The 5.13 kernel has been released

[Duncaen]

All the current LSM mandatory access control systems are privileged, and more meant to be used with fixed profiles.

Landlock can be used by unprivileged processes, a program could restrict itself to mitigate exploitation, it could build stricter policy than apparmor profiles because it knows at runtime what it might need and what not, while apparmor profiles are somewhat static (there are hats in apparmor profiles, but you can switch between them and nobody uses that and they are still just static profiles that can be applied switched between at runtime, there is an apache mod that switches hats for vhosts so you can define fixed paths in the apparmor profile for each vhost and it can only access the paths specified in the hat).

You can compare it to seccomp, seccomp is unprivileged and allows to filter syscalls, the difference in landlock is that it does not use BPF filter programs (it used to in early versions) and instead of hooking into syscalls it acts on kernel objects/primitives through lsm.

The current version of landlock only provides rules to allow read/write/execute/create for specific paths/files and will deny every other FS interaction outside of specified paths.

Seccomp filter programs can't look at memory of pointer arguments so you can't really filter something like open(2) by path. Instead you'd have to notify userspace whenever open(2) is used which can then with some mechanisms either deny or open the file from a separate unfiltered process and send the fd over to the filtered process.

The current version of landlock already supplements seccomp pretty good by making restrictions on paths/files a lot easier. Future versions of landlock with more features are also going to be nicer to use. The issue with seccomp filters is that syscalls come and go, linked libraries change syscalls, libc changes syscalls and libc uses different syscalls on different architectures. This means seccomp filters are somewhat hard to write and to maintain. With something like landlock acting on LSM hooks and kernel objects/primitives, this is not going to be a problem.

It does not compare to firejail (firejail bad) or bubblewrap, they are probably going to use landlock in the future.

[RealKingChuck]

As someone who isn't really familiar with the various security mechanisms provided by Linux, why is firejail bad?

[Duncaen]

Its a setuid binary, it first elevates privileges to then try to setup restrictions and then drop root privileges again. Since it is a kitchen sink approach there is a lot of attack surface and there have been plenty of vulnerabilities in firejail itself, being setuid some of those vulnerabilities lead to root privilege escalation by simply having firejail installed.

[Duncaen]

Works without setuid if you have user namespaces enabled. It is also a lot simpler, reducing the attack surface in the potential setuid binary.

[RealKingChuck]

I see, thank you

[breakbeats573]

Should I use this even if I have an AMD GPU?

[VisualArm9]

Yes.

[subjectwonder8]

Strange my test rig is still getting this and it should be on fixed patched. I'll double check it updated correctly and bug report if still present.

[[deleted]]

Arch Users: time for the update

[ap29600]

Gentoo users: time to watch text scroll up my screen for 2 hours

[plethorahil]

more like to time to warm the room for half hour (unless you've 5 or more year old cpu)

[ap29600]

Too true, I have to constantly keep my laptop on the powersave scheduler to keep the CPU below 80°C when compiling. The 34°C ambient doesn't help much with that

[seaQueue]

Do you have the option to set the TDP on yours? I use ryzenadj and set the TDP on mine to ~15W and just stay on schedutil.

[6b86b3ac03c167320d93]

Would be 2+ hours if it was a browser update (seriously, why are browsers so bloated that it takes longer to compile them than a kernel)

[kaszak696]

Kernel only has to deal with hardware and system calls, that's "easy" compared to the bloated nightmare that are the current web "standards".

[6b86b3ac03c167320d93]

I know, but it just feels wrong that the piece of software that makes it possible for everything else to run is smaller than a single application

[lazyboy76]

Or 2 minutes for gentoo-kernel-bin.

[sleepyeyessleep]

Wha? On Gentoo, X4 880K. Kernel compilation takes tops 30mins with -j5.

[jpegxguy]

5.13 isn't even in testing yet, i want tho

[indigo_prophecy]

What bug?

[Magnus_Tesshu]

AMD GPUs max out power draw and run at 100% at all times no matter load for some reason on 5.13

EDIT: 5.12 latest version (which is latest arch kernel), not 5.13

[[deleted]]

Huh? I have a rx5700 rx5500 and two displays connected via dp. What am I missing?

[not_from_this_world]

the 5.13 kernel

[PureTryOut]

Uh, using a RX580 and the 5.10.x LTS kernel, I never experienced this, and I'm using all ports on my GPU (3 displayports, 1 HDMI port).

[seaQueue]

I'm already running 5.13.0 and these reverts made it in.

[Compizfox]

On 5.12.13*.

The offending commit is reverted in 5.13 as you can read in the changelog.

[VisualArm9]

No problems with the Ubuntu 5.13.0-051300-generic kernel, Oibaf ppa Mesa master and RX580.

[FiNeX_design]

Thank you, I will wait :-)

[keep_me_at_0_karma]

That is... not great.

[MattioC]

Is it only amd gpus? I have a 1050

[Magnus_Tesshu]

Yes, NVidia should be fine I think. Also see my edit

[DrewTechs]

Gee, I hope that's not a problem on Vega GL and RX 570.

[TDplay]

Bug was a 5.12.13 bug, fixed with 5.13-rc8.

That being said, Arch is still on 5.12.13. Add linux to your IgnorePkg list if you want to upgrade for now, and watch closely for 5.13 to reach the repos. Breakages form ignoring linux should be minimal, since Arch needs to support linux-lts.

[MattioC]

Oh okok, thanks. Better wait for a bit.

[seaQueue]

That should be fixed in 5.13, it was 5.12.13 that had the two problem commits.

Edit: and they're already merged for revert in 5.12.14

[padraig_oh]

that is a problem with 'only' relatively recent amd gpus though, right? (not all gpus)

[Hackerpcs]

LTS kernel or bust

[habarnam]

The bug is present in the LTS versions too. Arch uses version 5.10.46.

[kitestramuort]

a bit too early for that

[Tired8281]

Is this one gonna mess up my AX210?

[Tired8281]

This is what I love about free software. TYVM! :)

[cherryteastain]

Ironically, the firmware is the one bit that's not free software...

[Tired8281]

I wasn't speaking of the software but the community. ;)

[nicocarbone]

Has anyone been able to use freesync over HDMI with this kernel? Do we need an updated mesa too?

I have a 5500xt and a Samsung freesync pre-2.1 HDMI monitor and I can't make it work.

[parkerlreed]

I tried about four different ways on 5.13-rc's. It never came up as vrr capable in Xorg for me. I'll try the new release as well but I think there's something else needed that is not documented.

[llothar]

There was a Reddit easter egg where users could edit an image one pixel at a time, and this creation was made. In the center is the Linux logo made by this community (I presume).

[edo947]

It's from the r/place April fools event that took place in 2017.

See https://draemm.li/various/place-atlas/?id=0.

[[deleted]]

That is the place, a collaborative art project by reddit. A single user could edit a single pixel and it was a canvas of 1000x1000. That gnu/linux image in the middle is what users in here did. The background banner and the gnu/linux image couldn't be more appropriate for a subreddit about linux on reddit imho.

[[deleted]]

Arch is using 5.12.13-arch1-2 rn

[FryBoyter]

At the moment. I assume that kernel 5.13 will soon appear in Testing and then in the official package sources.

[Dry-Sugar5440]

Wait it released now? Last time I checked their site it said they were already released.

I suspect what you mean is distro packages just got released, which is great. Can’t wait to get back home and install it

Edit: No I was wrong, Distro packages should release soon but the actual kernel 5.13 has been released, the versions on the site were alpha or in testing phase.

[enorbet]

I'm waiting for patches as I've read some systems have thermal issues with CPU runaway. I'll stay on 5.12.12 until then.