Gentoo Linux bans code contributions written with AIwww.theregister.comA good PR move opines community member
)
Linux Will Be Able To Boot ~0.035 Seconds Faster With One Line Kernel Patch
Phoronix
The Linux kernel itself can already boot quite fast but with a simple one-line patch another ~0.035 seconds will be able to be shaved off the boot time.
Intel Linux engineer Colin Ian King discovered that if aligning the slab in the ACPI code via the "SLAB_HWCACHE_ALIGN" flag will offer a measurable improvement in memory performance and reducing the kernel boot time.
c'est un peu lent parfois.
Last Tuesday, loads of Linux users—many running packages released as early as this year—started reporting their devices were failing to boot. Instead, they received a cryptic error message that included the phrase: “Something has gone seriously wrong.”
The cause: an update Microsoft issued as part of its monthly patch release. It was intended to close a 2-year-old vulnerability in GRUB, an open source boot loader used to start up many Linux devices. The vulnerability, with a severity rating of 8.6 out of 10, made it possible for hackers to bypass secure boot, the industry standard for ensuring that devices running Windows or other operating systems don’t load malicious firmware or software during the bootup process. CVE-2022-2601 was discovered in 2022, but for unclear reasons, Microsoft patched it only last Tuesday.
"I am retiring from the project," Filho declared. "After almost four years, I find myself lacking the energy and enthusiasm I once had to respond to some of the nontechnical nonsense, so it's best to leave it up to those who still have it in them."
Filho thanked the Rust to Linux team and reiterated his support for the project – which aims to bring the memory safety advantages of the Rust language to the C-based Linux kernel.
(...)
Discussions about adding Rust to Linux date back to 2020 and were realized in late 2022 with the release of Linux 6.1.
"I truly believe the future of kernels is with memory-safe languages," Filho's note continued. "I am no visionary but if Linux doesn't internalize this, I'm afraid some other kernel will do to it what it did to Unix."
And he concluded his message with a reference to a YouTube video from the Linux Storage, Filesystem, Memory-Management, and BPF Summit in May. Pointing to a portion of the video as an example of the kind of interaction that led him to step down, Filho wrote, "[T]o reiterate, no one is trying [to] force anyone else to learn Rust nor prevent refactorings of C code."
That remark is a response to a comment on the video that, according to Filho, came from Linux kernel maintainer Ted Ts'o: "Here's the thing, you're not going to force all of us to learn Rust."
https://www.phoronix.com/news/Linux-Compliance-Requirements
When a number of Russian Linux developers were removed from their MAINTAINERS file in the Linux kernel, it was described as due to "compliance requirements" but vague in what those requirements entailed. Linus Torvalds then commented on the Russian Linux maintainers being de-listed and made it clear that they were done due to government compliance requirements / legal issues around Russia. Now today some additional light has been shed on those new Linux kernel "compliance requirements".
The five flaws Qualys discovered allow attackers with local access to a vulnerable Linux system to escalate their privilege to root without user interaction.
Complete information about the flaws was made available in a separate text file, but a summary can be found below:
• CVE-2024-48990: Needrestart executes the Python interpreter with a PYTHONPATH environment variable extracted from running processes. If a local attacker controls this variable, they can execute arbitrary code as root during Python initialization by planting a malicious shared library.
• CVE-2024-48992: The Ruby interpreter used by needrestart is vulnerable when processing an attacker-controlled RUBYLIB environment variable. This allows local attackers to execute arbitrary Ruby code as root by injecting malicious libraries into the process.
• CVE-2024-48991: A race condition in needrestart allows a local attacker to replace the Python interpreter binary being validated with a malicious executable. By timing the replacement carefully, they can trick needrestart into running their code as root.
• CVE-2024-10224: Perl's ScanDeps module, used by needrestart, improperly handles filenames provided by the attacker. An attacker can craft filenames resembling shell commands (e.g., command|) to execute arbitrary commands as root when the file is opened.
• CVE-2024-11003: Needrestart's reliance on Perl's ScanDeps module exposes it to vulnerabilities in ScanDeps itself, where insecure use of eval() functions can lead to arbitrary code execution when processing attacker-controlled input.
It is important to note that, in order to exploit these flaws, an attacker would have to local access to the operating system through malware or a compromised account, which somewhat mitigates the risk.
Torvalds then added a postscript in which he revealed that he often uses the holiday season to build LEGO, which he frequently receives for Christmas and his late December birthday.
He kept up that tradition last year, but “also ended up doing a number of guitar pedal kit builds” which he described as “LEGO for grown-ups with a soldering iron". For the uninitiated, guitar pedals change the sound of an electric guitar in various ways. They’re usually a small metal box that includes a basic circuit board and a few dials to alter sound and are activated by a built-in footswitch. They’re ubiquitous, cheap, and fun. Many prominent guitarists rely on a collection of them to create their signature sounds.
Torvalds doesn’t play guitar, but did the builds “because I enjoy the tinkering, and the guitar pedals actually do something and are the right kind of ‘not very complex, but not some 5-minute 555 LED blinking thing’.”
He enjoyed the experience and wants to build more pedals, so has decided to give one away to a random kernel developer – both as an act of generosity and to “check to see if anybody actually ever reads these weekly rc announcements of mine”.
