July 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1173158] CONFIG_MODULE_SIG=y
by bugzilla_noreply＠suse.com 09 Jul '20

09 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173158 https://bugzilla.suse.com/show_bug.cgi?id=1173158#c51 --- Comment #51 from Stefan Dirsch <sndirsch(a)suse.com> --- For now we can add to Release Notes and openSUSE WIKI how to sign a kernel module on a secure boot system. Of course this needs to be redone with each kernel update ... -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173918] yast2-sound build result depends on kernel
by bugzilla_noreply＠suse.com 09 Jul '20

09 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173918 https://bugzilla.suse.com/show_bug.cgi?id=1173918#c5 Bernhard Wiedemann <bwiedemann(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(bwiedemann(a)suse.c | |om) | --- Comment #5 from Bernhard Wiedemann <bwiedemann(a)suse.com> --- > I thought what you are after is getting the same build when the kernel does > *not* change? That is the base requirement. Note that the above diff is from 5.6 to 5.7 . For Leap 15.2 patch-level kernel updates, there is no other diff than the version number. It can still be nice to not differ from just the version, so build-compare can recognize that nothing changed and one less package gets updated on mirrors and user machines. Another option would be to reduce the version granularity: kernel: 5.7 so it only differs for larger updates every 10 weeks. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173158] CONFIG_MODULE_SIG=y
by bugzilla_noreply＠suse.com 09 Jul '20

09 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173158 https://bugzilla.suse.com/show_bug.cgi?id=1173158#c50 --- Comment #50 from Stefan Dirsch <sndirsch(a)suse.com> --- (In reply to Joey Lee from comment #49) > (In reply to Michal Kubeček from comment #11) > > Have you really checked that we actually have a problem with unsigned > > modules? > > > > We have > > > > CONFIG_MODULE_SIG=y > > CONFIG_MODULE_SIG_FORCE=n > > > > in Leap 15.2 kernel and the help text for CONFIG_MODULE_SIG_FORCE says > > > > Reject unsigned modules or signed modules for which we don't have a > > key. Without this, such modules will simply taint the kernel. > > > > so that loading an unsigned module (or module signed with an unknown key) > > should taint the kernel and write a warning into kernel log but the module > > should load anyway. > > For upstream kernel, yes! But on SLE and LEAP (inherit from SLE), kernel has > a SUSE patch that it enable SIG_FORCE when secure boot be enabled. LOL. So let's revert this, so we're back to the behaviour we've agreed on here before. Sorry, guys. But we can't silently do such a fundamental change without announcing it at least a release before (I would suggest sle16/Leap 16.x for such a change). I'm not aware of any Feature ticket or bug to make it impossible to load unsigned modules either. I asked for such tickets. Nobody could give me a reference for such a ticket ... -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173047] Get rid of system config files in /etc: vncmanager
by bugzilla_noreply＠suse.com 09 Jul '20

09 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1173047 http://bugzilla.opensuse.org/show_bug.cgi?id=1173047#c5 Stefan Dirsch <sndirsch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |CONFIRMED --- Comment #5 from Stefan Dirsch <sndirsch(a)suse.com> --- (In reply to Dominique Leuenberger from comment #4) > https://build.opensuse.org/package/view_file/openSUSE:Factory/vncmanager/ > n_use_port_5901.patch?expand=1 > > Seems our sample config file does not exactly match what the code does Thanks a lot, Dominique! I'll fix that! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173158] CONFIG_MODULE_SIG=y
by bugzilla_noreply＠suse.com 09 Jul '20

09 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173158 https://bugzilla.suse.com/show_bug.cgi?id=1173158#c49 --- Comment #49 from Joey Lee <jlee(a)suse.com> --- (In reply to Michal Kubeček from comment #11) > Have you really checked that we actually have a problem with unsigned > modules? > > We have > > CONFIG_MODULE_SIG=y > CONFIG_MODULE_SIG_FORCE=n > > in Leap 15.2 kernel and the help text for CONFIG_MODULE_SIG_FORCE says > > Reject unsigned modules or signed modules for which we don't have a > key. Without this, such modules will simply taint the kernel. > > so that loading an unsigned module (or module signed with an unknown key) > should taint the kernel and write a warning into kernel log but the module > should load anyway. For upstream kernel, yes! But on SLE and LEAP (inherit from SLE), kernel has a SUSE patch that it enable SIG_FORCE when secure boot be enabled. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173733] Compute capabilities of NVIDIA drivers cannot be initialised by non-root users
by bugzilla_noreply＠suse.com 09 Jul '20

09 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173733 https://bugzilla.suse.com/show_bug.cgi?id=1173733#c50 --- Comment #50 from Stefan Dirsch <sndirsch(a)suse.com> --- (In reply to Cor Blom from comment #48) > > Could you check if you have two modprobe files like > > > > /etc/modprobe.d/50-nvidia-default.conf > > /etc/modprobe.d/50-nvidia-default.conf.rpmsave > > > > See my comment#41. If yes, please remove the older file and try again > > (reboot is the easiest). > > Yes, I had both. Removed the .rpmsave one and rebooted. It made not > difference. > > I have backuped both files and can provide them, if necessary. Thanks for verification. No, it's not necessary. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173733] Compute capabilities of NVIDIA drivers cannot be initialised by non-root users
by bugzilla_noreply＠suse.com 09 Jul '20

09 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173733 https://bugzilla.suse.com/show_bug.cgi?id=1173733#c49 --- Comment #49 from Stefan Dirsch <sndirsch(a)suse.com> --- (In reply to Mister Pend from comment #47) > Just out of curiosity, I clean installed my test machine (formerly working), > and now seeing the same issues on that machine. And looking at > /etc/modprobe.d/50-nvidia-default.conf, the NVreg_DeviceFileGID is still > 483. Installed from NVIDIA's repository. I can promise you 100% I haven't > manually edited this file. Resulting nvidia/cuda packages: Thanks for double checking! I have no explanation for this. :-( But as I said it should not matter as long as you don't want to add all users, who should have access to the nvidia devices to the group with this GID. > If there are further tests needed, I'm happy to help. My test machine I can > rebuild in under 30 minutes, so happy for potentially destructive tests too. Thanks a lot for you cooperation! Very much appreciated. At the moment I don't have anything for further testing. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173750] usbguard daemon segfaults - fixed upstream in version 0.7.8
by bugzilla_noreply＠suse.com 09 Jul '20

09 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173750 https://bugzilla.suse.com/show_bug.cgi?id=1173750#c19 --- Comment #19 from Robert Frohl <rfrohl(a)suse.com> --- (In reply to Mathias Homann from comment #16) > ok, i do have a working package of usbguard-notifier 0.0.6 in home:lemmy04 > that can be used with the current usbguard (after editing > /usr/lib/systemd/system/usbguard.service). > > Feel free to grab it. Should I submit it to hardware where usbguard lives? I will have a look and submit it once I find the time. Thanks for putting in the work! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173115] zypper dup from 15.1 shows mok screen on reboot
by bugzilla_noreply＠suse.com 09 Jul '20

09 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173115 Joey Lee <jlee(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jlee(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173750] usbguard daemon segfaults - fixed upstream in version 0.7.8
by bugzilla_noreply＠suse.com 09 Jul '20

09 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173750 https://bugzilla.suse.com/show_bug.cgi?id=1173750#c18 Robert Frohl <rfrohl(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CONFIRMED --- Comment #18 from Robert Frohl <rfrohl(a)suse.com> --- I just submitted the upstream version to leap 15.2. I am aware of the missing applet, but did not find anything yet that works well enough. CLI works okay if you spend some time with it, but has the obvious usability draw back. -- You are receiving this mail because: You are on the CC list for the bug.

1 0