Jon Seager, vice president of engineering at Canonical and technical lead of the Ubuntu project, has announced plans to integrate the NTP server ntpd-rs, written in Rust and already used in the infrastructure of the Let’s Encrypt certificate authority, into the upcoming release of Ubuntu 26.10. The ntpd-rs project will become the third component, following Rust Coreutils and sudo-rs, integrated into Ubuntu as part of the initiative to improve the quality of the system environment through the supply of software originally developed with a focus on security, reliability, and correctness.
The discussion is also underway regarding the replacement of the zlib library with zlib-rs and the implementation of the Sequoia package instead of GnuPG in the APT package manager. The ntpd-rs package is intended to be used by default as server a precise time synchronization client, which will eventually replace the currently used packages chrony, linuxptp, and possibly gpsd. The proposed implementation plan includes delivering the up-to-date version of the ntpd-rs package in the Ubuntu 26.10 repositories as an option for testing. In Ubuntu 27.04, they plan to use ntpd-rs by default as a unified server and client with support for the NTP, NTS, and PTP protocols.
The ntpd-rs project is being developed by the Trifecta Tech Foundation, which is also responsible for the development of the already integrated sudo-rs utility in Ubuntu. Canonical will fund the development of new features and enhanced security in ntpd-rs. Among other things, ntpd-rs will integrate contributions from the Statime project, which develops the implementation of the Precision Time Protocol (PTP) in Rust, in order to unify the support for current time synchronization protocols in one package and to use ntpd-rs not only as a replacement for chrony but also for linuxptp.
Additional features to be implemented in ntpd-rs before deployment include the implementation of the gPTP and CSPTP protocols, support for GPSD IP sockets, multithreading mode for NTP servers, the ability to use in a multi-homed mode, creation of isolation profiles based on AppArmor and seccomp, providing tools for testing and performance evaluation, and improvements related to logging and configuration management, as well as enhancements to the ntp-cli utility.
Udover samarbejdsprojekter med organisationen Trifecta Tech Foundation er Canonical også blevet en 'guld'-deltager i Rust Foundation, som arbejder med udviklingen og vedligeholdelsen af programmeringssproget Rust og dets tilhørende økosystem. Ud over Canonical, som er den eneste guld-deltager, yder 6 platinum-deltagere — Google, Microsoft, Amazon, ARM, Meta og Huawei — nødfinansiering til udviklingen af Rust. Det årlige bidrag fra en guld-deltager udgør 150.000 dollars, mens en platinum-deltager bidrager med 325.000 dollars.
Derudover kan man nævne meddelelsen fra Julian Andres Klode fra Canonical, der leder APT-projektet, om planerne om at reducere antallet af parsere i GRUB-bootloaderen for at mindske angrebsfladen. I Ubuntu 26.10 foreslås det at fjerne understøttelse af billedformaterne jpeg og png, part_apple tabelen og muligheden for at bruge filsystemerne btrfs, hfsplus, xfs og zfs til /boot partitionen fra de digitalt signeret builds af GRUB. Desuden planlægges det at fjerne understøttelse af LVM, md-raid (undtagen raid1) og krypterede LUKS partitioner i /boot.
Det er bemærket, at Ubuntu-installationsprogrammet altid kun bruger filsystemet ext4 til /boot, mens andre systemer ikke testes og udgør en risiko for omgåelse af den verificerede boot-mode, i lyset af periodiske opdagelser af sårbarheder i GRUB (1, 2, 3, 4, 5, 6, 7). Med hensyn til fjernelse af understøttelse af kryptering af /boot partitionen betragtes denne operation som værdiløs (security by obscurity) — i denne sammenhæng er det vigtigt at sikre integriteten i /boot partitionen, hvilket gøres ved hjælp af TPM FDE, snarere end at skjule data. På partitioner, der ikke er /boot, kan LUKS, LVM og MD-RAID fortsat anvendes som tidligere. Der vil heller ikke være nogen begrænsninger ved boot uden UEFI Secure Boot mode.
Kilde: opennet.ru
