May 2015 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 903989] New: lynis permissions needs small changes.
by bugzilla_noreply＠novell.com 19 Apr '17

19 Apr '17

http://bugzilla.opensuse.org/show_bug.cgi?id=903989 Bug ID: 903989 Summary: lynis permissions needs small changes. Classification: openSUSE Product: openSUSE Distribution Version: 13.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: roeland(a)linux-it.nl QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I just installed lynis-1.6.2-1.2.noarch to assess the syate of my 13.2 setup. It appears that the rpm content does not have correct permissions on some files. if I exec the first time: taplop:~ # lynis -h [!] Change file permissions of /usr/share/lynis/include/consts to 640. Command: chmod 640 /usr/share/lynis/include/consts [!] Change file permissions of /usr/share/lynis/include/functions to 640. Command: chmod 640 /usr/share/lynis/include/functions [X] Security check failed: See action above to correct this issue. Please change ownership and permissions of the related files and start Lynis again. taplop:~ # chmod 640 /usr/share/lynis/include/consts taplop:~ # chmod 640 /usr/share/lynis/include/functions taplop:~ # lynis -h Fatal error: permissions of file /usr/share/lynis/include/parameters are not strict enough. Access to 'other' should be denied or read-only. taplop:~ # ls -l /usr/share/lynis/include/parameters -rwxr-xr-x 1 root root 5187 Oct 6 17:43 /usr/share/lynis/include/parameters taplop:~ # chmod o-x /usr/share/lynis/include/parameters taplop:~ # ls -l /usr/share/lynis/include/parameters -rwxr-xr-- 1 root root 5187 Oct 6 17:43 /usr/share/lynis/include/parameters after this correction it works: taplop:~ # lynis -h [ Lynis 1.6.2 ] ################################################################################ Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under the terms of the GNU General Public License. See the LICENSE file for details about using this software. Copyright 2007-2014 - Michael Boelen, http://cisofy.com Enterprise support and plugins available via CISOfy - http://cisofy.com ################################################################################ [+] Initializing program ------------------------------------ Scan options: --auditor "<name>" : Auditor name --check-all (-c) : Check system --no-log : Don't create a log file --pentest : Non-privileged scan (useful for pentest) --profile <profile> : Scan the system with the given profile file --quick (-Q) : Quick mode, don't wait for user input --tests "<tests>" : Run only tests defined by <tests> --tests-category "<category>" : Run only tests defined by <category> Layout options: --no-colors : Don't use colors in output --quiet (-q) : No output, except warnings --reverse-colors : Optimize color display for light backgrounds Misc options: --check-update : Check for updates --debug : Debug logging to screen --view-manpage (--man) : View man page --version (-V) : Display version number and quit Enterprise options: --plugin-dir "<path"> : Define path of available plugins --upload : Upload data to central node See man page and documentation for all available options. Exiting.. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 914698] New: Regression - plymoth no longer prompts for password for encrypted partition
by bugzilla_noreply＠novell.com 19 Apr '17

19 Apr '17

http://bugzilla.opensuse.org/show_bug.cgi?id=914698 Bug ID: 914698 Summary: Regression - plymoth no longer prompts for password for encrypted partition Classification: openSUSE Product: openSUSE Distribution Version: 13.2 Hardware: x86-64 OS: openSUSE 13.2 Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: jsrain(a)suse.com Reporter: robert.munteanu(a)gmail.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- (Initially posted at https://forums.opensuse.org/showthread.php/504578-Booting-from-encrypted-pa… ) Running 13.2 x86_64 with all updates applied, nvidia proprietary driver. I have disk encryption set up with the YAST parititioner ( I assume LUKS is used ). After updating to kernel 3.16.7 I noticed that I could not boot with it - never got asked to enter my passphrase. So I stuck to using 3.16.6 and after some other updates not even 3.16.6 would work. Sorry for being fuzzy, I don't remember exactly when it happened. The workaround I found was to remove the 'splash=slient quiet' options from the linux line in grub and got the the point where the passphrase was asked for. However, the prompt was different than the one I used to get. The old one was green text and centered in the screen, the current one has the same colour as the text and for each character I input the previous line gets echoed with an additional '*' character appended. I have tried the following to change the plymouth theme # plymouth-set-default-theme text # grub2-mkconfig -o /boot/grub2/grub.cfg However, I get the same behaviour as before. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 884398] New: libvirt-created iptables rules lost on DHCP lease renewal
by bugzilla_noreply＠novell.com 17 Apr '17

17 Apr '17

https://bugzilla.novell.com/show_bug.cgi?id=884398 https://bugzilla.novell.com/show_bug.cgi?id=884398#c0 Summary: libvirt-created iptables rules lost on DHCP lease renewal Classification: openSUSE Product: openSUSE 13.1 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network AssignedTo: lnussel(a)suse.com ReportedBy: vuntz(a)suse.com QAContact: qa-bugs(a)suse.de CC: mt(a)suse.com Found By: --- Blocker: --- libvirt is adding some rules to the firewall for the networks configured for the VMs (to allow some NAT). However, when using dhcpcd (ie, default network configuration on a workstation), every time the lease is renewed, /etc/sysconfig/network/if-up.d/SuSEfirewall2 is run and is resetting the firewall rules to what is configured, which doesn't include the libvirt rules. That means that the libvirt rules are lost every now and then. A similar issue was debugged in bug 573246 and the fix was http://bugzillafiles.novell.org/attachment.cgi?id=378796. Is this fix acceptable for SuSEfirewall too? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 2

[Bug 858703] New: "Invalid arguments for the Label widget" in yast2 firewall module
by bugzilla_noreply＠novell.com 13 Apr '17

13 Apr '17

https://bugzilla.novell.com/show_bug.cgi?id=858703 https://bugzilla.novell.com/show_bug.cgi?id=858703#c0 Summary: "Invalid arguments for the Label widget" in yast2 firewall module Classification: openSUSE Product: openSUSE 13.1 Version: Final Platform: x86-64 OS/Version: openSUSE 13.1 Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 AssignedTo: yast2-maintainers(a)suse.de ReportedBy: aspiers(a)suse.com QAContact: jsrain(a)suse.com Found By: Development Blocker: --- [first reported in bug 851769 comment #13] With yast2-firewall-3.0.1-2.1.4.noarch, if I launch "yast2 firewall", click "Interfaces", select "crowbar-br0" which is an openvswitch bridge I configured for use as a GRE tunnel, and click Change then I get an error dialog: UI Syntax Error Invalid arguments for the Label widget Check the log file! And y2log contains: 2014-01-13 13:21:02 <3> indian.linksys.moosehall(30549) [Ruby] modules/NetworkInterfaces.rb:1468 No such device: crowbar-br0 2014-01-13 13:21:02 <1> indian.linksys.moosehall(30549) [Ruby] yast/ops.rb:62 Index 0 is out of array size 2014-01-13 13:21:09 <1> indian.linksys.moosehall(30549) [Ruby] yast/ops.rb:62 Index 0 is out of array size 2014-01-13 13:21:09 <3> indian.linksys.moosehall(30549) [libycp] firewall/uifunctions.rb:303 Invalid arguments for the Label widget: `Label (nil) 2014-01-13 13:21:09 <2> indian.linksys.moosehall(30549) [ui] YCPDialogParser.cc(parseLabel):1213 THROW: Invalid arguments for the Label widget 2014-01-13 13:21:09 <2> indian.linksys.moosehall(30549) [ui] YCP_UI.cc(OpenDialog):585 CAUGHT: Invalid arguments for the Label widget 2014-01-13 13:21:09 <3> indian.linksys.moosehall(30549) [libycp] firewall/uifunctions.rb:303 UI::OpenDialog() failed 2014-01-13 13:21:09 <1> indian.linksys.moosehall(30549) [ui] YPushButton.cc(setFunctionKey):188 Guessing button role YOKButton for YPushButton "Close" at 0x7f53583df860 from function key F10 A valid workaround appears to be to manually edit FW_DEV_EXT in /etc/sysconfig/SuSEfirewall2. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 10

[Bug 841046] New: SuSEfirewall2: support IPv6 in FW_TRUSTED_NETS
by bugzilla_noreply＠novell.com 13 Apr '17

13 Apr '17

https://bugzilla.novell.com/show_bug.cgi?id=841046 https://bugzilla.novell.com/show_bug.cgi?id=841046#c0 Summary: SuSEfirewall2: support IPv6 in FW_TRUSTED_NETS Classification: openSUSE Product: openSUSE Factory Version: 13.1 Beta 1 Platform: Other OS/Version: Other Status: NEW Severity: Critical Priority: P5 - None Component: Network AssignedTo: lnussel(a)suse.com ReportedBy: ro(a)suse.com QAContact: qa-bugs(a)suse.de CC: mt(a)suse.com Found By: Development Blocker: --- little patch for ipv6 support: mirrorbrain:/sbin # diff -u SuSEfirewall2 SuSEfirewall2.rudi --- SuSEfirewall2 2013-09-18 12:15:17.000000000 +0200 +++ SuSEfirewall2.rudi 2013-09-18 12:15:10.000000000 +0200 @@ -1482,6 +1482,12 @@ net="$1" proto="$2" port="$3" + iptables="$IPTABLES $IP6TABLES" + case "$net" in + *:*) iptables="$IP6TABLES" ;; + [0-9]*.*.*.*) iptables="$IPTABLES" ;; + esac + if [ -n "$4" ]; then error "Too many arguments in FW_TRUSTED_NETS -> $nets" elif [ -z "$net" ]; then @@ -1491,9 +1497,9 @@ elif check_proto_port "$proto" "$port" "" 'FW_TRUSTED_NETS'; then for chain in $input_zones; do # trusted networks can be on any interface ... chain=input_$chain - $LAC $IPTABLES -A $chain ${LOG}"-`rulelog $chain`-ACC-TRUST " -m state --state NEW -s $net $proto $port - $LAA $IPTABLES -A $chain ${LOG}"-`rulelog $chain`-ACC-TRUST " -s $net $proto $port - $IPTABLES -A $chain -j "$ACCEPT" -m state --state NEW,ESTABLISHED,RELATED -s $net $proto $port + $LAC $iptables -A $chain ${LOG}"-`rulelog $chain`-ACC-TRUST " -m state --state NEW -s $net $proto $port + $LAA $iptables -A $chain ${LOG}"-`rulelog $chain`-ACC-TRUST " -s $net $proto $port + $iptables -A $chain -j "$ACCEPT" -m state --state NEW,ESTABLISHED,RELATED -s $net $proto $port done fi done -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 2

[Bug 920368] New: openQA: yast fails to install on ext4 system
by bugzilla_noreply＠novell.com 11 Apr '17

11 Apr '17

http://bugzilla.opensuse.org/show_bug.cgi?id=920368 Bug ID: 920368 Summary: openQA: yast fails to install on ext4 system Classification: openSUSE Product: openSUSE Factory Version: 201502* Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Reference test: https://openqa.opensuse.org/tests/50993 Yast fails on the step 'preparing the disk' Y2Logs attached (extracted from openQA) -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 844198] New: /run/user/0 is not available for Kerberos caches
by bugzilla_noreply＠novell.com 11 Apr '17

11 Apr '17

https://bugzilla.novell.com/show_bug.cgi?id=844198 https://bugzilla.novell.com/show_bug.cgi?id=844198#c0 Summary: /run/user/0 is not available for Kerberos caches Classification: openSUSE Product: openSUSE Factory Version: 13.1 Beta 1 Platform: i686 OS/Version: SUSE Other Status: NEW Severity: Normal Priority: P5 - None Component: Network AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: lynn(a)steve-ss.com QAContact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1632.0 Safari/537.36 SUSE/31.0.1632.0 Automounted kerberised cifs shares need a root cache available. The beta expects the cache to be at /run/users/0/ but this directory is only produced if root has logged in. Hence, cifs.upcall cannot find the cache as it cannot be produced becaue the directory is not present. Previous to 13.1, the cache was created at /tmp which is not a problem, since /tmp always exists. Reproducible: Always Steps to Reproduce: 1.cd to a directory which corresponds to an autofs kerberized cifs mount 2. 3. Actual Results: Cannot cd to xyz. The directory does not exist. Expected Results: The directory is mounted. The workaround is to use systemd tmpfiles or create the cache directory in /etc/init.d/boot.local -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 7

[Bug 747783] New: systemd: 'service openvpn start' triggers spamming of all terminals
by bugzilla_noreply＠novell.com 11 Apr '17

11 Apr '17

https://bugzilla.novell.com/show_bug.cgi?id=747783 https://bugzilla.novell.com/show_bug.cgi?id=747783#c0 Summary: systemd: 'service openvpn start' triggers spamming of all terminals Classification: openSUSE Product: openSUSE 12.1 Version: Final Platform: x86-64 OS/Version: openSUSE 12.1 Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: gp(a)suse.com QAContact: qa(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0) Gecko/20100101 Firefox/10.0 1. become root 2. # service openvpn start 3. Watch as every terminal will be spammed with something like Broadcast message from root(a)trevally.site (Fri, 17 Feb 2012 17:28:14 +0100): Password entry required for 'Enter Auth Username:' (PID 17770). Please enter password with the systemd-tty-ask-password-agent tool! This does not make any sense since I am already in the terminal with the prompt; why bother all other terminals? Reproducible: Always -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 19

[Bug 914184] New: kernel: [drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder is 130
by bugzilla_noreply＠novell.com 07 Apr '17

07 Apr '17

http://bugzilla.opensuse.org/show_bug.cgi?id=914184 Bug ID: 914184 Summary: kernel: [drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder is 130 Classification: openSUSE Product: openSUSE Distribution Version: 13.2 Hardware: x86-64 OS: openSUSE 13.2 Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: Ulrich.Windl(a)rz.uni-regensburg.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- It seems when the monitor is powered down (by the screensaver), it does no longer respond with a correct EDID. I see these kernel messages: kernel: [drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder is 181 kernel: Raw EDID: kernel: 00 ff ff ff ff ff ff 00 15 c3 78 20 01 01 01 01 kernel: 0a 14 01 03 80 34 21 78 ea 1e c5 ae 4f 34 b1 26 kernel: 0e 50 54 a1 08 00 a9 40 81 80 81 40 b3 00 01 01 kernel: 01 01 01 01 01 01 28 3c 80 a0 70 b0 23 40 30 20 kernel: 36 00 07 44 21 00 00 1a 00 00 00 ff 00 30 31 ff kernel: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff kernel: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff kernel: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Another time I get this (from the same hardware): kernel: [drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder is 130 kernel: Raw EDID: kernel: 00 ff ff ff ff ff ff 00 15 c3 78 20 01 01 01 01 kernel: 0a 14 01 03 80 34 21 78 ea 1e c5 ae 4f 34 b1 26 kernel: 0e 50 54 a1 08 00 a9 40 81 80 81 40 b3 00 01 01 kernel: 01 01 01 01 01 01 28 3c 80 a0 70 b0 23 40 30 20 kernel: 36 00 07 44 21 00 00 1a 00 00 00 ff 00 30 32 37 kernel: 33 34 30 32 30 0a 20 20 38 0f ff ff ff ff ff ff kernel: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff kernel: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff --- # journalctl |cut -d' ' -f 5- | grep "remainder is" | sort | uniq -c 3 kernel: [drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder is 130 1 kernel: [drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder is 131 1 kernel: [drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder is 160 1 kernel: [drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder is 175 3 kernel: [drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder is 181 1 kernel: [drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder is 182 1 kernel: [drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder is 24 2 kernel: [drm:drm_edid_block_valid] *ERROR* EDID checksum is invalid, remainder is 81 Graphics is: intel(0): Integrated Graphics Chipset: Intel(R) HD Graphics 4600 Monitor is: Hardware Class: monitor Model: "EIZO SX2462W" Vendor: ENC "EIZO" Device: eisa 0x2078 "SX2462W" -- You are receiving this mail because: You are on the CC list for the bug.

1 16

[Bug 900932] New: ruby ships with extra root ssl certs
by bugzilla_noreply＠novell.com 24 Mar '17

24 Mar '17

http://bugzilla.suse.com/show_bug.cgi?id=900932 Bug ID: 900932 Summary: ruby ships with extra root ssl certs Classification: openSUSE Product: openSUSE Factory Version: 201410* Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- /usr/lib64/ruby/2.1.0/rubygems/request.rb seems to automatically add the root SSL certs from /usr/lib64/ruby/2.1.0/rubygems/ssl_certs/ to https connections. Ie bypassing the configuration of the admin. -- You are receiving this mail because: You are on the CC list for the bug.

1 2