Microsoft has released an update for the CBL-Mariner 1.0.20210901 distribution (Common Base Linux Mariner), which is being developed as a universal base platform for Linux environments used in cloud infrastructure, edge systems, and various Microsoft services. The project aims to unify the Linux solutions used by Microsoft and simplify the maintenance of various Linux systems to keep them up-to-date. The project's developments are distributed under the MIT license.
In the new release:
- The formation of the base ISO image (700 MB) has begun. In the first release, ready-made ISO images were not provided; it was assumed that the user could create their own image with the necessary components (build instructions are prepared for Ubuntu 18.04).
- Support for automatic package updates has been implemented, for which the Dnf-Automatic application has been included.
- The Linux kernel has been updated to version 5.10.60.1. Updated versions of programs include openvswitch 2.15.1, golang 1.16.7, logrus 1.8.1, tcell 1.4.0, gonum 0.9.3, testify 1.7.0, crunchy 0.4.0, xz 0.5.10, swig 4.0.2, squashfs-tools 4.4, mysql 8.0.26.
- OpenSSL now provides the option to return support for TLS 1 and TLS 1.1.
- The sha256sum utility has been used to check the source texts of the tools.
- New packages included are: etcd-tools, cockpit, aide, fipscheck, tini.
- The packages brp-strip-debug-symbols, brp-strip-unneeded, and ca-legacy have been removed. SPEC files for the Dotnet and aspnetcore packages have been removed, which are now built by the main .NET development team and are hosted in a separate repository.
- Vulnerability fixes have been transferred to the used versions of the packages.
The CBL-Mariner distribution provides a small standard set of core packages, serving as a universal foundation for building container internals, host environments, and services deployed in cloud infrastructures and on edge devices. More complex and specialized solutions can be created by adding additional packages on top of CBL-Mariner, but the foundation for all such systems remains unchanged, which simplifies maintenance and update preparation. For example, CBL-Mariner is used as the basis for the mini-distribution WSLg, which provides components of the graphical stack for running Linux GUI applications in environments based on the WSL2 (Windows Subsystem for Linux). Extended functionality in WSLg is achieved through the inclusion of additional packages with composite proxy server Weston, XWayland, PulseAudio, and FreeRDP.
The CBL-Mariner build system allows for the generation of both individual RPM packages based on SPEC files and source texts, as well as monolithic system images formed using the rpm-ostree toolkit and updated atomically without breaking into individual packages. Accordingly, two update delivery models are supported: through separate package updates and through rebuilding and updating the entire system image. A repository is available that includes about 3000 already built RPM packages, which can be used to assemble custom images based on a configuration file.
The distribution includes only the most essential components and is optimized for minimal memory and disk space consumption, as well as for high boot speed. The distribution is also notable for including various additional mechanisms for enhanced security. The project adopts a 'maximum security by default' approach. It provides the ability to filter system calls using the seccomp mechanism, disk partition encryption, and package verification through digital signatures.
Supported kernel space address randomization modes have been activated, along with mechanisms protecting against attacks related to symbolic links, mmap, /dev/mem, and /dev/kmem. For memory areas housing kernel data segments and modules, a read-only mode has been established, prohibiting code execution. Optionally, a capability to prevent kernel module loading after system initialization is available. The iptables toolkit is utilized for packet filtering. By default, stack overflow protection, buffer overflow safeguarding, and string formatting issues (_FORTIFY_SOURCE, -fstack-protector, -Wformat-security, relro) are enabled during build.
The system manager systemd is used for service management and booting. RPM and DNF package managers (tdnf variant from vmWare) are supplied for package management. The SSH server is not enabled by default. An installer is provided for the distribution, which can operate in both text and graphical modes. The installer offers the option for a full or basic set of packages, providing an interface for selecting disk partitions, setting the hostname, and creating users.
Source: opennet.ru
