Linux Journal

by George Whittaker Introduction

With the arrival of GNOME 48, the desktop experience steps into a refreshing new era, blending clarity, visual richness, and adaptability. This release unfolds a more intuitive configuration interface, native HDR capability, and finer-grained display scaling. Whether you’re streaming, tweaking your workspace, or simply glancing over your notifications, GNOME 48 brings you improvements that feel both modern and meaningful, crafted to feel like they were made for real people doing real tasks.

A Refined Settings Environment Revamped Configuration Hub

GNOME 48’s Settings app has shed its former rigidity and stepped into a role that feels inviting and efficient. Never again will you wade through scattered sections, options are now neatly grouped, and the design flow intuitively matches how your mind works. Menus anticipate your focus, search responds predictably, and the overall layout whispers, “you’re in control.”

Assistive Features Front and Center

Accessibility isn’t an afterthought anymore, it’s central. Icons are clearer, toggles are easier to reach, and each label reads like someone actually sat down to ask, “How can we make this tool-friendly for everyone?” GNOME 48 puts inclusivity on full display, ensuring that those who rely on adaptive tech never need to dig for solutions.

Tighter System Synergy

Gone are the days when Wi-Fi, sound levels, or power settings felt tucked away. These essentials now respond faster, with less visual fuss and more behind-the-scenes connection to smarter system logic. It’s the kind of integration where you flick a switch and everything else falls into harmony.

Elevating Visuals with HDR Why HDR Lights Up the Desktop Experience

Forget washed-out colors or muddled shades, GNOME 48 steps up with HDR rendering, delivering brightness, depth, and contrast that bring your display to life. Darker shadows, gleaming highlights, sumptuous gradients, HDR transforms ordinary visuals into something cinematic. It’s not just eye candy; it's more faithful media, smoother workflows, and next-level artistic clarity.

What You’ll Need to Shine

This full-color upgrade doesn’t work across all drift of hardware, but it does mesh well with modern, HDR-capable monitors and compatible GPU drivers accelerating through Wayland. GNOME 48 ensures things just click when your stack supports it, activating the richer palette whenever your display and graphics card are game.

Go to Full Article

by George Whittaker

In the last decade, the digital landscape has shifted from a space of casual convenience to a battleground for personal information. From constant corporate profiling to sprawling government surveillance programs, the reality is clear, our devices have become treasure troves for those seeking to exploit or monitor us. As trust in mainstream platforms erodes, a surge of interest has emerged around operating systems that place security and privacy at their very core. At the forefront of this movement are a new breed of Linux distributions designed not just for power users and security experts, but for anyone who values control over their data.

The Age of Hyper-Exposure

Every click, swipe, and typed search leaves a footprint. This wasn’t always a mainstream concern, many users once traded data for convenience without a second thought. But a string of high-profile incidents changed the narrative: massive data breaches leaking millions of personal records, whistleblower revelations exposing global surveillance programs, and marketing giants quietly building extensive behavioral profiles of individuals.

For the average person, these events have shattered the illusion of online privacy. For professionals handling sensitive work, journalists, lawyers, healthcare providers, data exposure is more than a nuisance; it’s a potential threat to safety, reputation, and trust. The result? An accelerating search for technology that resists tracking, intercepts intrusions, and limits data leakage before it can begin.

Why Linux Has Become the Privacy Battleground

Linux, in its many forms, has always worn transparency as a badge of honor. Unlike proprietary systems where code is hidden from public scrutiny, Linux distributions are open-source, meaning anyone can inspect the source code, audit for vulnerabilities, or suggest improvements. This creates a self-reinforcing cycle of trust and accountability.

Beyond transparency, Linux allows deep configurability. Users can strip away unnecessary software, remove hidden telemetry, and harden their system against attacks. Updates arrive quickly, often patched within hours of a security flaw being reported, compared to the slower cycles of commercial operating systems. And most importantly, Linux is free from the corporate incentives that often drive aggressive data collection.

What Sets Security-Focused Distros Apart

While all Linux distributions benefit from open-source transparency, security-oriented distros go several steps further by building privacy and protection into their foundation:

• Hardened System Kernels: Some distros use custom kernels with advanced security patches (like grsecurity) to close off potential attack vectors.

Go to Full Article

by George Whittaker Introduction

Flatpak promises a secure runtime for Linux applications through container-like isolation, relying on bubblewrap namespaces, syscall filtering, and portal interfaces. In theory, each app should operate inside a strong sandbox, disconnected from the host system. But in reality, experience shows gaps, tiny cracks through which apps may escape with serious consequences.

The Sandbox Promise… and the Reality

Flatpak applications begin life in a highly-restricted environment: no network by default, no access to host files beyond the runtime and a private data directory, limited syscalls, and restricted access to session or system services. Portals provide a controlled channel for granting specific capabilities (e.g. file dialogs, screenshot, printing) without broad privileges.

Yet, many Flatpak packages declare broad permissions like filesystem=home, filesystem=host, or device=all. That effectively grants full read-write access to the user's home directory or even system devices, defeating the purpose of the sandbox in practice. Users often assume that 'sandboxed' means locked-down, but blanket permissions expose them to risk.

Real-World Breakouts from the Sandbox CVE‑2024‑32462: RequestBackground Portal Abuse

Security researcher Gergo Koteles uncovered a high-severity vulnerability where malicious Flatpak apps could craft a .desktop file via the org.freedesktop.portal.Background.RequestBackground interface. That tricked Flatpak’s --command= parsing into injecting bwrap arguments (e.g. --bind). This allowed arbitrary host commands to execute outside the sandbox boundary. Versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8 were affected. Patched in the listed versions and mitigated in xdg-desktop-portal 1.18.4 and newer.

CVE‑2024‑42472: Persistent Data Symlink Exploit

A Flatpak flag, --persist (or persistent= in manifest), allows apps writable storage within their data directory. But if a malicious install replaces that directory with a symlink pointing to sensitive host folders (e.g. ~/.ssh), the sandbox mount entry follows it into the real filesystem, giving the app unintended access to files outside its name-spaced area. All versions up to 1.14.8 and 1.15.x ≤ 1.15.9 are vulnerable; patched in 1.14.10 and 1.15.10+.

Policy Complexity and Ecosystem Slip-Ups

A detailed study of hundreds of Flatpak and Snap packages found that nearly 42% of Flatpak apps either override the supposed isolation or misconfigure sandboxing, resulting in overprivilege or potential escape paths. Crafting fine-grained sandbox policy is hard, and mistakes slip through easily.

Go to Full Article

by George Whittaker Opening the Curtain on Tails 6.0

On February 27, 2024, the Tails Project unveiled version 6.0, a milestone release built atop Debian 12 “Bookworm” and GNOME 43 . Tails, short for The Amnesic Incognito Live System, is engineered from the ground up to prevent data leakage, protect against targeted surveillance, and ensure that every use leaves no trace unless explicitly permitted . Version 6.0 refines this mission with a bold suite of features tailored to block modern surveillance tactics.

USB Integrity: Stopping Sneaky Hardware Threats Warnings for Persistent Storage Failures

Live USBs are critical lifelines for persistence in Tails. Now, Tails 6.0 alerts users when underlying storage suffers read/write errors. This early detection, prior to catastrophic data loss, allows users to back up their encrypted areas before disaster strikes .

Defense Against Rogue USB Devices

One of the stealthiest attack vectors involves plugging in malicious USB gear while a device is unattended. Tails now ignores any USB device connected while the screen is locked. Only when the screen is unlocked can new USB devices be activated, closing the door on rubber‑duckying-style malware delivery .

Usability Upgrades That Don’t Sacrifice Security Automatic Device Mounting with Safeguards

Plug in a flash drive or encrypted external disk while Tails is unlocked, and the system now instantly mounts the device and prompts for decryption (e.g. VeraCrypt volumes), smoothing workflow while preserving safeguards .

Ambient Display Options for Privacy-Conscious Use

GNOME 43 brings native support for dark mode, night‑light warm tones, or combinations thereof, all accessible via the system menu. These modes reduce eye strain and lower screen glare in sensitive situations, minimizing accidental disclosure in low-light settings .

Simplified Screenshots and Screencast Access

Through a redesigned system menu, users can now take screenshots or record screencasts with a few clicks—reducing reliance on external tools and minimizing exposure via unnecessary browser or app use .

Streamlined Gmail Setup in Thunderbird

Configuring a Gmail account is now smoother: Tails 6.0 allows direct sign‑in within Thunderbird using standard two-step verification, no manual IMAP or security adjustments required, eliminating error-prone manual steps .

Go to Full Article

by George Whittaker Introduction

In recent times, two critical Linux security frameworks, AppArmor and SELinux, have seen noteworthy acceleration in real-world deployment. As Linux continues to anchor enterprise, container, cloud, and desktop systems, these Mandatory Access Control (MAC) tools have crossed threshold events signaling broader acceptance. This article examines those pivotal inflection points, dives into why they matter, and offers reflections on the shifting landscape of Linux security.

A Swift Journey to Widespread Use SELinux’s Ascendancy

Originally conceived by the NSA and later shepherded by Red Hat, SELinux added powerful MAC controls to Linux by the early 2000s. Since being fully embedded into the Linux 2.6.x kernel, SELinux has steadily expanded its reach. It has become the default security layer on Red Hat Enterprise Linux, Fedora, and their derivatives, and integrated into Debian 9+, plus Ubuntu from version 8.04. Android further embraced SELinux starting from version 4.3, marking its normalization in mobile devices.

But the most recent watershed occurred in early 2025: openSUSE Tumbleweed made SELinux the default MAC for new installations beginning with snapshot 20250211, accompanied by minimalVM images running in enforcing mode. Existing installations remain unaffected unless manually migrated, and AppArmor remains an installer option. Moreover, openSUSE Leap 16 will be shipping with SELinux in enforcing mode by default, affirming a full shift within SUSE ecosystems.

This chain of events reflects a conscious pivot in favor of SELinux across both SUSE and community platforms, aligning them more closely with enterprise-grade security policies.

AppArmor’s Established Reach

AppArmor, originally named SubDomain in the late '90s, emerged from Immunix and later became a core tool in SUSE distributions. It officially became part of the Linux kernel in version 2.6.36 around October 2010. Ubuntu began shipping it by default starting with 7.10; by 8.04, CUPS was protected. Over the following releases, its scope widened to include MySQL, libvirt, browser sessions, and more. In Debian 10 ("Buster"), released July 2019, AppArmor became enabled by default, anchoring its adoption across Debian-based ecosystems.

Go to Full Article

by George Whittaker Introduction

Privilege escalation in Linux has always walked a tightrope between convenience and risk. sudo allows users to perform tasks as root without sharing the root password—intuitive, powerful—but also a high-value target for exploits rooted in memory safety bugs. Ubuntu is now pioneering a transition: replacing the traditional C-based sudo with sudo‑rs, a Rust-powered rewrite engineered for safer root handling.

Understanding sudo‑rs

Built under the Trifecta Tech Foundation’s “Privilege Boundary” initiative, sudo‑rs is a from-scratch implementation of sudo and su created in Rust, a language celebrated for its compile-time guarantees against memory mishaps. Designed to behave like the classic “sudo,” it supports user prompts, permission checks, and environment handling, but keeps underlying behavior Turing-equivalent.

Why Ubuntu Is Betting on Rust

Rust’s strict approach to memory usage eradicates whole classes of vulnerabilities—like buffer overflows and use-after-free—that have long plagued system tools. For a utility as privileged as sudo, these protections offer exponentially greater security value. Ubuntu’s strategy, dubbed “Carefully But Purposefully Oxidising Ubuntu,” is a methodical shift toward memory-safe tooling.

Transitioning in Ubuntu 25.10 and Beyond

Canonical has announced that Ubuntu 25.10 (“Questing Quokka”), scheduled for October 9, 2025, will ship sudo‑rs as the default /usr/bin/sudo. This serves as a proving ground ahead of Ubuntu 26.04 LTS (April 2026). Regular users will find no change—commands, flags, and password prompts remain familiar—while Ubuntu monitors real-world feedback.

Ensuring Compatibility

To deliver a smooth switch, Canonical is funding “Milestone 5” development in sudo‑rs to implement:

• NOEXEC for shell escape control,

• AppArmor integration,

• sudoedit,

• Support for kernels older than 5.9 (critical for Ubuntu 20.04 containers).

A “less‑is‑more” philosophy guides, meaning legacy niche features—like LDAP-based sudoers—might remain absent. But, for most workflows, sudo‑rs should cover every essential feature.

Coexistence and Rollback

Ubuntu’s old sudo will still be available in the repositories and can be reselected via the alternatives system. Users needing features not yet ported to sudo‑rs can effortlessly revert.

Go to Full Article

by George Whittaker Driving Forces Behind Smarter Battery Use

In an era when remote work, video conferencing, and travel-heavy lifestyles are the norm, users expect laptops to last longer unplugged. Meanwhile, growing awareness of sustainability adds pressure to maximize energy efficiency. Recognizing this mantra, Linux developers have overhauled power-handling strategies, from the kernel core to user-space tools, to meet these expectations in 2025.

Core Kernel Enhancements: Harnessing Modern Power Tech Kernel 6.x’s Focus on Power Efficiency

• Linux 6.8 introduced refined support for newer hardware, including better CPU/GPU idle-state transitions and energy-friendly firmware interfaces.

• Linux 6.15, released in May 2025, continues this trend by adding improved power-capping, more regulators, voltage handlers, and enhanced support for ARM, RISC-V, and Intel/AMD CPU power modules.

These enhancements enable finer-grained control over sleep states, clock gating, and dynamic walling-off of unused chip domains, all pivotal for squeezing extra runtime.

MCU-Firmware Communication with FWCTL

A new firmware controller (fwctl) infrastructure within 6.15 gives user-space tools secure communication channels with embedded controller features, making tasks like adjusting battery charge thresholds more accessible and scriptable.

Advanced CPU & GPU Power Strategies Smarter Frequency Governors

Both intel_pstate and amd_pstate drivers continue evolving. Passive and conservative CPU governors now dynamically adapt based on workload profiles, delivering noticeable battery gains with minimal performance loss.

Low-Power On-Battery GPU Modes

Graphics subsystems are smarter about sleep:

• Intel's Arc and DG2 families now feature improved idle ramp-down behaviors for better battery performance.

• For AMD users, the transition from generic AMDGPU RADEON_POWER_PROFILE settings to fwctl-control offers more granular DPM tuning on laptops, especially under battery constraints.

Deep Sleep States and ACPI Evolution

The adoption of ACPI 6.6 and expanded kernel support for S0ix and modern-sleep states allow laptops to hang out in ultra-low-power standby, extending idle time battery life. Suspend-to-disk and resume logic also got less noisy, reducing spur-of-the-moment wake-ups that were draining battery life for many users.

Go to Full Article

by George Whittaker

When Rust first made its way into the Linux kernel in late 2022 (mainline inclusion began with version 6.1), it didn’t merely introduce a new programming language, it marked a profound shift in how we ensure operating system resilience. This article dives into why that matters, how it’s being implemented, and what it could mean for Linux’s long-term robustness.

Tackling the C Legacy: A Fragility Problem

For over three decades, the Linux kernel has been maintained in C, a language that offers both raw control and notorious pitfalls. Manual memory juggling in C leads to high-risk bugs: buffer overflows, phantom pointers, heap corruption, and race conditions. In fact, memory safety issues account for around two-thirds of all kernel vulnerabilities.

Enter Rust: a systems language designed to eliminate whole classes of these errors through strict compile-time checks, without sacrificing low-level efficiency.

Rust’s Safety Toolkit: What Sets It Apart

Rust’s most powerful features for kernel reliability include:

• Ownership semantics & the borrow checker These enforce rules about who owns a piece of memory at compile-time, no dangling pointers, no double frees.

• No runtime garbage collector All abstractions compile down to efficient machine code, ensuring performance remains rock-solid.

• Race elimination for free Rust-language concurrency prevents data races statically, eliminating a whole breed of timing-related bugs.

Combined, these attributes strip away entire categories of vulnerabilities that plague C-based code.

A New Layer: The Rust-for-Linux Framework

The groundwork for Rust modules in Linux was laid with kernel 6.1, and by version 6.8, the first experimental Rust drivers, covering areas like network PHYs and panic QR logging, were accepted. These drivers coexist with traditional C components, forming a hybrid architecture where Rust is used for new drivers while C remains the backbone.

Crucially, this integration includes:

• A Rust bindings crate to interface safely with C internals.

• A kernel crate that wraps core kernel structures and APIs for Rust consumption.

This layering enables gradual Rust adoption, developed drivers, not wholesale rewrites.

Early Results: Fewer Bugs, More Confidence

Evidence is already showing promise:

• Memory safety vulnerabilities drop out as code gets written in Rust, tackling roughly two-thirds of past CVEs.

• Kernel maintainers are noticeably more comfortable merging Rust patches, citing the added rigor from the borrow checker.

Go to Full Article

by George Whittaker A Paradigm Shift in Desktop Computing

The landscape of desktop operating systems has witnessed a notable transformation in 2025. Linux, once considered a niche player, has achieved a significant milestone by capturing 4.7% of the global desktop market share. This achievement underscores a growing trend of users seeking alternatives to traditional operating systems.

Tracing the Growth Trajectory

Linux's journey to its current standing has been marked by steady growth:

• July 2022: 2.76%

• July 2023: 3.12%

• July 2024: 4.44%

• June 2025: 4.7%

This upward trend reflects a combination of technological advancements and shifting user preferences.

Catalysts Behind the Surge 1. Gaming Innovations

The gaming sector has played a pivotal role in Linux's rising popularity. Valve's Steam Deck, a handheld gaming device running on Linux-based SteamOS, has introduced a new audience to the capabilities of Linux. Additionally, compatibility layers like Proton have enhanced the gaming experience on Linux platforms.

2. Enhanced Hardware Support

Modern Linux distributions have significantly improved hardware compatibility, making installation and daily use more seamless for users across various devices.

3. Cost-Effective Solutions

The open-source nature of Linux offers a free alternative to proprietary operating systems, appealing to both individual users and organizations aiming to reduce software licensing costs.

4. Regional Adoption Patterns

Certain regions have exhibited higher adoption rates. In the United States, Linux's desktop market share reached 5.03% in June 2025. In India, the figure stood at 16.21% as of July 2024. These statistics highlight the global appeal and adaptability of Linux.

Addressing Ongoing Challenges 1. Ecosystem Fragmentation

The diversity of Linux distributions, while offering flexibility, can lead to inconsistencies in user experience and software compatibility.

Despite progress, some proprietary applications and games remain inaccessible or require complex configurations on Linux systems.

2. Software Availability

Despite progress, some proprietary applications and games remain inaccessible or require complex configurations on Linux systems.

Go to Full Article

by George Whittaker

Released on March 24, 2025, Linux Kernel 6.14 introduces significant enhancements for Intel and AMD processors, focusing on performance, power efficiency, and hardware compatibility. These updates are particularly beneficial for users leveraging the latest CPU architectures and AI-driven workloads.

Intel CPU Enhancements Support for Upcoming Architectures

Linux 6.14 extends support to Intel's forthcoming Panther Lake CPUs, incorporating thermal driver support for improved power efficiency and enabling Ultra-High Bit Rate (UHBR) modes via DisplayPort on Thunderbolt's Alt-Mode. This advancement allows for 10G and 20G UHBR modes, enhancing display capabilities for devices equipped with Xe3 graphics.

Additionally, preparations for Intel's Clearwater Forest server processors are underway, with the inclusion of EDAC (Error Detection and Correction) driver support and readiness of the Turbostat tool for monitoring.

Performance and Virtualization Improvements

The kernel introduces Translation Lookaside Buffer (TLB) flushing scalability optimizations, reducing overhead during context switches and improving overall system performance. Enhancements to the x86 Kernel-based Virtual Machine (KVM) also contribute to better virtualization support, benefiting environments that rely on virtual machines.

AMD CPU Enhancements Introduction of AMD XDNA Driver

A notable addition in Linux 6.14 is the AMD XDNA driver, providing support for AMD's Neural Processing Units (NPUs) integrated into Ryzen AI processors. This driver facilitates AI workloads, such as machine learning applications, by enabling efficient execution of tasks like convolutional neural networks and large language models.

Power Management and Performance Tweaks

The AMD P-State driver receives updates, including dynamic ranking of preferred CPU cores and defaulting to the 'balance_performance' Energy Performance Policy (EPP) on Ryzen and EPYC processors. These changes aim to optimize power consumption without compromising performance.

Furthermore, encryption performance sees a 2-3% boost for AES-GCM and AES-XTS standards on Zen 4 and Zen 5 processors, enhancing data security operations.

Broader Implications

Beyond CPU-specific enhancements, Linux 6.14 introduces the NTSYNC driver, improving compatibility and performance for Windows games emulated via Wine and Proton. The kernel also expands support to accommodate up to 4,096 CPU cores, doubling the previous limit and catering to high-performance computing environments. Additionally, improvements in suspend/resume functionality enhance power management for various devices.

Go to Full Article

by George Whittaker

openSUSE Leap 16 marks a significant evolution in the openSUSE project, integrating the robustness of SUSE Linux Enterprise (SLE) with the dynamism of community contributions. This release aims to provide a stable, adaptable, and secure Linux distribution suitable for various environments, from enterprise servers to developer workstations.

Foundation: SUSE Linux Framework One (SLFO)

Leap 16 is built upon SUSE Linux Framework One (SLFO), formerly known as the Adaptable Linux Platform (ALP). This modular architecture allows for a more flexible and maintainable system, enabling users to tailor their installations to specific needs. By leveraging SLFO, Leap 16 inherits the enterprise-grade stability and support lifecycle of SLE 16, ensuring a reliable foundation for critical workloads.

Key Features and Enhancements 1. Modern Installation with Agama

Leap 16 introduces the Agama installer, a web-based, modular installation tool that replaces the traditional YaST installer. Agama offers a cleaner user interface and supports features like remote installations and scripting for automated deployments, enhancing the installation experience for both new and experienced users.

2. Enhanced Security with SELinux

Security-Enhanced Linux (SELinux) is now enabled by default in Leap 16, aligning with SLE's security practices. This change provides a more robust security framework, offering fine-grained access controls and improved isolation. For users preferring alternative security modules, AppArmor remains available as an option.

3. Transition to Wayland Display Server

Leap 16 adopts Wayland as the default display server, moving away from the legacy X11 system. Wayland offers improved performance, security, and support for modern graphics hardware. While X11 components are still available for compatibility, the shift to Wayland represents a step forward in graphical session management.

4. Updated Desktop Environments

Users can enjoy the latest desktop environments with Leap 16, including GNOME 48 and KDE Plasma 6.3. These updates bring new features, performance improvements, and enhanced user experiences to the desktop.

5. System Management Tools: Cockpit and Myrlyn

With the deprecation of YaST in Leap 16, system management transitions to Cockpit and Myrlyn. Cockpit provides a web-based interface for managing system settings, services, and performance monitoring. Myrlyn serves as a new Qt-based front end for software management, offering a streamlined experience for package installation and updates.

Go to Full Article