer that came back was that security issues aren't a huge concern, that most of the reported issues were obscure local exploits requiring the presence of specific hardware. Serious issues, like the vmsplice() vulnerability, are rare.More recently, as part of the panic associated with getting a talk together for the Linux Plumbers Conference, your editor decided to take a closer look at kernel vulnerabilities. It turns out that there are, in fact, quite a few of them. The vulnerabilities which have been given CVE numbers in 2008 (so far) are:
That is 41 CVE numbers (so far) for 2008 - not a small number. Fully 1/3 of these vulnerabilities were in the networking subsystem, which is scary: this is the most likely place to find remotely-exploitable problems in the kernel. It is true that sites not running SCTP or DCCP can forget about many of those, and IPv6 is responsible for a few of the rest, so most of those vulnerabilities were not a concern for most sites. Many of the remaining vulnerabilities were in the core kernel or in architecture-specific code. The number of vulnerabilities found in drivers - the part of the kernel which has long been sneered at as containing the worst code - is actually quite small. On the other hand, four of the CVE-listed vulnerabilities (the Xen, AppArmor, and utrace problems) were caused by out-of-tree code added by distributors. There is no way to know how many vulnerabilities were fixed without obtaining a CVE number - or without even realizing that a vulnerability existed in the first place. When a single program is responsible for this many vulnerabilities, it makes sense to ask why. The kernel, of course, is a very large program; more code means more bugs, some of which will have security implications. Beyond that, though, the kernel runs in a special, privileged environment. Flaws which would simply be fixed as just-another-crash in a normal application are denial-of-service vulnerabilities in the kernel - or worse. So a larger number of vulnerabilities in the kernel does not, by itself, imply that the kernel's code is worse than that of other programs; it only reflects the fact that the consequences of kernel bugs tend to be more severe. The discovery (and repair) of vulnerabilities does not necessarily imply that our current process is creating a lot of vulnerabilities; it could be that we are mostly fixing older problems. If the developers are fixing vulnerabilities more quickly than they are adding more, life should be good in the long run. The vulnerabilities in the list above vary from those which are very old (affecting 2.4 kernels too) to some which are very new (the UVC driver was added in 2.6.26). Some of them are in code which, while being intended for the mainline, has not yet been merged. It is probably impossible to say whether security problems are being fixed more quickly than they are being created, but one thing is clear: all of that code flowing into the mainline is bringing a certain number of security problems with it. For that reason, it is a little discouraging that there is little work being done in the kernel community with the explicit goal of improving the security of the kernel. Few patches are reviewed with security issues in mind; the vmsplice() vulnerability, as one example, was a clear failure of the review process. There are undoubtedly many people who are doing fuzz testing and such - some of them are even the good guys - but much of the formal testing going on seems aimed more at API conformance than at security verification. There must be more work going on behind the scenes, but it is still hard to avoid a sense of a certain amount of complacency with regard to security issues. As a community, we take pride in the security of our system. But one vulnerability per week is not the most inspiring security record. It would be good to find a way to do better than that. Better tools must be a part of the solution, but more thorough code review is also needed. There still is no substitute for a pair of eyeballs looking for ways in which new code might be subverted. Asking for more security-oriented review seems ambitious when code review is already one of the biggest bottlenecks in the development process. But the alternative would appear to be to continue to add to our collection of CVE numbers.
Security DR rootkit released under the GPLA free software Linux rootkit has been announced with a number of interesting features. Its availability may, unfortunately, help lower the bar for "script kiddies" and others, but it also provides a nice look into what makes up a rootkit. The rootkit, called DR for Debug Register, uses some new techniques to evade detection, such that even a change recently proposed for inclusion in the kernel would have missed it. A rootkit is malware that typically hooks into the kernel to hide its presence from administrators. Usually, rootkits can hide their processes from /proc, which in turn means ps won't see them, but sophisticated rootkits do much more than that. DR can also hide network sockets and files in the filesystem that are associated with rootkit processes. There are some benefits to this approach as the announcement describes:
The major benefit of the DR rootkit is that all this happens
transparently to the end user. The children of a hidden process are also
automatically hidden. The sockets a hidden process creates are also
hidden. But if you are a hidden process, you can see hidden resources.
This makes the DR rootkit nicely manageable.
Unlike many rootkits, DR does not alter the system call table directly. Instead it sets a hardware breakpoint for the syscall_call() function which gets called whenever a system call is made. When that breakpoint is reached, a handler is set up to watch for an access to the memory location where the specific system call's function pointer lives (i.e. syscall_table[__NR_syscall]). When the address is retrieved from that location, the breakpoint substitutes the address of the code the rootkit wants to run—the system call hook. The system call hooks is where the work is done to evade detection. By hooking less than a dozen different calls, DR can hide its processes, files, and sockets. By creating a program that does an exec() of a special filename—one that starts with "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"—one can set the "hidden" bit on the process; spawning a shell or running some malware after the exec() fails will cause those processes to no longer be visible to the rest of the system. There are some limitations outlined in the announcement, the biggest of which is that DR is implemented as a kernel module without any attempt to hide its presence. Doing an lsmod will show it clearly, but there are other ways to detect it as well. Fixing those are all are on the "to do" list and won't take a very large effort to complete. DR was created by Immunity, Inc. as part of their penetration testing efforts and has been released under the GPLv2. It contains roughly 1200 lines of well-documented code that should be of interest to anyone curious about rootkits. It is not the first rootkit available with source code, Adore predates it by several years and there are probably others, but it is an interesting—if a bit scary—release.
New vulnerabilities adminutil: multiple vulnerabilities
awstats: cross-site scripting
bitlbee: account hijack
clamav: multiple vulnerabilities
courier-authlib: SQL injection
django: cross-site request forgery
drupal: multiple vulnerabilities
php: multiple vulnerabilities
R: temporary file vulnerability
samba: wrong permissions of group_mapping.ldb
vlc: multiple vulnerabilities
wordpress: privilege escalation
xastir: insecure temporary files
xine-lib: denial of service
Page editor: Jake Edge Kernel development Brief items Kernel release statusThe current 2.6 development kernel is 2.6.27-rc6, released on September 9. "Same old deal - except it's been almost two weeks since -rc5. That said, the diff is actually about the same size, so I guess that means things are calming down." Full details may be found in the long-format changelog.As of this writing, no patches have been merged into the mainline repository since the 2.6.27-rc6 release. The current stable 2.6 kernel is 2.6.26.5, released on September 7. It contains a single fix for a build error introduced by 2.6.26.4, released earlier the same day. 2.6.26.4 contains a fairly long list of bug fixes. Also released on the 7th was 2.6.25.17, also containing a fair number of fixes. For older kernels: the 2.4 process has restarted with the release of 2.4.36.7, fixing "several minor security issues" and a few other problems. 2.4.37-rc1 is also out; this one includes a number of enhancements; see the announcement for details.
Kernel development news Quotes of the week
There's patronage. This is where the Crown
Prince of Bavaria, say, gives Linus Torvalds a castle and a moat, and bids him
to write code for the pleasure of the court, or else be thrown in the dungeon
with those BSD mongrels. Linus goes on to create great works, often prefaced
with a large set of logon messages in praise of his honoured patron, only to
die later in poverty following some dismissive comments he includes in a
kernel driver about the CEO of OSDN's mistresses' pet lioness.
-- Danny
O'Brien (a recycled column but still fun).
Critics of patronage point out to live on the whims of a distant, self-involved elite is a demeaning life for Linux programmers, reminiscent as it is of both medieval surfdom and being a mere Linux user, both of which being horrid epochs that as a civilisation we imagine we have transcended.
In Ubuntu we have in general considered upstream to be "our ROCK",
by which we mean that we want upstream to be happy with the way we
express their ideas and their work. More than happy - we want
upstream to be delighted! We focus most of our effort on
integration. Our competitors turn that into "Canonical doesn't
contribute" but it's more accurate to say we measure our
contribution in the effectiveness with which we get the latest
stable work of upstream, with security maintenance, to the widest
possible audience for testing and love. To my mind, that's a huge
contribution.
-- Mark
Shuttleworth
Grr. I'd love to say "I told you so", and write another rant about
-rc series patches. But I'm too lazy, so people - please mentally
insert my standard rant here.
-- Linus Torvalds
I didn't know that sending a test patch which is admittedly not pretty
is a capital crime nowadays.
-- Thomas Gleixner
In future I'll restrict myself to look at such stuff only on Monday to Friday between 9AM and 5PM and send test/RFC patches only when they got approved by the nonshitapproval committee, which holds a meeting once a month.
Tightening the merge window rulesThe 2005 kernel summit included a discussion on a recurring topic: how can the community produce kernels with fewer bugs? One of the problems which was identified in that session was that significant changes were often being merged late in the development cycle with the result that there was not enough time for testing and bug fixing. In response, the summit attendees proposed the concept of the "merge window," a two-week period in which all major changes for a given development cycle would be merged into the mainline. Once the merge window closed, only fixes would be welcome.Three years later, the merge window is a well established mechanism. Over that time, the discipline associated with the merge window has gotten stronger; it is now quite rare that significant changes go into the mainline outside of the merge window. The one notable exception is that new drivers can be accepted later in the cycle, based on the reasoning that a driver, being completely new and self-contained functionality, cannot cause regressions. Even then, there are hazards: the UVC webcam driver, merged quite late in the 2.6.26 cycle (in 2.6.26-rc9), brought a security hole with it. The merge window rule is often expressed as "only fixes can go in after the -rc1 release." Recent discussions have made it clear, though, that Linus is starting to develop a rather more restrictive view of how development should go outside of the merge window. The imminent 2008 kernel summit may well find itself taking on this topic and making some changes to the rules. In short, Linus has concluded that "fixes only" is not disciplined enough; a lot of work characterized as a "fix" can, itself, be a source of new regressions. So here's how Linus would like developers to operate now:
Here's a simple rule of thumb:
There can be no doubt that the tighter rules have come as a surprise to a number of developers - if nothing else, the frequency with which Linus has found himself getting grumpy with patch submitters makes that clear. And, the truth of the matter is that Linus has not enforced anything like the above rule in the past. Beyond new drivers, post-merge-window changes have typically included things like coding style and white space fixups, minor feature enhancements, defconfig updates, documentation updates, annotations for the sparse tool, and so on. Relatively few of these changes come equipped with an entry on the regression list. To look at this another way, here's a table which appeared in the 2.6.26 development statistics article, updated with 2.6.27 (to date) information:
2.6.27 appears to be following the trend set by previous kernels: on the order of 25% of the total changesets will be merged outside of the nominal merge window. The most recent 2.6.27 regression summary shows a total of 150 regressions during this development cycle, of which 33 were unresolved. That suggests that at least 2300 patches merged since 2.6.27-rc1 were not fixes for listed regressions. So the "regression fixes only" policy is truly new - and not really effective yet. Should this policy hold, it could have a number of interesting implications including, perhaps, an increase in the number of non-regression fixes shipped in distributor kernels. It might make developers become more diligent about reporting regressions so that the associated fix can be merged. With fewer changes going in later in the cycle, development cycles might just get a little shorter, perhaps even to the eight weeks that was, once, the nominal target. And, of course, we might just get kernel releases with fewer bugs, which would be a hard thing to complain about. In the short term, though, expect more grumpy emails to developers who are still trying to work by the older rules.
LIRC delurksThe Linux Infrared Remote Control project (LIRC) provides drivers for a number of infrared receivers and transmitters. It is, perhaps, most heavily used by people running MythTV and similar packages; it would, after all, completely ruin the experience to have to get up from the couch to change channels. Despite their established user base, and despite the fact that a number of distributors ship the code, the LIRC drivers have never found their way into the mainline kernel. In more recent times, little effort has gone into their development and maintenance; the link to "Caldera OpenLinux" on the project's web site would seem to make that clear.But LIRC is useful code, and, as is the case with most out-of-tree drivers, most people would really rather see LIRC in the mainline kernel. Merging into the mainline got a step closer on September 9, when Jarod Wilson posted a version of the LIRC drivers for consideration. Jarod, it seems, has been working (with Janne Grunau) on these drivers for some months; in the process, they have eliminated "tens of thousands" of complaints from the checkpatch.pl script and cleaned up a number of things. Even after that work, though, the LIRC drivers are clearly not yet up to normal kernel standards. Some very strange coding conventions are used in places. Many of the drivers have broken (or completely absent) locking. Duplicated code abounds. One driver has implemented a command parser in its write() function. Another driver is for hardware which already has a different driver in the mainline. And, importantly, these drivers do not work with the input subsystem. [PULL QUOTE: The LIRC drivers would appear to strongly support the notion that out-of-tree code is, almost by necessity, worse code. END QUOTE] In the past, Linus Torvalds (and others) have argued for merging drivers as soon as possible. If the code is poor, its chances of being improved get much higher once it's in the mainline and others can fix it. The LIRC drivers would appear to strongly support the notion that out-of-tree code is, almost by necessity, worse code. These drivers have been around for almost a decade, have been packaged by distributors, and have been used by large numbers of people. Despite all of that, they contain a large number of serious problems which have never been addressed. Now that the drivers have been posted to the linux-kernel list, quite a few of these problems are being pointed out; Jarod and Janne have been responding to reviews and fixing the issues. The "merge drivers early" philosophy would argue for pushing LIRC into 2.6.28, even if serious problems remain. Presence in the mainline will raise the visibility of the code, inspiring (one hopes) more developers to work on fixing it up. Merging LIRC will also free distributors from the need to create separate packages for those drivers. One important question will have to be addressed before merging LIRC can be seriously considered, though: its user-space API. Once LIRC is merged, its user-space API will be set in stone, so any problems with that API need to be resolved first. LIRC, being out of the mainline, did not follow the development of the input subsystem, so it does not behave like other input drivers - even in-tree drivers for infrared remotes. The use of an in-kernel command-line parser in at least one driver is sure to raise eyebrows; that sort of interaction should really be handled via ioctl() or sysfs. All told, it is hard to imagine this code being merged until the API problems have been resolved. Changing the LIRC API will, of course, lead to problems of its own. There is user-space code which depends on the current API; any changes will break that code. The kernel community will certainly understand this problem, but is unlikely to be swayed by it. There are a number of risks associated with maintaining production kernel code out of the mainline tree; one of those risks is that your established APIs will not be accepted by the kernel development community. So an API change may simply be part of the cost of getting LIRC into the mainline at this late date. It should be a cost worth paying. Once LIRC is in the mainline, interested developers will work to continue to bring the code up to kernel standards. The community will maintain it going forward. All Linux users will get the LIRC drivers with their kernel, with no need to deal with external packages. Getting there may be a bit frustrating for users of remotes and (especially) for the developers who have taken on the task of getting this code into the mainline. But, once it's done, remotes will just be more normal hardware, supported by the kernel like everything else.
System calls and rootkitsA patch to add some security checks before making system calls would seem like a reasonable addition to the kernel, but because it is, at best, a half-measure, it received a less than enthusiastic response. Preventing rootkits—malware that alters the kernel to hide its presence and function—from altering the system call table was the rationale behind the patch, but it would only work for the current crop of rootkits. Once that change was made, rootkit authors would just change their modus operandi in response. There are many possible ways that a root user—or malware running as root—can modify a Linux system to run rootkit code. Some currently "popular" rootkits modify the system call table, though it is ostensibly read-only. Some commercial malware scanners that run on Linux have also been known to use this technique. In both cases, certain system calls are re-routed from the standard kernel code to code that lives elsewhere. That code, running in kernel mode, can then do just about anything it wants with the system. Arjan van de Ven proposed a patch that hooked into the system call entry code to check the address of the call to ensure that it was within the addresses occupied by kernel code. He describes the change and its impact this way:
The patch below, while obviously not perfect protection against malware,
adds some cheap sanity checks to the syscall path to verify the
system call is actually still in the kernel code region and not some
external-to-this region such as a rootkit.
The overhead is very minimal; measured at 2 cycles or less. (this is because the branches get predicted right and the rest of the code is almost perfectly parallelizable... and an indirect function call is a branch issue anyway) Various kernel hackers pointed out the flaws inherent in that scheme. As Andi Kleen succinctly puts it:
This just means that the root kits will switch to patch
the first instruction of the entry points instead.
[...]
So the protection will be zero to minimal, but the overhead will
be there forever.
One of the more interesting ideas to come out of the discussion was Alan Cox's thoughts on using a hypervisor to enforce protections:
The only place you can expect to make a difference here is in virtualised
environments by teaching KVM how to provide 'irrevocably read only' pages
to guests where the guest OS isn't permitted to change the rights back or
the virtual mapping of that page.
Ingo Molnar described a rather complicated scheme that might increase the likelihood of a rootkit being detected, but with a fairly high cost—in build complexity as well as the ability to debug the resulting kernel. The compiler would be changed to insert calls to rootkit checks randomly throughout the kernel binary in ways that would be difficult or impossible for a rootkit to detect and evade. In the end, though, a rootkit could simply install a new kernel that does exactly what it wants, then cause, or wait for, a reboot. Without some kind of hardware enforcement (e.g. Trusted Platform Module) or locked-down virtualization, Linux is defenseless against attacks that run as root. The kernel could change to thwart a particular kind of attack, such as van de Ven's patch, but other kinds of attacks will still succeed. It is clearly a situation where "the only way to win is not to play this game", as Pavel Machek—amongst others—noted in the thread. In the end, van de Ven wrote off the patch as an exercise in measuring the cost of this kind of runtime checking. It was fairly low cost solution, but without any major upside. The real upside was getting kernel hackers thinking about the problem, which could lead to some better solutions down the road.
Patches and updates Kernel trees
Build system
Core kernel code
Development tools
Device drivers
Documentation
Filesystems and block I/O
Janitorial
Memory management
Networking
Architecture-specific
Security-related
Virtualization and containers
Benchmarks and bugs
Miscellaneous
Page editor: Jonathan Corbet Distributions News and Editorials What's up with the Intrepid IbexUbuntu's current development release is called the Intrepid Ibex, which is soon to become v8.10. The Alpha5 release was announced this week, which is pretty close to on schedule. One more alpha release is planned, followed by a single beta, and the final release should be available by October 30, 2008.Looking at the blueprints for Intrepid we see a number of high priority items such as 3G networking, which will be integrated into NetworkManager. Another high priority item is an improved flash experience, which is aimed at improving the plugin finder wizard, better interaction with sites that use the flash detection kit, and an improved user-experience for selecting available alternatives. Internally there are the Package Status Pages, which are meant to provide a web page for each of the top 20-30 packages in Ubuntu showing bug counts and other vital signs and statistics. What else is new in Intrepid? GNOME 2.23.91, X.Org server 7.4, Linux kernel 2.6.27, and Network Manager 0.7 are all being included. An encrypted private directory will also be added to each home directory. In addition, there's a Guest session available from the User Switcher panel applet to give temporary access with restricted privileges. Dynamic Kernel Module Support (DKMS) is also available in Intrepid. It allows kernel drivers to be automatically rebuilt when new kernels are released. This makes it possible for kernel package updates to be made available immediately without waiting for rebuilds of driver packages, and without third-party driver packages becoming out of date. Finally, the "Last successful boot" recovery entry retains a copy of your running kernel and makes it available from the boot loader. This makes it possible for old kernel packages to be safely auto-removed by the package manager, instead of being kept indefinitely. Kubuntu will be using KDE4, with no plans to support KDE3. The Kubuntu wiki for Intrepid says, "KDE 3 is obsolete and largely unmaintained. Keeping with KDE 3 would offer no advantage over giving users Hardy." Bug squashing has been ongoing, with a number of focused Hug Days. The latest of these will be held September 11 to focus on bugs that don't have a package assigned to them. There are still a few known issues in the Alpha5 release, but overall the development is progressing nicely. Of course, if wild mountain goats are not your thing (however intrepid they might be), you can always wait for the more mythological Jaunty Jackalope, which will be in the planning stages at a Ubuntu Developer Summit (UDS) in Mountain View, California next December.
New Releases Intrepid Alpha 5 releasedUbuntu's Intrepid Ibex (v8.10) has reached the fifth alpha release. Intrepid Alpha 5 is also available in Ubuntu Education Edition, Kubuntu and Xubuntu flavors.
Distribution News Debian GNU/Linux Debian/m68k meeting in KielThe Debian m68k porters met recently at the Christian Albrechts University in Kiel, Germany. The m68k port will not be officially supported in Debian Lenny. "The most pressing matter we discussed, however, has been what we thought the best way to go forward was. Contrary to what some people may think, the end of Debian/m68k on debian.org to us does not mean the end of the Debian/m68k port as a whole; and while we may be having problems currently, most of these problems are on their way to bein solved medium to long term."
Fedora Fedora status updateThere's a new update on the status of updates for the Fedora 8 and 9 distributions. "We're in the final stages of testing a few corner cases, and preparing the official builds of fedora-release, PackageKit, gnome-packagekit, and unique (needed as a new dep for gnome-packagekit). All existing updates in the old update locations will be purged, and just these updates will be put in their place, signed with our old key. Once you've updated to these packages, the next update attempt will point you to our new locations with our new keys and you should be able to process any further pending updates." Things should be getting back to normal before too long.
Fedora 8 and 9 updates re-enabledNewly signed packages, along with a rather large backlog of updates, for Fedora 8 and 9 are making their way out to the mirrors and should be available to users soon. The process of getting the new keys and repository locations is meant to be fairly straightforward—nearly transparent. A FAQ is available as well. "In a few hours, updates for Fedora 8 and Fedora 9 will start hitting mirrors. These updates are designed to transition users from our old repo locations to new locations that have all our updates re-signed with a new set of keys." Click below for the full announcement.
FESCo Issue trackingThe Fedora Engineering Steering Committee (FESCo) has a new way for users to bring issues to their attention. New issues for FESCo can now be filed at https://fedorahosted.org/fesco/. "Note that FESCo (Fedora Engineering Steering Committee) handles the process of accepting new features, the acceptance of new packaging sponsors, Special Interest Groups (SIGs) and SIG Oversight, the packaging process, handling and enforcement of maintainer issues and other technical matters related to the distribution and its construction"
SUSE Linux and openSUSE KDE in openSUSE 11.1 and beyondJoe Brockmeier looks at the status of KDE in openSUSE 11.1. KDE 3.5 will be available, although the package selection may be slimmed down on the DVD, and will not be included on the main desktop selection page. Click below for more on the availability of KDE 3.5 in 11.1 and in 11.2.
Ubuntu family Introducing the Jaunty JackalopeUbuntu has announced the follow-up to the Intrepid Ibex, this time with a mythical creature, the Jaunty Jackalope. "The Warrior Rabbit is our talisman as we move into a year where we can reasonably expect Ubuntu to ship on several million devices, to consumers who can reasonably expect the software experience to be comparable to those of the traditional big OSV's - Microsoft and Apple. The bar is set very high, and we have been given the opportunity to leap over it. It's a once-in-a-lifetime chance to shine, and we want to make sure that the very best thinking across the whole open source ecosystem is reflected in Ubuntu, because many people will judge free software as a whole by what we do." Click below for the full announcement.
New Distributions Ojuba LinuxOjuba Linux is an Arabic Fedora-based distribution with packages translated to Arabic/Islamic languages such as hijra and minbar. Many packages have been patched to have better Arabic support. Ojuba Linux comes with some third party packages to have multimedia support for proprietary formats and proprietary drivers. Thanks to Muayyad AlSadi.
Distribution Newsletters DistroWatch Weekly, Issue 269The DistroWatch Weekly for September 8, 2008 is out. "This week's feature story is a review of Debian GNU/Linux 5.0 "Lenny" on the ASUS Eee PC. With Debian being the first Linux distribution to have an open communication channel with the Taiwan-based hardware manufacturer, our expectations were high, but is Lenny really a good choice for the popular ultra-portable? Read on to find out. In the news section, Google restarts the browser war with Chrome, Dell unveils the long-awaited Inspiron Mini 9, Mandriva Linux 2009 enters the release candidate stage, and Fedora calls on beta testers to help with testing the promising ext4 file system. Also worth a mention, a new community edition of openSUSE 11.0 with Enlightenment as its principal window manager is now available for download. Finally, a lot of interesting news for the fans of Linux Mint as Clement Lefebvre announces a range of upcoming community editions before giving an excellent interview on a Linux news blog."
Fedora Weekly News, Issue 142The Fedora Weekly News for September 7, 2008 is out. "This week in Announcements we alert you to the "Fedora 10 Beta Freeze Coming Soon" and the new "FESCo Issue Tracking". In PlanetFedora "Tech Tidbits" contains some juicy morsels on evaluating package sizes and Haskell. In Developments we examine the process of "Getting Back On Our Feet" after the intrusions. SecurityAnnouncements finally has some content. Artwork covers "Working on a Sound Theme" and the acceptance of the "Echo Icon Theme as a Fedora 10 Feature""
OpenSUSE Weekly News/37This edition of the openSUSE Weekly News looks at Hack Week III Judging, Novell OpenPR Blog: Zonker Blogs, Board election, Hackweek review, Jigish Gohil: Spin openSUSE Live CD or USB stick image "easily", Stephan Binner: New KDE Four Live-CDs, and much more.
PCLinuxOS Magazine September 2008The September edition of PCLinuxOS Magazine is available in the HTML version or the PDF version. Some highlights from this editon include: Linux Media Players - Round up, Gnome User Guide, Connect an XBox and PCLinuxOS, Chapter 6- Kde User Guide, and more.
Ubuntu Weekly Newsletter #107The Ubuntu Weekly Newsletter for September 6, 2008 covers: Intrepid Alpha 5 released, KDE Community Stabilizes Desktop with KDE 4.1.1, KDE 4.1.1 available for Kubuntu 8.04, Wanted: Moderators for Ubuntu Brainstorm, Ubuntu Developer Week Summary, PackageKit: Call for testing, New MOTU, Ubuntu Package Status Pages, New Proposed WikiGuide page, Call for feedback on new wiki theme, Ubuntu-UK podcast #13, Say Ubuntu, KDE Usability project video, Atlanta Linux Fest, and much more.
Interviews Interview with Joe Brockmeier - openSUSE Community Manager at Novell (How Software is Built)How Software is Built has an interview with Joe Brockmeier. "Sean: Tell us a bit about where you feel openSUSE sits in the landscape of desktop distributions. What do you think it's exceedingly good at, and maybe some of the places where you see challenges or opportunities? Joe: Generally, my metric for success on the desktop is how well it fits what people need. I don't really spend a lot of time comparing it to other Linux distros, because I really think we all have the same mission, which is to get people using Linux. So I don't view them as competition, so much as inspiration, if anything. The audience we're trying to address includes home office users and others who want a good, solid desktop operating system that's as easy to use as possible. I think openSUSE is exceedingly good at package management, being easy to use, offering a top-notch desktop experience in GNOME or KDE, and providing a wide range of the best free and open source software available. Our challenge is reaching new users and encouraging more users to become contributors."
Minty Chat with Mr. Clement Lefebvre (Help for Linux)The BlogSpot site Help For Linux has an interview with Clement Lefebvre, the creator of Linux Mint. "Linux Mint is a project which is among the most innovative and prolific in regards to developing GTK applications. Of course we like to make the distribution look nice, we do include the codecs and we do sit on top of a great package base (credit for this goes to Ubuntu but also to Debian by the way). What we do though, where we spend a lot of time and where we really add value to the Linux desktop has to do with development. We implemented our own software and upgrade managers, we have a unique Gnome menu, we designed a file-sharing system which doesn't exist anywhere else and these are some of the things we like to be appreciated for."
Page editor: Rebecca Sobol Development The OpenBTS project creates a stand-alone cell phone networkOn September 3, 2008, Harvind Samra announced the new OpenBTS project:
The Open BTS Project is an effort to construct an open-source Unix application that uses the
Universal Software Radio Peripheral
(USRP) to present a
GSM air interface ("Um") to standard GSM handset and uses the
Asterisk software PBX
to connect calls. The combination of the ubiquitous GSM air interface with VoIP backhaul could form the basis of a new type of cellular network that could be deployed and operated at substantially lower cost than existing technologies in greenfields in the developing world.
OpenBTS is currently a work in progress, released components (and the associated pile of telecom acronyms) include a Gaussian minimum-shift keying (GMSK) radio modem and interface code for the USRP hardware, GSM forward error correction (FEC) coders and decoders, GSM L3 message serializers/deserializers, a hybrid GSM/SIP control layer, and a partial short message service (SMS) stack implementation. There are plans for expanding the functionality of the various components of the code. The fairly short project FAQ notes a potential legal issue with a proposed workaround solution: "Although the project founders have built a more complete GSM BTS (base transceiver station), some of that code may be the subject of a legal dispute. While the authors deny any wrongdoing is this matter, it would still not be prudent to release all of the code in these circumstances... Hopefully, the incomplete parts can be replaced quickly." The OpenBTS developers ran a recent alpha-level system field test at the 2008 Burning Man art/technology festival in the Nevada desert. They applied for and received a temporary FCC license, memorialized by this poster, in order to keep everything legal with the licensing authorities. Around $7000 worth of radio equipment was assembled. To top it off, everything was powered by a small wind generator and a 12V battery. A WiFi backhaul connection was made to a nearby satellite ground station to provide VoIP connectivity to the external world. Some interesting technical problems were encountered, including being flooded by connections from active cell phones that were looking for connection points when the system was first activated. Another issue discovered was a "security hole" involving unlimited external long distance dialing. After sorting through the various issues, the system was declared operational. Many in-system and external voice and text connections were made, the alpha test was declared a success. The live field test resulted in exposing a lot of real-world problems that led to numerous code improvements. There's no doubt that sitting in a tent in a hot and windy desert is a fairly difficult environment to develop code in, but progress was made nonetheless. The OpenBTS project illustrates the kind of technical advances that can be made by a small, but dedicated group of people using open-source software and open hardware.
System Applications Audio Projects PulseAudio 0.9.12 releasedVersion 0.9.12 of the PulseAudio sound server has been announced. See the change log for more details.
Database Software PostgreSQL Weekly NewsThe September 7, 2008 edition of the PostgreSQL Weekly News is online with the latest PostgreSQL DBMS articles and resources.
pysqlite 2.5.0 releasedVersion 2.5.0 of pysqlite, a DB-API 2.0-compliant database interface for SQLite, has been announced. "This is a release with major new features."
Networking Tools Net-SNMP: 5.4.2 released (SourceForge)Version 5.4.2 of Net-SNMP has been announced. "net-snmp provides tools and libraries relating to the Simple Network Management Protocol including: An extensible agent, An SNMP library, tools to request or set information from SNMP agents, tools to generate and handle SNMP traps, etc. I'm happy to announce the release of version 5.4.2 of Net-SNMP, which is the newest version in the development of the project and contains many bug fixes over the 5.4.1 release."
SkipoleMonitor 0.8 releasedVersion 0.8 of SkipoleMonitor has been announced. "SkipoleMonitor is a free network monitor for Windows and Linux. On running the program, a GUI window appears, and hosts can be added, which Skipole Monitor will regularly ping, showing the results via a built-in Web server. Hosts can be grouped, so the Web server will show group symbols which the viewer can open to inspect the hosts, or further sub-groups, within. As hosts (and groups of hosts) change status, SkipoleMonitor can be set to send email and syslog alerts."
Web Site Development Django 1.0 releasedVersion 1.0 of the Django web development platform has been announced. "No, youre not hallucinating, its really here. Around three years ago, Adrian, Simon, Wilson and I released some code to the world. Our plan was to hack quietly on it for a bit, release a solid 1.0 release, and then really get the ball rolling. Well. What happened, of course, was that an amazing community sprung up literally overnight our IRC channel had over a hundred people in it the day after release, and its never been that empty since." See the release notes for more information.
Midgard 8.09.0beta2 releasedVersion 8.09.0beta2 of Midgard, a web content management system, has been announced. "When finalized, the 8.09 "Ragnaroek LTS" will be a Long Term Support version of Midgard for which bug fixes and minor feature improvements will be supplied by the Midgard community for several years. It is recommended that all Midgard users upgrade their installations to the Midgard 8.09 series for stability, performance and maintenance reasons."
Rails 2.1.1: Lots of bug fixesVersion 2.1.1 of the Rails web development platform has been announced. "Rails 2.1.1 is another maintenance release that includes a bunch of bug fixes and a fix for the REXML vulnerability. Ive extracted all the changes from the CHANGELOGs into a single Gist. Enjoy!"
web2py 1.40 is outVersion 1.40 of web2py, a Python-based web development platform, has been announced. "version 1.40 includes: - Database Abstraction Layer for SQLite, MySQL, PostgreSQL, MSSQL, FireBird, Oracle, and the Google App Engine. - More handlers for wsgi, fastcgi, mod_python and cgi (for the google app engine). - Setup scripts for production deployment."
Miscellaneous Andutteye: 3.0 is released (SourceForge)Version 3.0 of Andutteye has been announced. "Andutteye is an open source systems management platform that automates enterprise data centers and keeps them running. Andutteye provides a full featured and central monitoring and management solution."
Desktop Applications Business Applications PostBooks: 3.1 beta 2 (SourceForge)Version 3.1 beta 2 of PostBooks has been announced, it includes several new capabilities. PostBooks is: "Fully integrated ERP, CRM, and accounting for small to midsized businesses. Graphical client runs on Linux, Mac, and Windows (built with open source Qt framework). Business logic resides in PostgreSQL database server. Fully international-ready."
Data Visualization python-graph 1.2.0 releasedVersion 1.2.0 of python-graph has been announced. "python-graph is a library for working with graphs in Python. This software provides a suitable data structure for representing graphs and a whole set of important algorithms."
Desktop Environments GNOME 2.24.0 Beta 2 (2.23.91) ReleasedVersion 2.24.0 Beta 2 of GNOME has been announced. "You all know what you have to do now. Go download it. Go compile it. Go test it. And go hack on it, document it, translate it, fix it."
GNOME Software AnnouncementsThe following new GNOME software has been announced this week:
KDE Software AnnouncementsThe following new KDE software has been announced this week:
Xorg Software AnnouncementsThe following new Xorg software has been announced this week:
Encryption Software GPA 0.8.0 releasedVersion 0.8.0 of GPA has been announced. "GPA is a graphical frontend for the GNU Privacy Guard. GPA can be used to encrypt, decrypt, and sign files, to verify signatures and to manage the private and public keys. This is a development release. Please be careful when using it on production keys."
Libgcrypt 1.4.2 releasedVersion 1.4.2 of Libgcrypt has been announced, some new capabilities have been added. "The GNU project is pleased to announce the availability of Libgcrypt version 1.4.2. Libgcrypt is a general purpose library of cryptographic building blocks. It is originally based on code used by GnuPG. It does not provide any implementation of OpenPGP or other protocols. Thorough understanding of applied cryptography is required to use Libgcrypt."
Financial Applications LedgerSMB 1.2.16 releasedVersion 1.2.16 of LedgerSMB, a web-based financial system, has been announced. "This version corrects one issue introduced in 1.2.15 and a variable scoping issue which prevents Perl 5.10.0 from working as expected in some cases. Users are advised to upgrade, but those who are using pricematrix logic and who are using versions prior to 1.2.15 should put the release through some light testing before putting it into production."
Games cocos2d 0.3.0 releasedVersion 0.3.0 of cocos2d has been announced, it includes new features and bug fixes. "cocos2d is a framework for building 2D games, demos, and other graphical/interactive applications."
Interoperability Wine 1.1.4 announcedVersion 1.1.4 of Wine has been announced. Changes include: "Substantial chunks of WinHTTP are implemented. More JavaScript support. Beginnings of shell AppBar implementation. Several fixes for Google Chrome support. Chinese translations. Various bug fixes."
Multimedia Elisa Media Center 0.5.9 releasedVersion 0.5.9 of Elisa Media Center has been announced. "This release introduces a number of important new features, among which: - Login to restricted services (therefore allowing more functionalities for said services inside Elisa for logged in users); currently supported: Yes.fm; next on the list: Flickr. - A search engine: currently allows you to search for music in your local collection and on Yes.fm if logged in. - A tight integration of the brand new Yes.fm, an online music service (currently limited to Spain), in the UI, allowing local collection completion among other cool features. - Photo browsing by date."
Office Applications Chandler Desktop 1.0.1 releasedVersion 1.0.1 of Chandler Desktop has been announced. "The Chandler Project is an open source, standards-based information manager designed for personal use and small group collaboration. Chandler Desktop 1.0.1 is a bug fix update to the previous full release, 1.0. For more information, see the following blog post: http://blog.chandlerproject.org/2008/09/10/chandler-deskt..."
Science libquantum 1.0.0 and 1.1.0 releasedVersions 1.0.0 and 1.1.0 of libquantum have been announced. "libquantum is a highly optimized C library for the simulation of quantum systems, especially of quantum computers. Prominent features include simulation of decoherence effects, quantum error correction."
Speech Software eSpeak 1.39 releasedVersion 1.39 of eSpeak, a text to speech converter, has been announced. "Fix for crash with some SSML tags. From the ChangeLog file: Minor language improvements: French, English/US Fix missing phoneme translations for mbrola French voice."
Web Browsers Firefox 3.1 Alpha 2 now available for downloadVersion 3.1 Alpha 2 of Firefox has been announced. "The second developer milestone of the next release of Firefox - code named Shiretoko Alpha 2 - is now available for download. Shiretoko is built on pre-release version of the Gecko 1.9.1 platform, which forms the core of rich internet applications such as Firefox. Please note that this release is intended for developers and testers only. This Alpha of Shiretoko / Gecko 1.9.1 introduces several new features".
Google Launches New Browser (MozillaZine)MozillaZine discusses the new Google Chrome browser. "Google has launched a new open source browser, Chrome. The new browser boasts a minimalistic UI, a new Javascript engine dubbed V8, and sandboxed tabs to prevent one tab from crashing the browser. Chrome uses components from Apple's webkit and Mozilla Firefox."
Miscellaneous aria2: 0.15.3 released (SourceForge)Version 0.15.3 of aria2 has been announced. "aria2 is a utility for downloading files. The supported protocols are HTTP(S),FTP,BitTorrent,Metalink. It can download a file from multiple sources/protocols and tries to utilize your maximum download bandwidth. This release fixes the bug in chunk checksum validation and infinite loop in FTP downloads and segmentation fault when downloading gzipped file from Metalink. Turkish translation was added and German and Russian translations were updated."
Languages and Tools C GCC 4.4.0 Status ReportThe September 9, 2008 edition of the GCC 4.4.0 Status Report has been published. "Trunk in in Stage 3, so only bug fixes, documentation changes and new ports are generally allowed, subject to the discretion of individual maintainers. I discussed the nature of that discretion and how some maintainers need to be more conservative than others..."
Caml Caml Weekly NewsThe September 9, 2008 edition of the Caml Weekly News is out with new articles about the Caml language.
Python ftputil 2.3 releasedVersion 2.3 of ftputil, a high-level FTP client library for Python, has been announced. "ftputil has got support for the ``with`` statement which was introduced by Python 2.5. You can now construct host and remote file objects in ``with`` statements and have them closed automatically (contributed by Roger Demetrescu)."
Jython 2.5 Alpha 2 releasedVersion 2.5 Alpha 2 of Jython, a Java-based Python implementation, has been announced. "Django runs pretty well on this release. I am attending Djangocon where Jim Baker and Leo Soto will be presenting on Django on Jython, and I wanted them to be able to tell people to grab a release instead of telling them to grab Jython from svn. There are many bug fixes, but also many bugs that have not yet been fixed."
Python-URL! - weekly Python news and linksThe September 9, 2008 edition of the Python-URL! is online with a new collection of Python article links.
Tcl/Tk Tcl-URL! - weekly Tcl news and linksThe September 4, 2008 edition of the Tcl-URL! is online with new Tcl/Tk articles and resources.
Tcl-URL! - weekly Tcl news and linksThe September 10, 2008 edition of the Tcl-URL! is online with new Tcl/Tk articles and resources.
Editors Emacs 22.3 releasedVersion 22.3 of Emacs has been announced. "Emacs 22.3 is a bugfix release."
IDEs DrJava: Stable Update 20080904 (SourceForge)Stable Update 20080904 of DrJava has been announced. "DrJava is a lightweight programming environment for Java designed to foster test-driven software development. It includes an intelligent program editor, an interactions pane for evaluating program text, a source level debugger, and a unit testing tool. Available for download at http://drjava.org. This is a minor update to the recent stable release, fixing a bug in the execution of unit tests."
Version Control monotone 0.41 releasedVersion 0.41 of the monotone distributed version control system has been announced. "This version mainly fixes some annoying bugs and adds few new features, mainly in the automation area."
yap: Yet Another (Git) PorcelainAn early release of yap has been announced. "After starting yap several weeks ago, I feel it has reached a level of maturity that makes it suitable for public consumption. yap is three things, in increasing order of relevance: 1) A git porcelain implemented in python 2) A git porcelain with a friendlier, more orthogonal interface 3) A extensible git porcelain"
Page editor: Forrest Cook Linux in the news Recommended Reading Putting A 'Korset' On The Spread Of Computer Viruses: Invention Stays One Step Ahead Of Anti-virus Software (Science Daily)Science Daily takes a look at a program called Korset, that fights malware. "Prof. Wool and Ben-Cohen have built an open-source software solution for servers that run on Linux. "We modified the kernel in the system's operating system so that it monitors and tracks the behavior of the programs installed on it," says Prof. Wool. Essentially, he says, they have built a model that predicts how software running on a server should work. If the kernel senses abnormal activity, it stops the program from working before malicious actions occur. "When we see a deviation, we know for sure there's something bad going on," Prof. Wool explains."
The Fedora-Red Hat Crisis (Datamation)Here's a Datamation article raising concerns about the relationship between Fedora and Red Hat resulting from the handling of the recent security problems. "The damage to Fedora's credibility is potentially immense. In a matter of days, Red Hat has quashed Fedora's claim to independence. It has also threatened the credibility of the Red Hat employees who manage Fedora -- people whose devotion to FOSS has always been clear in their actions and dedication." (Thanks to LWN reader dowdle).
Trade Shows and Conferences Akademy 2008 was Amazing (KDE.News)KDE.News reports from Akademy 2008. "We played. We worked hard. We drank beer and we ate food. We even discussed eating food. We listened to talks. We brainstormed. We discussed. We designed. And we wrote code. But after a long and busy week, it was time to go home. Most of us have regained our strength after this exhausting, yet energising week, and we are looking back at one of the best meetings we ever had."
OSCON 2008 presentations, videos posted (Linux-Watch)Linux-Watch wraps up OSCON, the O'Reilly Open Source Convention held last July. "This year, OSCON introduced the Open Mobile Exchange, a one-day event addressing business, technology, web, and open source topics related to the mobile technology industry. Other events included a "hallway track" held to "debate and discuss important issues," as well as an OSCamp, a freewheeling user-directed "unconference" that was open to all comers. The event was further enlivened by the colocation of the second annual Ubuntu Live developers conference held during the first two days of OSCON at the same Oregon Convention Center location."
Companies A Question About the Novell-Microsoft Deal (Groklaw)Groklaw questions the recent Novell-Microsoft deal. "I've been thinking about something for a few days now. It's about the latest Novell-Microsoft deal that was announced on August 20, where Microsoft agreed to buy another $100 million worth of vouchers from Novell. I was wondering: how come two public companies can make a deal that seems to me to be material and yet keep pieces of the deal secret?"
Linux Adoption Linux in U.S. Schools: Why the Resistance? (IT Management)Matt Hartley questions the slow adoption of Linux by US schools. "Software alternatives are just not available for Linux. I hear the statement above almost everyday. What makes the statement so ridiculous is that it is completely inaccurate 99 percent of the time. Normally I would dismiss this as the loss of the person or the business that has opted to limit their horizons with their platform decisions, but when I hear this coming from schools...I find myself shaking my head in complete disbelief."
Switching From Windows To Linux In 3 Easy Steps (Linux Journal)Shawn Powers advocates switching friends to Linux one application at a time. "It's painless for a person to try open source applications in Windows. The beauty is that open source apps speak for themselves, and tend to work amazingly well, "selling" themselves without much convincing required." Some cross-platform, open source applications to get people started are Firefox, OpenOffice.org, Abiword, VLC, Pidgin, Stellarium and Songbird.
Interviews Interview: JOLIE and Service-Oriented Computing Explained (KDE.News)KDE.news has an interview with Fabrizio Montesi, one of the developers of the JOLIE language for "service-oriented computing". "Which is what JOLIE is all about - a generic programming language for programming any kind of service or service-oriented architecture, independent of the underlying protocols (JOLIE abstracts the communication away, e.g. D-Bus apps can communicate with a SOAP-based service through JOLIE). And of course, this is incredibly easy to use. In most other languages you'd find it is very hard to write service-oriented code, but JOLIE is all about services."
Reviews Lego-like Linux modules to ship in October (LinuxDevices)LinuxDevices looks at the BugBase. "Bug Labs will ship its tiny, open-source ARM11-powered BugBase and three add-on modules in October, and will switch to Poky Linux. Meanwhile, a recent review finds the hackable Linux-based platform to be intriguing, but currently too "flaky" for typical consumers."
Hacker-friendly karaoke PMP runs Linux (LinuxDevices)LinuxDevices takes a look at a personal media player, with a karaoke focus, that runs Linux. The device is specifically geared towards folks that want to tinker with the free software onboard. "The Cool-Karaoke stands apart from most personal media players (PMPs) that offer karaoke features due to its inclusion of 'lots of hardware audio mixers,' says the company. Unlike software mixers, hardware mixers let users mix their voices with the background music in real-time, receiving feedback through the earphone. The device is said to offer pitch shifting, high-sensitivity microphone reception, and vocal reduction, and to support multiple lyrics formats including LRC and simple text files."
It's Official: Dell Enters the Netbook Fray (Internet News)Internet News looks at Dell's new Inspiron Mini 9 sub-notebook. "Except for a keyboard that omits the usual row of function keys above the number row, the Mini's specs match several of its competitors'. A glossy 8.9-inch display with 1,024x600 resolution shows most Web pages with no need for horizontal scrolling. Under the hood are Intel's Atom N270, a 1.6GHz one-core processor with 2MB of Level 2 cache, and GMA 950 integrated-graphics chipset. The $349 configuration will feature a custom Dell interface atop Ubuntu Linux 8.04, much as Asus and Acer offer customized versions of Xandros and Linpus Linux, respectively."
Java Sound & Music Software for Linux, Part 1 (Linux Journal)Dave Phillips takes a look at Java-based music and sound applications. "I've wanted to write this article for quite a while. Over the years I've noted that Java-based music and sound applications have increased in number and quality, yet no comprehensive list or summaries have covered these advances. And so at long last I present this survey of music and sound applications that require Java. The presentation follows no particular order, but in this first part I'll begin by questioning the use of Java in sound and music applications development, followed by a brief look at Java's internal audio and MIDI capabilities."
Open source release takes Linux rootkits mainstream (The Register)The Register covers the release of an open-source rootkit. "When implemented, Immunity's DR, or Debug Register, makes backdoors and other types of malware extremely difficult to detect or eradicate. It's notable because it cloaks itself by burrowing deep inside a server's processor and availing itself of debugging mechanisms available in Intel's chip architecture. The rootkit, in other words, mimics a kernel debugger."
Miscellaneous NC State Computer Science Embraces FOSS Into Its Curriculum (Red Hat News)A college course in open source software is the subject of an article at Red Hat News. A graduate level course at North Carolina State focused on actually working with the community on an open source project. "You cant learn FOSS exclusively in books collaboration with the community is a critical element to success. While lectures covered the basic concepts of FOSS, the true innovation and learning occurred through student work with FOSS projects. A measure of success for this class and other collegiate-level open source classes is to have students continue working on FOSS projects beyond their required work in the classroom."
Page editor: Forrest Cook Announcements Commercial announcements Red Hat acquires QumranetRed Hat announced that it has acquired Qumranet, Inc., developers of the KVM virtualization tool. "Qumranet is the inventor and key maintainer of KVM, the only virtualization technology that is fully incorporated into the Linux kernel. Red Hat views KVM as the next generation of virtualization technology -- it combines support for the latest hardware virtualization capabilities and the rapid feature development of the Linux kernel into a complete, highly functional, virtualization platform. Red Hat believes that a strong coupling between the hypervisor and the kernel is a major advantage." (thanks to Matt Domsch).
Transverse brings first Open Source OSS to the enterpriseTransverse has announced its existence. "Transverse, a pioneer of open source business solutions, is officially announcing its company launch today. Transverse is the first company to extend the true promise of open source computing to telecom operational support systems (OSS) -- better quality, higher reliability, more flexibility, lower cost, and an end to vendor lock-in."
New Books The Art of Debugging with GDB, DDD, and Eclipse--New from No Starch PressNo Starch Press has published the book The Art of Debugging with GDB, DDD, and Eclipse by Norman Matloff and Peter Jay Salzman.
Python for Unix and Linux System Administration - New from O'ReillyO'Reilly has published the book Python for Unix and Linux System Administration by Noah Gift and Jeremy M. Jones.
Resources ODBMS.ORG publishes new user reportsODBMS.ORG has announced the publication of a new series of user reports. "ODBMS.ORG, a vendor-independent non-profit group of high-profile software experts lead by Prof. Roberto Zicari, today announced the exclusive publication of a second series of new user reports on using technologies for storing and handling persistent objects."
Education and Certification Python training in Colorado, October 15-17Mark Lutz will teach a Python class in Longmont, CO on October 15-17, 2008. "This is a public training session open to individual enrollments, and covers the same topics as the 3-day onsite sessions that Mark teaches, with hands-on lab work. The class provides an in-depth introduction to Python and its common applications, and parallels the instructor's popular Python books."
Meeting Minutes Perl 6 Design Minutes (use Perl)use Perl has published the meeting minutes from the July 30, 2008 Perl 6 design team meeting. "Allison, Jerry, Will, Jesse, and chromatic attended. "
Upcoming Events Engine Yard to Sponsor First Ever MerbCampEngine Yard has announced the first MerbCamp. "Engine Yard, provider of the leading Ruby and Rails deployment platform, today announced its sponsorship of MerbCamp, the first official gathering of the Merb community, which takes place October 11-12 on the University of California at San Diego (UCSD) campus. Registration opens today at http://www.merbcamp.com."
Events: September 18, 2008 to November 17, 2008The following event listing is taken from the LWN.net Calendar.
If your event does not appear here, please tell us about it. Audio and Video programs osbootcamp.org releases short python talk on videoOpen Source Bootcamp has released a video on Python. "Open Source Bootcamp (osbootcamp) teaches skills with open source. We recently had a python talk which we've recorded and made freely available from the osbootcamp.org videos section. Enjoy!"
Page editor: Forrest Cook
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
