The kernel has a lot of code paths that are normally disabled: debugging print statements, tracepoints, etc. To support these efficiently, there is a common mechanism called static keys that provides a way to enable or disable a code path at run time, with effectively no overhead for disabled branches. BPF programs have not been able to take advantage of static keys so far, because they aren't compiled into the kernel. Now, it looks like BPF may be getting support for a similar mechanism — and the design could also provide one of the components needed to support jump tables, another missing feature. Anton Protopovov presented his plans to add static keys to BPF at the 2024 Linux Storage, Filesystem, Memory Management, and BPF Summit.

PostmarketOS is an Alpine Linux derivative distribution aimed at mobile devices; the v24.06 release claims support for over 250 devices, though the level of that support varies widely. "This release is geared mainly towards Linux enthusiasts. We are working hard on stability improvements and automated testing, but if you expect Android or iOS levels of polish, then this is not for you yet." Changes include an upgrade to Alpine Linux 3.20, newer GNOME and KDE versions, and more.

Software-interrupt handlers (also called "bottom halves") have a long history in the Linux kernel; for much of that history, developers have wished that they could go away. One of their unfortunate characteristics is that they can add unexpected latency to the execution of unrelated processes; this problem is felt especially acutely in the realtime-preemption community. The solution adopted there has created problems of its own, though; in response Sebastian Andrzej Siewior is proposing a new locking mechanism for realtime builds of the kernel that may have benefits for non-realtime users as well.

Security updates have been issued by AlmaLinux (389-ds-base, buildah, c-ares, cockpit, containernetworking-plugins, fence-agents, gdk-pixbuf2, gvisor-tap-vsock, libreoffice, podman, python-idna, rpm-ostree, and ruby), Debian (atril, chromium, ffmpeg, libndp, libvpx, nano, plasma-workspace, pymongo, roundcube, sendmail, and thunderbird), Fedora (booth and thunderbird), Mageia (aom, atril, libvpx, nano, nss, firefox, and vte), Red Hat (linux-firmware), SUSE (bind, booth, mariadb, openssl-1_1, php7, php8, and webkit2gtk3), and Ubuntu (linux-azure, linux-azure-fde, linux-azure, linux-gke, and linux-nvidia-6.5).

Linus has released 6.10-rc4 for testing. "Apart from a rather unusual spike in the diffstat due to a parisc fix, things look normal and pretty small."

The 6.9.5, 6.6.34, 6.1.94, 5.15.161, 5.10.219, 5.4.278, and 4.19.316 stable kernels have all been released; each contains another set of important fixes.

The Python Software Foundation has published a set of reports from the 2024 Python Language summit. Topics covered include version numbering, the limited C API, a new default read-eval-print loop, and Python's security model in light of the XZ backdoor:

For multiple reasons like being able to fix bugs and single-maintainer modules, CPython doesn't require reviewers on the pull requests of core developers. This can lead to "unilateral action", meaning that a change is introduced into CPython without the review of someone besides the author. Other situations like release managers backporting fixes to other branches without review are common.

Christian Schaller writes about AI and GPU-related features that are in flight and planned for Fedora 41.

Milan Crha has been working together with Alan Day and Jakub Steiner to come up with a streamlined user experience in GNOME Software to let you install the binary NVIDIA driver and provide you with an integrated graphical user interface help to sign the kernel module for use with secure boot. This is a bit different than what we for instance are doing in RHEL, where we are working with NVIDIA to provide pre-signed kernel modules, but that is a lot harder to do in Fedora due to the rapidly updating kernel versions and which most Fedora users appreciate as a big plus. So instead what we are for opting in Fedora is as I said to make it simple for you to self-sign the kernel module for use with secure boot. We are currently looking at when we can make this feature available, but no later than Fedora Workstation 41 for sure.

KDE developer Nate Graham has announced a new set of KDE Human Interface Guidelines (HIG) for the KDE project. Graham says that the goals for the new HIGs were to reflect how KDE designs software today, make the content 100% actionable, improve navigation, and to improve the guidelines so people feel comfortable contributing:

Like any rewrite, there are bound to be rough edges and omissions compared to the old version. Maybe I missed a piece of useful information in the old HIG that had been buried somewhere but retained some value. Maybe there's low-hanging fruit for improvement. Help out by contributing!

The openSUSE project recently announced the second release candidate (RC2) of its Aeon Desktop, formerly known as MicroOS Desktop GNOME. Aside from the new coat of naming paint, Aeon breaks ground in a few other ways by dabbling with technologies not found in other openSUSE releases. The goal for Aeon is to provide automated system updates using snapshots that can be applied atomically, removing the burden of system maintenance for "lazy developers" who want to focus on their work rather than desktop administration. System-tinkerers need not apply.

This Project Zero article looks at the exploitation of a few Android driver bugs in great detail.

As it becomes more difficult to find 0-days in core Android, third-party Linux kernel drivers continue to become a more and more attractive target for attackers. While the bulk of present-day detected ITW [in-the-wild] Android exploitation targets GPU drivers, it's equally important that other third-party drivers are encouraged towards the same security standards.

Security updates have been issued by CentOS (389-ds-base, bind, bind-dyndb-ldap, and dhcp, firefox, glibc, ipa, less, libreoffice, and thunderbird), Debian (cups), Fedora (chromium and cyrus-imapd), Mageia (golang and poppler), Oracle (bind, bind-dyndb-ldap, and dhcp, gvisor-tap-vsock, python-idna, and ruby), Red Hat (dnsmasq and expat), SUSE (libaom, php8, podman, python-pymongo, python-scikit-learn, and tiff), and Ubuntu (h2database and vte2.91).

The BPF verifier is a complex program. This has the unfortunate effect of making it simultaneously more difficult for contributors to work on, and more likely to harbor unknown bugs. Shung-Hsi Yu had two concrete proposals for how to simplify the verifier to make it easier to maintain that he presented at the 2024 Linux Storage, Filesystem, Memory Management, and BPF Summit. Yu proposed changing how the verifier tracks partially known values and cleaning up the interface to hide the details of the value-tracker's internal representation.

Redirecting execution flow is a common malware technique that can be used to compromise operating systems. To protect from such attacks, the chip makers of leading architectures like x86 and arm64 have implemented control-flow-integrity (CFI) extensions, though they need system software support to function. At the Linux Security Summit North America, RISC-V kernel developer Deepak Gupta described the CFI protections for that architecture and invited community input on the kernel support for them.

Version 1.79.0 of the Rust language has been released. Changes this time include inline const expressions, the "associated item bounds syntax", and more.

Security updates have been issued by Debian (firefox-esr), Fedora (nginx-mod-modsecurity, php, and tomcat), Mageia (strongswan), Oracle (389-ds-base, buildah, c-ares, cockpit, containernetworking-plugins, fence-agents, firefox, gdk-pixbuf2, idm:DL1, ipa, kernel, libreoffice, podman, rpm-ostree, and thunderbird), Red Hat (dnsmasq and nghttp2), Slackware (mozilla), SUSE (curl, firefox, kernel, kernel-firmware-nvidia-gspx-G06, nvidia-open- driver-G06-signed, openssl-3, and python-Pillow), and Ubuntu (libmatio, libndp, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux-oem-6.5, and virtuoso-opensource).

The LWN.net Weekly Edition for June 13, 2024 is available.

The Cockpit project has announced the first release of Cockpit Files, a plugin for Cockpit that allows file management on your server via a web browser:

Cockpit Files was initially started by Google Summer of Code (GSoC) student Mahmoud Hamdy and is now under active development by the Cockpit team. The goal is to replace the functionality of the cockpit-navigator plugin from 45Drives and include automated testing per commit, a standard PatternFly-based interface, and consistency with the rest of Cockpit.

Development builds for Fedora are available via a Copr repository, and packages are expected for Arch, Debian, and Fedora. LWN covered the Cockpit project in March.

CentOS Linux 7 was first released in July 2014, and is due to go end-of-life (EOL) on June 30. By now, anyone who pays attention to such things is aware that Red Hat pulled the plug on CentOS Linux in late 2020 to be replaced by CentOS Stream instead. CentOS Linux 8 support was wound down at the end of 2021 rather than in 2029 as originally stated. CentOS Linux 7 was allowed to serve out its full lifespan—but that EOL is approaching rapidly and there's no direct upgrade path. Users and organizations looking for a lifeline might want to consider AlmaLinux's ELevate utility, which allows CentOS users to migrate to alternate enterprise Linux (EL) operating systems.