add a couple of links to AppArmor documentation
|Deletions are marked like this.||Additions are marked like this.|
|Line 122:||Line 122:|
|An App``Armor profile is now available for Apache in the libapache2-mod-apparmor package. When used in combination with the mod_apparmor Apache module, web applications can now be protected and isolated from each other. Instructions for enabling the profile are in the /etc/apparmor.d/usr.lib.apache2.mpm-prefork.apache2 file.
The Ubuntu developers are moving quickly to bring you the latest and greatest software the Open Source Community has to offer. This is the Ubuntu 9.10 beta release, which brings a host of exciting new features.
Note: This is a beta release. Do not install it on production machines. The final stable version will be released on October 29th, 2009.
Upgrading from Ubuntu 9.04
To upgrade from Ubuntu 9.04 on a desktop system, press Alt+F2 and type in "update-manager -d" (without the quotes) into the command box. Update Manager should open up and tell you: New distribution release '9.10' is available. Click Upgrade and follow the on-screen instructions.
To upgrade from Ubuntu 9.04 on a server system: install the update-manager-core package if it is not already installed; edit /etc/update-manager/release-upgrades and set Prompt=normal; launch the upgrade tool with the command sudo do-release-upgrade -d; and follow the on-screen instructions.
Get it while it's hot. ISOs and torrents are available at:
http://releases.ubuntu.com/releases/9.10/ (Ubuntu Desktop, Server, and Netbook Remix)
http://uec-images.ubuntu.com/releases/9.10/ (Ubuntu Server for UEC and EC2)
http://releases.ubuntu.com/kubuntu/9.10/ (Kubuntu Desktop and Netbook)
Local mirrors are also available:
FIXME: import mirror list automatically
New features since Ubuntu 9.04
These features are showcased for your attention. Please test them and report any bugs you find:
As part of our boot performance work, we have now transitioned to Upstart. If you are testing on your primary machine, we strongly suggest having an Ubuntu Karmic Alpha 5 LiveCD available, or creating an Alpha 5 USB startup disk before doing an upgrade. This will allow us to help you recover in the case that something goes wrong during the boot of your system after upgrade. We request that all bugs affecting the performance or functionality of boot be tagged with ubuntu-boot in Launchpad.
We've done some work on improving the overall look and feel of booting the system. Please open bugs with the tag "ubuntu-boot-experience" on any messages you see flashed after grub loads and before the new Ubuntu Splash screen (xsplash) displays. If you have trouble catching them before the splash screen loads, you can also check vt1 or dmesg output for copies of these messages. We also accept photos or video attachments if that's easier, however please make sure the text is readable.
Ubuntu 9.10 Beta includes the latest GNOME 2.28 desktop environment with a number of great new features:
- The gdm 2.28 login manager is a complete rewrite compared to the version in earlier Ubuntu releases, permitting a more integrated login experience.
Application development with Quickly
Quickly makes it easy for developers to make new applications for Ubuntu, and to share those application with other Ubuntu users via .deb packages or personal package archives.
Ubuntu Enterprise Cloud Images
Ubuntu 9.10 Beta includes images for common use on Ubuntu Enterprise Cloud (UEC) and Amazon's EC2. You can try out the latest Ubuntu 9.10 server image instantly on EC2 using a preconfigured AMI, or download an image and put it into your own Ubuntu Enterprise Cloud. For information on using UEC images on Amazon EC2, see the EC2 Starter's Guide.
Ubuntu One file sharing
Ubuntu 9.10 Beta ships the Ubuntu One file sharing service by default, providing tightly-integrated file synchronization of your computer with other computers and the Ubuntu One network storage service.
Linux kernel 2.6.31
Ubuntu 9.10 Beta includes the 2.6.31-11.36 kernel based on 18.104.22.168. The kernel ships with Kernel Mode Setting enabled for Intel graphics (see below). linux-restricted-modules is deprecated in favour of DKMS packages.
Ubuntu 9.10 Beta's underlying technology for power management, laptop hotkeys, and handling of storage devices and cameras maps has moved from "hal" (which is in the process of being deprecated) to "DeviceKit-power", "DeviceKit-disks" and "udev". When testing Ubuntu 9.10 Beta, please be alert for regressions in those areas and report any bugs you find.
New Intel video driver architecture available for testing
The Intel video driver has switched from the "EXA" acceleration method to the new "UXA", solving major performance problems of Ubuntu 9.04. Ubuntu 9.10 Beta also features kernel mode setting by default on Intel hardware, which reduces boot-time flickering and dramatically speeds up suspend/resume.
ext4 by default
The new "ext4" filesystem is used by default for new installations with Ubuntu 9.10 Beta; of course, other filesystems are still available via the manual partitioner. Existing filesystems will not be upgraded.
If you have full backups and are confident, you can upgrade an existing ext3 filesystem to ext4 by following directions in the Ext4 Howto. (Note that the comments on that page at the time of writing about Ubuntu's use of vol_id vs. blkid are out of date and are not applicable to Ubuntu 9.10 Beta.) Maximum performance will typically only be achieved on new filesystems, not on filesystems that have been upgraded from ext3.
GRUB 2 by default
GRUB 2 is the default boot loader for new installations with Ubuntu 9.10 Beta, replacing the previous GRUB "Legacy" boot loader. Existing systems will not be upgraded to GRUB 2 at this time, as automatically reinstalling the boot loader is an inherently risky operation.
Some features are still missing relative to GRUB Legacy. Notable among these are lock/password support, an equivalent of grub-reboot, and Xen handling.
The iSCSI installation process has been improved, and no longer requires iscsi=true as a boot parameter; the installer will offer you the option of logging into iSCSI targets if there are no local disks, or you can select "Configure iSCSI" in the manual partitioner.
Putting the root filesystem on iSCSI is now supported.
AppArmor in Ubuntu 9.10 Beta features an improved parser that uses cache files, greatly speeding up AppArmor initialisation on boot. AppArmor also now supports 'pux' which, when specified, means a process can transition to an existing profile if one exists or simply run unconfined if one does not.
Please see the AppArmor documentation for information on using AppArmor in Ubuntu.
In addition to the above changes to AppArmor itself, several profiles were added. Enforcing profiles for ntpd, the GNOME document viewer (evince), and libvirt are enabled by default. Complain mode profiles for Dovecot are now available in the apparmor-profiles package.
A new profile is provided for Firefox as well, though it is disabled by default. Users can enable AppArmor sandboxing of their browser by running:
$ sudo aa-enforce /etc/apparmor.d/usr.bin.firefox-3.5
This profile can be disabled again by performing:
$ sudo apparmor_parser -R /etc/apparmor.d/usr.bin.firefox-3.5 $ sudo ln -s /etc/apparmor.d/usr.bin.firefox-3.5 /etc/apparmor.d/disable/usr.bin.firefox-3.5
An AppArmor profile is now available for Apache in the libapache2-mod-apparmor package. When used in combination with the mod_apparmor Apache module, web applications can now be protected and isolated from each other. Instructions for enabling the profile are in the /etc/apparmor.d/usr.lib.apache2.mpm-prefork.apache2 file.
Please see the SecurityTeam/KnowledgeBase for a full listing of readily available profiles in Ubuntu.
Libvirt now contains AppArmor integration when using KVM or QEMU. Libvirtd is configured to launch virtual machines that are confined by uniquely restrictive AppArmor profiles. This feature significantly improves virtualisation in Ubuntu by providing user-space host protection as well as guest isolation.
The Uncomplicated Firewall now has support for filtering by interface and egress filtering when using the ufw command. Documentation for ufw is also improved to help users better utilise the ufw framework and take full advantage of Linux netfilter's power and flexibility. See UbuntuFirewall#Features for a full list of features.
Non-eXecutable (NX) memory protection, also known as eXecute-Disable (XD), has always been available in Ubuntu for any systems that had the hardware to support it and ran the 64-bit kernel or the 32-bit server kernel. The 32-bit PAE desktop kernel (linux-image-generic-pae) now also provides the PAE mode needed for hardware with the NX CPU feature.
For systems that lack NX hardware, the 32-bit kernels now provide an approximation of the NX CPU feature via software emulation that can help block many exploits an attacker might run from stack or heap memory.
Blocking Module Loading
To block the loading of any further modules after boot (generally for servers with unchanging hardware), the /proc/sys/kernel/modules_disabled one-way sysctl flag now exists to add another layer of protections against attackers loading kernel rootkits.
Building on the work done in Ubuntu 8.10 and 9.04 to proactively protect Ubuntu from unknown threats by using strict compiler flags, more applications have been built as Position-Independent Executables (PIE) to take advantage of the Address Space Layout Randomisation (ASLR) available in the Ubuntu kernel.
In addition to the growing program list, PIE programs are now also built with the BIND_NOW linker flag to take full advantage of the existing RELRO linker flag. This results in PIE programs having fewer places in their memory that can be controlled to redirect program flow when an attacker attempts memory-corruption exploits.
As is to be expected at this stage of the release process, there are several known bugs that users are likely to run into with Ubuntu 9.10 Beta. We have documented them here for your convenience along with any known workarounds, so that you don't need to spend time reporting these bugs again:
Some users with Intel video chipsets will experience a black screen on reboot after install because the fbcon module is not being loaded. As a workaround, users can boot with the i915.modeset=0 option. Investigation of this issue is ongoing. (431812)
If a RAID partitioning scheme is used during installation the grub boot loader will only be installed on the first hard drive instead of all the drives. Booting the system if the first drive has failed will not work. As a workaround users can manually install grub to each disk in the array using the grub-install command (427048).
Some users report that, in connection with the conversion of the base system to native upstart jobs, the system will fail to boot if the root partition has errors. As a workaround for this problem, users can boot from external media and run fsck manually. Investigation of this issue is ongoing. (432237)
A bug in the boot-time ordering of NFS-related init scripts will prevent systems from booting if any "core" filesystems (including /usr or /home) are mounted over NFS. Users with such configurations are advised to wait for the Ubuntu 9.10 Release Candidate before ugrading. (431248)
When performing an Ubuntu Enterprise Cloud setup from the Server CD, Eucalyptus components fail to automatically register the components. To solve this, immediately upgrade to the latest Eucalyptus packages after installation, and sudo restart eucalyptus. (438602, 439251).
In the Ubuntu Moblin Remix developer preview, the sources.list in the live image and installed systems will miss the ~moblin PPA; you can add it manually for now (420048). Also, the web browser does not function correctly in the released image; a fix for this bug is available in the ~moblin PPA (439677).
It should come as no surprise that this beta release of Karmic Koala contains other bugs. Your comments, bug reports, patches and suggestions will help fix bugs and improve future releases. Please report bugs using the tools provided.
If you want to help out with bugs, the Bug Squad is always looking for help.
Participate in Ubuntu
If you would like to help shape Ubuntu, take a look at the list of ways you can participate at
To sign up for future Ubuntu development announcements, please subscribe to Ubuntu's development announcement list at: