GNU/Linux Leftovers

posted by Roy Schestowitz on Mar 13, 2025

• GNU/Linux

  • Kernel Space

    • LWN ☛ A hole in FineIBT protection

      Intel's indirect branch tracking (IBT) is a hardware-implemented control-flow-integrity mechanism that makes it harder for an attacker to gain control of the system by way of a corrupted indirect branch. FineIBT is a software extension to IBT that is meant to improve its protection. Recently, though, Jennifer Miller reported a novel way to bypass FineIBT by taking advantage of how the kernel's system-call entry point is constructed. In response, Peter Zijlstra is working on some FineIBT enhancements to close that hole and make IBT more secure in general.

      The kernel (like many other programs) makes extensive use of indirect branches, typically in the form of a function call using a pointer value that is determined at run time. These indirect calls have always been an attractive target for attackers; if that pointer can be set to an attacker-controlled value, the call can be sent to an arbitrary location. Usually, that is all that is needed to gain control over the system. In a body of code as large as the kernel, there will surely be an instruction sequence that performs some useful operation for an attacker when it is invoked in an unexpected way.

    • LWN ☛ Guard pages for file-backed memory

      One of the many new features packed into the 6.13 kernel release was guard pages, a hardening mechanism that makes it possible to inject zero-access pages into a process's address space in an efficient way. That feature only supports anonymous (user-space data) pages, though. To make guard pages more widely useful, Lorenzo Stoakes has put together a patch set enabling the feature for file-backed pages as well; in the process, he examined and resolved a long list of potential problems that extending the feature could encounter. One potential problem was not on his list, though.

      The purpose of a guard page is to prevent buggy (or malicious) code from overrunning a memory region. An inaccessible page placed at the end of a region will cause a segmentation fault should the running process try to read or write to it; well-placed guard pages can trap a number of common buffer overruns and similar problems. Prior to 6.13, though, the only way to put a guard page into a process's address space was to set the protections on one or more pages with mprotect(); that works, but at the cost of creating a new virtual memory area (VMA) to contain the affected page(s). Placing a lot of guard pages will create a lot of VMAs, which can slow down many memory-management functions.

  • Instructionals/Technical

    • Remy Van Elst ☛ Safely expose the Kubernetes Dashboard in Traefik k3s via a ServersTransport

      I'm using the Headlamp dashboard for my [high-available local kubernetes cluster](/s/tutorials

    • dwaves.de ☛ Debian 13 wifi usb adapter trouble (edimax works :D)

  • Games

    • TecMint ☛ MangoHud – Monitor FPS, CPU & GPU Load in Linux Games

      It works as an overlay for Vulkan and OpenGL applications, displaying important information like FPS (frames per second), CPU and GPU usage, temperatures, and more.

• Distributions and Operating Systems

  • Canonical/Ubuntu Family

    • Ubuntu ☛ Among the waves: Plucky Puffin

      “For the latest 25.04 mascot, I wanted to capture the spirit of being ‘plucky’ in a fun and approachable way. Puffins tend to look a bit quirky at first, so I set out to give this one a strong and proud personality. I introduced a stormy sea to add energy and a sense of adventure—plus it set the stage for a cool animation later on!“Since the wild sea could easily feel overwhelming, I added a circle to bring everything together. I let the puffin’s head break out of the circle, which hints that it’s confidently taking charge. The detail of using the Circle of Friends as the puffin’s eye not only ties back to Ubuntu but also gives a warm nod to community and friendship. (Look closer there is further nod to the CoF)“Overall, I aimed for a design that’s both courageous and friendly—a little reminder that sometimes being a bit different is what makes you truly special.”