|
|
Subscribe / Log in / New account

A look at Ubuntu Desktop LTS 24.04

Did you know...?

LWN.net is a subscriber-supported publication; we rely on subscribers to keep the entire operation going. Please help out by buying a subscription and keeping LWN on the net.

By Joe Brockmeier
May 1, 2024

Ubuntu 24.04 LTS, code-named "Noble Numbat", was released on April 25. This release includes GNOME 46, installer updates, security enhancements, a lot of updated packages, and a new App Center that puts a heavy emphasis on using Snaps to install software. It is not an ambitious release, but it brings enough to the table that it's a worthwhile update.

Ubuntu users expecting to upgrade to the new release right away are in for a bit of disappointment. The release notes indicate that upgrades from earlier releases are not yet supported. Users on the previous release, 23.10, will be offered an upgrade via Ubuntu's software and updates application when it is ready. Moving from 22.04 LTS will be supported when 24.04.1 is released in August. Those eager to jump right in are advised to make a backup of their data and do a clean install rather than attempting an upgrade.

Meet the new LTS

Starting with a fresh install will provide a chance to try out the latest version of the Subiquity installer, which now includes the ability to update itself before beginning an installation. If the system is connected to the Internet, Subiquity will check to see if there is an update available and (if so) apply it before proceeding. This can be quite useful for addressing bugs or adding new features after the installation media for a release has been distributed.

One interesting change in the installer workflow is the addition of a step to set up accessibility features immediately after the language is selected. This may be a helpful addition for users who need assistive technologies, when it's fully ready. The screen reader included with the installer is described in the release notes as incomplete and has a number of bugs indicating that it is currently not usable to perform the installation.

The disk partitioning step now offers TPM-backed disk encryption if the system has a compatible trusted platform module (TPM). The ZFS filesystem is also offered as an option, as it is in the 22.04.4 LTS installer, but is now marked experimental and is lacking encryption support. The option to install ZFS was disabled in the 22.10 release due to a bug that caused problems on first boot. Support for guided ZFS installation was re-added in Ubuntu 23.10 with a note that encryption would return in a future release. Aside from those changes, the workflow for installation is basically the same as the previous LTS release.

Desktop

"Basically the same" is a theme that carries through to the desktop, at least at first glance. Once installed, there's little visible difference between 24.04 LTS and the prior LTS release. A few icons have changed, the wallpaper sports the Numbat logo, and the button that used to be labeled "Activities" in the top-left corner is replaced with a pill-shaped icon. Like its predecessor, clicking that will bring up the activities overview that shows all of the open application windows.

One of the user-interface improvements Ubuntu attempted to drive in previous releases was a "Global" menu that integrated the application's menu with the top bar of the desktop rather than in the application's window, in a similar fashion to the user interface of macOS. However, Apple is able to enforce uniformity in its interfaces in a way that Canonical cannot. It was an interesting idea that could have saved a bit of screen space, but most applications did not support the feature so the menu would only include a few menu options such as "quit" and "new window". It has been entirely removed in this release, which is understandable but unfortunate. No matter how much screen space is available, a little more is always appreciated.

The desktop is mostly standard GNOME 46, which we covered in March, with a few additions, tweaks, and the omission of the GNOME Software application along with support for Flatpaks. GNOME Software and Flatpak can be installed with APT, but only if users know to go looking for them.

The rest of the changes are minor in comparison. For example, in Ubuntu alt-tab cycles between windows rather than applications. The desktop sports the Ubuntu Dock, which is similar to the GNOME Dash-to-Dock extension except that it can't be disabled. There is also an "enhanced tiling" feature that provides more flexible window-tiling options than standard GNOME. Dragging a window to the corner of the screen will cause it to snap into position taking up either one-half or one-quarter of the screen. (GNOME only allows two windows to be "tiled" side-by-side.) It's still limited compared to extensions like gTile that allow a wide range of tiling options, but it can be useful.

[Ubuntu Desktop]

Ubuntu Desktop now defaults to a "minimal" install that leaves out things like games, a mail client, and office software. This is an interesting evolution (no pun intended) from the early days of Ubuntu. When the distribution first arrived on the scene, one of its distinguishing characteristics was providing an opinionated selection of software rather than asking the user to choose from a dizzying array of options at install time. Now users are given a nearly blank slate. This does make some sense—in the nearly 20 years since the Warty Warthog release, people depend a lot less on locally installed software. A browser and a handful of applications may be all that a person needs to be productive if much of their software is browser-based. For additional software, users can turn to the new Ubuntu App Center.

[Ubuntu App Center]

At first glance, it would be easy to conclude that the App Center only works with Snap packages. All of the software that users can find just by browsing the store is Snap-only. Debian packages are filtered out of searches. It would be unfair to say that the option of installing Debian packages is hidden, but it is easily missed.

Users who prefer to install software via the command-line will be mostly unaffected by the push toward Snaps. The exceptions include Firefox and Thunderbird, which are not available as standard Debian packages in the Ubuntu repositories. Instead, users who try to "apt install thunderbird" receive a dummy package that installs the Snap instead.

Of course, GNOME is not the only Ubuntu desktop flavor available. Users can opt for Budgie, Cinnamon, KDE, LXQT, Mate, or the Unity desktops. There are also use-case-specific options, Edubuntu for educational use, Kylin for Chinese users, and Studio for multimedia production.

Miscellaneous

Naturally, 24.04 has a great number of updated packages. It includes Linux kernel 6.8.0, systemd v255.4, LLVM 18, GCC 13.2.0 (with an experimental version of the unreleased GCC 14), GNU C Library (glibc) 2.39, and Binutils 2.42. Other changes include updates to Python 3.12 as the default Python, OpenJDK 21, Rust 1.75, Go 1.22, Ruby 3.2.3, and Perl 5.38.2.

The new Firmware Updater application is a nice addition, but it is something of a black box. It displays a list of system firmware along with upgrades (and downgrades) that can be applied, as well as options to update their checksums and to verify the firmware. Unfortunately, it doesn't provide links to the original download site for firmware or give the user any way to even see the checksums. Clicking "Verify Firmware" pops up a dialog that asks if the user wants to verify the firmware. Clicking "OK" just closes the dialog box without any indication whether the check was performed or if it passed.

[Ubuntu Firmware Updater]

There are a few security enhancements worth noting. For example, unprivileged user namespaces are now restricted to prevent potential kernel exploits. Because many applications, like Buildah, Firefox, Podman, Thunderbird, and others, use user namespaces, there are nearly 100 AppArmor profiles allowing well-known applications to use user namespaces. If an application isn't in that list, such as Bubblewrap, it's reasonably easy to create an AppArmor profile that allows the application to create a user namespace. It's also possible to disable the restriction entirely, though that hasn't proven necessary so far in my day-to-day use.

APT now expects RSA signing keys of 2048 bits or more, and will warn when trying to install packages signed with 1024-bit keys. The release notes indicate that the warning will become an error when APT 2.8.0 is introduced at a later date. (The current version is 2.7.14.)

Not entirely baked

There is certainly no rush for Ubuntu users to upgrade right now with standard support for 22.04 LTS through 2027. Numbat will receive standard security maintenance (in other words, free updates without requiring an account) through 2029. Those who have an Ubuntu Pro account can receive updates for 24.04 LTS through 2034. See the release cycle page for full details.

Overall, Noble Numbat is a good release, but it feels much less finished than one might expect for an LTS release. This may, in part, be because the release cycle was interrupted by the XZ situation. Canonical opted to delay the beta by one week and do a full rebuild of all packages, but stuck to the April 25 release date. An extra week (or more) to address bugs might have been in order. Ubuntu users who prefer stability over novelty may wish to sit out the upgrade until 24.04.1 is available later this year.



(Log in to post comments)

A look at Ubuntu Desktop LTS 24.04

Posted May 2, 2024 1:19 UTC (Thu) by aaronmdjones (subscriber, #119973) [Link]

I don't understand why they chose kernel 6.8 which is going to be EOL in July 2024 as opposed to 6.6 LTS which is going to be supported by upstream until December 2026. They've just created another two and a half years of extra work for themselves.

A look at Ubuntu Desktop LTS 24.04

Posted May 2, 2024 1:56 UTC (Thu) by gmatht (guest, #58961) [Link]

Maybe it was just the kernel that was in Debian testing. I recall Debian put an unstable version of LyX into testing, Ubuntu forked from that testing, and we ended up with an unstable version of LyX in stable Ubuntu. The problem is that unstable LyX doesn't even have a stable file format, so a stable Ubuntu started creating documents in some random format that lacked official support from anyone. (IIRC unofficially, the LyX project never dropped support for the unstable format).

A look at Ubuntu Desktop LTS 24.04

Posted May 2, 2024 6:04 UTC (Thu) by MKesper (subscriber, #38539) [Link]

Nope. Debian right now features 6.6 for testing and 6.7 for sid.

A look at Ubuntu Desktop LTS 24.04

Posted May 2, 2024 14:28 UTC (Thu) by HenrikH (subscriber, #31152) [Link]

AFAIK 6.8 contains support for the coming new RDNA4 cards from AMD.

A look at Ubuntu Desktop LTS 24.04

Posted May 2, 2024 2:39 UTC (Thu) by xanni (subscriber, #361) [Link]

You somehow omitted my personal favourite flavour, XUbuntu with the XFCE desktop.

A look at Ubuntu Desktop LTS 24.04

Posted May 2, 2024 3:17 UTC (Thu) by jzb (editor, #7867) [Link]

Huh. Oops. I apologize, that was definitely not intentional.

Those new AppArmor profiles don't quite work for me

Posted May 2, 2024 3:40 UTC (Thu) by gutschke (subscriber, #27910) [Link]

I installed 24.04 in a Proxmox container (not VM), and the new unconfined AppArmor profiles that automatically ship for all sorts of applications cause unexpected problems for me.

AppArmor marks things like Chrome, Firefox, UWSGI, ... as "unconfined, but have a profile defined". That sounds perfectly reasonable based on my limited understanding of AppArmor. But it has the unfortunate effect that the attempt to open any type of socket() ends with EPERM. If I remove the AppArmor profile, these applications start working again.

I am puzzled by what that means and whether this is a bug in Ubuntu, Proxmox, AppArmor, LXC, the kernel, or something completely different. So, I don't even really know with which project I should file a bug.

Other than that, I like what I have seen so far. Things seem significantly snappier and more responsive, at least when run as a Proxmox container. Haven't tried installation on bare metal yet.

Those new AppArmor profiles don't quite work for me

Posted May 2, 2024 13:13 UTC (Thu) by jajpol (subscriber, #8044) [Link]

The snap for Chrome is unofficial, which may be the issue. It's packaged by a volunteer called Ryan.

Those new AppArmor profiles don't quite work for me

Posted May 4, 2024 3:30 UTC (Sat) by kunitz (subscriber, #3965) [Link]

I'm compiling golang versions myself and run into the problem that one test fails because of one of the new apparmor profiles. The workaround so far, was to deactivate one profile. I lack the time to learn another configuration language that covers the whole system, to find a more granular fix. Apparmor contradicts a long-term Linux kernel rule, don't break user space.

Those new AppArmor profiles don't quite work for me

Posted May 4, 2024 5:04 UTC (Sat) by jrjohansen (subscriber, #75010) [Link]

There are lots of security restrictions that can break certain use cases.

You only need to learn the config language if you want to disable the restriction on a case by case basis. You can disable it globally with sysctl as describe at the end of the release note on them https://discourse.ubuntu.com/t/noble-numbat-release-notes...

In fact Ubuntus kernel does not even enable the restriction by default, the enablement is also done via a sysctl.

Those new AppArmor profiles don't quite work for me

Posted May 4, 2024 8:54 UTC (Sat) by kunitz (subscriber, #3965) [Link]

Thanks for the link, the remarks are useful. Note that the userns restriction is enabled by default, you must explicitly disable it.

Those new AppArmor profiles don't quite work for me

Posted May 4, 2024 3:59 UTC (Sat) by jrjohansen (subscriber, #75010) [Link]

They are working but you will led to do a little to enable your proxmox container to use unprivileged user namespaces (you are being affected by the new unprivileged user namespace restriction), because the proxmox container does not have a profile defined. When it creates the user namespace it will transition to the unpriviled_userns profile, which will deny all capability requests, hence the EPERMs you are seeing. If you look in the kernel logs you will see an apparmor message about transitioning to the unprivileged_userns profile.

To fix this you can follow the instructions in the release notes https://discourse.ubuntu.com/t/noble-numbat-release-notes...

Those new AppArmor profiles don't quite work for me

Posted May 4, 2024 4:09 UTC (Sat) by gutschke (subscriber, #27910) [Link]

I believe I still don't quite get it.

The release notes give an example how to move Chrome into the unconfined profile. Inside of the container, this has already been done by Ubuntu 24.04. But instead of fixing things, that seems to be the exact thing that causes problems. If I *remove* this profile and run Chrome without an AppArmor profile, everything works correctly. But with the configuration that the release notes suggest I need, I get the EPERM.

I can see how this is the correct general area for hunting the bug, though. Proxmox recently upgraded to a more modern kernel, and while the Proxmox VE host runs Debian, it uses an Ubuntu kernel. So, yes, it would have picked up whatever restrictions Ubuntu now enables for user namespaces.

I noticed that you said the problem is the LXC container lacking an AppArmor profile. But that's even more confusing. How would I set that up, and is that really what I am supposed to do? That sounds rather invasive to require to do from anybody who wants to continue using LXC.

Those new AppArmor profiles don't quite work for me

Posted May 4, 2024 5:25 UTC (Sat) by jrjohansen (subscriber, #75010) [Link]

This is a nesting of unprivileged user namespaces issue.

The lxc container system uses unprivileged user namespaces to setup the container. With the restriction enabled user namespaces become semi-privileged. That is they either require privilege to be created or the application creating the user namespace needs a profile that allows it. Unknown codes creation of user namespaces is controlled. There is two options here.

1. If the unprivileged_userns profile is loaded user code will be allowed to create a user namespace, but that user namespace will be restricted so that it has no capabilities within the user namespace.
2. If the unprivileged_userns profile is not loaded unknown user code will not be able to create user namespaces at all.

This means with the restriction enabled for lxc to use user namespaces it requires a profile, or potential proxmox. The behavior of what is allowed within the container will then be defined by the profile an lxc/proxmox.

Chrome also wants to create user namespaces for its sandbox. If it is run within the container, there are several different options. Lxc containers are a complicated case as there are different possible configuration. If lxc creates an apparmor policy namespace, then the unconfined profile within that namespace will also enforce the user namespace, and the chrome profile will need to exist in the the container's policy namespace (not at the system level). The container should either be configured with the needed policy or disable the restriction within the container. Anyways this is what I guess is happening, but I can't say for sure without more information. I suggest you file a bug again lxc or apparmor on launchpad.

You can completely disable the restriction via a sysctl its described at the end of the release note's section on the user namespace restriction.

A look at Ubuntu Desktop LTS 24.04

Posted May 2, 2024 6:14 UTC (Thu) by MKesper (subscriber, #38539) [Link]

I really don't get it why so many think Ubuntu would be a better base for your work than Debian. Ok, five years of support sounds great at first. But the number of packages which are really included in Ubuntu is small. There are NO guarantees at all for the whole bunch in "universe". After two years you will want to switch to the next LTS anyway because it's just becoming a nightmare with installing more and more packages from unknown provenience by curl|bash.
Snap is an abomination with horrible performance. They sneak in more and more subscription stuff.
And where Debian packaging is lacking, like up to date docker, Ubuntu provides no working alternative, either. That snap package just doesn't work...
Debian, on the other hand, handles updates very smoothly, has an insane amount of supported packages but sadly not the marketing forces of Canonical.

A look at Ubuntu Desktop LTS 24.04

Posted May 2, 2024 8:33 UTC (Thu) by rsidd (subscriber, #2582) [Link]

I use snaps for a few things, including firefox. It did have issues a year or 18 months ago, but works fine now.

The LTS includes 5 years of *commercial* support, if you want to pay for it ("Ubuntu Pro"), which Debian doesn't offer. And it includes universe. And Debian stable tends to be very out-of-date.

Personally I don't use LTS unless it's the current release, I update every 6 months. That's stable enough for me.

A look at Ubuntu Desktop LTS 24.04

Posted May 2, 2024 9:15 UTC (Thu) by aragilar (subscriber, #122569) [Link]

Debian also has a 5 year LTS (https://www.debian.org/lts/), and you can go to https://www.freexian.com/ (along with any of the people/groups listed on https://www.debian.org/consultants/) if you want to pay (or use ELTS https://wiki.debian.org/LTS/Extended).

I'm genuinely confused about the "stable is out-of-date and so it bad" meme, as the point of stable is a solid base that doesn't break, and that upgrades are supported in a controlled manner (as opposed to other systems which are significantly more laissez-faire with their upgrades).

A look at Ubuntu Desktop LTS 24.04

Posted May 2, 2024 15:32 UTC (Thu) by rsidd (subscriber, #2582) [Link]

Not saying stable is bad. It's good for a server. Not for most desktop users, not for me anyway. Also, is it a meme?

Debian Stable on the desktop

Posted May 2, 2024 19:29 UTC (Thu) by dskoll (subscriber, #1630) [Link]

I'm running Debian Stable on my desktop (with XFCE) and it's fine. I have only two pieces of software installed outside of Debian packages: Firefox, which I install directly from Mozilla's binary release tarball, and kdenlive, which I install as an Appimage. Everything else is current enough for my needs.

A look at Ubuntu Desktop LTS 24.04

Posted May 5, 2024 19:28 UTC (Sun) by Heretic_Blacksheep (subscriber, #169992) [Link]

I'd point out that "most desktop users" don't use Linux as a desktop. The primary desktop OS is Windows where people and especially corporations may install a program then never update it for the life of their desktop hardware, even if it has automatic prompting for updates. Therefore, for the majority of desktop users "old" isn't a big issue so long as their browser still works for the websites they visit. I'd say that's probably true of the average non-developer Unix users as well whether they use Mac, Linux, or BSD. Most of us just tend to run what's packaged. It helps that certain programs that may be more time or feature sensitive are often packaged in atomic whole or with a 3rd party repository, for me that would be Blender (tar packages though I still prefer Windows or Mac for Blender - ROCm on Linux currently sucks... sorry AMD :P), Krita (appimage), Firefox release (Mozilla's own repository) with Firefox-ESR from the distro repository a hot backup if/when Firefox release breaks something important, and sometimes Chirp (a ham radio program). Everything else, including the limited amount of programming I do, is fine with the distro packages.

In some ways I'm just an advanced "power user" and technician, but I still consider myself a fairly boringly mundane desktop user that has to support the "rest of" computer land as a day job. The "rest of" desktop users usually hate updating anything because they've been taught, through personal experience!, that updates break things. This is true regardless of what OS you use. There's always a non-zero chance of updates breaking something important to the user. Therefore with the average desktop computer user (those that remain anyway) LTS is definitely a Good Thing because there's less chance of something important to them breaking during the software's support lifetime. And as a personal side note, it's why I keep a backup of previous releases of the games and programs I use regularly in case they break something important to me in the next update.

I think the problem isn't "most desktop users". I think the problem is most desktop program developers hit a lot more gotchas in Linux land because of distro library compatibility fragmentation than if there were a sole canonical common denominator reference as at least theoretically exists in the Windows, Mac, and other commercial platforms. And since that's a problem for developers, it ends up a problem for enthusiast desktop users in the same world who always have to have the latest everything. I just don't see it as a problem for "most" desktop users who are rightly update gun-shy when all they want to do is get on with their own work, not fix problems with broken tools.

A look at Ubuntu Desktop LTS 24.04

Posted May 2, 2024 11:38 UTC (Thu) by mgedmin (subscriber, #34497) [Link]

> I really don't get it why so many think Ubuntu would be a better base for your work than Debian.

I really want to have the latest version of GNOME every 6 months without using Debian testing or unstable.

A look at Ubuntu Desktop LTS 24.04

Posted May 10, 2024 5:58 UTC (Fri) by MKesper (subscriber, #38539) [Link]

But this has nothing to do with basing e.g. a container image on the distro.

A look at Ubuntu Desktop LTS 24.04

Posted May 2, 2024 9:42 UTC (Thu) by rbranco (subscriber, #129813) [Link]

Wish more distros dare to include ZFS.

A look at Ubuntu Desktop LTS 24.04

Posted May 2, 2024 15:33 UTC (Thu) by rsidd (subscriber, #2582) [Link]

As a zfs user on ubuntu I agree. But the legal situation is complicated.

Mozilla now provides Firefox as .deb packages

Posted May 2, 2024 10:43 UTC (Thu) by CChittleborough (subscriber, #60775) [Link]

As mentioned in LWN's coverage of Firefox 122,0, you can get Firefox packages directly from Mozilla as .deb packages, with automagic updates. Even better, these packages are built with link-time optimization. No Snap needed, not even a Flatpak!


Copyright © 2024, Eklektix, Inc.
This article may be redistributed under the terms of the Creative Commons CC BY-SA 4.0 license
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds