July 2008 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 331060] New: updater should show the current version for upgrades, not just the candidate version
by bugzilla_noreply＠novell.com 20 Mar '09

20 Mar '09

https://bugzilla.novell.com/show_bug.cgi?id=331060 Summary: updater should show the current version for upgrades, not just the candidate version Product: openSUSE 10.2 Version: Final Platform: x86 OS/Version: Linux Status: NEW Severity: Normal Priority: P5 - None Component: libzypp AssignedTo: tgoettlicher(a)novell.com ReportedBy: logixoul(a)gmail.com QAContact: kkaempf(a)novell.com Found By: --- The qt updater applet shows only the candidate version for any given upgrade. It should also show the currently installed version. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 9

[Bug 285482] New: 'verify installed package dependencies' functionality in YaST
by bugzilla_noreply＠novell.com 19 Mar '09

19 Mar '09

https://bugzilla.novell.com/show_bug.cgi?id=285482 Summary: 'verify installed package dependencies' functionality in YaST Product: openSUSE 10.3 Version: Alpha 5 Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: ke(a)novell.com QAContact: jsrain(a)novell.com CC: gs(a)novell.com, sh(a)novell.com Found By: Documentation Fate 301178. Does not work as annnounced for me. Default installation (with GNOME). rpm -e --nodeps sax2 tcl Start yast -> software management -> Extra -> Verify System => Yast says dependencies are fine. File -> Quit. Surprisingly, YaST installs "sax2". Quit yast, whole procedure again. ... Quit and yast installs tcl. [I did not test with yast-ncurses.] -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 14

[Bug 372070] New: open-vm-tools: suid binary
by bugzilla_noreply＠novell.com 19 Mar '09

19 Mar '09

https://bugzilla.novell.com/show_bug.cgi?id=372070 Summary: open-vm-tools: suid binary Product: openSUSE 11.0 Version: Alpha 3 Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security AssignedTo: security-team(a)suse.de ReportedBy: prusnak(a)novell.com QAContact: qa(a)suse.de Found By: --- I created new package open-vm-tools. These are tools that could be installed when openSUSE is running in VMware. It contains one binary that should be packaged as suid root. If it is not, only root on guest system can access Shared files from host system. i586/open-vm-tools-2008.03.11-1.i586.rpm: -rwsr-xr-x 1 root root 43124 Mar 18 15:44 /usr/sbin/mount.vmhgfs file /usr/sbin/mount.vmhgfs is packaged with suid/sgid permissions but is not listed in any of /etc/permissions* please contact security team -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 18

[Bug 381276] New: libzypp unexpectedly calls mkinitrd
by bugzilla_noreply＠novell.com 19 Mar '09

19 Mar '09

https://bugzilla.novell.com/show_bug.cgi?id=381276 Summary: libzypp unexpectedly calls mkinitrd Product: openSUSE 11.0 Version: Beta 1 Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel AssignedTo: seife(a)novell.com ReportedBy: poeml(a)novell.com QAContact: qa(a)suse.de Found By: --- I updated a couple of packages from Factory, and at some point, libzypp hangs after printing the following line, for about 10 minutes. / Installing: suspend-0.80.20080219-20 [100%] I see gzip running in top, and notice that the suspend package's %post apparently has called mkinitrd, which recreates all initrds on my system (which clearly something that I don't want it to do!!) root 23613 0.3 1.3 7796 4252 pts/1 S+ 14:18 0:00 \_ rpm --root / --dbpath /var/lib/rpm -U --percent --force --nodeps -- /var/cache/zypp/packages/factory/ppc/suspend-0.80.20080219-20.ppc.rpm root 23614 0.0 0.4 3416 1392 pts/1 S+ 14:18 0:00 \_ /bin/sh /var/tmp/rpm-tmp.22927 1 root 23615 0.0 0.4 3416 1512 pts/1 S+ 14:18 0:00 \_ /bin/bash /sbin/mkinitrd root 27514 3.0 0.3 3552 1248 pts/1 S+ 14:20 0:01 \_ /bin/bash /sbin/mkinitrd root 29407 1.0 0.1 1956 600 pts/1 S+ 14:20 0:00 \_ cpio -H newc --create root 29408 100 0.2 2080 716 pts/1 R+ 14:20 0:23 \_ gzip -9 Especially as not kernel or mkinitrd package was updated: # zypper update * Building repository 'factory' cache Reading installed packages... The following NEW packages are going to be installed: bundle-lang-common-ar poppler-data yast2-registration yast2-add-on yast2-firewall yast2-online-update opensuse-codecs-installer suseRegister bash-completion yum-basearchonly release-notes-openSUSE gtk2-branding-upstream yast2-control-center-qt yast2-qt-pkg gimp-plugins-python gstreamer-0_10-plugins-base splashy ghostscript-omni suspend uuid-runtime yast2-ncurses-pkg libgstinterfaces-0_10-0 kdelibs3-doc bash-doc ft2demos enscript PolicyKit-doc graphviz-gd libgvfscommon0 libasound2-64bit libgio-fam gvfs libgpod-tools libgluezilla0 perl-doc limal-ca-mgm-perl sane-backends-autoconfig alsa-plugins readline-doc alsa-oss-64bit perl-Crypt-SSLeay yast2-control-center Overall download size: 20.7 M. After the operation, additional 118.0 M will be used. Continue? [YES/no]: y Downloading package bundle-lang-common-ar-11.0-92.noarch, 152.0 K (529.0 K unpacked) * Downloading: bundle-lang-common-ar-11.0-92.noarch.rpm [done (62.0 K/s)] [...] The suspend package has this in %post: # rpm -q suspend --scripts postinstall scriptlet (using /bin/sh): if [ "$YAST_IS_RUNNING" != "instsys" -a \ ! -e /.buildenv -a \ -x /sbin/update-bootloader -a \ -x /sbin/mkinitrd ]; then /sbin/mkinitrd /sbin/update-bootloader --refresh fi I see a few problems with this: 1) is it really needed to run mkinitrd to up date _all_ initrds after updating the suspend package? 2) the user is not informed about the mkinitrd run and zypper gives no indication what it's doing for 10 minutes (that's probably a zypper issue?) 3) recreating _all_ initrds (which is what it did) is dangerous, I don't want that. It is okay for me if it recreates the initrd for the booted kernel, like it would do if I update the kernel... Stefan, I suppose you could have some input on this? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 4

[Bug 408352] New: potential time shift vulnerability in Online Update
by bugzilla_noreply＠novell.com 19 Mar '09

19 Mar '09

https://bugzilla.novell.com/show_bug.cgi?id=408352 Summary: potential time shift vulnerability in Online Update Product: openSUSE 11.0 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security AssignedTo: security-team(a)suse.de ReportedBy: sbrabec(a)novell.com QAContact: qa(a)suse.de CC: zypp-maintainers(a)forge.provo.novell.com Found By: --- I found following theoretical problem in the Online Update work-flow. I did not verify, that the problem is real and whether it can be exploited. Suppose that malicious person takes control over one of online update mirrors and wants to provide vulnerable software. It is not possible to do it directly, as all online updates are signed. But following scenario may be possible: 1. Instead of mirroring from the official servers, it will only back-up the original unline update contents. 2. Provide data from the back-up to the mirror and increase time shift over the time. Server is up, provides correctly signed packages, time new security update appears. User has no doubt. 3. Log IP addresses of machines checking for online update. This scenario could provide vulnerability window created by the time shift and list of IP addresses of still vulnerable machines. Malicious person has enough time to create an exploit and install it to vulnerable machines. Proposed fix: Verify time stamp of update server. If unusual time shift is detected, display a warning. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 5

[Bug 399298] New: encrypt swap partions by default on every boot using a random key
by bugzilla_noreply＠novell.com 19 Mar '09

19 Mar '09

https://bugzilla.novell.com/show_bug.cgi?id=399298 Summary: encrypt swap partions by default on every boot using a random key Product: openSUSE 11.1 Version: Alpha 0 Platform: All OS/Version: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: Security AssignedTo: security-team(a)suse.de ReportedBy: funtasyspace(a)yahoo.com QAContact: qa(a)suse.de Found By: --- I think for security reasons, swap partitions should be encrypted by default in a way where a RANDOM encryption key is generated on EVERY boot, so users are not required to enter the key on every boot. As the swap partition is also used for hibernation/suspend-to-ram this would raise the problem of not being able to decrypt the hibernation data on the next boot. Therefore I would suggest to automatically create a dedicated, encrypted hibernation file before hibernating and writing the RAM content into this file instead of writing into the swap partition. The key for this encrypted hibernation file should be derived from a password the user is requested to enter immediately after initiating the hibernation process (or by using a fingerprint reader if available for more convenience, but less security). Though, an open question would be a solution for the case, when the user is not present to enter a password or swipe his finger because hibernation is done automatically (after an idle timeout or because of low battery). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 3

[Bug 334690] New: libcurl comes with too few certs
by bugzilla_noreply＠novell.com 19 Mar '09

19 Mar '09

https://bugzilla.novell.com/show_bug.cgi?id=334690 Summary: libcurl comes with too few certs Product: openSUSE 10.3 Version: Final Platform: All OS/Version: openSUSE 10.3 Status: NEW Severity: Normal Priority: P5 - None Component: Other AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: tom.horsley(a)att.net QAContact: qa(a)suse.de Found By: --- The /usr/share/curl/curl-ca-bundle.crt file that ships with openSUSE (rpm curl-ca-bundle-7.16.4-16) has a vastly limited subset of certs compared to firefox (for example). Since zypper uses libcurl for https access, this means that repos accessible only via https are likely not accessible without resorting to fiddling with the certs file. For example, the equivalent file on a fedora 7 box is found at /etc/pki/tls/certs/ca-bundle.crt and is 441017 bytes. The /usr/share/curl/curl-ca-bundle.crt file is only 238102 bytes. Copying the fedora 7 certs to my opensuse box did indeed allow me to access an https repo, but that is way too obscure for most folks to figure out. It seems reasonable to expect all the tools that talk https to have access to the same set of certs when they all come on the same linux distribution. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 13

[Bug 374148] New: Tracker bug for multiscreen bugs
by bugzilla_noreply＠novell.com 18 Mar '09

18 Mar '09

https://bugzilla.novell.com/show_bug.cgi?id=374148 Summary: Tracker bug for multiscreen bugs Product: openSUSE 11.0 Version: Alpha 3 Platform: Other OS/Version: openSUSE 11.0 Status: NEW Severity: Normal Priority: P5 - None Component: GNOME AssignedTo: federico(a)novell.com ReportedBy: federico(a)novell.com QAContact: qa(a)suse.de Found By: Development This is a bug to track all multiscreen/xinerama/randr-related bugs. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 122

[Bug 397411] New: Hibernation won't work with encrypted root/home
by bugzilla_noreply＠novell.com 18 Mar '09

18 Mar '09

https://bugzilla.novell.com/show_bug.cgi?id=397411 Summary: Hibernation won't work with encrypted root/home Product: openSUSE 11.0 Version: RC 1 Platform: x86 OS/Version: openSUSE 11.0 Status: NEW Severity: Normal Priority: P5 - None Component: Other AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: freeform.reform(a)gmail.com QAContact: qa(a)suse.de Found By: Other 11.0 lets you encrypt root / home. If done so, hibernation doesn't work as the hibernation file is not decrypted (screen goes blank). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 23

[Bug 381960] New: provide debuginfo for OO backtrace analysis
by bugzilla_noreply＠novell.com 18 Mar '09

18 Mar '09

https://bugzilla.novell.com/show_bug.cgi?id=381960 Summary: provide debuginfo for OO backtrace analysis Product: SUSE Linux 10.1 Version: Final Platform: i686 OS/Version: SuSE Linux 10.1 Status: NEW Severity: Enhancement Priority: P5 - None Component: OpenOffice.org AssignedTo: eward(a)novell.com ReportedBy: estellnb(a)gmail.com QAContact: qa(a)suse.de Found By: Community of Practice At the moment it does not appear to be possible to get a meaningful backtrace out of a hanging instance of OpenOffice: * no debuginfo at relevant areas of the backtrace * xprop / dcop wmiface do not succeed in returning a pid on being applied on a window that belongs to openoffice (useful with drkonqui) even OO can hang every now or then .- reported at suse 10.1; perhaps best to be provided for suse 11.0 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 9