August 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1200615] [Build 20220614] kde/live 32bit fails to unlock screensaver
by bugzilla_noreply＠suse.com 04 Aug '22

04 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1200615 https://bugzilla.suse.com/show_bug.cgi?id=1200615#c4 --- Comment #4 from openQA Review <openqa-review(a)suse.de> --- This is an autogenerated message for openQA integration by the openqa_review script: This bug is still referenced in a failing openQA test: kde-live@USBboot_aarch64-3G https://openqa.opensuse.org/tests/2491222#step/consoletest_finish/1 To prevent further reminder comments one of the following options should be followed: 1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted 2. The openQA job group is moved to "Released" or "EOL" (End-of-Life) 3. The bugref in the openQA scenario is removed or replaced, e.g. `label:wontfix:boo1234` Expect the next reminder at the earliest in 56 days if nothing changes in this ticket. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1160707] qemu VNC console corruption
by bugzilla_noreply＠suse.com 04 Aug '22

04 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1160707 https://bugzilla.suse.com/show_bug.cgi?id=1160707#c45 --- Comment #45 from openQA Review <openqa-review(a)suse.de> --- This is an autogenerated message for openQA integration by the openqa_review script: This bug is still referenced in a failing openQA test: qam_ha_hawk_haproxy_node01 https://openqa.suse.de/tests/9253099 To prevent further reminder comments one of the following options should be followed: 1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted 2. The openQA job group is moved to "Released" or "EOL" (End-of-Life) 3. The bugref in the openQA scenario is removed or replaced, e.g. `label:wontfix:boo1234` Expect the next reminder at the earliest in 176 days if nothing changes in this ticket. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1198978] New: Upgrade Leap 15.2->15.3 apparently incomplete
by bugzilla_noreply＠suse.com 03 Aug '22

03 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1198978 Bug ID: 1198978 Summary: Upgrade Leap 15.2->15.3 apparently incomplete Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Upgrade Problems Assignee: screening-team-bugs(a)suse.de Reporter: bryan.gartner(a)suse.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- For an existing instance of Leap 15.2, trying to migrate/upgrade to 15.3, following steps documented in https://en.opensuse.org/SDB:System_upgrade, e.g. zypper --releasever=15.3 dup --download-in-advance Once that completes and system is rebooted, this is still the case node:~> more /etc/os-release NAME="openSUSE Leap" VERSION="15.2" ID="opensuse-leap" ID_LIKE="suse opensuse" VERSION_ID="15.2" PRETTY_NAME="openSUSE Leap 15.2" ANSI_COLOR="0;32" CPE_NAME="cpe:/o:opensuse:leap:15.2" BUG_REPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org/" And this remains the same even after a follow-on of zypper ref; zypper patch ; reboot as well. -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1199253] New: VUL-0: CVE-2022-1053: keylime: Tenant and Verifier might not use the same registrar data
by bugzilla_noreply＠suse.com 03 Aug '22

03 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1199253 Bug ID: 1199253 Summary: VUL-0: CVE-2022-1053: keylime: Tenant and Verifier might not use the same registrar data Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/330814/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: aplanas(a)suse.com Reporter: cathy.hu(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- rh#2065024 Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an AK of a software TPM. Affects all versions of Keylime <6.4.0 References: https://bugzilla.redhat.com/show_bug.cgi?id=2065024 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1053 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1201385] AUDIT-0: postfix: review of permissions-file-setuid-bit: /usr/sbin/postlog (02755)
by bugzilla_noreply＠suse.com 03 Aug '22

03 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201385 http://bugzilla.opensuse.org/show_bug.cgi?id=1201385#c21 Christian Wittmer <chris(a)computersalat.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(dimstar@opensuse. | |org) --- Comment #21 from Christian Wittmer <chris(a)computersalat.de> --- (In reply to Dominique Leuenberger from comment #17) > @Christian, > > The build of postfix currently fails with: > > [ 132s] -------------------------------------------------------------------- > [ 132s] ERROR: chkstat --level secure modified package postfix > [ 132s] Please add '%verify(not mode,...) for those to avoid listings in > rpm -V. > [ 132s] diff for both runs of rpm -V: > [ 132s] --- //.build_rpmVp_orig 2022-08-01 13:44:14.812000000 +0000 > [ 132s] +++ //.build_rpmVp_easy 2022-08-01 13:44:14.876000000 +0000 > [ 132s] @@ -0,0 +1 @@ > [ 132s] +.M....G.. /usr/sbin/postlog > [ 132s] -------------------------------------------------------------------- > [ 132s] -------------------------------------------------------------------- > [ 132s] ERROR: chkstat --level paranoid modified package postfix > [ 132s] Please add '%verify(not mode,...) for those to avoid listings in > rpm -V. > [ 132s] diff for both runs of rpm -V: > [ 132s] --- //.build_rpmVp_orig 2022-08-01 13:44:14.812000000 +0000 > [ 132s] +++ //.build_rpmVp_paranoid 2022-08-01 13:44:14.932000000 +0000 > [ 132s] @@ -0,0 +1 @@ > [ 132s] +.M....G.. /usr/sbin/postlog > [ 132s] -------------------------------------------------------------------- > > And, indeed, /usr/sbin/postlog is not listed in the set_permissions and > verify_permissions scripts sections of postfix.spec, also the files section > does not correspond to this: > > i.e %post contains: > > %set_permissions %{_sbindir}/postqueue > %set_permissions %{_sbindir}/postdrop > %set_permissions %{_sysconfdir}/%{name}/sasl_passwd > %set_permissions %{_sbindir}/sendmail > > (missing /usr/sbin/postlog) > > %verifyscript is: > %verify_permissions -e %{_sbindir}/postqueue > %verify_permissions -e %{_sbindir}/postdrop > %verify_permissions -e %{_sysconfdir}/%{name}/sasl_passwd > %verify_permissions -e %{_sbindir}/sendmail > (again, missing postlog) > > and files section is > %attr(0755,root,root) %{_sbindir}/postlog > > lacking verify (not mode, group) as the mode is adjusted by the permissions > profile to 2755 and group changes to maildrop > > group is actually debatable why it should not be packaged as :maildrop' > directly, as all security profiles (easy,secure, paranoid) set that group > (rule is to set the rpm metadata to match the paranoid setting, i.e. > 32+/usr/sbin/postlog root:maildrop 0755 > > Hope that helps @dimstar those above mentioned missings are needed with the new 3.7.x version which is prepared here already: https://build.opensuse.org/package/rdiff/home:computersalat:devel:mail/post… So when the permissions package is updated and available for 15.3 and 15.4 (as it seems to be with comment #19 and #20) the SR here: https://build.opensuse.org/request/show/989467 can be accepted ... if you agree. Thank you :-) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1199734] Cannot join windows domain with YaST
by bugzilla_noreply＠suse.com 03 Aug '22

03 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1199734 https://bugzilla.suse.com/show_bug.cgi?id=1199734#c20 --- Comment #20 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2022:2659-1: An update that solves 5 vulnerabilities and has 6 fixes is now available. Category: security (important) Bug References: 1196224,1198255,1199247,1199734,1200556,1200964,1201490,1201492,1201493,1201495,1201496 CVE References: CVE-2022-2031,CVE-2022-32742,CVE-2022-32744,CVE-2022-32745,CVE-2022-32746 JIRA References: Sources used: openSUSE Leap 15.4 (src): ldb-2.4.3-150400.4.8.1, samba-4.15.8+git.500.d5910280cc7-150400.3.11.1 SUSE Linux Enterprise Module for Basesystem 15-SP4 (src): ldb-2.4.3-150400.4.8.1, samba-4.15.8+git.500.d5910280cc7-150400.3.11.1 SUSE Linux Enterprise High Availability 15-SP4 (src): samba-4.15.8+git.500.d5910280cc7-150400.3.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1196224] User Kerberos Tickets are not refresh or get destroyed after Update to samba 4.15.4
by bugzilla_noreply＠suse.com 03 Aug '22

03 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1196224 https://bugzilla.suse.com/show_bug.cgi?id=1196224#c22 --- Comment #22 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2022:2659-1: An update that solves 5 vulnerabilities and has 6 fixes is now available. Category: security (important) Bug References: 1196224,1198255,1199247,1199734,1200556,1200964,1201490,1201492,1201493,1201495,1201496 CVE References: CVE-2022-2031,CVE-2022-32742,CVE-2022-32744,CVE-2022-32745,CVE-2022-32746 JIRA References: Sources used: openSUSE Leap 15.4 (src): ldb-2.4.3-150400.4.8.1, samba-4.15.8+git.500.d5910280cc7-150400.3.11.1 SUSE Linux Enterprise Module for Basesystem 15-SP4 (src): ldb-2.4.3-150400.4.8.1, samba-4.15.8+git.500.d5910280cc7-150400.3.11.1 SUSE Linux Enterprise High Availability 15-SP4 (src): samba-4.15.8+git.500.d5910280cc7-150400.3.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202121] New: MicroOS Snapshot20220801 kwrite missing KDE-specific features and icons when ran from Toolbox or Flatpak
by bugzilla_noreply＠suse.com 03 Aug '22

03 Aug '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1202121 Bug ID: 1202121 Summary: MicroOS Snapshot20220801 kwrite missing KDE-specific features and icons when ran from Toolbox or Flatpak Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: MicroOS Assignee: kubic-bugs(a)opensuse.org Reporter: jared.hudson(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 860587 --> http://bugzilla.opensuse.org/attachment.cgi?id=860587&action=edit Comparing kwrite in toolbox vs kwrite on MicroOS host I installed MicroOS Snapshot20220801 as a KVM VM and picked the KDE Desktop installation pattern. kwrite was not installed by default so I went looking for what my options are. I could run sudo transactional-update pkg install kwrite but that would require a reboot which seems quite extreme just to get an editor. I referred to the documentation https://en.opensuse.org/Portal:MicroOS/Desktop#Installation:_KDE which recommends flatpak or Toolbox or Distrbox. I ran toolbox enter. This required downloading several container blobs which could be an issue for air-gapped systems or people with constrained bandwidth. This is a negative compared to traditional Leap or even Tumbleweed ISO which includes most required packaged on the ISO. I ran sudo zypper ref && sudo zypper dup - No additional packages downloaded. I ran sudo zypper install adwaita-icon-theme xorg-x11-fonts libX11-xcb1 gsettings-desktop-schemas gdk-pixbuf-query-loaders which required installing 17 packages. (from https://en.opensuse.org/Portal:MicroOS/Desktop#Installation:_KDE) I ran sudo gdk-pixbuf-query-loaders-64 --update-cache as instructed from https://en.opensuse.org/Portal:MicroOS/Desktop#Installation:_KDE which produced the error "Failed to create file ��/usr/lib64/gdk-pixbuf-2.0/2.10.0/loaders.cache.3JKAQ1��: No such file or directory" /usr/lib64/gdk-pixbuf-2.0 is not included in the "toolbox enter" container. I then ran sudo zypper -n in kwrite which wanted to install 177 new packages. All of those packages were already installed on my MicroOS host. Re-downloading these packages wastes disk space and bandwidth. Once done I ran kwrite. It doesn't look or behave like a normal KDE Kwrite does from Leap, Tumbleweed or even if I had installed Kwrite in the MicroOS host and rebooted. Here's a list of differences: There are no icons for menu items. I'll attach a screenshot illustrating the difference between toolbox vs MicroOS host version. I did eventually install on the host and reboot in order to write this bug report and compare/contrast differences. The open dialog is missing KDE features. I'll attach screenshot to illustrate. On the left of the Open Dialog there's only Computer and jhhudso, it looks like a KDE application from several years ago. Whereas a modern KDE application has a set of "Places" like Home, Desktop, Documents, Downloads. It also normally has a set of Devices such as your disk, USB devices plugged, etc. The toolbox version of kwrite is missing all of this. I have no way to mount or unmount a USB stick via the Open dialog of the toolbox kwrite. The Kwrite Settings/Configure menu is missing icons above the words Appearance, Color Themes, Editing and Open/Save. The Save/Save As dialog is missing the KDE ability to save to a Network share. When Kwrite is run from the host instead of toolbox, it has the ability to utilize Network resources such as Bluetooth, MTP Devices and Shared Folders (SMB). You can save to a URL in the host-based version such as smb://192.168.1.7/username/ but that functionality is missing from toolbox version. The toolbox version uses a lot more memory than the host based version. As reported by pmap -X, the toolbox version uses 133 MiB (PSS) out of 138 MiB (RSS). Whereas the host version, uses only 33 MiB (PSS) out of 122 MiB (RSS). Most libraries kwrite depends on are already loaded in memory. To try flatpak I ran flatpak remote-add --user --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo flatpak search kwrite flatpak install kwrite It gives the error: F: An error was encountered searching remote ��flathub�� for ��kwrite��: Unable to load summary from remote flathub: GPG verification enabled, but no summary found (check that the configured URL in remote config is correct) Found ref ��app/org.kde.kwrite/x86_64/stable�� in remote ��flathub�� (system). Use this ref? [Y/n]: y After installing I ran with flatpak run org.kde.kwrite. Visually the flatpak version looks the same as the host based version which is good. There are icons, theme is correct, Settings/Configure has icons as well. The Host and Flatpak versions are not able to open the Kwrite Handbook, Report Bug Wizard or Donate (options from Help) without being told who handles https. The toolbox version doesn't give a pop-up option of who handles https and only prints to the console "Unable to detect a web browser to launch 'https://docs.kde.org.....' The flatpak version of kwrite uses more memory than the host similar to this issue in the Toolbox. As reported by pmap -X, the flatpak version uses 137 MiB (PSS) out of 218 MiB (RSS). -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1201552] os-autoinst-devel fails to upgrade with "the to be installed os-autoinst-devel-4.6.1639403953.ae94c4bd-bp154.1.137.x86_64 requires 'pkgconfig(opencv)'"
by bugzilla_noreply＠suse.com 03 Aug '22

03 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1201552 https://bugzilla.suse.com/show_bug.cgi?id=1201552#c3 Oliver Kurz <okurz(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #3 from Oliver Kurz <okurz(a)suse.com> --- Seems to be all good now -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1194605] python3 leaks strict compiler flags into user packages via sysconfig
by bugzilla_noreply＠suse.com 03 Aug '22

03 Aug '22

https://bugzilla.suse.com/show_bug.cgi?id=1194605 https://bugzilla.suse.com/show_bug.cgi?id=1194605#c4 --- Comment #4 from Matthias Koeppe <matthiaskoeppe(a)gmail.com> --- Let me bump this up. python3 on tumbleweed is still broken. There is now improved documentation, both in CPython and in setuptools. - https://docs.python.org/3/using/configure.html#envvar-CFLAGS_NODIST - https://docs.python.org/3/using/configure.html#envvar-LDFLAGS_NODIST - https://setuptools.pypa.io/en/latest/userguide/ext_modules.html#compiler-an… -- You are receiving this mail because: You are on the CC list for the bug.

1 0