New profiles
In addition to the above changes to AppArmor itself, several profiles were added. Enforcing profiles for ntpd, the GNOME document viewer (evince), and libvirt are enabled by default. Complain mode profiles for Dovecot are now available in the apparmor-profiles package. A new profile is provided for Firefox as well, though it is disabled by default. Users can enable AppArmor sandboxing of their browser by running:
$ sudo aa-enforce /etc/apparmor.d/usr.bin.firefox-3.5
Please see the SecurityTeam/KnowledgeBase for a full listing of readily available profiles in Ubuntu.
Libvirt
Libvirt now contains AppArmor integration when using KVM or QEMU. Libvirtd is configured to launch virtual machines that are confined by uniquely restrictive AppArmor profiles. This feature significantly improves virtualisation in Ubuntu by providing user-space host protection as well as guest isolation. Uncomplicated Firewall
The Uncomplicated Firewall now has support for filtering by interface and egress filtering when using the ufw command. Documentation for ufw is also improved to help users better utilise the ufw framework and take full advantage of Linux netfilter's power and flexibility. See UbuntuFirewall#Features for a full list of features.
Non-eXecutable Emulation
Non-eXecutable (NX) memory protection, also known as eXecute-Disable (XD), has always been available in Ubuntu for any systems that had the hardware to support it and ran the 64-bit kernel or the 32-bit server kernel. The 32-bit PAE desktop kernel (linux-image-generic-pae) now also provides the PAE mode needed for hardware with the NX CPU feature.
For systems that lack NX hardware, the 32-bit kernels now provide an approximation of the NX CPU feature via software emulation that can help block many exploits an attacker might run from stack or heap memory. Blocking Module Loading
To block the loading of any further modules after boot (generally for servers with unchanging hardware), the /proc/sys/kernel/modules_disabled one-way sysctl flag now exists to add another layer of protections against attackers loading kernel rootkits.
Position-Independent Executables
Building on the work done in Ubuntu 8.10 and 9.04 to proactively protect Ubuntu from unknown threats by using strict compiler flags, more applications have been built as Position-Independent Executables (PIE) to take advantage of the Address Space Layout Randomisation (ASLR) available in the Ubuntu kernel.
In addition to the growing program list, PIE programs are now also built with the BIND_NOW linker flag to take full advantage of the existing RELRO linker flag. This results in PIE programs having fewer places in their memory that can be controlled to redirect program flow when an attacker attempts memory-corruption exploits.
Known issues
已知问题
As is to be expected at this stage of the release process, there are several known bugs that users are likely to run into with Ubuntu 9.10 Beta. We have documented them here for your convenience along with any known workarounds, so that you don't need to spend time reporting these bugs again:
这个阶段的发布版本就像预期一样,用户在使用Ubuntu 9.10 beta很有可能会遇到一些已知的bugs。在这里我们已经把它们文档化,而且为了您的方便,一道给出了一些已知的修改,这样您就不必要花费时间再次报告这些 bugs 了。
* Some users with Intel video chipsets will experience a black screen on reboot after install because the fbcon module is not being loaded. As a workaround, users can boot with the i915.modeset=0 option. Investigation of this issue is ongoing. (431812)
* 一些使用 Intel 视频芯片组的用户在安装完重启时会遇到黑屏,这是因为 fbcon 模块没有被加载。一个可用的修改方案是,用户在启动系统时可以附加 i915.modeset=0 选项。对这个问题的调查仍在进行中。
* If a RAID partitioning scheme is used during installation the grub boot loader will only be installed on the first hard drive instead of all the drives. Booting the system if the first drive has failed will not work. As a workaround users can manually install grub to each disk in the array using the grub-install command (427048).
* 安装系统时如果使用的是 RAID 分区模式, grup 启动管理器将只会被安装在第一个硬盘,而不是所有的(硬盘)驱动器。如果第一个硬盘启动失败,将不能启动系统。一个可用的修改方案是,用户可以使用 grub-install 命令手动安装 grub 到磁盘阵列的每一个磁盘
* Some users report that, in connection with the conversion of the base system to native upstart jobs, the system will fail to boot if the root partition has errors. As a workaround for this problem, users can boot from external media and run fsck manually. Investigation of this issue is ongoing. (432237)
* 一些用户报告说,
* A bug in the boot-time ordering of NFS-related init scripts will prevent systems from booting if any "core" filesystems (including /usr or /home) are mounted over NFS. Users with such configurations are advised to wait for the Ubuntu 9.10 Release Candidate before ugrading. (431248)
* 任何的“核心”文件系统(包括 /usr 或 /home)如果是通过NFS的方式安装(挂载)的,在启动时排序与NFS相关的初始化脚本的一个bug将会阻止系统启动。建议有这样配置的用户等待 Ubuntu 9.10 候选版本发布后再升级。
* When performing an Ubuntu Enterprise Cloud setup from the Server CD, Eucalyptus components fail to automatically register the components. To solve this, immediately upgrade to the latest Eucalyptus packages after installation, and sudo restart eucalyptus. (438602, 439251).
* In the Ubuntu Moblin Remix developer preview, the sources.list in the live image and installed systems will miss the ~moblin PPA; you can add it manually for now (420048). Also, the web browser does not function correctly in the released image; a fix for this bug is available in the ~moblin PPA (439677).
初步的翻译只剩下这么多了,英语能力还行的坛友们积极参与哦
ps:俺的六级考了两次都没过
