October 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1202059] AUDIT-0: ruby3.1-rubygem-d-installer: review of D-Bus services org.opensuse.DInstaller (and friends)
by bugzilla_noreply＠suse.com 10 Oct '22

10 Oct '22

https://bugzilla.suse.com/show_bug.cgi?id=1202059 https://bugzilla.suse.com/show_bug.cgi?id=1202059#c11 --- Comment #11 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- (In reply to igonzalezsosa(a)suse.com from comment #10) > > The D-Bus interface looks pretty large and dynamic. Since this is for > > installing Linux onto the host the security posture for it probably will be > > different than for regular D-Bus services. The clients of this D-Bus service > > will have root-like power, if I am not mistaken, because they will be able to > > trigger the installation of the system. Am I correct in this? > > Yes, you are correct about this. It is expected to be used as root in the installation media only. So the *service* runs as root or also the *clients* ? If the clients are also root-only then you could change the D-Bus configuration in /etc/dbus-1/system.d/org.opensuse.DInstaller.conf so that only root is able to access the interface. Then this would not require further review. > OK, understood. We are moving this file to /usr/share/dbus-1/system.d. See https://github.com/yast/d-installer/pull/254. great! > > $ gdbus introspect -y -d org.opensuse.DInstaller -o > > /org/opensuse/DInstaller/Manager1 > > Error: GDBus.Error:org.freedesktop.DBus.Error.InvalidArgs: Unit name > > d-installer is not valid. > > Are you trying the service on an already installed system? In the installation media it seems to work, but I will have a look. Yes I tested in on a current Tumbleweed installation. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204085] spice-vdagentd 0.22.1 doesn't work properly on guest
by bugzilla_noreply＠suse.com 10 Oct '22

10 Oct '22

https://bugzilla.suse.com/show_bug.cgi?id=1204085 Charles Arnold <carnold(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|virt-bugs(a)suse.de |carnold(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1203133] py2pack generate fails with " TypeError: unsupported operand type(s) for +: 'generator' and 'list"
by bugzilla_noreply＠suse.com 10 Oct '22

10 Oct '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1203133 http://bugzilla.opensuse.org/show_bug.cgi?id=1203133#c2 --- Comment #2 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1203133) was mentioned in https://build.opensuse.org/request/show/1009359 Backports:SLE-15-SP3 / python-py2pack -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204134] New: [Build 20221006] openQA test fails in ioctl03: LTP fails with kernel 6.0
by bugzilla_noreply＠suse.com 10 Oct '22

10 Oct '22

https://bugzilla.suse.com/show_bug.cgi?id=1204134 Bug ID: 1204134 Summary: [Build 20221006] openQA test fails in ioctl03: LTP fails with kernel 6.0 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/2782139/modules/ioct l03/steps/7 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: petr.vorel(a)suse.com Reporter: fvogt(a)suse.com QA Contact: qa-bugs(a)suse.de CC: chrubis(a)suse.com Found By: openQA Blocker: Yes ## Observation openQA test in scenario opensuse-Tumbleweed-JeOS-for-kvm-and-xen-x86_64-jeos-ltp-syscalls@uefi_virtio-2G fails in [ioctl03](https://openqa.opensuse.org/tests/2782139/modules/ioctl03/steps/7) tst_test.c:1526: TINFO: Timeout per run is 0h 00m 30s ioctl03.c:76: TINFO: Available features are: 0x7173 ioctl03.c:80: TPASS: TUN 0x1 ioctl03.c:80: TPASS: TAP 0x2 ioctl03.c:80: TPASS: NO_PI 0x1000 ioctl03.c:80: TPASS: ONE_QUEUE 0x2000 ioctl03.c:80: TPASS: VNET_HDR 0x4000 ioctl03.c:80: TPASS: MULTI_QUEUE 0x100 ioctl03.c:80: TPASS: IFF_NAPI 0x10 ioctl03.c:80: TPASS: IFF_NAPI_FRAGS 0x20 ioctl03.c:85: TFAIL: (UNKNOWN 0x40) ## Test suite description ## Reproducible Fails since (at least) Build [20220922](https://openqa.opensuse.org/tests/2724512) ## Expected result Last good: [20220921](https://openqa.opensuse.org/tests/2717010) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1201348] [Build 20220708] [SELinux] Upgrading Tumbleweed fails due to SELinux package issues
by bugzilla_noreply＠suse.com 10 Oct '22

10 Oct '22

https://bugzilla.suse.com/show_bug.cgi?id=1201348 https://bugzilla.suse.com/show_bug.cgi?id=1201348#c16 --- Comment #16 from Johannes Segitz <jsegitz(a)suse.com> --- Upstream is unwilling to add the necessary changes. I'll discuss this with the SELinux group how to proceed here -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1200673] New: [SELinux] dnsmasq: failed to create inotify for /etc/resolv.conf: Permission denied (when starting virtual network default)
by bugzilla_noreply＠suse.com 10 Oct '22

10 Oct '22

https://bugzilla.suse.com/show_bug.cgi?id=1200673 Bug ID: 1200673 Summary: [SELinux] dnsmasq: failed to create inotify for /etc/resolv.conf: Permission denied (when starting virtual network default) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mcepl(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This is actually probably just a duplicate of the Red Hat bug https://bugzilla.redhat.com/show_bug.cgi?id=1453114, with SELinux Enforcing on openSUSE/Tumbleweed (yes, that's my adrenalin sport) I cannot start default virtual network: I get this in the log: stitny:~ # ausearch -m avc -m user_avc -m selinux_err -m user_selinux_err -i -ts today|grep dns type=AVC msg=audit(06/18/22 11:38:45.958:193) : avc: denied { watch } for pid=6907 comm=dnsmasq path=/run/netconfig dev="tmpfs" ino=1685 scontext=system_u:system_r:dnsmasq_t:s0-s0:c0.c1023 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir permissive=0 type=AVC msg=audit(06/18/22 11:41:23.686:258) : avc: denied { watch } for pid=7922 comm=dnsmasq path=/run/netconfig dev="tmpfs" ino=1685 scontext=system_u:system_r:dnsmasq_t:s0-s0:c0.c1023 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir permissive=0 type=AVC msg=audit(06/18/22 11:43:34.664:308) : avc: denied { watch } for pid=8218 comm=dnsmasq path=/run/netconfig dev="tmpfs" ino=1685 scontext=system_u:system_r:dnsmasq_t:s0-s0:c0.c1023 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir permissive=1 stitny:~ # Using libvirt-glib-1_0-0-4.0.0-1.8.x86_64 libvirt-libs-8.4.0-1.1.x86_64 libvirt-daemon-qemu-8.4.0-1.1.x86_64 libvirt-client-8.4.0-1.1.x86_64 selinux-policy-20220124-3.4.noarch libvirt-daemon-8.4.0-1.1.x86_64 dnsmasq-2.86-4.3.x86_64 -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1195904] New: SELinux: targeted: ssh violation
by bugzilla_noreply＠suse.com 10 Oct '22

10 Oct '22

https://bugzilla.suse.com/show_bug.cgi?id=1195904 Bug ID: 1195904 Summary: SELinux: targeted: ssh violation Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: okir(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The following happens with the SELinux packages from MicroOS 5.1 on SLES15SP3. User "testuser" has been assigned SELinux user user_u and attempts to log in via ssh, using key authentication TEST: verify that the SSH key we generated can be used for authentication == Authorizing ssh key id_rsa == client: echo $HOME; user=testuser client: downloading /home/testuser/.ssh/id_rsa.pub server: mkdir -m 0755 -p ~/.ssh; user=testuser server: uploading data to /home/testuser/.ssh/authorized_keys client: ssh -oStrictHostKeyChecking=no server true; user=testuser Warning: Permanently added 'server,192.168.121.205' (ECDSA) to the list of known hosts. Failing: server: SELinux policy violation server: by systemd (pid=4281; context=user_u:user_r:user_t:s0; permissive=1) server: create access to dir inaccessible (dev=None; ino=None; context=system_u:object_r:user_tmp_t:s0) server: create access to file reg (dev=None; ino=None; context=system_u:object_r:user_tmp_t:s0) server: create access to fifo_file fifo (dev=None; ino=None; context=system_u:object_r:user_tmp_t:s0) server: create access to sock_file sock (dev=None; ino=None; context=system_u:object_r:user_tmp_t:s0) server: create access to lnk_file .#invocation:dbus.socketbf6abda56b666fe5 (dev=None; ino=None; context=system_u:object_r:user_tmp_t:s0) OK, RSA key authentication seems to work FAIL: server: SELinux policy violation -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1202571] kernel 5.19.1 shuts down after waking from suspend
by bugzilla_noreply＠suse.com 10 Oct '22

10 Oct '22

https://bugzilla.suse.com/show_bug.cgi?id=1202571 https://bugzilla.suse.com/show_bug.cgi?id=1202571#c6 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #6 from Takashi Iwai <tiwai(a)suse.com> --- OK, then let's close the bug. Feel free to reopen if you still encounters the problem again. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204172] kernel crash in drm ( [Build 20221010-1] openQA test fails in updates_packagekit_gpk )
by bugzilla_noreply＠suse.com 10 Oct '22

10 Oct '22

https://bugzilla.suse.com/show_bug.cgi?id=1204172 https://bugzilla.suse.com/show_bug.cgi?id=1204172#c5 --- Comment #5 from Marcus Meissner <meissner(a)suse.com> --- actually it is 15.3 with the SLE15-SP3 kernel. bug open seleected the wrong opensuse -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204172] kernel crash in drm ( [Build 20221010-1] openQA test fails in updates_packagekit_gpk )
by bugzilla_noreply＠suse.com 10 Oct '22

10 Oct '22

https://bugzilla.suse.com/show_bug.cgi?id=1204172 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|Leap 42.3 |Leap 15.3 -- You are receiving this mail because: You are on the CC list for the bug.

1 0