Linux Format April 2022

Jonni Bidwell The records tell of a rogue who, masquerading as a GCC packager, managed to sneak an arcane stanza into the source. The result was that whenever a certain string was input to any program compiled by this tainted GCC including new versions of GCC)… ah well, that would be telling! Nick Peers I’m perfectly happy to compile stuff from source so long as the instructions are clear and legible so I don’t have to think too hard about it. However, if an up-to-date snap, flatpak or AppImage exists, I’ll always take the lazy option and choose that. Les Pounder I don’t compile much from source: a project found on GitHub, or an emulator for an old computer. The last serious project I compiled from source was before the release of the Raspberry Pi…

Compiling the kernel from source was always a key moment in many Unix courses. After all, there was a time when everyone who wanted to seriously learn how to admin a system would need to learn this skill. Not that it’s that complex a thing to do – you just need the right files, tools and a modicum of time. Rightly so, modern Linux distros have neatly hidden away this complexity with just outliers such as Gentoo (see LXF276) or Linux from Scratch (see page 48) requiring this step. As always, getting your hands dirty with such things is a fantastic learning experience. And Jonni’s here to step you through the process. He reveals everything you need to know about building your own kernel, the benefits and tweaks you can make,…

THIS ISSUE: Upsurge of Linux malware Polkit exploit highlighted Governments target privacy Framework’s firmware open sourced During 2021 malware targeting Linux devices increased by 35 per cent. The majority of malware instances involved IoT (Internet of Things) devices caught up in DDoS (distributed denial of service) attacks. IoT devices encompass a range of gadgets. Many of them are internet-connected and run some form of Linux distribution. People who buy a smart fridge, for example, may not know the security implications, which makes them attractive targets for hackers looking to create DDoS attacks, as they ‘recruit’ a large number of low-powered devices to perform such attacks. According to a Crowdstrike report (https://bit.ly/lxf287crowdstrike), XorDDoS, Mirai and Mozi malware were involved in over 22 per cent of Linux threats in 2021, and there were 10 times…

A serious new vulnerability has been found in polkit’s pkexec application, which is installed by default in many Linux distros. Due to its popularity, and the fact that it’s used to control system-wide privileges, the vulnerability has resulted in a major security issue for millions of Linux systems. Its discovery by researchers at Qualys (you can read the announcement at https://bit.ly/lxf287qualys) has got a lot of people concerned, with US National Security Agency (NSA) cybersecurity director Rob Joyce writing on Twitter (https://bit.ly/lxf287tweet) that the vulnerability “has me concerned. Easy and reliable privilege escalation preinstalled on every major Linux distribution.” According to researchers, this vulnerability has been included since the first release of pkexec in May 2009, and any local user can exploit this vulnerability to obtain full root privileges. It didn’t take…

Senators in the US are once again pushing for the EARN IT act to be made law. If passed, the act would bring in sweeping internet regulations that some fear would give third-party companies and the government access to the private messages of civilians. It could even lead to penalties for companies that offer end-to-end encryption, which would affect messaging services like WhatsApp, Signal and iMessage. The EARN IT act also focuses on Amazon, with creators of the act accusing the company of not properly scanning content it hosts on Amazon Web Services. With many websites using AWS, this could mean that large swathes of the internet are scanned by governmentapproved software such as PhotoDNA, which integrates with law enforcement databases. The Electronic Frontier Foundation explains the act at https://bit.ly/lxf287earnit. The bill…

Michael Meeks is general manager at Collabora Productivity Collabora Online (COOL) 21.11 has arrived. It packs online collaborative document-editing goodness into an easy-to-obtain update. We packed another year of rendering and interoperability development into the LibreOffice Technology core. COOL itself brings a swathe of UX improvements. One piece I worked on is performance: profiling and optimising our client-side Javascript to make the experience slick and smooth. Previously, we thought any interaction issues were caused by network latency or by excessive server-side work. However, after doing end-toend profiling we found the browser was the primary culprit. After persuading it not to re-render the DOM on each web-socket message we got a big step-change in slickness. Other big wins were background document saving, accelerated multiuser editing, and a mature diagramming component. Another improvement was exposing…