In the latest monthly update for openSUSE Tumbleweed in January 2024, the distribution unveils a new format to better communicate major changes, improvements, and key issues. This update is now recommended by contributors involved in openSUSE’s marketing efforts.

Kernel and Hardware Support

The Linux Kernel receives updates to versions 6.6.7, 6.6.9, 6.6.10, 6.6.11, and 6.7.1, addressing memory management and security vulnerabilities. Notable enhancements include PCI updates for Zhaoxin Root Ports, contributing to improved compatibility and performance for Zhaoxin’s CPUs and motherboards.

Browser and Graphics Updates

Mozilla Firefox is updated to version 121.0 and 121.0.1, resolving issues such as hanging when loading sites with column-based layouts. The KDE Frameworks update to version 5.114.0 brings significant improvements, including fixes in Extra CMake Modules, holiday additions for Kenya, and adjustments for AVIF in KImageFormats.

The Mesa update to version 23.3.3 introduces a new Vulkan driver for NVIDIA hardware (NVK) in the experimental phase. This marks a step forward in support for NVIDIA GPUs, accompanied by enhancements in graphics performance and compatibility for Asahi and RADV.

System Management and PHP Enhancements

Systemd sees updates to version 254.8, focusing on the cautious resolution of reported bugs and ensuring stability in device management systems. PHP is updated from version 8.2.14 to 8.2.15, bringing fixes for SSA integrity verification, improvements in CLI built-in web server timeouts, and resolving issues with stream wrapper registration.

Multimedia and Networking

GStreamer is updated to version 1.22.8, addressing vulnerabilities in the AV1 video codec parser and making improvements in reverse playback and seeking in qtdemux. Samba sees updates to version 4.19.4, resolving issues related to the machine account password, improving documentation generation, and addressing critical vulnerabilities and bugs.

Security and Bug Fixes

The update includes critical security patches across various packages, with notable improvements in Firefox, systemd, Samba, and PHP. Multiple Common Vulnerabilities and Exposures (CVEs) are addressed in packages like xorg-x11-server, xwayland, gnutls, java-11-openjdk, and samba, enhancing overall security and stability.

openSUSE Tumbleweed and MicroOS have made some significant changes to their boot loader and full disk encryption (FDE) capabilities. The new image now uses systemd-boot as the boot loader and implements full disk encryption based on systemd. This update aims to improve the security of the distribution while simplifying the design.

systemd-boot

The previous boot loader used by openSUSE, GRUB2, is feature-rich but complex and slow to develop. The openSUSE package for GRUB2 contains over 200 patches, some of which have been present for many years. While GRUB2 supports various systems and file systems, the introduction of UEFI made many of its features redundant, as the system firmware already provided similar functionalities.

As a result, more straightforward boot loaders focused on UEFI, such as gummiboot, emerged. Eventually, this code was integrated into systemd and renamed systemd-boot. Compared to GRUB2, systemd-boot is much simpler and serves as a small EFI binary that presents a menu with different boot loader entries and delegates the execution to the selected kernel.

systemd-boot can also work with unified kernel images (UKI) that aggregate the kernel, command line, and initrd into a single unit. openSUSE plans to support UKIs in the future.

openSUSE has been planning to provide systemd-boot as an alternative to GRUB2 for some time, and in August 2023, Tumbleweed started supporting systemd-boot. The yast-bootloader tool also gained support for systemd-boot for new installations.

While supporting another boot loader comes with challenges, such as decreased support for different architectures and compatibility issues with btrfs file systems, openSUSE is actively working on addressing these problems.

Full Disk Encryption

openSUSE has also introduced support for full disk encryption based on systemd. While GRUB2 already supported unlocking LUKS volumes, systemd offers some additional features, such as partial support for LUKS2 encryption and integration with TPM2 devices.

The TPM2 (Trusted Platform Module 2) is a cryptographic device that can unlock secrets only when certain conditions related to the system’s state are met. The TPM2 will unlock the secret if the system is in a known good state, ensuring that the firmware, boot loader, kernel, and initrd have not been tampered with.

To take advantage of TPM2 for FDE, openSUSE has developed a policy that instructs the TPM2 to decrypt a secret only if certain platform configuration registers (PCR) contain the expected values. The PCR values are measured during the boot process, and any changes to the system will result in different PCR values, preventing the secret from being decrypted.

openSUSE has also improved the prediction of PCR values using the pcr-oracle tool, which can encrypt a key under a set of PCR values that can change. This allows for flexible unlocking mechanisms and better system integrity checks.

Using systemd for Disk Encryption

While GRUB2 is still functional for FDE, the use of systemd-boot provides an alternative architecture that works with any boot loader that follows the Boot Loader Specification (BLS). With systemd-boot, the kernel and initrd are placed in the unencrypted EFI system partition (ESP), and the unlock of the sysroot (where the system is located) is done from inside the initrd using systemd-cryptsetup options.

To support this new architecture, openSUSE provides a MicroOS image named kvm-and-xen-sdboot that showcases the new FDE capabilities. This image includes systemd-boot, sdbootutil scripts for synchronizing boot entries, pcr-oracle for predicting PCR values, disk-encryption-tool for encrypting the sysroot device, and dracut-pcr-signature, a dracut module that loads predictions into the initrd from the ESP.

The tools work together to ensure a secure and seamless boot process. The VM with a virtual TPM2 device measures the executed code and data, extending the PCR values. systemd-boot then reads the correct boot entry, and the disk-encryption-tool script encrypts the sysroot device. Finally, the jeos-firstboot modules handle the enrollment of FIDO2 keys and provide recovery key information.

Future Improvements

While the current implementation is a sound proof of concept, there are several areas for improvement. The disk-encryption-tool should be integrated into the installer, and the jeos-firstboot modules should also live in the installer or be merged with the functionality provided by the encryption tool. Separating system keys from user keys and enabling the use of TPM2 and FIDO2 keys simultaneously are also potential improvements.

Additionally, openSUSE aims to work with upstream projects, such as systemd and GRUB2, to incorporate the current tools and features. The diagnosis of TPM2 rejection for unlocking the LUKS2 key could be improved, and the integration of multiple encrypted disks should be validated and enhanced.

Ultimately, openSUSE is considering the use of unified kernel images and further standardization to simplify the architecture. The generation and registration of new keys, as well as the selection of PCR values, may be automated or better documented to streamline the process.

The openSUSE community has announced a logo competition for a new openSUSE logo, as well as four openSUSE distributions: Tumbleweed, Leap, Slowroll, and Kalpa. The aim of the competition is to strengthen the visual identity of the openSUSE brand and create a cohesive brand identity for its distributions.

The new logo designs should visualize a unified brand and integrate well with newer project logos like Aeon, MicroOS, and Leap Micro. The logos for the openSUSE distributions are designed with simple shapes and lines, typically as empty outlines. The logos use a 16u square canvas with a 1u stroke width.

The competition is open to the openSUSE community and the deadline for submissions is November 22. The winners will receive a “Geeko Mystery Box” as a reward for their creative designs.

The rules of the contest state that the logo should be licensed under CC-BY-SA 4.0 and allow everyone to use it without attribution if it is used as the logo for the openSUSE Project. The design must be original and not include any third party materials. Both monochrome and color formats are required for submission, and the design should reflect the openSUSE communities.

To submit a design, participants must email their vector file in SVG format to ddemaio@opensuse.org, along with a PNG of the design posted on the openSUSE website. The file size should be less than 512 KB. Participants should also include their name, mail address, and a description of the design’s philosophy.

The submitted designs will be added to a survey where the community can vote on them. The final decision will be made at an openSUSE Community meeting.

openSUSE has announced the availability of Leap Micro 5.5, the latest version of its modern lightweight host operating system. Leap Micro 5.5 is essentially a rebranded version of SLE Micro, so all the documents and release notes from SLE Micro 5.5 are applicable to Leap Micro as well.

It’s important to note that with the release of Leap Micro 5.5, Leap Micro 5.3 has reached its End of Life (EOL). Users of Leap Micro 5.3 are strongly advised to upgrade to either the Leap Micro 5.4 or 5.5 release to ensure access to the latest features, security enhancements, and ongoing support.

One of the standout features of Leap Micro 5.5 is its enhanced support for SELinux. Security-Enhanced Linux (SELinux) now includes podman-docker and hyper-v support for AArch64, providing users with a more robust and secure computing experience. Leap Micro 5.5 also includes podman 4.4, which introduces podman quadlets. Users can check out the Nextcloud deployment using quadlets to explore this feature. Additionally, Leap Micro ships with podman-docker, a podman wrapper that can be used together with docker-compose.

The container management interface Cockpit has also received notable improvements in version 298. Users can now use Cockpit to manage all of their home workloads, providing a more convenient management solution.

For users new to the immutable OS space, which consists of systems with read-only /root, there is a transactional update guide available to help navigate the update process. Additionally, users can use the Toolbox tool to install additional software without the need for a reboot, making it particularly useful for debugging scenarios where a reboot is not feasible.

The openSUSE Leap Micro 5.5 Beta has been released, offering a lightweight Linux operating system designed for containers and virtualized workloads. As the community version of SUSE Linux Enterprise Micro, openSUSE Leap Micro focuses on reliability and caters to container and virtualization use-cases. One of the major changes in this release is improved Security Enhanced Linux (SELinux) support. A release candidate for Leap Micro 5.5 will be available soon, with the official general availability (GA) release expected in early October. For more information and to download the Leap Micro 5.5 Beta, visit the openSUSE website.

Source: Phoronix.