February 2016 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 965192] New: openssh: chroot jail for restricted access with SFTP clients fails
by bugzilla_noreply＠novell.com 04 Feb '16

04 Feb '16

http://bugzilla.opensuse.org/show_bug.cgi?id=965192 Bug ID: 965192 Summary: openssh: chroot jail for restricted access with SFTP clients fails Classification: openSUSE Product: openSUSE Distribution Version: 13.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: bjoernv(a)arcor.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I tried to create a restricted user "steve". Steve should only have access to his home folder /home/steve. I followed the following guides: Restrict SFTP users to home folder https://bensmann.no/restrict-sftp-users-to-home-folder/ Trying to use jail users to home directories http://www.linuxquestions.org/questions/linux-security-4/trying-to-use-jail… With some openSUSE specifics this was: 1) Modification of /etc/ssh/sshd_config: LogLevel DEBUG3 [...] Match Group sftponly ChrootDirectory %h ForceCommand /usr/lib/ssh/sftp-server AllowTcpForwarding no 2) User setup for "steve" $ useradd -m steve $ passwd steve $ groupadd sftponly $ usermod steve -g sftponly $ usermod steve -s /bin/false $ usermod steve -d /mnt/steve 3) Bind mount for /home/steve $ mount --rbind /home/steve /mnt/steve $ mount -o remount,nodev,nosuid /mnt/steve/ Steve can not access SFTP anyway (error "Write failed: Broken pipe"). Systemd journal shows: Feb 04 17:46:03 cecilia sshd[14357]: debug1: SELinux support disabled Feb 04 17:46:03 cecilia sshd[14357]: debug1: PAM: establishing credentials Feb 04 17:46:03 cecilia sshd[14357]: debug3: safely_chroot: checking '/' Feb 04 17:46:03 cecilia sshd[14357]: debug3: safely_chroot: checking '/mnt/' Feb 04 17:46:03 cecilia sshd[14357]: debug3: safely_chroot: checking '/mnt/steve' Feb 04 17:46:03 cecilia sshd[14357]: fatal: chroot into directory without nodev and either noexec or nosuid But "nodev" and "nosuid" is set for mount /mnt/steve: $ mount [...] /dev/sda3 on / type ext4 (rw,relatime,errors=remount-ro,data=ordered) [...] /dev/sda3 on /mnt/steve type ext4 (rw,nosuid,nodev,relatime,errors=remount-ro,data=ordered) [...] Debugging shows, that function "test_nosuid" will probably only check "/"-mount (without nosuid, nodev), but not "/mnt/steve". Unfortunately there is no debuginfo package for openssh-6.6p1-5.3.1.x86_64 so that debugging is not comfortable. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 939921] rsyslog stops working after logrotate until restarted
by bugzilla_noreply＠novell.com 04 Feb '16

04 Feb '16

http://bugzilla.suse.com/show_bug.cgi?id=939921 http://bugzilla.suse.com/show_bug.cgi?id=939921#c4 Nirmoy Das <nirmoy.das(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |nirmoy.das(a)suse.com Resolution|--- |WORKSFORME --- Comment #4 from Nirmoy Das <nirmoy.das(a)suse.com> --- I am unable to produce the bug on openSUSE 13.1(EOL) as well on 13.2 Note: 13.1 is already in EndOfLife, better is upgrade to latest openSUSE and report us back with below information if the same problem persist. Please send output of below commands: systemctl restart syslog.service ; systemctl status syslog.service ; systemctl reload syslog.service ; systemctl status syslog.service As well attach below config files: /etc/logrotate.d/syslog /usr/lib/systemd/system/rsyslog.service /usr/lib/systemd/system/rsyslog.service -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 962996] curl: expired cookie causes failure of test 46
by bugzilla_noreply＠novell.com 04 Feb '16

04 Feb '16

http://bugzilla.novell.com/show_bug.cgi?id=962996 http://bugzilla.novell.com/show_bug.cgi?id=962996#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2016:0340-1: An update that solves one vulnerability and has three fixes is now available. Category: security (moderate) Bug References: 934333,936676,962983,962996 CVE References: CVE-2016-0755 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP1 (src): curl-7.37.0-18.1 SUSE Linux Enterprise Software Development Kit 12 (src): curl-7.37.0-18.1 SUSE Linux Enterprise Server 12-SP1 (src): curl-7.37.0-18.1 SUSE Linux Enterprise Server 12 (src): curl-7.37.0-18.1 SUSE Linux Enterprise Desktop 12-SP1 (src): curl-7.37.0-18.1 SUSE Linux Enterprise Desktop 12 (src): curl-7.37.0-18.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 964548] VUL-1: KDE lockscreen bypass by switching display off and on
by bugzilla_noreply＠novell.com 04 Feb '16

04 Feb '16

http://bugzilla.opensuse.org/show_bug.cgi?id=964548 http://bugzilla.opensuse.org/show_bug.cgi?id=964548#c10 --- Comment #10 from Dirk Weber <d_werner(a)gmx.net> --- (In reply to Dirk Weber from comment #9) > Created attachment 664478 [details] > output of kscreenlocker_greet --testing; .xsession-errors-:0 > > requested output of /usr/lib64/libexec/kscreenlocker_greet --testing additional observation: the output of kscreenlocker_greet --testing looks identical (except for the timestamp) on the affected system and on the not affected system. The big difference is that on the not affected system the kscreenlocker_greet is still running after switching the monitor off and on. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 956480] zypper download only claims error for successful run
by bugzilla_noreply＠novell.com 04 Feb '16

04 Feb '16

http://bugzilla.novell.com/show_bug.cgi?id=956480 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|ibs:running:1603:moderate |ibs:running:1603:moderate |maint:planned:update |maint:planned:update | |ibs:running:1604:moderate -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 965027] zypper upgrades system without authorization
by bugzilla_noreply＠novell.com 04 Feb '16

04 Feb '16

http://bugzilla.novell.com/show_bug.cgi?id=965027 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |ibs:running:1604:moderate -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 965198] New: science/scilab: cannot read CSV files (Xcos/'RFILE_f' block) after upgrade
by bugzilla_noreply＠novell.com 04 Feb '16

04 Feb '16

http://bugzilla.opensuse.org/show_bug.cgi?id=965198 Bug ID: 965198 Summary: science/scilab: cannot read CSV files (Xcos/'RFILE_f' block) after upgrade Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: x86-64 OS: Other Status: NEW Severity: Major Priority: P5 - None Component: 3rd party software Assignee: badshah400(a)gmail.com Reporter: lebevc(a)gmail.com QA Contact: opensuse-communityscreening(a)forge.provo.novell.com CC: dmitry(a)roshchin.org Found By: --- Blocker: --- openSuse 13.2 KDE_amd64 in version 5.5.2-32.1 import from delimited TXT files work O.K. after upgrade to 5.5.2-32.2 (today 04.feb.16) Xcos module 'RFILE_f' cannot read from delimited files: ==> error message: "invalid index" Same error was present in 5.5.1 version in 'official release' -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 965190] New: graphics/gd: gdlib-config --version returns ..
by bugzilla_noreply＠novell.com 04 Feb '16

04 Feb '16

http://bugzilla.opensuse.org/show_bug.cgi?id=965190 Bug ID: 965190 Summary: graphics/gd: gdlib-config --version returns .. Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: pgajdos(a)suse.com Reporter: johannesobermayr(a)gmx.de QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- $ gdlib-config --version .. This error makes it necessary to patch aMule on Packman: https://pmbs.links2linux.de/package/view_file/Extra/aMule/0002-Fix-gdlib-de… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 964548] VUL-1: KDE lockscreen bypass by switching display off and on
by bugzilla_noreply＠novell.com 04 Feb '16

04 Feb '16

http://bugzilla.opensuse.org/show_bug.cgi?id=964548 http://bugzilla.opensuse.org/show_bug.cgi?id=964548#c9 --- Comment #9 from Dirk Weber <d_werner(a)gmx.net> --- Created attachment 664478 --> http://bugzilla.opensuse.org/attachment.cgi?id=664478&action=edit output of kscreenlocker_greet --testing; .xsession-errors-:0 requested output of /usr/lib64/libexec/kscreenlocker_greet --testing -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 964548] VUL-1: KDE lockscreen bypass by switching display off and on
by bugzilla_noreply＠novell.com 04 Feb '16

04 Feb '16

http://bugzilla.opensuse.org/show_bug.cgi?id=964548 http://bugzilla.opensuse.org/show_bug.cgi?id=964548#c8 --- Comment #8 from Dirk Weber <d_werner(a)gmx.net> --- > @Dirk: can you please try to run: > 1) run "kscreenlocker_greet --testing" from a konsole > 2) turn off the display > > Afterwards please tell us whether the application exited or not. If it did, > please add the debug output from the konsole. I followed the procedure. after switching the monitor on again the kscreenlocker_greet was gone. I attach the output of "kscreenlocker_greet --testing" and appended to it the content of .xsession-errors-:0 Also some check for the files which can not be opened according to the output of kscreenlocker_greet. -- You are receiving this mail because: You are on the CC list for the bug.

1 0