February 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1163197] Installer kernel panic
by bugzilla_noreply＠novell.com 09 Feb '20

09 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1163197 http://bugzilla.suse.com/show_bug.cgi?id=1163197#c14 --- Comment #14 from Borislav Petkov <bpetkov(a)suse.com> --- (In reply to Takashi Iwai from comment #13) > FWIW, the kernel in OBS Kernel:stable repo is based on 5.5.y. You can try > the kernel package from there. That one: http://download.opensuse.org/repositories/Kernel:/stable/standard/x86_64/ ? If so, yes, sure, that works too. Thx. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1163197] Installer kernel panic
by bugzilla_noreply＠novell.com 09 Feb '20

09 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1163197 http://bugzilla.suse.com/show_bug.cgi?id=1163197#c13 --- Comment #13 from Takashi Iwai <tiwai(a)suse.com> --- (In reply to Borislav Petkov from comment #10) > Yah, > > I was hoping that we'll have an rpm built but ours has advanced from 5.5 so > please use this one: FWIW, the kernel in OBS Kernel:stable repo is based on 5.5.y. You can try the kernel package from there. TW kernel is still in 5.4.y by some issues in 5.5 kernel. I'm not against learning the kernel build process (it's good in anyway and it might be needed later), but if we want a quick test, the rpm installation can be faster. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1163197] Installer kernel panic
by bugzilla_noreply＠novell.com 09 Feb '20

09 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1163197 http://bugzilla.suse.com/show_bug.cgi?id=1163197#c12 Borislav Petkov <bpetkov(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(bpetkov(a)suse.com) | --- Comment #12 from Borislav Petkov <bpetkov(a)suse.com> --- Do this: 1. copy kernel config into the build directory: $ cp /boot/config-4.4.180-102-default .config 2. update it $ yes "" | make oldconfig 3. Now build kernel: $ make -j9 binrpm-pkg Install resulting rpm. Lemme know if that doesn't work and I'll build one for ya. HTH and thx. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1163120] No mitigations for CPU vulnerabilities
by bugzilla_noreply＠novell.com 09 Feb '20

09 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1163120 http://bugzilla.suse.com/show_bug.cgi?id=1163120#c9 --- Comment #9 from Borislav Petkov <bpetkov(a)suse.com> --- > - Why are L1TF and Meltdown not mitigated in kernel-default but only in > kernel-pae? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… > - Is it possible to mitigate MDS and 'Spec store bypass' through kernel > or only through microcode? As previously stated, only through microcode update. > - Can L1TF, MDS or 'Spec store bypass' be exploited through web > JavaScript, like shown in the video/papers? L1TF: https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html#mitiga… MDS: https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html#attack-… SSB: https://software.intel.com/security-software-guidance/software-guidance/spe… > https://lkml.org/lkml/2019/12/8/205 The section "Process Isolation" here https://software.intel.com/security-software-guidance/software-guidance/spe… kinda explains what you need to do. The section "Web-Browsers" here https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html#attack-… says that MDS exploitation through JS is highly-unlikely. The section "Mitigation selection guide" here https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html#mitiga… says that if you don't use virtualization, the system is protected, as I already pointed out previously. And that's all the answers I can give you: I cannot tell you just by describing what you do whether what you do is absolutely secure. Maybe, maybe not. I also cannot tell you how likely is a "highly-unlikely" exploitation. I don't think anyone would give you guarantees here. What I can tell you is that we do our best to have the kernel up-to-date and contain the latest mitigations. I sincerely hope that helps. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1162511] Flooded with messages dev_pm_opp_set_rate: failed to find current OPP for freq on Raspberry Pi 4B
by bugzilla_noreply＠novell.com 09 Feb '20

09 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1162511 http://bugzilla.suse.com/show_bug.cgi?id=1162511#c8 --- Comment #8 from Freek de Kruijf <freek(a)opensuse.org> --- (In reply to Freek de Kruijf from comment #7) > Currently I started all over again with XFCE for RPi4 for Tumbleweed with > the latest image: > openSUSE-Tumbleweed-ARM-XFCE-raspberrypi4.aarch64-2020.01.30- > Snapshot20200201.raw.xz > I replaced packet wpa_supplicant by a lower version that I saved earlier. > Before first boot I reconfigured the SD card, removed swap partition, moved > partition ROOT to the left and enlarged it to 30G, made an 80G HOME and a 4G > swap. It is a 128GB SD card. > The WiFi interfaces, build-in and dongle, do not start during boot, but do > come up using "wicked ifup wlxxx". > Until now there is no flooding. > I hope to continue configuring the system tomorrow; postfix, dovecot, > thunderbird, and other user applications; also testing the XFCE desktop. I > need to do other things first. Apparently the situation is not reproducible. The current system with all previously configured packages does not show any sign of flooding. Unfortunately a crucial thing, video with sound, lacks support, also missing aarch64 support by packman for Tumbleweed, so I need to use Raspbian to really get what my user needs. I can use Tumbleweed or Leap 15.2 to configure a server. In my view this report can be closed. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1163197] Installer kernel panic
by bugzilla_noreply＠novell.com 09 Feb '20

09 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1163197 http://bugzilla.suse.com/show_bug.cgi?id=1163197#c10 Borislav Petkov <bpetkov(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(ivanleo(a)gmail.com | |), | |needinfo?(bpetkov(a)suse.com) | --- Comment #10 from Borislav Petkov <bpetkov(a)suse.com> --- Yah, I was hoping that we'll have an rpm built but ours has advanced from 5.5 so please use this one: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/snapshot… Feel free to ask if you need any help building a kernel, or, if it is too much trouble, I can build one for ya. Once you do that, pls catch the same files and upload them. Thx. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1163120] No mitigations for CPU vulnerabilities
by bugzilla_noreply＠novell.com 09 Feb '20

09 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1163120 http://bugzilla.suse.com/show_bug.cgi?id=1163120#c8 --- Comment #8 from Suse User <suseino(a)riseup.net> --- > If you want an answer to something, please formulate it as an > exact question. - Why are L1TF and Meltdown not mitigated in kernel-default but only in kernel-pae? - Is it possible to mitigate MDS and 'Spec store bypass' through kernel or only through microcode? - Can L1TF, MDS or 'Spec store bypass' be exploited through web JavaScript, like shown in the video/papers? > AFAIU, you're asking whether you can do something additional as a user > in case Spectre and Meltdown are not mitigated on your CPU. But they > *are* mitigated, on *your* machine: The 2-part general question asked on LKML is about any system with a vulnerable CPU hradware. It arises from the following: A. Mitigations for some systems may not exist B. Mitigations may exist but they are not complete fixes, as papers say C. Browser-level mitigations are like B. Therefore: D. Web JavaScript (and WebAssemby) can be dangerous and one cannot possibly verify manually each and every script while browsing the web E. Unfortunately there are websites which don't work with JS disabled Based on that I have formulated the 2 questions on LKML: https://lkml.org/lkml/2019/12/8/205 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1163197] Installer kernel panic
by bugzilla_noreply＠novell.com 09 Feb '20

09 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1163197 http://bugzilla.suse.com/show_bug.cgi?id=1163197#c5 Borislav Petkov <bpetkov(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ivanleo(a)gmail.com Flags| |needinfo?(ivanleo(a)gmail.com | |) --- Comment #5 from Borislav Petkov <bpetkov(a)suse.com> --- Can you boot the upstream 5.5 kernel on that machine? If yes, please upload full dmesg and do cat /proc/timer_list > timer_list.txt and upload that txt file too. Thx. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1162421] New: pam_winbind broken in version samba 4.9.5 GIT.243
by bugzilla_noreply＠novell.com 09 Feb '20

09 Feb '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1162421 Bug ID: 1162421 Summary: pam_winbind broken in version samba 4.9.5 GIT.243 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Samba Assignee: samba-maintainers(a)SuSE.de Reporter: juergen.mell(a)t-online.de QA Contact: samba-maintainers(a)SuSE.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Build Identifier: With the latest SAMBA update comes a broken version of pam_winbind. The error message is: PAM unable to dlopen(/lib64/security/pam_winbind.so): /usr/lib64/samba/libreplace-samba4.so: version `SAMBA_4.9.5_GIT.243.E76C5CB3D97LP151.2.15.1_SUSE_OS1 5.0_X86_64' not found (required by /lib64/security/pam_winbind.so The library libreplace-samba4.so is present, but its version string does not contain the "SUSE_OS15" part. The result is that authentification against a domein controller fails, eg. in Cyrus imap Downgrading to samba 4.9.5 GIT.224 fixed the problem Reproducible: Always Steps to Reproduce: 1.Set up a program to authenticate against a remote domain controller with pam_winbind, eg. Cyrus imap's saslauthd 2. 3. Actual Results: Authentification will always fail and you will see the error mesage shown in the description above. Expected Results: Authentification should succeed. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1163120] No mitigations for CPU vulnerabilities
by bugzilla_noreply＠novell.com 09 Feb '20

09 Feb '20

http://bugzilla.suse.com/show_bug.cgi?id=1163120 http://bugzilla.suse.com/show_bug.cgi?id=1163120#c7 --- Comment #7 from Borislav Petkov <bpetkov(a)suse.com> --- (In reply to Suse User from comment #6) > (1) After the above clarification, I suppose you can have a second look to > my previous question. Hardly a clarification because I still have no clue what exactly you're asking. If you want an answer to something, please formulate it as an exact question. > (2) My other question is: > > https://lkml.org/lkml/2019/12/8/205 > > *I understand (2) and the answer to it may be considered off-topic to this > bug report but I still hope you could shed some light on it too (in direct > email is fine too, if you think it would be more appropriate). AFAIU, you're asking whether you can do something additional as a user in case Spectre and Meltdown are not mitigated on your CPU. But they *are* mitigated, on *your* machine: /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full generic retpoline, STIBP: disabled, RSB filling -- You are receiving this mail because: You are on the CC list for the bug.

1 0