Uh-oh...
by Dave Ihnat
Didn't see this go by, but it looks hot enough to risk a repeat posting.
From a friend:
It appears there's been a very serious effort to backdoor sshd on
Linux via the xz compression/decompression system.
https://www.openwall.com/lists/oss-security/2024/03/29/4
If you have anything running very recent Linux, it's worth investigating
whether you're affected.
IBM Red Hat says, if you're running Fedora 40 or Fedora Rawhide:
> PLEASE IMMEDIATELY STOP USAGE OF ANY FEDORA
> RAWHIDE INSTANCES for work or personal activity.
The identity that did this got to the point of being not only an xz
maintainer but a Linux kernel contributor, and contributed to a number
of other Open Source projects as well over the course of years. The
identity may have been compromised to do this, or may have been created
to do this, and may have used other contributions to build rapport or
to compromise more projects as well.
I looked at the detection script available at the URL in the posting. It's
harmless at worst (don't know yet if it can detect anything).
Caveat Utilitor,
--
Dave Ihnat
1 month, 3 weeks
- 9
- 14
Installing weak dependencies: lsb_release - Why ?
by Francis.Montagnac＠inria.fr
Hi.
I noticed, at least since March 19, that updating Fedora-39 installs
also the lsb_release RPM as a weak dependency.
Why ?
Is there a way to prevent that, except excluding this RPM at each
update ?
AFAIK those weak dependencies are controlled by the --supplements of
the RPM, but lsb_release has none.
In addition, the lsb_release RPM conflicts with redhat-lsb-core that
provides more files, for example:
/lib64/ld-lsb-x86-64.so.3 -> ld-linux-x86-64.so.2
that is needed by external binaries like lmutil (flexlm).
Thanks for any input.
--
francis
1 month, 3 weeks
- 1
- 0
[Test Day] Fedora CoreOS 40 Test Week
by Sumantro Mukherjee
Hey All,
During the week of April 1- April 7 2024, the Fedora 40 CoreOS Test
Week will be happening. The test week is an opportunity for the
community to test FCOS based on Fedora 40 content before it is
released as part of the `testing` and `stable` streams.
As part of the Test Week, we'll host a virtual in-person session on
Tuesday April 2 from 10:00 AM - 11:30 AM EDT (2:00 PM - 3:30PM UTC)
where you can drop in, ask questions and get help from members of the
Fedora CoreOS team.
If you want to participate in the Test Week, check out the Fedora Wiki
page for details and log your results on the Test Day page.
- Wiki: https://fedoraproject.org/wiki/Test_Day:Fedora_40_CoreOS
- Test Day Results: https://testdays.fedoraproject.org/events/179
- FCOS Tracker: https://github.com/coreos/fedora-coreos-tracker/issues/1685
- QA Ticket: https://pagure.io/fedora-qa/issue/767
- Tue April 2 Video Meeting Link:
https://meet.google.com/uwb-enhy-evg?authuser=0
- Tue April 2 Notes Doc: https://hackmd.io/kwCRZ9fGTgWuMSh0HDwQJw?view
Thanks for your interest and we hope to see you online!
--
//sumantro
Fedora QE
TRIED AND PERSONALLY TESTED, ERGO TRUSTED
1 month, 3 weeks
- 1
- 0
shutdown as a simple user
by François Patte
Bonjour,
Up to yesterday, I was allowed to shutdown and hibernate my machine as a
simple user.
Yesterday a powercut while the machine was up suppressed this
feature.... I don't understand why.
How can recover this feature?
Thank you
--
François Patte
UFR de mathématiques et informatique
Laboratoire CNRS MAP5, UMR 8145
Université Paris Descartes
45, rue des Saints Pères
F-75270 Paris Cedex 06
Tél. +33 (0)6 7892 5822
http://www.math-info.univ-paris5.fr/~patte
FSF
https://www.fsf.org/blogs/community/presenting-shoetool-happy-holidays-fr...
1 month, 3 weeks
- 3
- 4