Hello *,

upcoming Core Update 146 (testing, see: https://blog.ipfire.org/post/ipfire-2-25-core-update-146-is-available-for-te...) is running here for about 24 hours without any unexpected behaviour so far.

Tested IPFire functionalities in detail: - IPsec (N2N connections only) - Squid (authentication enabled, using an upstream proxy) - OpenVPN (RW connections only) - IPS/Suricata (with Emerging Threats ruleset enabled) - Guardian - Quality of Service - DNS (with DNS over TLS and strict QNAME minimisation) - Tor (relay mode)

Compared to Core Update 145, this update uses a little bit less RAM than it did before, but this is merely academic and probably not noticeable on most systems.

Looking at /var/log/boot.log, this line looks strange to me, but was already present before this update - just for your information:

[ 5.763783] udevd[572]: ignoring invalid mode '@DEV_KVM_MODE@'

I would like to take this opportunity to apologise to Arne for the poor quality of most of the Kernel hardening patches. They were written in a hurry to get them ready for this update, and I am sorry about their quality in retrospective.

Anyway, some security improvements made it into Core Update 146, and adding them one at a time seems to make sense more to me. I look forward to the release of this Core Update.

Technical details for the records:

[root@maverick ~]# uname -a Linux maverick 4.14.184-ipfire #1 SMP Thu Jun 18 14:30:42 GMT 2020 x86_64 Intel(R) Celeron(R) CPU N3150 @ 1.60GHz GenuineIntel GNU/Linux

[root@maverick ~]# grep . /sys/devices/system/cpu/vulnerabilities/* /sys/devices/system/cpu/vulnerabilities/itlb_multihit:Not affected /sys/devices/system/cpu/vulnerabilities/l1tf:Not affected /sys/devices/system/cpu/vulnerabilities/mds:Mitigation: Clear CPU buffers; SMT disabled /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI /sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Not affected /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: disabled, RSB filling /sys/devices/system/cpu/vulnerabilities/srbds:Not affected /sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Not affected

Thanks, and best regards, Peter Müller