November 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1119619] New: certbot does not renew certificates (again)
by bugzilla_noreply＠novell.com 11 Jul '22

11 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1119619 Bug ID: 1119619 Summary: certbot does not renew certificates (again) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Factory Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: jimc(a)math.ucla.edu QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Formerly I had python-certbot-0.26.1-1.1.noarch and it could renew certs. Now I have python3-certbot-0.28.0-2.1.noarch on OpenSuSE Tumbleweed VERSION="20181208" This is the one with the dependency on python-mock restored/added. It says "No renewals were attempted" on both of my hosts that use certbot. I tracked this down to a (non) migration issue: formerly the state dir was /etc/certbot but now it is /etc/letsencrypt, which of course contains no lineages, so no renewals were attempted. Workaround: mv /etc/letsencrypt /etc/letsencrypt.empty mv /etc/certbot /etc/letsencrypt ln -s letsencrypt certbot The symlink is so explicit filenames in config files, or symlinks in e.g. /etc/openssl/private, will still find the cert and key until I locate and fix them. Tested: my Apache webserver still can authenticate using the (not quite expired) old cert. I ran "certbot renew", its webroot challenges were acceptable (despite some DNAT stuff), and the report was: Congratulations, all renewals succeeded... (list of 1 renewed cert). Testing: the webserver successfully uses the new cert. By the way, old logs are in /var/log/certbot which is still there but is supplanted by /var/log/letsencrypt. It would be nice if the python3-certbot and python2-certbot packages had a migration script for users who are having trouble figuring out why their certs are not being renewed. I'm not sure whether migration scripts in packages should be reported upstream, or to the distro; if the former, let me know and I'll open a ticket upstream. Also I set the component to "security" since the X.509 certificate's purpose is security, but if a different component would be more appropriate please feel free to change it. -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1149986] New: telegram-desktop cannot be started with enabled GTK integration and libqt5-qtstyleplugins-platformtheme-gtk2 installed
by bugzilla_noreply＠novell.com 10 Jul '22

10 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1149986 Bug ID: 1149986 Summary: telegram-desktop cannot be started with enabled GTK integration and libqt5-qtstyleplugins-platformtheme-gtk2 installed Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: tux93(a)opensuse.org Reporter: tux93(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Trying to start telegram-desktop built with enabled GTK integration and libqt5-qtstyleplugins-platformtheme-gtk2 installed fails with > ~>telegram-desktop > (telegram-desktop:4205): GLib-GObject-WARNING **: 17:15:44.346: cannot register existing type 'GdkDisplayManager' > (telegram-desktop:4205): GLib-CRITICAL **: 17:15:44.346: g_once_init_leave: assertion 'result != 0' failed > (telegram-desktop:4205): GLib-GObject-CRITICAL **: 17:15:44.346: g_object_new_with_properties: assertion 'G_TYPE_IS_OBJECT (object_type)' failed Currently this is resolved by a conflict of telegram-desktop with libqt5-qtstyleplugins-platformtheme-gtk2 which leads to cunfusion of users (bug 1148509) Ideally the root cause should be found and patched. A package without the conflict for testing can be found at https://build.opensuse.org/project/show/home:tux93:tdesktop-no-conflict -- You are receiving this mail because: You are on the CC list for the bug.

2 33

[Bug 1177800] New: [Ten64] getsysinfo caused kernel error (synchronous external abort)
by bugzilla_noreply＠suse.com 08 Jul '22

08 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1177800 Bug ID: 1177800 Summary: [Ten64] getsysinfo caused kernel error (synchronous external abort) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: aarch64 OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: afaerber(a)suse.com QA Contact: qa-bugs(a)suse.de CC: matt(a)traverse.com.au, snwint(a)suse.com, yousaf.kaukab(a)suse.com Found By: --- Blocker: --- Running `getsysinfo` (via ssh) on Tumbleweed 20201011 with kernel-default 5.9.0 from Kernel:HEAD repository caused a kernel error, with ssh getting stuck and reconnections failing. Serial login still worked. zehn:~ # getsysinfo /proc/bus/input /proc/cpuinfo /proc/device-tree /proc/devices /proc/fb /proc/filesystems /proc/interrupts /proc/iomem /proc/ioports /proc/meminfo /proc/modules /proc/net/dev /proc/partitions /proc/scsi /proc/tty /proc/version /sys /usr/sbin/getsysinfo: line 23: 2761 Segmentation fault cp -x -a --parents "$i" "$dir/$host" 2> /dev/null /var/lib/hardware/udi /proc/mounts System data written to: /tmp/zehn.tar.gz zehn:~ # [ 544.956478] Internal error: synchronous external abort: 96000210 [#1] SMP [ 544.963295] Modules linked in: af_packet ip6t_REJECT nf_reject_ipv6 ip6t_rpfilter xt_tcpudp ipt_REJECT nf_reject_ipv4 xt_conntrack ebtable_nat ebtable_broute ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security iscsi_ibft iscsi_boot_sysfs ip_set nfnetlink ebtable_filter ebtables rfkill ip6table_filter ip6_tables iptable_filter ip_tables x_tables fsl_dpaa2_ptp ptp_qoriq fsl_dpaa2_eth phylink xgmac_mdio hid_generic fsl_mc_dpio usbhid cdc_acm i2c_mux_pca954x i2c_mux tpm_i2c_atmel spi_fsl_qspi qoriq_thermal leds_gpio optee tee uio_pdrv_genirq uio qoriq_cpufreq nls_iso8859_1 nls_cp437 vfat fat drm xhci_plat_hcd xhci_hcd usbcore caam_jr mmc_block libdes authenc caamhash_desc caamalg_desc crypto_engine rtc_ds1307 mp886x aes_ce_blk crypto_simd cryptd aes_ce_cipher crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce dpaa2_console nvme nvme_core dwc3 sdhci_of_esdhc caam sdhci_pltfm ulpi [ 544.963547] error sdhci udc_core roles mmc_core i2c_imx btrfs blake2b_generic libcrc32c xor xor_neon raid6_pq sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua [ 545.066303] CPU: 0 PID: 2761 Comm: cp Not tainted 5.9.0-1.g11733e1-default #1 openSUSE Tumbleweed (unreleased) [ 545.076303] Hardware name: traverse ten64/ten64, BIOS 2020.07-rc1-g1d4a3d9d5c 07/28/2020 [ 545.084393] pstate: 60000085 (nZCv daIf -PAN -UAO BTYPE=--) [ 545.089967] pc : dw_pcie_read+0x48/0xc0 [ 545.093799] lr : dw_pcie_access_other_conf.isra.0+0xc4/0x120 [ 545.099452] sp : ffff800012203bf0 [ 545.102759] x29: ffff800012203bf0 x28: 0000000000000400 [ 545.108067] x27: ffff00833e683400 x26: ffff008348240000 [ 545.113375] x25: ffff800010085000 x24: 0000000000000000 [ 545.118683] x23: ffff00834b239880 x22: ffff800012203cc4 [ 545.123991] x21: 0000000000000004 x20: 0000000000000400 [ 545.129299] x19: ffff00834b2398a8 x18: 0000000000000000 [ 545.134607] x17: 0000000000000000 x16: ffffafadaf1be170 [ 545.139915] x15: 0000000000000000 x14: 0000000000000000 [ 545.145222] x13: 0000000000000000 x12: 0000000000000040 [ 545.150530] x11: ffff00834bd8c920 x10: 0000000000000000 [ 545.155837] x9 : ffffafadaf12e8f4 x8 : 0000000002080000 [ 545.161145] x7 : 0000000000000000 x6 : ffff800010f00000 [ 545.166452] x5 : 0000000000000000 x4 : 0000000000000908 [ 545.171759] x3 : 0000000000000003 x2 : ffff800012203cc4 [ 545.177066] x1 : 0000000000000004 x0 : ffff800010085400 [ 545.182374] Call trace: [ 545.184816] dw_pcie_read+0x48/0xc0 [ 545.188298] dw_pcie_rd_conf+0x11c/0x150 [ 545.192217] pci_user_read_config_dword+0xa8/0x190 [ 545.197004] pci_read_config+0x1f8/0x264 [ 545.200923] sysfs_kf_bin_read+0x78/0xa0 [ 545.204840] kernfs_file_direct_read+0x90/0x220 [ 545.209365] kernfs_fop_read+0x44/0x50 [ 545.213111] vfs_read+0xb8/0x1e4 [ 545.216334] ksys_read+0x78/0x110 [ 545.219643] __arm64_sys_read+0x28/0x34 [ 545.223476] el0_svc_common.constprop.0+0x84/0x230 [ 545.228261] do_el0_svc+0x30/0xa0 [ 545.231572] el0_svc+0x18/0x50 [ 545.234621] el0_sync_handler+0x90/0x254 [ 545.238538] el0_sync+0x158/0x180 [ 545.241849] Code: 528010e0 d50323bf b900005f d65f03c0 (b9400001) [ 545.247941] ---[ end trace 68383e7eecaae870 ]--- -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1110456] New: rsyslog not logging most messages
by bugzilla_noreply＠novell.com 07 Jul '22

07 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1110456 Bug ID: 1110456 Summary: rsyslog not logging most messages Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kubic Assignee: kubic-bugs(a)opensuse.org Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- On SLES, all messages I see in journalctl are also available in /var/log/messages. On Kubic, where we use rsyslog, nearly no message I see in journalctl can be found in /var/log/messages. So something with journalctl and rsyslog is configured wrong. -- You are receiving this mail because: You are on the CC list for the bug.

2 11

[Bug 1068678] New: Package rsyslog requires package system-user-news
by bugzilla_noreply＠novell.com 07 Jul '22

07 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1068678 Bug ID: 1068678 Summary: Package rsyslog requires package system-user-news Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: freek(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When installing rsyslog in Tumbleweed there are warning messages that the user news is not present (chown: invalid user: 'news:news'). Unless rsyslog is changed to not using news, the package should require the package "system-user-news". -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1160171] New: Blender failed to launch (symbol lookup error: undefine symbol)
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1160171 Bug ID: 1160171 Summary: Blender failed to launch (symbol lookup error: undefine symbol) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: andythe_great(a)pm.me QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- kakake@linux-gsde:~> blender blender: symbol lookup error: /usr/lib64/libOpenColorIO.so.1: undefined symbol: _ZN4YAML6detail9node_data12empty_scalarB5cxx11E Try executing Blender in terminal result in this message. I did sudo zypper clean sudo zypper ref sudo zypper rm -u blender sudo zypper in blender reboot still same problem. The question was also ask here: https://forums.opensuse.org/showthread.php/538693-Blender-failed-to-launch-… Blender 2.81-2.1-x86_64 from vendor openSUSE Operating System: openSUSE Tumbleweed 20200103 KDE Plasma Version: 5.17.4 KDE Frameworks Version: 5.65.0 Qt Version: 5.13.1 Kernel Version: 5.3.12-2-default OS Type: 64-bit Processors: 8 × Intel® Core™ i7-3770 CPU @ 3.40GHz Memory: 7.5 GiB of RAM -- You are receiving this mail because: You are on the CC list for the bug.

2 12

[Bug 1027942] New: virt-manager: Missing upstream bug fixes
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1027942 Bug ID: 1027942 Summary: virt-manager: Missing upstream bug fixes Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Tools Assignee: virt-bugs(a)suse.de Reporter: carnold(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- There are upstream patches fixing bugs needed for this version of virt-manager. -- You are receiving this mail because: You are on the CC list for the bug.

2 37

[Bug 1170161] New: AUDIT-FIND: enlightenment: enlightenment_system: _store_mount_verify() follows symlinks in /media/$user
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1170161 Bug ID: 1170161 Summary: AUDIT-FIND: enlightenment: enlightenment_system: _store_mount_verify() follows symlinks in /media/$user Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: simonf.lees(a)suse.com Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: matthias.gerstner(a)suse.com, security-team(a)suse.de Blocks: 1169238 Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1169238 This function rejects relative path components in the target mount path, unlike its sibbling function described in b). However, it is unaware of symlinks. Furthermore it makes sure that /media/$user and /media/$user/sub are existing and are owned by the $uid:$gid of the unprivileged user. - by placing a symlink in /media/$user/sub the setuid-root binary can be tricked to create attacker owned directories in arbitrary locations. This can quite likely lead to full root access by creating user owned directories e.g. beneath /etc that are then used by other privileged programs. - if the attacker wins a race condition he can also cause the setuid-root binary to pass ownership of arbitrary existing directories to himself. The `_store_mount_verify()` functions performs a single `stat()` call on the target mount path. Only if it exists and is not owned by the unprivileged user, the execution is aborted. Therefore if the attacker places a suitable symlink in the target path just after this `stat()` is performed by the setuid-root binary, the following `_mkdir()` invocation will `mkdir()` and `chown()` the path components nonetheless. This allows full root system access by gaining ownership of e.g. /etc or /root. To fix this I suggest not to pass ownership of /media/$user or of any sub-directories to the unprivileged user. If /media/$user is user controlled then the mount operation should be rejected. -- You are receiving this mail because: You are on the CC list for the bug.

2 10

[Bug 1170162] New: AUDIT-FIND: enlightenment: enlightenment_system: _store_umount_verify(): does not protect against shell metacharacters and relative path components
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1170162 Bug ID: 1170162 Summary: AUDIT-FIND: enlightenment: enlightenment_system: _store_umount_verify(): does not protect against shell metacharacters and relative path components Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: simonf.lees(a)suse.com Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: security-team(a)suse.de Blocks: 1169238 Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1169238 This function tries to make sure that the user can only unmount his own mounts below /media/$user. It also rejects backslashes in the path. However it does not reject relative path components or shell characters. - this allows a regular user to unmount arbitrary file systems by passing paths like "/media/$user/../../tmp. - since the unmount is performed by calling the `umount` utility via "/bin/sh", shell metacharacters will be interpreted. Passing a path like '/media/testuser/$(date)' will cause the setuid-root program to execute the `date` program as root. This leads to full code execution as root. The only requirement is that a directory of the same name exists. Spaces are also allowed in the path, therefore even complex commands can be executed as root. I recommend to reject relative path components and shell metacharacters in this function to fix the issue. -- You are receiving this mail because: You are on the CC list for the bug.

2 11

[Bug 1155688] New: openh264 needs a later flatpak version
by bugzilla_noreply＠novell.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1155688 Bug ID: 1155688 Summary: openh264 needs a later flatpak version Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: All OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: tech4patton(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Current version in repo is 1.2.3 which is considered the "old stable". Latest version of that branch is 1.2.5 which is needed to support new features. https://github.com/flatpak/flatpak/releases/tag/1.2.5 The main feature is the support for allowing the use of extra_data for runtimes (as opposed to only for apps) which is used by the new org.freedesktop.Platform.openh264 extension. Here is what happens when I update flatpak apps ---------------------------------------------------------------------- > flatpak update Looking for updates… ID Arch Branch Op Remote Download 1. [✗] org.freedesktop.Platform.openh264 x86_64 19.08 i flathub < 593.4 kB 2. [✓] com.spotify.Client x86_64 stable u flathub 115.0 MB / 126.4 MB Warning: org.freedesktop.Platform.openh264 needs a later flatpak version Changes complete. -- You are receiving this mail because: You are on the CC list for the bug.

2 5