December 2019 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1158538] patch2mail: security hardening: run as unprivileged user
by bugzilla_noreply＠novell.com 06 Dec '19

06 Dec '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1158538 http://bugzilla.opensuse.org/show_bug.cgi?id=1158538#c3 Christian Boltz <suse-beta(a)cboltz.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(matthias.gerstner | |(a)suse.com) --- Comment #3 from Christian Boltz <suse-beta(a)cboltz.de> --- (In reply to Matthias Gerstner from comment #2) > Yes it looks good. But having to run zypper refresh as root reduces the > value of this hardening quite a lot. I'm not sure if it is worth the added > complexity in this case. What do you think? It would be easy to run xsltproc as non-root, and looking at the amount of CVEs listed in libxslt-tools, that probably isn't the worst idea. That would mean (pseudo-patch) LANG=C /usr/bin/zypper --xmlout --non-interactive lu $params | \ + setpriv --reuid nobody \ xsltproc /usr/share/patch2mail/patch2mail.xsl - > "$tmp" This willl also need Requires: user(nobody) (I never used setpriv, does the syntax look correct?) The "mail" call could also run as non-root, but the security track of mailx looks much better than the one from xsltproc ;-) An alternative way could be to ship an AppArmor profile for patch2mail with Ux for zypper (because cachedir is configurable and could be != /var/cache/zypp) and ix for everything else, maybe even Cx to a restrictive child profile for xsltproc. With some additional effort (see my pseudocode), it would also be possible to run zypper lu and sourcing the sysconfig file as non-root, but... > > One problem / possible regression I see is that errors in "zypper -q > > refresh" will not end up in the zypper lu output, and therefore won't be > > visible anymore. > > It would not be part of the zypper lu output, but it should still be part of > the cron output, no? As we say in germany: "Jein" ;-) Currently refresh errors are part of the zypper xml output, and end up in the mail patch2mail will send out. If refreshing is done in a separate step, it will probably result in - a mail from cron showing stderr of the patch2mail cronjob ("refresh failed for $repo") - a mail from patch2mail showing available updates - without the warning about the refresh failure Merging both parts into one mail would make things more complicated again. IMHO sane options are a) only run xsltproc as nobody b) add an AppArmor profile Opinions? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1158701] New: alsa-sink.c: ALSA woke us up to write new data to the device, but there was actually nothing to write!
by bugzilla_noreply＠novell.com 06 Dec '19

06 Dec '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1158701 Bug ID: 1158701 Summary: alsa-sink.c: ALSA woke us up to write new data to the device, but there was actually nothing to write! Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Sound Assignee: tiwai(a)suse.com Reporter: forumino(a)riseup.net QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The attached journal excerpt shows on each boot. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1153259] slurm-slurmdbd postrans script fails
by bugzilla_noreply＠novell.com 06 Dec '19

06 Dec '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1153259 Egbert Eich <eich(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|cgoll(a)suse.com |eich(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1158696] New: [HPC,SLURM] /var/spool/slurm has wrong ownership
by bugzilla_noreply＠novell.com 06 Dec '19

06 Dec '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1158696 Bug ID: 1158696 Summary: [HPC,SLURM] /var/spool/slurm has wrong ownership Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Factory Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: hpc-bugs(a)suse.de Reporter: eich(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- /var/spool/slurm should be owned by slurm:slurm (Thanks to Lawrence for pointing me to this!) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1157504] Cura 4.3.0-1.1 fails to start in newly installed tumbleweed 20191116
by bugzilla_noreply＠novell.com 06 Dec '19

06 Dec '19

http://bugzilla.suse.com/show_bug.cgi?id=1157504 http://bugzilla.suse.com/show_bug.cgi?id=1157504#c3 --- Comment #3 from Christophe Giboudeaux <christophe(a)krop.fr> --- Are there downsides or can we apply the patch to KDE:Qt5? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1155819] weakremovers of future product not evaluated
by bugzilla_noreply＠novell.com 06 Dec '19

06 Dec '19

http://bugzilla.suse.com/show_bug.cgi?id=1155819 http://bugzilla.suse.com/show_bug.cgi?id=1155819#c16 --- Comment #16 from Michael Andres <ma(a)suse.com> --- https://github.com/openSUSE/libzypp/pull/194 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1158474] update of kernel package(s) takes LONG time (44 MINUTES!!!!) - module compression?
by bugzilla_noreply＠novell.com 06 Dec '19

06 Dec '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1158474 http://bugzilla.opensuse.org/show_bug.cgi?id=1158474#c11 --- Comment #11 from robert spitzenpfeil <rs.opensuse(a)spitzenpfeil.org> --- I suggest testing: * smartctl --all /dev/<SSD-device> * basic read/write performance test. SSD should deliver up to 500MB/s on SATA-III * use 'dstat' / 'iotop' / 'iostat' to check for excessive IOWAIT * monitor CPU temperature / fan speed (thermal throttling?) * check for SATA / FS errors in syslog -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1158474] update of kernel package(s) takes LONG time (44 MINUTES!!!!) - module compression?
by bugzilla_noreply＠novell.com 06 Dec '19

06 Dec '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1158474 http://bugzilla.opensuse.org/show_bug.cgi?id=1158474#c10 --- Comment #10 from robert spitzenpfeil <rs.opensuse(a)spitzenpfeil.org> --- Hardware: Core2 T5200 @ 1.60GHz, 2GB RAM, SSD This laptop is > 10 years old --- >> time sudo /usr/sbin/depmod -F /boot/System.map-5.3.12-1-default -ae 5.3.12-1-default real 0m13.823s user 0m11.218s sys 0m0.872s --- >> time sudo zypper in -y -f kernel-default-5.3.12-1.1.x86_64 real 1m47.881s user 0m49.057s sys 0m12.847s --- Something is VERY wrong with your computer. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1158568] xorg-x11-server package should call 'chkstat --system /usr/bin/Xorg' on install/update
by bugzilla_noreply＠novell.com 06 Dec '19

06 Dec '19

http://bugzilla.suse.com/show_bug.cgi?id=1158568 http://bugzilla.suse.com/show_bug.cgi?id=1158568#c2 --- Comment #2 from Michael Pujos <pujos.michael(a)gmail.com> --- Thanks, didn't know about permissions-zypp-plugin. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1132418] Apparmor shows exit. Launching Apparmor config displays undefined method 'addPid' for nil:NilClass
by bugzilla_noreply＠novell.com 06 Dec '19

06 Dec '19

http://bugzilla.suse.com/show_bug.cgi?id=1132418 http://bugzilla.suse.com/show_bug.cgi?id=1132418#c16 --- Comment #16 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2019:3198-1: An update that has three recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1121274,1123258,1132418 CVE References: Sources used: SUSE Linux Enterprise Module for Basesystem 15 (src): yast2-apparmor-4.0.6-3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0