September 2014 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 895611] New: insserv.conf/systemd-insserv-generator creates dependency on network-online.target for mult-user.target
by bugzilla_noreply＠novell.com 11 Sep '14

11 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=895611 https://bugzilla.novell.com/show_bug.cgi?id=895611#c0 Summary: insserv.conf/systemd-insserv-generator creates dependency on network-online.target for mult-user.target Classification: openSUSE Product: openSUSE Factory Version: 201409* Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network AssignedTo: lnussel(a)suse.com ReportedBy: lnussel(a)suse.com QAContact: qa-bugs(a)suse.de CC: werner(a)suse.com, fcrozat(a)suse.com Found By: --- Blocker: --- /etc/insserv.conf lists a dependency on $network for named. systemd-insserv-generator translates that to a dependency on network-online.target for nss-lookup.target. Therefore multi-user.target always waits for full network activation even if the system uses only local authentication. in the old world $network was kind of synonymous for network online. Translating named to nss-lookup is kind of odd but kind of understandable. So insserv.conf needs to avoid adding the dependency between named and $network. If named is enabled it will add the dependency to network-online itself anyways. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 3

[Bug 890908] New: ca-certificates-mozilla includes p11-kit data/certs reported as containing 'invalid basic constraints certificate extension'
by bugzilla_noreply＠novell.com 11 Sep '14

11 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=890908 https://bugzilla.novell.com/show_bug.cgi?id=890908#c0 Summary: ca-certificates-mozilla includes p11-kit data/certs reported as containing 'invalid basic constraints certificate extension' Classification: openSUSE Product: openSUSE 13.1 Version: Final Platform: All OS/Version: openSUSE 13.1 Status: NEW Severity: Normal Priority: P5 - None Component: Security AssignedTo: security-team(a)suse.de ReportedBy: grantksupport(a)operamail.com QAContact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:32.0) Gecko/20100101 Firefox/32.0 /usr/sbin/update-ca-certificates -v ... running /usr/lib/ca-certificates/update.d/certbundle.run ... creating /var/lib/ca-certificates/ca-bundle.pem ... p11-kit: invalid basic constraints certificate extension running /usr/lib/ca-certificates/update.d/etc_ssl.run ... p11-kit: invalid basic constraints certificate extension running /usr/lib/ca-certificates/update.d/java.run ... creating /var/lib/ca-certificates/java-cacerts ... p11-kit: invalid basic constraints certificate extension running /usr/lib/ca-certificates/update.d/openssl.run ... creating /var/lib/ca-certificates/openssl ... p11-kit: invalid basic constraints certificate extension sh -x /usr/lib/ca-certificates/update.d/certbundle.run + set -e + cafile=/var/lib/ca-certificates/ca-bundle.pem + cadir=/var/lib/ca-certificates/pem + '[' -z '' -a /var/lib/ca-certificates/ca-bundle.pem -nt /var/lib/ca-certificates/pem ']' + '[' -z '' ']' + cat + trust extract --format=pem-bundle --purpose=server-auth --filter=ca-anchors /var/lib/ca-certificates/ca-bundle.pem.tmp p11-kit: invalid basic constraints certificate extension + cat /var/lib/ca-certificates/ca-bundle.pem.tmp + rm -f /var/lib/ca-certificates/ca-bundle.pem.tmp + mv /var/lib/ca-certificates/ca-bundle.pem.new /var/lib/ca-certificates/ca-bundle.pem trust extract --format=pem-bundle --purpose=server-auth --filter=ca-anchors /var/lib/ca-certificates/ca-bundle.pem.tmp p11-kit: invalid basic constraints certificate extension trust extract -v --format=pem-bundle --purpose=server-auth --filter=ca-anchors /var/lib/ca-certificates/ca-bundle.pem.tmp p11-kit: invalid basic constraints certificate extension (p11-kit:23270) extract_certificate: skipping certificate that doesn't match trust flags (p11-kit:23270) extract_certificate: skipping certificate that doesn't match trust flags (p11-kit:23270) extract_certificate: skipping certificate that doesn't match trust flags (p11-kit:23270) extract_certificate: skipping certificate that doesn't match trust flags (p11-kit:23270) extract_certificate: skipping certificate that doesn't match trust flags (p11-kit:23270) extract_certificate: skipping certificate that doesn't match trust flags (p11-kit:23270) extract_certificate: skipping certificate that doesn't match trust flags (p11-kit:23270) extract_certificate: skipping certificate that doesn't match trust flags (p11-kit:23270) extract_certificate: skipping certificate that doesn't match trust flags (p11-kit:23270) extract_certificate: skipping certificate that doesn't match trust flags (p11-kit:23270) extract_certificate: skipping certificate that doesn't match trust flags p11-kit: couldn't complete writing of file: /var/lib/ca-certificates/ca-bundle.pem.tmp: File exists reading rm -f /var/lib/ca-certificates/ca-bundle.pem.tmp strace trust extract -v --format=pem-bundle --purpose=server-auth --filter=ca-anchors /var/lib/ca-certificates/ca-bundle.pem.tmp ... stat("/usr/share/pki/trust/TURKTRUST_Mis-issued_Intermediate_CA_1:2.2.8.39.p11-kit", {st_mode=S_IFREG|0644, st_size=470, ...}) = 0 open("/usr/share/pki/trust/TURKTRUST_Mis-issued_Intermediate_CA_1:2.2.8.39.p11-kit", O_RDONLY|O_CLOEXEC) = 4 mmap(NULL, 470, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7f2f21f1f000 munmap(0x7f2f21f1f000, 470) = 0 close(4) = 0 write(2, "p11-kit: invalid basic constrain"..., 57p11-kit: invalid basic constraints certificate extension ) = 57 stat("/usr/share/pki/trust/Explicitly_Distrusted_DigiNotar_PKIoverheid.pem", {st_mode=S_IFREG|0644, st_size=1967, ...}) = 0 open("/usr/share/pki/trust/Explicitly_Distrusted_DigiNotar_PKIoverheid.pem", O_RDONLY|O_CLOEXEC) = 4 ... ls -al /usr/share/pki/trust/TURKTRUST_*p11-kit -rw-r--r--+ 1 root root 470 Jun 5 01:17 /usr/share/pki/trust/TURKTRUST_Mis-issued_Intermediate_CA_1:2.2.8.39.p11-kit -rw-r--r--+ 1 root root 468 Jun 5 01:17 /usr/share/pki/trust/TURKTRUST_Mis-issued_Intermediate_CA_2:2.2.8.100.p11-kit rpm -q --whatprovides /usr/share/pki/trust/TURKTRUST_* ca-certificates-mozilla-1.97-3.12.1.noarch ca-certificates-mozilla-1.97-3.12.1.noarch ls -al /usr/share/pki/trust/*p11-kit -rw-r--r--+ 1 root root 350 Jun 5 01:17 /usr/share/pki/trust/Distrust_a_pb.com_certificate_that_does_not_comply_with_the_baseline_requirements.:2.3.21.121.20.p11-kit -rw-r--r--+ 1 root root 296 Jun 5 01:17 /usr/share/pki/trust/Distrusted_AC_DG_Tresor_SSL:2.3.3.29.167.p11-kit -rw-r--r--+ 1 root root 557 Jun 5 01:17 /usr/share/pki/trust/Distrust:_O=Egypt_Trust__OU=VeriSign_Trust_Network_=cert_1_3=:2.16.76.0.54.27.229.8.43.169.170.206.116.10.5.62.251.52.p11-kit -rw-r--r--+ 1 root root 559 Jun 5 01:17 /usr/share/pki/trust/Distrust:_O=Egypt_Trust__OU=VeriSign_Trust_Network_=cert_2_3=:2.16.62.12.158.135.105.170.149.92.234.35.216.69.158.212.91.81.p11-kit -rw-r--r--+ 1 root root 555 Jun 5 01:17 /usr/share/pki/trust/Distrust:_O=Egypt_Trust__OU=VeriSign_Trust_Network_=cert_3_3=:2.16.18.189.38.162.174.51.192.127.36.123.106.88.105.242.10.118.p11-kit -rw-r--r--+ 1 root root 471 Jun 5 01:17 /usr/share/pki/trust/MITM_subCA_1_issued_by_Trustwave:2.4.107.73.210.5.p11-kit -rw-r--r--+ 1 root root 471 Jun 5 01:17 /usr/share/pki/trust/MITM_subCA_2_issued_by_Trustwave:2.4.107.73.210.6.p11-kit -rw-r--r--+ 1 root root 470 Jun 5 01:17 /usr/share/pki/trust/TURKTRUST_Mis-issued_Intermediate_CA_1:2.2.8.39.p11-kit -rw-r--r--+ 1 root root 468 Jun 5 01:17 /usr/share/pki/trust/TURKTRUST_Mis-issued_Intermediate_CA_2:2.2.8.100.p11-kit MOVE the suspect p11-kit data out of the way mkdir -p /usr/share/pki/trust/TEMP mv /usr/share/pki/trust/*p11-kit /usr/share/pki/trust/TEMP recheck. no more 'invalid' error /usr/sbin/update-ca-certificates -v running /usr/lib/ca-certificates/update.d/certbundle.run ... creating /var/lib/ca-certificates/ca-bundle.pem ... p11-kit: couldn't complete writing of file: /var/lib/ca-certificates/ca-bundle.pem.tmp: File exists running /usr/lib/ca-certificates/update.d/etc_ssl.run ... running /usr/lib/ca-certificates/update.d/java.run ... creating /var/lib/ca-certificates/java-cacerts ... running /usr/lib/ca-certificates/update.d/openssl.run ... creating /var/lib/ca-certificates/openssl ... Reproducible: Always Steps to Reproduce: 1. 2. 3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 10

[Bug 894370] VUL-0: MozillaFirefox 32/31.1 security release
by bugzilla_noreply＠novell.com 10 Sep '14

10 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=894370 https://bugzilla.novell.com/show_bug.cgi?id=894370#c19 --- Comment #19 from Swamp Workflow Management <swamp(a)suse.de> 2014-09-10 22:04:32 UTC --- SUSE-SU-2014:1112-1: An update that contains security fixes can now be installed. Category: security (important) Bug References: 894370 CVE References: Sources used: SUSE Linux Enterprise Server 11 SP2 LTSS (src): MozillaFirefox-24.8.0esr-0.3.1, mozilla-nspr-4.10.7-0.3.1, mozilla-nss-3.16.4-0.3.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 0

[Bug 895204] New: processes cause kernel to hold onto chroot mount even after umount
by bugzilla_noreply＠novell.com 10 Sep '14

10 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=895204 https://bugzilla.novell.com/show_bug.cgi?id=895204#c0 Summary: processes cause kernel to hold onto chroot mount even after umount Classification: openSUSE Product: openSUSE 13.1 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel AssignedTo: kernel-maintainers(a)forge.provo.novell.com ReportedBy: aspiers(a)suse.com QAContact: qa-bugs(a)suse.de Found By: Development Blocker: --- This bug is fairly easy to reproducible by doing local builds of kiwi images using a chroot on 13.1. The first kiwi image I discovered it with was this one: https://github.com/SUSE-Cloud/suse-cloud-vagrant/tree/master/kiwi/cloud-adm… (following the instructions in the README) and then more recently with this one: https://build.suse.de/package/show/Devel:Cloud:4/suse-cloud-vagrant-admin (built via "osc build vagrantbox_images") The issue is that during kiwi's clean-up phase after building an image, even though it appears to successfully umount the bind mounts which it set up inside the chroot, actually they are not all fully umounted according to the kernel. For example: $ rm -rf /tmp/kiwi-build rm: cannot remove ‘/tmp/kiwi-build/build/image-root/proc’: Device or resource busy Even though this mountpoint no longer appears in /proc/mounts, a command such as grep -l tmp/kiwi /proc/*/task/*/mountinfo \ | sort -u \ | sed 's,^/proc/$[0-9]\+$/task/.\+/mountinfo$,\1,' \ | xargs -r ps -fp will often reveal one or more processes still hanging onto that mount. Typically the guilty processes are one or more of the following: rtkit-daemon, colord, and the openvpn daemon. I have no clue what these have in common, but they all exhibit the capability to somehow autonomously open some kind of reference to the mount within the kernel at some point after it was mounted, and then they won't let it go until you kill them. In the case where /tmp/kiwi-build is mounted on tmpfs, this bug prevents the kernel from freeing the entire tmpfs from memory until the process hanging onto the mount is freed, as I first reported on research@ in May: http://mailman.suse.de/mlarch/SuSE/research/2014/research.2014.05/msg00005.… The bug means that repeated kiwi builds are very problematic. But the bottom line is that the kernel is allowing a discrepancy between what /proc/mounts says, and which mounts are really being held open. And unless I misunderstood something, that shouldn't ever happen. In the case of building kiwi images via "osc build", the mountpoint will look something like this: /var/tmp/build-root/vagrantbox_images/x86_64/usr/src/packages/KIWIROOT-vmx/proc so the above "grep -l tmp/kiwi" needs to be adjusted to something like "grep -l KIWIROOT" -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 4

[Bug 808490] New: YaST VNC module broken
by bugzilla_noreply＠novell.com 10 Sep '14

10 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=808490 https://bugzilla.novell.com/show_bug.cgi?id=808490#c0 Summary: YaST VNC module broken Classification: openSUSE Product: openSUSE 12.3 Version: Final Platform: x86-64 OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: me(a)kalenz.eu QAContact: jsrain(a)suse.com Found By: Community User Blocker: --- VNC module is completely ineffective. It allows "switching on" VNC and opening the appropriate firewall port (5901), but afterwards there is no entry added to /etc/init.d, no Xvnc service running, firewall port not opened. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 56

[Bug 867771] New: network:telephony/linphone: Please update
by bugzilla_noreply＠novell.com 10 Sep '14

10 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=867771 https://bugzilla.novell.com/show_bug.cgi?id=867771#c0 Summary: network:telephony/linphone: Please update Classification: openSUSE Product: openSUSE.org Version: unspecified Platform: Other OS/Version: Other Status: NEW Severity: Minor Priority: P5 - None Component: 3rd party software AssignedTo: opensuse-communityscreening(a)forge.provo.novell.com ReportedBy: bjoernv(a)arcor.de QAContact: opensuse-communityscreening(a)forge.provo.novell.com CC: jengelh(a)inai.de, nix(a)opensuse.org Found By: --- Blocker: --- Current version of Linphone is 3.7.0. Please update. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 2

[Bug 853311] New: Various applications crash because of unlock-before-lock and TSX
by bugzilla_noreply＠novell.com 10 Sep '14

10 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=853311 https://bugzilla.novell.com/show_bug.cgi?id=853311#c0 Summary: Various applications crash because of unlock-before-lock and TSX Classification: openSUSE Product: openSUSE 13.1 Version: Final Platform: x86-64 OS/Version: openSUSE 13.1 Status: NEW Severity: Major Priority: P5 - None Component: Basesystem AssignedTo: schwab(a)suse.com ReportedBy: vojtech(a)suse.com QAContact: qa-bugs(a)suse.de CC: matz(a)suse.com Found By: Beta-Customer Blocker: No Various applications (GroupWise client, libusb) crash on 13.2 and processors having the TSX feature because transactional memory lock elision is enabled in glibc on posix semaphores that doesn't tolerate unlocking a non-locked lock. It should be possible to disable TSX support using an environment variable. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 16

[Bug 894370] VUL-0: MozillaFirefox 32/31.1 security release
by bugzilla_noreply＠novell.com 10 Sep '14

10 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=894370 https://bugzilla.novell.com/show_bug.cgi?id=894370#c Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|maint:running:58812:importa |maint:running:58812:importa |nt |nt |maint:released:sle11-sp3:58 |maint:released:sle11-sp3:58 |825 |825 | |maint:released:sle11-sp2:58 | |829 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 0

[Bug 896083] New: apache module access_compat reports false error when using directive satisfy any/all
by bugzilla_noreply＠novell.com 10 Sep '14

10 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=896083 https://bugzilla.novell.com/show_bug.cgi?id=896083#c0 Summary: apache module access_compat reports false error when using directive satisfy any/all Classification: openSUSE Product: openSUSE 13.1 Version: Final Platform: x86-64 OS/Version: openSUSE 13.1 Status: NEW Severity: Normal Priority: P5 - None Component: Apache AssignedTo: bnc-team-apache(a)forge.provo.novell.com ReportedBy: admin(a)beckspaced.com QAContact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0 i use the following setup in my .htaccess file: ========== Order allow,deny Allow from 12.23.122.10 Allow from 34.19.32.213 AuthName "Protected Area" AuthType Basic AuthUserFile /srv/.htpasswd Require user demo Satisfy any ========== so i basically use host-level access and user authentication and with satisfy any i can grant access access_compat reports an false error in the log while i can access the site without any problems! [Wed Sep 10 11:51:23.831798 2014] [access_compat:error] [pid 28491] [client 79.250.87.131:62285] AH01797: client denied by server configuration: /srv/www/webdev/ httpdocs/ [Wed Sep 10 11:51:24.197423 2014] [access_compat:error] [pid 28492] [client 79.250.87.131:62288] AH01797: client denied by server configuration: /srv/www/webdev/ httpdocs/favicon.ico [Wed Sep 10 11:51:54.928762 2014] [access_compat:error] [pid 28694] [client 79.250.87.131:62290] AH01797: client denied by server configuration: /srv/www/webdev/ httpdocs/index2.html if i only use host-level access then access_compat doesn't report an error if i only use user authentication then access_compat also doesn't report an error it only happens when using both mechanisms with satisfy any Reproducible: Always Steps to Reproduce: 1. setup a virtual host 2. create an .htaccess file with settings: Order allow,deny Allow from 12.23.122.10 Allow from 34.19.32.213 AuthName "Protected Area" AuthType Basic AuthUserFile /srv/.htpasswd Require user demo Satisfy any 3. apache access_compat will report an false error Actual Results: [Wed Sep 10 11:51:23.831798 2014] [access_compat:error] [pid 28491] [client 79.250.87.131:62285] AH01797: client denied by server configuration: /srv/www/webdev/ httpdocs/ [Wed Sep 10 11:51:24.197423 2014] [access_compat:error] [pid 28492] [client 79.250.87.131:62288] AH01797: client denied by server configuration: /srv/www/webdev/ httpdocs/favicon.ico [Wed Sep 10 11:51:54.928762 2014] [access_compat:error] [pid 28694] [client 79.250.87.131:62290] AH01797: client denied by server configuration: /srv/www/webdev/ httpdocs/index2.html Expected Results: no error message in the apache logs -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 0

[Bug 896059] New: Non-maintainer submissions appear stuck in review
by bugzilla_noreply＠novell.com 10 Sep '14

10 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=896059 https://bugzilla.novell.com/show_bug.cgi?id=896059#c0 Summary: Non-maintainer submissions appear stuck in review Classification: Internal Novell Products Product: openSUSE Build Service Version: master Platform: All OS/Version: Linux Status: NEW Severity: Normal Priority: P5 - None Component: General AssignedTo: adrian(a)suse.com ReportedBy: jengelh(a)inai.de QAContact: adrian(a)suse.com Found By: Beta-Customer Blocker: --- Example SR: 246371 If a user who is not maintainer of libvmime issues a submitreq of libvmime towards Factory, the resulting SR includes a review action item on libvmime maintainers. This however is not obvious when accessing the request via osc: Observed: $ osc rq show 246371 Request: #246371 submit: server:mail/libvmime@3 -> openSUSE:Factory State: review 2014-08-25T14:51:25 factory-auto Comment: Pick Staging Project Review: accepted Group: factory-staging [...] coolo [...] accepted User: factory-repo-checker [...] factory-repo-checker [...] accepted Group: opensuse-review-team [...] dimstar [...] accepted Group: factory-auto [...] factory-auto [...] accepted Group: legal-auto [...] licensedigger [...] This is confusing, since normally, a submission to Factory should move away from "review" state once all five factory parties have accepted it. Expected: $ osc rq show Request: #246371 submit: server:mail/libvmime@3 -> openSUSE:Factory State: review 2014-08-25T14:51:25 factory-auto Review: new Maintainer: server:mail/libvmime accepted Group: factory-staging [...] -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 0