NSLIG – February 2019

Back to Meeting Notes 2019

Notes from the February 2019 Meeting

[hr height=”30″ style=”default” line=”default” themecolor=”1″]

The meeting was started with Linux News and the first item was a brief video walk-around of the first Raspberry Pi retail store. There was no indication where the store is located, but it is not likely that they are planning one for Federation Square to compete with the proposed Apple Store.

– late news: the Raspberry Pi retail store is located on the first floor of the Grand Arcade in Cambridge, U.K.

The second item was about kernel releases 5.0 and 4.20. The first release candidate (RC1) of Kernel 5.0 has been released. A significant item is that VFS is not supported. The kernel version 4.20.1 is also available. There are file system changes in 4.20.1. The speaker did not explain how significant they are.

There are three bugs in systemd that allow local users to get root privileges. Systemd controls most services and is used by most Linux distributions – it is a large and centralised project that is supported by Red Hat. Fixes for two of the bugs were released in mid-January, and the remaining fix just after the video was created.

Some details were given on the upcoming release of Android (version Q). They include changes to the permissions system to improve security, and support for Android on big screens and foldables.  The latter change may be just in time for the release of Samsung’s S10 phone series that includes a foldable device.

The forum session started with a comment about Buttercup – a new password manager that is cross-platform: Linux, Mac OS and Windows. It may be an alternative to the widely-used Keepass, and is said to be simple to use.

Gibson Research (GRC) is developing a program called SQRL – pronounced “squirrel” – to implement a “Secure Quick Reliable Login” which can supercede traditional methods of website login. The project is moving towards an initial release. Lots more information at …

https://www.grc.com/sqrl/sqrl.htm

A user of Mint version 19.1 could not get Wine working. Apparently it is a problem related to version 3 of Wine. Changing to version 4 fixes the problem.

One of our SIG members (Rob Brown) has been appointed to the Melbourne PC Users Group committee, and gave an update on what is happening at the Moorabbin office. A major focus for the committee is to get more members into the group. The committee is very aware that a relatively small core of members do the vast majority of work needed to keep the group functioning, and they are appealing for more members to volunteer their time and skills.

At the physical level, the audio system has been upgraded and the streaming of Monthly Meetings is now working well after some earlier hiccups. The basement of the building has been transformed from a storage space to a functioning workshop, with a lathe, a mill, and functional bench workspaces.

The latest membership cards have a QR code on them, and there is project under way to scan the code at meetings. This will supersede handwritten lists, and allow a link to the membership system to check for currency of membership.

After the social break the evening’s main topic was presented by David Hatton.

Are my updates done?

Ever had the experience of coming across an online report of a serious bug in a Linux package and wondered – “Have I got that updated?”

Some distros include a facility to show brief display of update history, but this doesn’t always show the whole history. David took a look at how the update history is recorded, how to find out when a particular package was last updated and what was fixed.

For a specific example there is a series of podcasts titled “Security Now”, and Linux featured in a recent  podcast because of the bugs in systemd mentioned earlier.

The usual response to a query about whether a machine is exposed is to “check your updates”.

To do this, the log file viewer can be used, which is found in the system tools menu. The log file viewer has the ability for the user to filter the output to find items related to a specific component, e.g. systemd. When looking at the log file viewer, only relatively recent updates are recorded. David provided advice on how to find out more detail and over a longer period.

First look at the dpkg data recorded in /var/log/dpkg.log using the terminal program. This log file records each action of the package update system. The information recorded looks like the screenshot below.

 

The terminal command

$ grep “ upgrade” /var/log/dpkg.log

shows a list of items installed recently – note that “ marks are used to include a leading space in the search term.

To find out whether a specific package, eg/. systemd, has recently been updated use the command

$ grep “ upgrade systemd” /var/log/dpkg.log

This will result in something like that shown below …

To look further back in time, there are additional files such as /var/log/dpkg.log.1. Log files created before dpkg.log and dpkg.log.1 are usually compressed by the system to reduce the space needed to store them. To find updates in the compressed files you will need to use the zgrep command, eg/.

$ zgrep –color “ upgrade systemd” var/log/dpkg.log.2.gz

The apt program can also show details of the changes, by using a command such as:

$ apt changelog systemd

A sample of the type of results is shown below.

 

It is also possible to search the Ubuntu website ubuntuupdates.org which retains a list of all updates to that system.

David’s conclusion is that the information about updates is available in Linux, and can be seen down to a very detailed level.

Systemd: more information …

A Youtube video about systemd is available for those interested. It is titled “The tragedy of systemd” and can be seen via:

https://www.youtube.com/watch?v=o_AIw9bGogo