January 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1169874] [Build 20200417] Failure to boot due to resume=/dev/disk/by-path
by bugzilla_noreply＠suse.com 11 Jan '21

11 Jan '21

https://bugzilla.suse.com/show_bug.cgi?id=1169874 https://bugzilla.suse.com/show_bug.cgi?id=1169874#c33 --- Comment #33 from Josef Reidinger <jreidinger(a)suse.com> --- (In reply to Fabian Vogt from comment #32) > (In reply to Fabian Vogt from comment #29) > > Created attachment 844914 [details] > > YaST logs (patched Kernel.rb, still no resume=) > > > > I patched Kernel.propose_hibernation? to log "prop hiber" on entry and > > "returning true" on exit, and only the entry is logged: > > > > 2021-01-07 05:50:26 <2> g149(9912) [Ruby] > > modules/Kernel.rb(propose_hibernation?):559 prop hiber > > 2021-01-07 05:50:26 <1> g149(9912) [Ruby] proposal/space_maker.rb(block in > > provide_space):84 No need to find a fit for this partition, it will reuse > > /dev/vda3: #<Y2Storage::Planned::Partition mount_point=swap, > > reuse_name=/dev/vda3, reuse_sid=46, min_size=0 B, max_size=2 GiB, disk=nil, > > max_start_offset=nil, subvolumes=[]> > > > > I did another try with also patching out the product features condition and > > then resume= appeared in the cmdline. > > Had another look, the bug hid in plain sight: > @defaults has "propose_hibernate" => true > but it's actually called "propose_hibernation"! agh, good catch. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1180766] New: apparmor unix (connect) type=stream rule disallows creating unix stream sockets
by bugzilla_noreply＠suse.com 11 Jan '21

11 Jan '21

https://bugzilla.suse.com/show_bug.cgi?id=1180766 Bug ID: 1180766 Summary: apparmor unix (connect) type=stream rule disallows creating unix stream sockets Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: AppArmor Assignee: suse-beta(a)cboltz.de Reporter: maciek.borzecki(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I'm trying to update snapd to 2.48.2 which contains a fix for the snap's AppArmor profile that blocks access to ICE sockets: https://github.com/snapcore/snapd/pull/9542 The rule is defined as: deny unix (connect, receive, send) type=stream peer=(addr="@/tmp/.ICE-unix/[0-9]*"), However, the rule apparently blocks all access to X sockets. The audit log contains the following entry: type=AVC msg=audit(1610354923.200:498): apparmor="DENIED" operation="create" profile="snap.ohmygiraffe.ohmygiraffe" pid=9202 comm="getent" family="unix" sock_type="stream" protocol=0 requested_mask="create" denied_mask="create" This is confirmed by strace output: [pid 9165] socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC, 0) = -1 EACCES (Permission denied) The behavior is unexpected, as abstractions/base explicitly allows creating unix sockets. I was able to extract the relevant bits and come up with a minimal profile that demonstrates that behavior without snaps: #include <tunables/global> profile "test-profile" { #include <abstractions/base> #include <abstractions/consoles> #include <abstractions/dbus-strict> #include <abstractions/dbus-session-strict> #include <abstractions/X> #include <abstractions/fonts> allow /etc/** mrkix, allow /usr/** mrkix, # Deny access to ICE granted by abstractions/X # See: https://bugs.launchpad.net/snapd/+bug/1901489 deny owner @{HOME}/.ICEauthority r, deny owner /run/user/*/ICEauthority r, deny unix (connect, receive, send) type=stream peer=(addr="@/tmp/.ICE-unix/[0-9]*"), } Then after loading and trying to run gnome-calculator, it cannot connect to Xorg: $ strace aa-exec -p test-profile /usr/bin/gnome-calculator .. socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC, 0) = -1 EACCES (Permission denied) ... time->Mon Jan 11 11:58:56 2021 type=AVC msg=audit(1610362736.216:1763): apparmor="DENIED" operation="create" profile="test-profile" pid=17496 comm="gnome-calculato" family="unix" sock_type="stream" protocol=0 requested_mask="create" denied_mask="create" I have further arrived at this minimal sample: #include <tunables/global> profile "test-profile" { #include <abstractions/base> deny unix (connect) type=stream, } $ sudo strace -e socket aa-exec -p test-profile python3 -c 'import socket; socket.socket(socket.AF_UNIX, socket.SOCK_STREAM, 0)' socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC, 0) = -1 EACCES (Permission denied) Traceback (most recent call last): File "<string>", line 1, in <module> File "/usr/lib64/python3.8/socket.py", line 231, in __init__ _socket.socket.__init__(self, family, type, proto, fileno) PermissionError: [Errno 13] Permission denied +++ exited with 1 +++ time->Mon Jan 11 12:26:38 2021 type=AVC msg=audit(1610364398.488:1944): apparmor="DENIED" operation="create" profile="test-profile" pid=18103 comm="python3" family="unix" sock_type="stream" protocol=0 requested_mask="create" denied_mask="create" The profile works as expected on Ubuntu 20.04 and Arch (using 5.10.6 kernel). Arch uses pretty much the mainline kernel without any patches on top, thus at least the AppArmor bits should be close to what is on openSUSE. I have found this patch in opensuse's tree, maybe it is relevant: https://github.com/openSUSE/kernel-source/blob/master/patches.suse/apparmor… Relevant packages on Tumbleweed: apparmor-abstractions-3.0.1-1.2.noarch apparmor-docs-3.0.1-1.2.noarch apparmor-parser-3.0.1-1.2.x86_64 apparmor-parser-lang-3.0.1-1.2.noarch apparmor-profiles-3.0.1-1.2.noarch apparmor-rpm-macros-1.0-6.3.noarch apparmor-utils-3.0.1-1.2.noarch apparmor-utils-lang-3.0.1-1.2.noarch kernel-default-5.10.4-1.1.x86_64 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1180591] Display backlight stuck at 100%
by bugzilla_noreply＠suse.com 11 Jan '21

11 Jan '21

https://bugzilla.suse.com/show_bug.cgi?id=1180591 https://bugzilla.suse.com/show_bug.cgi?id=1180591#c8 --- Comment #8 from Maurizio Galli <maurizio.galli(a)gmail.com> --- (In reply to Takashi Iwai from comment #7) > Thanks. Judging from the given information, it's nouveau and the backlight > is controlled solely via ACPI video driver. It's a bit surprising that the > control doesn't take any effect in ACPI while it's exposed... > Actually I'm using the nvidia proprietary driver. Should I try nouveu drivers first? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1169874] [Build 20200417] Failure to boot due to resume=/dev/disk/by-path
by bugzilla_noreply＠suse.com 11 Jan '21

11 Jan '21

https://bugzilla.suse.com/show_bug.cgi?id=1169874 https://bugzilla.suse.com/show_bug.cgi?id=1169874#c32 --- Comment #32 from Fabian Vogt <fvogt(a)suse.com> --- (In reply to Fabian Vogt from comment #29) > Created attachment 844914 [details] > YaST logs (patched Kernel.rb, still no resume=) > > I patched Kernel.propose_hibernation? to log "prop hiber" on entry and > "returning true" on exit, and only the entry is logged: > > 2021-01-07 05:50:26 <2> g149(9912) [Ruby] > modules/Kernel.rb(propose_hibernation?):559 prop hiber > 2021-01-07 05:50:26 <1> g149(9912) [Ruby] proposal/space_maker.rb(block in > provide_space):84 No need to find a fit for this partition, it will reuse > /dev/vda3: #<Y2Storage::Planned::Partition mount_point=swap, > reuse_name=/dev/vda3, reuse_sid=46, min_size=0 B, max_size=2 GiB, disk=nil, > max_start_offset=nil, subvolumes=[]> > > I did another try with also patching out the product features condition and > then resume= appeared in the cmdline. Had another look, the bug hid in plain sight: @defaults has "propose_hibernate" => true but it's actually called "propose_hibernation"! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173726] mpv/smplayer unable to play videos over samba share
by bugzilla_noreply＠suse.com 11 Jan '21

11 Jan '21

https://bugzilla.suse.com/show_bug.cgi?id=1173726 https://bugzilla.suse.com/show_bug.cgi?id=1173726#c6 --- Comment #6 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-RU-2021:0044-1: An update that has one recommended fix can now be installed. Category: recommended (moderate) Bug References: 1173726 CVE References: JIRA References: Sources used: openSUSE Leap 15.2 (src): mpv-0.32.0+git.20200301T004003.e7bab0025f-lp152.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1169614] AUDIT-0: cockpit: setuid, dbus, pam
by bugzilla_noreply＠suse.com 11 Jan '21

11 Jan '21

https://bugzilla.suse.com/show_bug.cgi?id=1169614 https://bugzilla.suse.com/show_bug.cgi?id=1169614#c21 --- Comment #21 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0045-1: An update that contains security fixes can now be installed. Category: security (moderate) Bug References: 1169614 CVE References: JIRA References: Sources used: openSUSE Leap 15.1 (src): rpmlint-1.10-lp151.9.12.1, rpmlint-mini-1.10-lp151.5.19.2, rpmlint-tests-84.87+git20181018.60e0249-lp151.9.12.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1180764] VUL-1: CVE-2020-26262: coturn: malicious user is able to relay packets to the loopback interface, unless --denied-peer-ip (or similar) has been specified
by bugzilla_noreply＠suse.com 11 Jan '21

11 Jan '21

https://bugzilla.suse.com/show_bug.cgi?id=1180764 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1180740] New: [Build 20210108] rubygem-nokogiri - dangling symlinks?
by bugzilla_noreply＠suse.com 11 Jan '21

11 Jan '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1180740 Bug ID: 1180740 Summary: [Build 20210108] rubygem-nokogiri - dangling symlinks? Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/1581925/modules/upda te_alternatives/steps/12 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Ruby Assignee: ruby-devel(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: openQA Blocker: Yes ## Observation openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-extra_tests_transactional_server@64bit fails in [update_alternatives](https://openqa.opensuse.org/tests/1581925/modules/upda… This is the first snapshot with rubygem-nokogiri 1.11.0 ## Test suite description test transactional server. Maintainer: Zaoliang Luo <zluo(a)suse.com> ## Reproducible Fails since (at least) Build [20210108](https://openqa.opensuse.org/tests/1581118) ## Expected result Last good: [20210107](https://openqa.opensuse.org/tests/1579287) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1180693] Regression: snd_hda_intel does not detect headphones on front panel
by bugzilla_noreply＠suse.com 11 Jan '21

11 Jan '21

https://bugzilla.suse.com/show_bug.cgi?id=1180693 https://bugzilla.suse.com/show_bug.cgi?id=1180693#c11 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |WONTFIX Flags|needinfo?(vaniaz(a)msn.com) | --- Comment #11 from Takashi Iwai <tiwai(a)suse.com> --- OK, let's close now. Feel free to reopen if you find something new. Thanks. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1180591] Display backlight stuck at 100%
by bugzilla_noreply＠suse.com 11 Jan '21

11 Jan '21

https://bugzilla.suse.com/show_bug.cgi?id=1180591 https://bugzilla.suse.com/show_bug.cgi?id=1180591#c7 --- Comment #7 from Takashi Iwai <tiwai(a)suse.com> --- Thanks. Judging from the given information, it's nouveau and the backlight is controlled solely via ACPI video driver. It's a bit surprising that the control doesn't take any effect in ACPI while it's exposed... Maybe narrowing the regression range might help. There are many kernel packages available in my OBS repo, e.g. home:tiwai:kernel:5.4, home:tiwai:kernel:5.5, etc. Could you try installing those old kernels one by one, and check which kernel started showing the bad behavior? Before testing that, it would be safer to increase the number of installable kernels in /etc/zypp/zypp.conf. Edit the file and add more entries in the line defining "multiversion.kernels". -- You are receiving this mail because: You are on the CC list for the bug.

1 0