The update is based on Linux 6.6.32 and includes mitigations for Register File Data Sampling in Intel processors, as well as fixes for CPU graph issues. The Raspberry Pi has been supported for CPU frequency scaling, and experimental support for Btrfs allows for data compression and snapshot creation, which may benefit development and rollbacks.
IPFire 2.29 - Core Update 186 released
Finally it is time for another release of IPFire! IPFire 2.29 - Core Update 186. Packaged with a refreshed kernel, experimental support for Btrfs, as well as various security & bug fixes.
But before we start talking about the changes in detail, we would like to take a moment and ask for your support. We put a lot of effort into building and testing this update and could not do any of this without your donation. Please, donate to the project helping us to put more resources to bring you more and better updates. It is very much appreciated by all of us here!
A Refreshed Kernel
This update brings a refresh of the IPFire Kernel, based on Linux 6.6.32. It has mitigations for the latest Register File Data Sampling (RFDS, CVE-2023-28746) in Intel processors and fixes issues with the CPU graph for processors when some virtual cores are offline.
The Raspberry Pi has received support for CPU frequency scaling.
Experimental Support for Btrfs
This release introduces experimental support for Btrfs in IPFire. Currently this has been implemented to test out what benefits IPFire could draw from this new design of a filesystem. It enables compression of all data it holds and allows to create snapshots which might become useful for the development process and enable easier rollbacks.
Misc.
- Firewall Blocklists
- Spamhaus EDROP has been merged into DROP. Users who had EDROP enabled will automatically have DROP enabled after installing this update.
- The discontinued Alienvault list has been removed.
- Suricata haș been enabled to use Linux Landlock which is supposed to protect against any unauthorised file system access from exploits.
- The Unbound/DHCP Leases bridge has been patched to avoid unnecessary reloads of Unbound. Thanks to Nick Howitt for his first-time contribution.
- Some unnecessary warnings during the boot process have been silenced.
- Updated packages: Apache2 2.4.59, BIND 9.16.49, kmod 32, libhtp 0.5.48, OpenSSL 3.2.2, SQLite 3.45.3, squid 6.9, strongSwan 5.9.14, Suricata 7.0.5, tzdata 2024a
Add-ons
- Icinga has been removed, as announced in February
- The broken sslh add-on has been removed
- Updated packages: Bacula 13.0.4, dnsdist 1.9.3, Lynis 3.1.1, mympd 14.1.2, Tor 0.4.8.11
After installing this update, please reboot your IPFire appliance.
