Capítulo 5. Problemas a serem considerados para o jessie

Índice

5.1. Estado da segurança dos navegadores web
5.2. OpenSSH server defaults to "PermitRootLogin without-password"
5.3. Puppet 2.7 / 3.7 compatibility
5.4. PHP 5.6 upgrade has behavioural changes
5.5. Upgrading installs the new default init system for Jessie
5.5.1. Stricter handling of failing mounts during boot under systemd
5.6. Jessie udev needs kernel with CONFIG_DEVTMPFS=y (non-standard setups)
5.7. Manual migration of disks encrypted with LUKS whirlpool (non-standard setups)
5.8. The GNOME desktop requires basic 3D graphics
5.9. The GNOME desktop does not work with the AMD proprietary FGLRX driver
5.10. Changes in the GNOME default keyboard shortcuts

Algumas vezes, mudanças introduzidas em uma nova versão têm efeitos colaterais que não podem ser evitados ou que acabam expondo bugs em outros locais. Esta seção documenta problemas conhecidos. Por favor, também leia a errata, a documentação dos pacotes relevantes, relatórios de bugs e outras informações mencionadas na Seção 6.1, “Leitura complementar”.

5.1. Estado da segurança dos navegadores web

O Debian 8 inclui diversos motores de navegadores que são afetados por um fluxo constante de vulnerabilidades de segurança. A alta taxa de vulnerabilidades e a ausência parcial de suporte do upstream na forma de ramos de longo prazo tornam muito difícil o suporte a esses navegadores com correções de segurança adaptadas. Além disso, as interdependências das bibliotecas tornam impossível atualizar para uma versão upstream mais nova. Por isso, navegadores feitos sobre os motores webkit, qtwebkit e khtml foram incluídos no Jessie, mas não estão cobertos pelo suporte de segurança. Esses navegadores não devem ser usados em sites web não confiáveis.

For general web browser use we recommend Iceweasel or Chromium.

Chromium - while built upon the Webkit codebase - is a leaf package, which will be kept up-to-date by rebuilding the current Chromium releases for stable. Iceweasel and Icedove will also be kept up-to-date by rebuilding the current ESR releases for stable.

Note that the package debian-security-support, introduced in Jessie, helps to track security support status of installed packages.

5.2. OpenSSH server defaults to "PermitRootLogin without-password"

In an attempt to harden the default setup, the openssh-server configuration will now default to "PermitRootLogin without-password". If you rely on password authentication for the root user, you may be affected by this change.

The openssh-server will attempt to detect such cases and increase the priority of its debconf prompt.

If you want to keep password authentication for the root user, you can also preseed this question by using:

$ echo 'openssh-server openssh-server/permit-root-login boolean true' | debconf-set-selections
    

5.3. Puppet 2.7 / 3.7 compatibility

If you are using Puppet, please be aware that Puppet 3.7 is not backwards compatible with Puppet 2.7. Among other things, the scoping rules have changed and many deprecated constructs have been removed. See the Puppet 3.x release notes for some of the changes, although be aware that there are further changes in 3.7.

Checking the log files of your current puppetmaster for deprecation warnings and resolving all of those warnings before proceeding with the upgrade will make it much easier to complete the upgrade. Alternatively, or additionally, testing the manifests with a tool like Puppet catalog test may also find potential issues prior to the upgrade.

When upgrading a Puppet managed system from wheezy to jessie, you must ensure that the corresponding puppetmaster runs at least Puppet version 3.7. If the master is running wheezy's puppetmaster, the managed jessie system will not be able to connect to it.

For more information on incompatability changes, please have a look at Telly upgrade issues and "The Angry Guide to Puppet 3"

5.4. PHP 5.6 upgrade has behavioural changes

The upgrade to Jessie includes an upgrade of PHP from 5.4 to 5.6. This may affect any local PHP scripts and you are advised to check those scripts before upgrading. Below are a selected subset of these issues:

  • To prevent man-in-the-middle attacks against encrypted transfers client streams now verify peer certificates by default.

    As a result of this change, existing code using ssl:// or tls:// stream wrappers (e.g. file_get_contents(), fsockopen(), stream_socket_client()) may no longer connect successfully without manually disabling peer verification via the stream context's "verify_peer" setting.

    For more information about this particular issue, please read this document

  • PHP changes the handling of case-insensitivity in many cases:

    • All internal case insensitivity handling for class, function and constant names is done according to ASCII rules. Current locale settings are ignored.

    • The keywords "self", "parent" and "static" are now always case insensitive.

    • The json_decode() function no longer accepts non-lowercase variants of "boolean" values.

  • The logo GUID functions (e.g. php_logo_guid()) have been removed.

  • It is no longer possible to overwrite keys in static scalar arrays. Please see PHP bug 66015 for an example and more information about this particular issue.

  • The mcrypt_encrypt(), mcrypt_decrypt() and mcrypt_{MODE}() functions no longer accept keys or IVs with incorrect sizes. Furthermore an IV is now required if the used block cipher mode requires it.

For more information or the full list of potential issues, please have a look at upstream's list of backwards incompatible changes for PHP 5.5 and 5.6.

5.5. Upgrading installs the new default init system for Jessie

Jessie ships with systemd-sysv as default init system. If you have a preference for another init such as sysvinit-core or upstart, it is recommended to setup APT pinning prior to the upgrade. As an example, to prevent systemd from being installed during the upgrade, you can create a file called /etc/apt/preferences.d/local-pin-init with the following contents:

Package: systemd-sysv
Pin: release o=Debian
Pin-Priority: -1
  
[Cuidado]Cuidado

Be advised that some packages may have degraded behaviour or may be lacking features under a non-default init system.

Please note that the upgrade may install packages containing "systemd" in their name even with APT pinning. These alone do not change your init system. To use systemd as your init system, the systemd-sysv package must be installed first.

5.5.1. Stricter handling of failing mounts during boot under systemd

The new default init system, systemd-sysv, has a stricter handling of failing "auto" mounts during boot compared to sysvinit. If it fails to mount an "auto" mount (without the "nofail" option), systemd will drop to an emergency shell rather than continuing the boot.

We recommend that all removable or "optional" mount points (e.g. non-critical network drives) listed in /etc/fstab either have the "noauto" or the "nofail" option.

5.6. Jessie udev needs kernel with CONFIG_DEVTMPFS=y (non-standard setups)

[Nota]Nota

This section is only for people, who compile their own kernel. If you use the kernels compiled by Debian, you can disregard this section.

The udev package in Jessie requires a kernel compiled with "CONFIG_DEVTMPFS=y". Please ensure your kernel is compiled with that option prior to upgrading. For more information see /usr/share/doc/systemd/README.gz.

5.7. Manual migration of disks encrypted with LUKS whirlpool (non-standard setups)

[Nota]Nota

This section is only for people have set up LUKS encrypted disks themselves using the whirlpool hash. The debian-installer never supported creating such disks.

If you have manually setup an encrypted disk with LUKS whirlpool, you will need to migrate it manually to a stronger hash. You can check if your disk is using whirlpool by using the following command:

    # /sbin/cryptsetup luksDump <disk-device> | grep -i whirlpool
  

For more information on migrating, please see item "8.3 Gcrypt 1.6.x and later break Whirlpool" of the cryptsetup FAQ.

[Cuidado]Cuidado

If you have such a disk, cryptsetup will refuse to decrypt it by default. If your rootdisk or other system disks (e.g. /usr) are encrypted with whirlpool, you should migrate them prior to the first reboot after upgrading cryptsetup.

5.8. The GNOME desktop requires basic 3D graphics

The GNOME 3.14 desktop in Jessie no longer has fallback support for machines without basic 3D graphics. To run properly, it needs either a recent enough PC (any PC built in the last 10 years should have the required SSE2 support) or, for architectures other than i386 and amd64, a 3D-accelerated graphics adapter with EGL drivers.

5.9. The GNOME desktop does not work with the AMD proprietary FGLRX driver

Unlike other OpenGL drivers, the AMD FGLRX driver for Radeon adapters does not support the EGL interface. As such, several GNOME applications, including the core of the GNOME desktop, will not start at all when this driver is in use.

It is recommended to use the free radeon driver, which is the default in jessie, instead.

5.10. Changes in the GNOME default keyboard shortcuts

The default keyboard shortcuts in the GNOME desktop have changed in order to match more closely those of some other operating systems.

Shortcut settings previously modified by the user will be preserved upon upgrade. These settings can still be configured from the GNOME control center, accessible from the top right menu by clicking on the “settings” icon.