October 2025 - wlug - list.wlug.org.nz

Flatpak Doesn't Work in Ubuntu 25.10, But a Fix is Coming
by Peter Reutemann 14 Oct '25

14 Oct '25

'"It's not just you: Flatpak flat-out doesn't work in the new Ubuntu 25.10 release," writes the blog OMG Ubuntu: While Flatpak itself can be installed using apt, trying to install Flatpaks with Flatpak from the command-line throws a "could not unmount revokefs-fuse filesystem" error, followed by "Child process exited with code 1". For those who've installed the Ubuntu 'Questing Quokka' and wanted to kit it out with their favourite software from Flathub, it's a frustrating road bump. AppArmor, the tool that enforces Ubuntu's security policies for apps, is causing the issue. According to the bug report on Launchpad, the AppArmor profile for fusermount3 lacks the privileges it needs to work properly in Ubuntu 25.10. Fusermount3 is a tool Flatpak relies on to mount and unmount filesystems... This is a bug and it is being worked on. Although there's no timeframe for a fix, it is marked as critical, so will be prioritised. The bug was reported in early September, but not fixed in time for this week's Ubuntu 25.10 release, reports Phoronix: Only [Friday] an updated AppArmor was pushed to the "questing-proposed" archive for testing. Since then... a number of users have reported that the updated AppArmor from the proposed archive will fix the Flatpak issues being observed. From all the reports so far it looks like that proposed update is in good shape for restoring Flatpak support on Ubuntu 25.10. The Ubuntu team is considering pushing out this update sooner than the typical seven day testing period given the severity of the issue. More details from WebProNews: Industry insiders point out that AppArmor, Ubuntu's mandatory access control system, was tightened in this release to enhance security... This isn't the first time AppArmor has caused friction; similar issues plagued Telegram Flatpak apps in Ubuntu 24.04 LTS earlier this year, as noted in coverage from OMG Ubuntu.' -- source: https://news.slashdot.org/story/25/10/13/067256 Cheers, Peter

1 0

Ubuntu 25.10 'Questing Quokka' Released
by Peter Reutemann 10 Oct '25

10 Oct '25

'9to5Linux reports: Dubbed Questing Quokka, Ubuntu 25.10 is powered by the latest and greatest Linux 6.17 kernel series for top-notch hardware support and ships with the latest GNOME 49 desktop environment, defaulting to a Wayland-only session for the Ubuntu Desktop flavor, meaning there's no other session to choose from the login screen. Ubuntu Desktop also ships with two new apps, namely GNOME's Loupe instead of Eye of GNOME as the default image viewer, as well as Ptyxis instead of GNOME Terminal as the default terminal emulator. Also, there's a new update notification that will be shown with options to open Software Updater or install updates directly.' Other highlights of Ubuntu 25.10 include sudo-rs as the default implementation of sudo, Dracut as the default initramfs-tools, Chrony as the default NTP (Network Time Protocol) client, Rust Coreutils as the default implementation of GNU Core Utilities, and TPM-backed FDE (Full Disk Encryption) recovery key management. Moreover, Ubuntu 25.10 adds NVIDIA Dynamic Boost support and enables suspend-resume support in the proprietary NVIDIA graphics driver to prevent corruption and freezes when waking an NVIDIA desktop. For Intel users, Ubuntu 25.10 introduces support for new Intel integrated and discrete GPUs.' -- source: https://news.slashdot.org/story/25/10/09/2054218 Cheers, Peter

1 0

VLC’s First Update in a Year to Introduce Qt6 and Windows ARM64 Support
by Peter Reutemann 09 Oct '25

09 Oct '25

'After a year of silence, one of the most popular media players, VLC, is back with a new release candidate, version 3.0.22 RC1 (Vetinari). Although much of the attention is on version 4.0, long in development and expected to deliver major changes, this release also includes a notable update. One of the most important features is support for building VLC with Qt6, which is (as you can guess) a big win for all KDE enthusiasts. On top of that, the release candidate introduces native Windows ARM64 support, reflecting the growing interest in ARM hardware on laptops and tablets. The update also packs a wide set of fixes and adjustments. The developers disabled the older liba52, libmpeg2, and libdca libraries by default, encouraging use of libavcodec instead. On the playback side, users can expect improvements for AV1, Opus, ProRes, FLAC, and JPEG handling, plus more reliable behavior when seeking over SFTP and refinements in Matroska and DVD caption support. Regarding security, VLC 3.0.22 RC1 addresses a record number of issues, many of them caught through the oss-fuzz project and funding from the SecureTrust Fund. That makes this update one of the most important in recent years from a stability and safety standpoint. Lastly, Windows users will notice that the player now allows renaming, moving, or deleting the currently playing file, and there’s even a renewed compatibility with Windows XP SP3 (yes, there are still enthusiasts betting on it), which is still in use in some very specific setups.' -- source: https://linuxiac.com/vlcs-first-update-in-a-year-to-introduce-qt6-and-windo… Cheers, Peter

1 0

Tails 7.0 Anonymous Linux OS Officially Released, Based on Debian 13 “Trixie”
by Peter Reutemann 07 Oct '25

07 Oct '25

'Tails 7.0 is out today as a major update to this portable Linux OS based on the Debian GNU/Linux operating system that protects users against surveillance and censorship. Highlights of Tails 7.0 include a Debian 13 “Trixie” base and a kernel from the long-term supported Linux 6.12 LTS series from the upstream Debian release, the latest GNOME 48 desktop environment by default featuring GNOME Console as default terminal emulator and GNOME Loupe as default image viewer. The Tails devs note the fact that the Root Terminal was broken when replacing GNOME Terminal with GNOME Console, so they renamed Root Terminal to Root Console. They also removed the Kleopatra app from the Favorites menu, so now users will have to start Kleopatra from Apps > Accessories. Moreover, they removed the obsolete Network Connection option from the Welcome Screen, the Places menu, and some packages from the live ISO image, including unar, aircrack-ng, and sq. Tails 7.0 ships with many updated components, including Tor 0.4.8.17, Tor Browser 14.5.7, Mozilla Thunderbird 128.14 ESR, OnionShare 2.6.3, Kleopatra 24.12, KeePassXC 2.7.10, GIMP 3.0.4, Inkscape 1.4, Audacity 3.7.3, and Electrum 4.5.8. For Inkscape, Tails now skips the onboarding. This release also fixes various issues, including an issue with selecting the correct keyboard for certain languages. Check out the release notes for more details about the changes included in Tails 7.0, which is available for download right now from the official website as ISO and USB images for 64-bit systems.' -- source: https://9to5linux.com/tails-7-0-anonymous-linux-os-released-based-on-debian… Cheers, Peter

1 0

Redis Warns of Critical Flaw Impacting Thousands of Instances
by Peter Reutemann 07 Oct '25

07 Oct '25

'BleepingComputer reports: The Redis security team has released patches for a maximum severity vulnerability that could allow attackers to gain remote code execution on thousands of vulnerable instances. Redis (short for Remote Dictionary Server) is an open-source data structure store used in approximately 75% of cloud environments, functioning like a database, cache, and message broker, and storing data in RAM for ultra-fast access. The security flaw (tracked as CVE-2025-49844) is caused by a 13-year-old use-after-free weakness found in the Redis source code and can be exploited by authenticated threat actors using a specially crafted Lua script (a feature enabled by default). Successful exploitation enables them to escape the Lua sandbox, trigger a use-after-free, establish a reverse shell for persistent access, and achieve remote code execution on the targeted Redis hosts. After compromising a Redis host, attackers can steal credentials, deploy malware or cryptocurrency mining tools, extract sensitive data from Redis, move laterally to other systems within the victim's network, or use stolen information to gain access to other cloud services. "This grants an attacker full access to the host system, enabling them to exfiltrate, wipe, or encrypt sensitive data, hijack resources, and facilitate lateral movement within cloud environments," said Wiz researchers, who reported the security issue at Pwn2Own Berlin in May 2025 and dubbed it RediShell. While successful exploitation requires attackers first to gain authenticated access to a Redis instance, Wiz found around 330,000 Redis instances exposed online, with at least 60,000 of them not requiring authentication. Redis and Wiz urged admins to patch their instances immediately by applying security updates released on Friday, "prioritizing those that are exposed to the internet." To further secure their Redis instances against remote attacks, admins can also enable authentication, disable Lua scripting and other unnecessary commands, launch Redis using a non-root user account, enable Redis logging and monitoring, limit access to authorized networks only, and implement network-level access controls using firewalls and Virtual Private Clouds (VPCs).' -- source: https://it.slashdot.org/story/25/10/06/222222 Cheers, Peter

1 0

Systemd 258 Drops cgroup v1, Raises Kernel Baseline to 5.4
by Peter Reutemann 06 Oct '25

06 Oct '25

'Systemd, a widely adopted system and service manager for Linux, has released its latest iteration, v258, which introduces significant changes that administrators should be aware of. Probably the headline change is that support for cgroup v1—the so-called “legacy” and “hybrid” hierarchies—has been removed. From now on, only cgroup v2 is mounted during boot and inside systemd-nspawn containers. Another notable move is the bump in the minimum kernel requirement. The baseline is now Linux 5.4, first released back in 2019, with 5.7 listed as the recommended version. That means older distributions or kernels simply won’t be able to run systemd 258. Security changes are also in play. By default, tty/pts device nodes now get mode 0600 instead of the old 0620, which effectively means “mesg n” is the new normal. On the crypto side, OpenSSL has become the only supported backend for systemd-resolved and systemd-importd, dropping support for both GnuTLS and libgcrypt. Session handling has been reworked, too. systemd-logind now assigns system jobs like cron tasks or FTP sessions to new “light” classes by default. That way, they won’t spin up a full per-user service manager unless explicitly configured. PAM sessions tied to normal users remain unchanged. Admins maintaining old setups should also take note: support for System V–style init scripts is officially deprecated and scheduled for removal in systemd 259. The same goes for the legacy /run/lock/ directory, and for iptables support in networkd and nspawn, which will rely solely on nftables from the next release.' -- source: https://linuxiac.com/systemd-258-drops-cgroup-v1-raises-kernel-baseline-to-… Cheers, Peter

1 0

How to switch your Windows 10 PC to Linux Mint - for free
by Peter Reutemann 06 Oct '25

06 Oct '25

Maybe this article with step-by-step instructions might help some of the Windows user in your circle to switch to Linux... -- source: https://www.zdnet.com/article/how-to-switch-your-windows-10-pc-to-linux-min… Cheers, Peter

1 0