Fedora 40 Moving Ahead In Beefing Up Its Security

The Fedora Engineering and Steering Committee "FESCo" has signed off on two separate change proposals for further enhancing the system security with the in-development Fedora 40 Linux to be released in April.

FESCo has approved the change to yield linker errors on hitting security issues. The ld.bfd linker will now generate an error if it's supposed to create an executable binary that contains one or more security issues. The security issues include things like a loadable segment with read/write/execute permissions, thread local storage segments with execute permissions, and an executable stack.

Currently such security issues are raised as warnings by the linker which may go unnoticed to the package maintainers. But now in treating them as errors they will need to be fixed up or otherwise overrode in the RPM spec.

The other change approved by FESCo this week is applying systemd security hardening with Fedora 40. Various systemd tunables will now be set to provide various protections and additional restrictions and isolation around systemd services.

Separately and aside from security work items, FESCo also approved this week dropping OpenSSL Compat, 389 Directory Server 3.0.0, and shipping Wget2 as the wget package.

More details on the changes approved this week by FESCo for F40 can be found via the meeting minutes.