Hello *,
upcoming Core Update 146 (testing, see: https://blog.ipfire.org/post/ipfire-2-25-core-update-146-is-available-for-te...) is running here for about 24 hours without any unexpected behaviour so far.
Tested IPFire functionalities in detail: - IPsec (N2N connections only) - Squid (authentication enabled, using an upstream proxy) - OpenVPN (RW connections only) - IPS/Suricata (with Emerging Threats ruleset enabled) - Guardian - Quality of Service - DNS (with DNS over TLS and strict QNAME minimisation) - Tor (relay mode)
Compared to Core Update 145, this update uses a little bit less RAM than it did before, but this is merely academic and probably not noticeable on most systems.
Looking at /var/log/boot.log, this line looks strange to me, but was already present before this update - just for your information:
[ 5.763783] udevd[572]: ignoring invalid mode '@DEV_KVM_MODE@'
I would like to take this opportunity to apologise to Arne for the poor quality of most of the Kernel hardening patches. They were written in a hurry to get them ready for this update, and I am sorry about their quality in retrospective.
Anyway, some security improvements made it into Core Update 146, and adding them one at a time seems to make sense more to me. I look forward to the release of this Core Update.
Technical details for the records:
[root@maverick ~]# uname -a Linux maverick 4.14.184-ipfire #1 SMP Thu Jun 18 14:30:42 GMT 2020 x86_64 Intel(R) Celeron(R) CPU N3150 @ 1.60GHz GenuineIntel GNU/Linux
[root@maverick ~]# grep . /sys/devices/system/cpu/vulnerabilities/* /sys/devices/system/cpu/vulnerabilities/itlb_multihit:Not affected /sys/devices/system/cpu/vulnerabilities/l1tf:Not affected /sys/devices/system/cpu/vulnerabilities/mds:Mitigation: Clear CPU buffers; SMT disabled /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI /sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Not affected /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: disabled, RSB filling /sys/devices/system/cpu/vulnerabilities/srbds:Not affected /sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected
Thanks, and best regards, Peter Müller