November 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1065388] New: apparmor is breaking tool file in lessopen.sh
by bugzilla_noreply＠novell.com 28 Feb '23

28 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1065388 Bug ID: 1065388 Summary: apparmor is breaking tool file in lessopen.sh Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Factory Status: NEW Severity: Major Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: werner(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Tracing lessopen.sh with export LESS_ADVANCED_PREPROCESSOR=yes shows [...] ++ file -L ./less.1 + type='./less.1: writable, regular file, no read permission' but it should be noether less/less-487> file -L ./less.1 ./less.1: troff or preprocessor input, ASCII text in /etc/apparmor.d/usr.bin.lessopen.sh I found /usr/bin/file rix, but no rule for /usr/bin/file its self! All tools listed in /etc/apparmor.d/usr.bin.lessopen.sh should be able to read files as otherwise nothings goes. -- You are receiving this mail because: You are on the CC list for the bug.

2 28

[Bug 972678] New: KDE:Qt/python-pyside: Bug - Installation of this breaks software "opensesame"
by bugzilla_noreply＠novell.com 28 Feb '23

28 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=972678 Bug ID: 972678 Summary: KDE:Qt/python-pyside: Bug - Installation of this breaks software "opensesame" Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: x86-64 OS: Linux Status: NEW Severity: Normal Priority: P5 - None Component: Bugzilla Assignee: dmueller(a)suse.com Reporter: patrickmurphy221(a)gmail.com QA Contact: novbugzilla-bugs(a)forge.provo.novell.com Found By: --- Blocker: --- - Overview Tumbleweed zypper dup requests installation of python-pyside, but installing it breaks the program "opensesame". - More detail Installed OpenSUSE Tumbleweed (snapshot 2016-03-18). Installed package "opensesame" (psychology experiment builder, homepage: http://osdoc.cogsci.nl/) from OpenSUSE Science repository (https://build.opensuse.org/project/show/science) It works fine. When I do a "zypper dup" (March 23rd or 24th), the package "python-pyside" is installed (requested by the distribution; not a dependency of opensesame) and it breaks opensesame. Trying to run opensesame gives this error instead of launching the program: python: siplib.c:8551: sip_api_can_convert_to_type: Assertion `td == ((void *)0) || (((td)->td_flags & 0x0007) == 0x0000) || (((td)->td_flags & 0x0007) == 0x0002)' failed. Aborted (core dumped) Uninstalling python-pyside makes opensesame work again (but "zypper dup" continues to request that I install python-pyside). This does not seem to be specific to the OpenSUSE Science repository, since downloading the opensesame python source from its official website and running that gives the exact same result. - To reproduce 1. Install opensesame, from OpenSUSE Science repo or from source. 2. Install python-pyside (as requested by zypper dup). Reversing the order has same effect. Happens on Tumbleweed. In the past I've run opensesame on Leap without problems, but I don't think it ever requested installation of python-pyside, so breakage would not be expected. (First time submitting a bug; apologies if I didn't include the right detail or use the right format.) -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1040812] New: KDE:Qt5/libqt5-qtbase: Bug: KDE:Qt5 has been upgraded to QT 5.9, publishing is OFF
by bugzilla_noreply＠novell.com 28 Feb '23

28 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1040812 Bug ID: 1040812 Summary: KDE:Qt5/libqt5-qtbase: Bug: KDE:Qt5 has been upgraded to QT 5.9, publishing is OFF Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: hrvoje.senjan(a)gmail.com Reporter: Mathias.Homann(a)opensuse.org QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- Again KDE:Qt5 has been up- or downgraded, this time to Qt 5.9, but publishing is OFF, so AGAIN all repositories that build using Qt5 are broken. FIX ASAP. -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1173619] New: VUL-0: unbound: LPE from unbound to root
by bugzilla_noreply＠suse.com 27 Feb '23

27 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1173619 Bug ID: 1173619 Summary: VUL-0: unbound: LPE from unbound to root Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: darin(a)darins.net Reporter: wolfgang.frisch(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- via security(a)suse.de: I believe to have found a configuration issue in the Unbound package. Or, depending on how you look at it, in the Unbound server itself. 1. Before starting the Unbound server, systemd routinely runs unbound-anchor. From 'systemctl cat unbound': ExecStartPre=/usr/bin/sudo -u unbound /usr/sbin/unbound-anchor -a /var/lib/unbound/root.key -c /etc/unbound/icannbundle.pem As you can see this process is run as user unbound. 2. The Unbound server writes a pid file before dropping privileges, i.e. as root. It then chown's the file in a second step. 'grep username /etc/unbound/unbound.conf': username: "unbound" And from the Unbound source: https://github.com/NLnetLabs/unbound/blob/2a90e8fa1e22aa75d1cf67a1f71ebbf3f… As you can see in the source, Unbound doesn't check if there is already a symbolic link in place of the pid file. 3. openSUSE configures Unbound to create the pid file in a directory owned by the unbound user. 'grep pidfile /etc/unbound/unbound.conf': pidfile: "/var/run/unbound/unbound.pid" 'cat /usr/lib/tmpfiles.d/unbound.conf': D /run/unbound 0755 unbound unbound - 4. unbound-anchor is a nice little "do-one-thing-and-do-it-right" tool. But if it is compromised, and as it has write permission in the pid file directory and reliably runs before the server, an attacker could easily gain full root privileges by just creating a symbolic link /run/unbound/unbound.pid. 5. IMHO this would be best fixed in openSUSE by creating a root owned /run/unbound directory, or changing the pid file path to /run/unbound.pid or something like that. I think this would have the added advantage that openSUSE could ship and maybe enforce the Unbound AppArmor profile used in Debian and Ubuntu: https://gitlab.com/apparmor/apparmor-profiles/-/blob/master/ubuntu/20.04/us… With the current openSUSE setup there is the problem that if AppArmor filters CAP_DAC_OVERRIDE, Unbound has no permission to create a pid file in /run/unbound anymore. If you have questions please don't hesitate to contact me. Thanks for taking a look. Kind regards, Detlef -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1174051] New: opensuse-community.org links not working
by bugzilla_noreply＠suse.com 19 Feb '23

19 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1174051 Bug ID: 1174051 Summary: opensuse-community.org links not working Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Wiki Assignee: suse-beta(a)cboltz.de Reporter: e-dimas(a)yandex.ru QA Contact: adrian.schroeter(a)suse.com Found By: --- Blocker: --- I am trying to install codecs using "opensuse-community.org" But links to "KDE Codecs", "GNOME Codecs", "NVIDIA Graphics Card Driver" do not work. I use the browser Firefox. If you enter "https://opensuse-community.org/codecs-kde.ymp" in the address bar, the installation of codecs starts. Please fix the links "1 Click Install". -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1174184] New: mozilla/firefox78: Bug
by bugzilla_noreply＠suse.com 19 Feb '23

19 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1174184 Bug ID: 1174184 Summary: mozilla/firefox78: Bug Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: x86-64 OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: 3rd party software Assignee: wolfgang(a)rosenauer.org Reporter: bauglir(a)fsfe.org QA Contact: bnc-team-screening(a)forge.provo.novell.com Found By: --- Blocker: --- Created attachment 839753 --> http://bugzilla.opensuse.org/attachment.cgi?id=839753&action=edit Error message openSuSE Leap 15.2: After upgrading to latest Firefox 78.0.2 version, current profile opens once and then it starts showing an error window with attatched message. There's no problem opening new profiles, just opening old profiles. -- You are receiving this mail because: You are on the CC list for the bug.

1 57

[Bug 1175850] New: MicroOS Desktop can't reboot?
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1175850 Bug ID: 1175850 Summary: MicroOS Desktop can't reboot? Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: MicroOS Assignee: kubic-bugs(a)opensuse.org Reporter: mike(a)flingtoad.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- On a default install of MicroOS Desktop (KDE) (ALPHA) 20200824-0, there is no obvious way to reboot the machine after install packaged with transactional-update. Here's what I've tried. 1. 'transactional-update reboot' (notifies rebootmgrctl that a reboot is requested, but 'rebootmgrctl status' seems to be waiting for the scheduled maintenance time. 2. 'rebootmgrctl reboot now' does not seem to do anything. 3. 'rebootmgrctl reboot fast' does not seem to do anything. 4. Click "Leave" -> "Restart" from KDE menu does not seem to do anything. 5. Click "Leave" -> "Shutdown" from KDE menu does not seem to do anything. 6. Click "Leave" -> "Shutdown" from KDE menu does not seem to do anything. 7. 'systemctl reboot' drops to a non-graphical target with login prompt, but doesn't continue with a reboot. 8. 'shutdown -r now' drops to a non-graphical target with login prompt, but doesn't continue with a reboot. 9. 'shutdown -h now' complains about not being able to unmount /etc, but eventually does halt. 10. 'systemctl reboot' to drop to term and the ctrl-alt-delete several times does eventually reboot >From what I can tell, 4-6 only happen when running the X session for KDE. If you run the Wayland session, 4-6 work but the others still don't. I haven't tried Wayland (Full). Other notes and observations: 1. I don't think the X session is starting the org.kde.ksmserver, but it does get started for Wayland. 2. I'm using full-disk encryption. 3. No matter how I exit the KDE session, it never saved my display configuration. I have to reconfigure the displays each time. Perhaps another bug report for this one. -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1165830] New: [TRACKER] grand distro cleanup
by bugzilla_noreply＠novell.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1165830 Bug ID: 1165830 Summary: [TRACKER] grand distro cleanup Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: lnussel(a)suse.com Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- track efforts to clean up the distro like /usr move /etc cleanup dependency cleanup -- You are receiving this mail because: You are on the CC list for the bug.

2 21

[Bug 1167519] New: VUL-1: CVE-2020-10870: zim: creates temporary directories with predictable names, enabling malicious users to prevent other users from being able to start Zim
by bugzilla_noreply＠novell.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1167519 Bug ID: 1167519 Summary: VUL-1: CVE-2020-10870: zim: creates temporary directories with predictable names, enabling malicious users to prevent other users from being able to start Zim Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/255622/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: luke(a)ljones.dev Reporter: wolfgang.frisch(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2020-10870 Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10870 https://github.com/zim-desktop-wiki/zim-desktop-wiki/issues/1028 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10870 -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1178453] New: [Build 20201103] gnuhealth_client crashes on start
by bugzilla_noreply＠suse.com 12 Feb '23

12 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1178453 Bug ID: 1178453 Summary: [Build 20201103] gnuhealth_client crashes on start Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/1460183/modules/gnuh ealth_client_first_time/steps/2 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: openQA Blocker: Yes ## Observation openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-gnuhealth@64bit fails in [gnuhealth_client_first_time](https://openqa.opensuse.org/tests/1460183/modu… ## Test suite description Maintainer: okurz(a)suse.de Test scenario for gnuhealth software stack ## Reproducible Fails since (at least) Build [20201103](https://openqa.opensuse.org/tests/1458960) ## Expected result Last good: [20201030](https://openqa.opensuse.org/tests/1456811) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 15