Previously: v4.12.
Here s a short summary of some of interesting security things in Sunday s v4.13 release of the Linux kernel:
security documentation ReSTificationDocumentation/security/ tree had been converted yet. I took the opportunity to take a few passes at formatting the existing documentation and, at Jon Corbet s recommendation, split it up between end-user documentation (which is mainly how to use LSMs) and developer documentation (which is mainly how to use various internal APIs). A bunch of these docs need some updating, so maybe with the improved visibility, they ll get some extra attention.
CONFIG_REFCOUNT_FULLrefcount_t API in v4.11, Elena Reshetova (with Hans Liljestrand and David Windsor) has been systematically replacing atomic_t reference counters with refcount_t. As of v4.13, there are now close to 125 conversions with many more to come. However, there were concerns over the performance characteristics of the refcount_t implementation from the maintainers of the net, mm, and block subsystems. In order to assuage these concerns and help the conversion progress continue, I added an unchecked refcount_t implementation (identical to the earlier atomic_t implementation) as the default, with the fully checked implementation now available under CONFIG_REFCOUNT_FULL. The plan is that for v4.14 and beyond, the kernel can grow per-architecture implementations of refcount_t that have performance characteristics on par with atomic_t (as done in grsecurity s PAX_REFCOUNT).
CONFIG_FORTIFY_SOURCEFORTIFY_SOURCE compile-time and run-time protection for finding overflows in the common string (e.g. strcpy, strcmp) and memory (e.g. memcpy, memcmp) functions. The idea is that since the compiler already knows the size of many of the buffer arguments used by these functions, it can already build in checks for buffer overflows. When all the sizes are known at compile time, this can actually allow the compiler to fail the build instead of continuing with a proven overflow. When only some of the sizes are known (e.g. destination size is known at compile-time, but source size is only known at run-time) run-time checks are added to catch any cases where an overflow might happen. Adding this found several places where minor leaks were happening, and Daniel and I chased down fixes for them.
One interesting note about this protection is that is only examines the size of the whole object for its size (via __builtin_object_size(..., 0)). If you have a string within a structure, CONFIG_FORTIFY_SOURCE as currently implemented will make sure only that you can t copy beyond the structure (but therefore, you can still overflow the string within the structure). The next step in enhancing this protection is to switch from 0 (above) to 1, which will use the closest surrounding subobject (e.g. the string). However, there are a lot of cases where the kernel intentionally copies across multiple structure fields, which means more fixes before this higher level can be enabled.
NULL-prefixed stack canarystrcpy), since they will either stop an overflowing read at the NULL byte, or be unable to write a NULL byte, thereby always triggering the canary check. This does reduce the entropy from 64 bits to 56 bits for overflow cases where NULL bytes can be written (e.g. memcpy), but the trade-off is worth it. (Besdies, x86_64 s canary was 32-bits until recently.)
IPC refactoring__randomize_layout). v4.14 will also have the automatic mode enabled, which randomizes all structures that contain only function pointers.
A large number of fixes to support randstruct have been landing from v4.10 through v4.13, most of which were already identified and fixed by grsecurity, but many were novel, either in newly added drivers, as whitelisted cross-structure casts, refactorings (like IPC noted above), or in a corner case on ARM found during upstream testing.
lower ELF_ET_DYN_BASEELF_ET_DYN_BASE (the lowest possible random position of a PIE executable in memory) was already so high in the memory layout (specifically, 2/3rds of the way through the address space). Fixing this required teaching the ELF loader how to load interpreters as shared objects in the mmap region instead of as a PIE executable (to avoid potentially colliding with the binary it was loading). As a result, the PIE default could be moved down to ET_EXEC (0x400000) on 32-bit, entirely avoiding the subset of Stack Clash attacks. 64-bit could be moved to just above the 32-bit address space (0x100000000), leaving the entire 32-bit region open for VMs to do 32-bit addressing, but late in the cycle it was discovered that Address Sanitizer couldn t handle it moving. With most of the Stack Clash risk only applicable to 32-bit, fixing 64-bit has been deferred until there is a way to teach Address Sanitizer how to load itself as a shared object instead of as a PIE binary.
early device randomness 2017, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 License.
An image speaks for a thousand words...

In the same way it vital to ask the "smart questions", it is equally important to ask the dumb ones.
Whilst your milieu might be say comparing and contrasting the finer details of commission structures between bond brokers, if you aren't quite sure of the topic learn to be bold and confident enough to boldly ask: I'm sorry, but what actually is a bond?
Don't consider this to be an all-or-nothing affair. After all, you might have at least some idea about what a bond is. Rather, adjust your tolerance to also ask for clarification when you are merely slightly unsure or merely slightly uncertain about a concept, term or reference.
Back in 2011 I stumbled across a file "sortpaper.png", which was a hand-crafted
wallpaper I'd created some time in the early noughties to help me organise icons
on my computer's Desktop. I published it at the time in the blog post sortpaper.
Since then I rediscovered the blog post, and since I was looking for an excuse
to try out the Processing software, I wrote a
Processing Sketch to re-create it, but with the size and colours parameterized:
sortpaper.pde.txt. The thumbnail above links to an example 1920x1080 rendering.
MeteoSurf is a free multi-source weather forecasting App designed to provide wind and wave conditions of the Mediterranean Sea. It is an application for smartphones and tablets, built as a Progressive Web App able to supply detailed and updated maps and data showing heights of sea waves (and other information) in the Central Mediterranean. It is mainly targeted for surfers and wind-surfers but anyone who needs to know the sea conditions will take advantage from this app.
Data can be displayed as animated graphical maps, or as detailed table data. The maps refer to the whole Mediterranean Sea, while the table data is able to provide specific information for any of the major surf spots in the Med.
As of current version, MeteoSurf shows data collecting them from 3 different forecasting systems Read More [by Fabio Marzocca]
For a number of years now there has been growing concern that the management technologies in recent Intel CPUs (ME, AMT and vPro) also conceal capabilities for spying, either due to design flaws (no software is perfect) or backdoors deliberately installed for US spy agencies, as revealed by Edward Snowden. In a 2014 interview, Intel's CEO offered to answer any question, except this one.
The LibreBoot project provides a more comprehensive and technical analysis of the issue, summarized in the statement "the libreboot project recommends avoiding all modern Intel hardware. If you have an Intel based system affected by the problems described below, then you should get rid of it as soon as possible" - eerily similar to the official advice German authorities are giving to victims of Cayla the doll.
All those amateur psychiatrists suggesting LibreBoot developers suffer from symptoms of schizophrenia have had to shut their mouths since May when Intel confirmed a design flaw (or NSA backdoor) in every modern CPU had become known to hackers.
Bill Gates famously started out with the mission to put a computer on every desk and in every home. With more than 80% of new laptops based on an Intel CPU with these hidden capabilities, can you imagine the NSA would not have wanted to come along for the ride?
Four questions everybody should be asking

$ rsync -avz mirror.ftp-master.debian.org:/srv/ftp-master.debian.org/buildinfo .
$ python3 index.py
You need at least python3-debian installed $ sqlite3 depends.sqlite "select * from depends where depend='dh-elpa' and depend_version<='0106'"
where 0106 is some adhoc normalization of 1.6DEB_BUILD_OPTIONS=parallel=4, which sped up the builds
considerably. I also discovered that the Wheezy build chain doesn't
support sbuild's --source-only-changes flag which I had
hardcoded in my sbuild.conf file. This seems to be simply
because sbuild passes --build=source to dpkg-buildpackage, an option that is supported only in jessie or
later.
mysql commandline client which is
probably used and abused by hundreds if not thousands of home-made
scripts, but also all of Perl's MySQL support, which is probably used
by even a larger base of software.
Through the Debian bug reports (Debian bug #866818 and Debian bug #866821), I have learned that the patches existed in the upstream
tracker but were either ignored or even reverted in the
latest 4.043 upstream release. It turns out that there are talks of
forking that library because of maintainership issue. It blows my
mind that such an important part of MySQL is basically unmaintained.
I ended up backporting the upstream patches, which was also somewhat
difficult because of the long-standing issues with SSL support in
MySQL. The backport there was particularly hard to test, as you need
to run that test suite by hand, twice: once with a server configured
with a (valid!) SSL certificate and one without (!). I'm wondering how
much time it is really worth spending on trying to fix SSL in MySQL,
however. It has been badly broken forever, and while the patch is an
improvement, I would actually still never trust SSL transports in
MySQL over an untrusted network. The few people that I know use such
transports wrap their connections around a simpler stunnel
instead.
The other issue was easier to fix so I submitted a pull request
upstream to make sure that work isn't lost, although it is not
clear what the future of that patch (or project!) will be at this
point.
dh key too small errors for Rubygems, but also other
errors for Ruby. I also had trouble backporting one test which I had
to simply skip for Rubygems. I uploaded and announced test
packages and hopefully I'll be able to complete this work soon,
although I would certainly appreciate any help on this...
reds_on_main_agent_monitors_config function, which is simply not
present in our older version. A hostile message would fall through the
code and not provoke memory allocation or out of bounds access, so I
simply marked the wheezy version as not-affected, something which
usually happens during the original triage but can also happen during
the actual patching work, as in this case.
flagged tag when added to new
messages (patch series). This allows me to easily sync the one
tag (inbox) that is not statically assigned during notmuch new, by
using flagged as a synchronization tool. This allows me to use
notmuch more easily across multiple machines without having to sync
all tags with dump/restore or using muchsync which wasn't working for
me (although a new release came out which may fix my issues). The
magic incantation looks something like this:
notmuch tag -inbox tag:inbox and not tag:flagged
notmuch tag +inbox not tag:inbox and tag:flagged
However, most of my time in the first week (Debcamp) was spent trying
to complete the networking setup: configure switches, setup wiring and
so on. I also configured an apt-cacher-ng proxy to serve
packages to attendees during the conference. I configured it with
Avahi to configure clients automatically, which led me to discover
(and fix) issue Debian bug #870321) although there are more issues
with the autodiscovery mechanism... I spent extra time to document the
(somewhat simple) configuration of such a server in the Debian
wiki because it was not the first time I had research that
procedure...
I somehow thought this was a great time to upgrade my laptop to
stretch. Normally, I keep that device running stable because I don't
use it often and I don't want to have major traumatizing upgrades
every time I leave with it on a trip. But this time was special: there
were literally hundreds of Debian developers to help me out if there
was trouble. And there was, of course, trouble as it turns out! I had
problems with the fonts on my display, because, well, I had
suspended (twice) my laptop during the install. The fix was simply
to flush the fontconfig cache, and I tried to document this in the
fonts wiki page and my upgrades page.
I also gave a short training called Debian packaging 101 which
was pretty successful. Like the short presentation I made at the last
Montreal BSP, the workshop was
based on my quick debian development guide.
I'm thinking of expanding this to a larger audience with a "102"
course that would discuss more complex packaging problems. But my
secret plan (well, secret until now I guess) is to make packaging
procedures more uniform in Debian by training new Debian packagers
using that same training for the next 2 decades. But I will probably
start by just trying to do this again at the next Debconf, if I can
attend.
debsign
-k '792152527B75921E!' ...) or use inline signatures in email sent
for security announcement (since that trick doesn't work in Mutt or
Notmuch). I tried to figure out how to better coordinate this next
time by reading up documentation on keyring.debian.org, but there
is no fixed date for key changes on the rsync interface. There are
"monthly changes" so one's best bet is to look for the last change in
their git repository.
GL-NNN) after noticing a similar token used on GitHub. This
would be a useful addition because I often have numbering conflicts
between Debian BTS bug numbers and GitLab issues in packages I
maintain there. In particular, I have problems using GitLab issue
numbers in Monkeysign, because commit logs end up in Debian changelogs
and will be detected by the Debian infrastructure even though those
are GitLab bug numbers. Using such a shortcut would avoid detection
and such a conflict.
for i in seq 10000 ; do
shuf -n4 /usr/share/dict/words tr -d '\n'
done > length
And then feed that data in the tool:
$ numpy-stats lengths
"max": 60,
"mean": 33.883293722913464,
"median": 34.0,
"min": 14,
"size": 143060,
"std": 5.101490225062775
I am surprised that there isn't such a tool already: hopefully I am
wrong and will just be pointed towards the better alternative in the
comments here!
and filesystem changes (!!). En vrac, a list of
changes which may be of interest:
As I've blogged
before,
I've been on and off working on
SReview, a video review system.
Development over the past year has been mostly driven by the need to
have something up and running for first FOSDEM 2017, and then DebConf17,
and so I've cut corners left and right which made the system, while
functional, not quite entirely perfect everywhere. For instance, the
backend scripts were done in ad-hoc perl, each reinventing their own
wheel. Doing so made it easier for me to experiment with things and
figure out where I want them to go, without immediately creating a lot
of baggage that is not necessarily something I want to be stuck to. This
flexibility has already paid off, in that I've redone the state machine
between FOSDEM and DebConf17 and all it needed was to update a few
SQL statements here and there. Well, and add a few of them, too.
It was always the intent to replace most of the ad-hoc perl with something
better, however, once the time was ripe. One place where historical baggage is
not so much of a problem, and where in fact abstracting away the complexity
would now be an asset, is in the area of FFmpeg command lines. Currently,
these are built by simple string expansion. For example, we do something like
this (shortened for brevity):
system("ffmpeg -y -i $outputdir/$slug.ts -pass 1 -passlogfile ...");
inside an environment where the $outputdir and $slug variables are
set in a perl environment. That works, but it has some downsides; e.g.,
adding or removing options based on which codecs we're using is not so
easy. It would be much more flexible if the command lines were generated
dynamically based on requested output bandwidth and codecs, rather than
that they be hardcoded in the file. Case in point: currently there are
multiple versions of some of the backend scripts, that only differ in
details mostly the chosen codec on the ffmpeg command line.
Obviously this is suboptimal.
Instead, we want a way where video file formats can be autodetected, so
that I can just say "create a file that uses encoder etc settings of
this other file here". In addition, we also want a way where we can
say "create a file that uses encoder etc settings of this other file
here, except for these one or two options that I want to fine-tune
manually". When I first thought about doing that about a year ago, that
seemed complicated and not worth it or at least not to that
extent.
Enter Moose.
The Moose OO system for Perl 5 is an interesting way to do object
orientation in Perl. I knew Perl supports OO, and I had heard about
Moose, but never had looked into it, mostly because the standard perl OO
features were "good enough". Until now.
Moose has a concept of adding 'attributes' to objects. Attributes can be
set at object construction time, or can be accessed later on by way of
getter/setter functions, or even simply functions named after the
attribute itself (the default). For more complicated attributes, where
the value may not be known until some time after the object has been
created, Moose borrows the concept of "lazy" variables from Perl 6:
package Object;
use Moose;
has 'time' => (
is => 'rw',
builder => 'read_time',
lazy => 1,
);
sub read_time
return localtime();
The above object has an attribute 'time', which will not have a value
initially. However, upon first read, the 'localtime()' function will be
called, the result is cached, and then (and on all further calls of the
same function), the cached result will be returned. In addition, since
the attribute is read/write, the time can also be written to. In that
case, any cached value that may exist will be overwritten, and if no
cached value exists yet, the read_time function will never be called.
(it is also possible to clear values if needs be, so that the function
would be called again).
We use this with the following pattern:
package SReview::Video;
use Moose;
has 'url' => (
is => 'rw',
)
has 'video_codec' => (
is => 'rw',
builder => '_probe_videocodec',
lazy => 1,
);
has 'videodata' => (
is => 'bare',
reader => '_get_videodata',
builder => '_probe_videodata',
lazy => 1,
);
has 'probedata' => (
is => 'bare',
reader => '_get_probedata',
builder => '_probe',
lazy => 1,
);
sub _probe_videocodec
my $self = shift;
return $self->_get_videodata-> codec_name ;
sub _probe_videodata
my $self = shift;
if(!exists($self->_get_probedata-> streams ))
return ;
foreach my $stream(@ $self->_get_probedata-> streams )
if($stream-> codec_type eq "video")
return $stream;
return ;
sub _probe
my $self = shift;
open JSON, "ffprobe -print_format json -show_format -show_streams " . $self->url . " "
my $json = "";
while(<JSON>)
$json .= $_;
close JSON;
return decode_json($json);
The videodata and probedata attributes are internal-use only
attributes, and are therefore of the 'bare' type that is, they
cannot be read nor written to. However, we do add 'reader' functions
that can be used from inside the object, so that the object itself can
access them. These reader functions are generated, so they're not part
of the object source. The probedata attribute's builder simply calls
ffprobe with the right command-line arguments to retrieve data in JSON
format, and then decodes that JSON file.
Since the passed JSON file contains an array with (at least) two
streams one for video and one for audio and since the
ordering of those streams depends on the file and is therefore not
guaranteed, we have to loop over them. Since doing so in each and every
attribute of the file we might be interested in would be tedious, we add
a videodata attribute that just returns the data for the first found
video stream (the actual source also contains a similar one for audio
streams).
So, if you create an SReview::Video object and you pass it a filename
in the url attribute, and then immediately run print
$object->video_codec, then the object will
ffprobe, and cache the (decoded) output for further use$object->video_codec('h264'),
then the ffprobe and most of the caching will be skipped, and instead
the h265 data will be returned as video codec name.
Okay, so with a reasonably small amount of code, we now have a bunch of
attributes that have defaults based on actual files but can be
overwritten when necessary. Useful, right? Well, you might also want to
care about the fact that sometimes you want to generate a video file
that uses the same codec settings of this other file here. That's
easy. First, we add another attribute:
has 'reference' => (
is => 'ro',
isa => 'SReview::Video',
predicate => 'has_reference'
);
which we then use in the _probe method like so:
sub _probe
my $self = shift;
if($self->has_reference)
return $self->reference->_get_probedata;
# original code remains here
With that, we can create an object like so:
my $video = SReview::Video->new(url => 'file.ts');
my $generated = SReview::Video->new(url => 'file2.ts', reference => $video);
now if we ask the $generated object what the value of its
video_codec setting is without telling it ourselves first, it will use
the $video object for its probed data, and use that.
That only misses generating the ffmpeg command line, but that's all
fairly straightforward and therefore left as an exercise to the reader.
Or you can cheat, and look it
up.
Shockingly enough, my focus started out on Gitano once more. We managed a
1.1 release of Gitano during the Debian conference's "camp" which occurs in the
week before the conference. This was a joint effort of myself, Richard Maw,
and Richard Ipsum. I have to take my hat off to Richard Maw, because without
his dedication to features, 1.1 would lack some stuff which Richard Ipsum
proposed around ruleset support for basic readers/writers and frankly 1.1 would
be a weaker release without it.
Because of the debconf situation, we didn't have a
Gitano developer day which, while sad, didn't slow us down much...
This is an excellent example of where just because one person is too busy doesn't mean that a good idea should be dropped, and I am grateful to Richard Maw for getting this work mergeable and effectively guilt-tripping me into reviewing/merging. This is a learnable moment for me and I hope to do better into the future.
git-multimail.py
in Gitano. This work ranged across hooks and caused me to spend a long time
thinking about the semantics of configuration overriding etc. Fortunately
I got there in the end, and with a massive review effort from Richard Maw,
we got it merged into Gitano.readdir() from
readdir_r() thanks to Richard Ipsum; Gall 1.3 which contained a bunch of
build cleanups, and also a revparse_single() implementation in the C code
to speed things up thanks to Richard Maw; Supple 1.0.8 which improved wrapper
environment cleanups thanks to Richard Ipsum, allowed baking of paths in which
means Nix is easier to support (again thanks to Richard Ipsum), fixed setuid
handling so that Nix is easier to support (guess what? Richard Ipsum again);
Lace 1.4 which now verifies definition names in allow/deny/anyof/allof and
also produces better error messages from nested includes.
And, of course, Gitano 1.1 whose changes were somewhat numerous and so you
are invited to read them in the Gitano NEWS file for the release.
My monthly report covers a large part of what I have been doing in the free software world. I write it for my donors (thanks to them!) but also for the wider Debian community because it can give ideas to newcomers and it s one of the best ways to find volunteers to work with me on projects that matter to me.
Debian LTS
This month I was allocated 12h and during this time I did 4 days of front desk handling CVE triage (28 commits to the security tracker). I had a bit of time left and I opted to work on a package that had been lingering for a while: exiv2. It turns out the security researchers who requested the CVE did not even contact the upstream author so I opened 12 tickets on GitHub. The upstream author was unaware of those issues and is relatively unfamiliar with the general process of handling security updates. I started the work of reproducing each issue and so far they only affect the version 0.26 in experimental.
Misc Debian/Kali work
live-build and live-config. I pushed a few updates: dropping the useless xorriso hardlinks option (as discussed in https://bugs.kali.org/view.php?id=4109), adding a .disk/mkisofs file on request of Thomas Schmitt, fixing a severe issue with the handling of locales configuration that broke wayland sessions entirely.
open-vm-tools and vmwgfx. The switch of GNOME to Wayland by default resulted in multiple regressions reported by Kali users, in particular for VMWare users where desktop resizing was no longer working. There was a patch available but it did not work for me, so I worked with Thomas Hellstrom (of VMWare) to identify the problems and he provided me an updated patch. I submitted this patch to Debian too (bug report, pull request).
Linux 4.12 also showed another regression for VMWare users where the screen would not be refreshed/updated when you are using Wayland/KMS. I did multiple tests for Thomas and provided the requested data so that they could create a fix (which I incorporated into Kali and should come to Debian through the upstream stable tree).
Packaging. I uploaded zim 0.67 to unstable. I fixed an RC bug on shiboken to get pyside and ubertooth back into testing. I had to hack the package to use gcc-6 on mips64el because that architecture is suffering from a severe gcc bug which probably broke a large part of the code compiled since the switch to gcc-7 (and which triggered a test failure in shiboken, fortunately) I wonder if anybody will make sure to recompile all packages that might have been misbuilt.
Infrastructure. In a discussion on debian-devel, the topic of using tracker.debian.org to store who is maintaining what came up again. I responded to let know that this is something that I d like to see done and that I have already taken measures to go into this direction. I wanted to make an experiment with my zim package but quickly came on a problem with ftpmaster s lintian auto-rejects (which I submitted in #871575).
The BTS is now linking to tracker.debian.org on its web interface. To continue and give a push to this move, I scanned all the files in the qa SVN repository and updated many occurrences of packages.qa.debian.org with tracker.debian.org.
I also spotted a small problem in the way we handle autoremovals mails in tracker.debian.org, we often get them twice: I filed #871683 to get this fixed on release.debian.org.
Bug reports. vmdebootstrap creates unbootable qemu image (#872999). bugs in udebs are not shown on view by source package (#872784). New upstream release of ethtool (#873692). Upstream bugreport on systemd: support a systemd.swap=no boot command-line option.
I also shared some of my ideas/dreams in #859867 speaking of a helper tool to setup and maintain up-to-date build chroots and autopkgtest qemu images.
More bug fixes and pull requests. I created a patch to fix a build failure of systemd when /tmp is an overlayfs (#854400, the pull request has been discarded). I fixed the RC bug #853570 on ncrack and forwarded my changes upstream (here and here).
Thanks
See you next month for a new summary of my activities.
No comment Liked this article? Click here. My blog is Flattr-enabled.
| Series: | Species Imperative #3 |
| Publisher: | DAW |
| Copyright: | 2006 |
| ISBN: | 0-7564-0345-6 |
| Format: | Hardcover |
| Pages: | 543 |
An new version 0.0.9 of RcppAnnoy, our Rcpp-based R integration of the nifty Annoy library by Erik, is now on CRAN. Annoy is a small and lightweight C++ template header library for very fast approximate nearest neighbours.
This release corrects an issue for Windows users discovered by GitHub user 'khoran' who later also suggested the fix of binary mode. It upgrades to Annoy release 1.9.1 and brings its new Manhattan distance to RcppAnnoy. A number of unit tests were added as well, and we updated some packaging internals such as symbol registration.
And I presume I had a good streak emailing with Uwe's robots as the package made it onto CRAN rather smoothly within ten minutes of submission:
Changes in this version are summarized here:![]()
Courtesy of CRANberries, there is also a diffstat report for this release.Changes in version 0.0.9 (2017-08-31)
- Synchronized with Annoy upstream version 1.9.1
- Minor updates in calls and tests as required by annoy 1.9.1
- New Manhattan distance modules along with unit test code
- Additional unit tests from upstream test code carried over
- Binary mode is used for
save(as suggested by @khoran in #21)- A new file
init.cwas added with calls toR_registerRoutines()andR_useDynamicSymbols()- Symbol registration is enabled in
useDynLib
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.
Next.