April 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1208394] AUDIT-0: ruby3.1-rubygem-d-installer: follow-up audit of D-Bus setup (separate D-Bus design)
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1208394 https://bugzilla.suse.com/show_bug.cgi?id=1208394#c6 Matthias Gerstner <matthias.gerstner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CONFIRMED Assignee|security-team(a)suse.de |matthias.gerstner(a)suse.com --- Comment #6 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- I will work on this now. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1209338] AUDIT-0: mumble: review of D-Bus service net.sourceforge.mumble.murmur
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209338 https://bugzilla.suse.com/show_bug.cgi?id=1209338#c4 Matthias Gerstner <matthias.gerstner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CONFIRMED |IN_PROGRESS --- Comment #4 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- I'm mostly finished with the review. So in the outset things look not too bad: - the service runs as non-root as user _mumble-server and has no special privileges. - the system wide config file is owned and controlled only by root. - the code shows that the author(s) have some understanding of system programming and thus also some awareness of security topics. - the code is a bit hard to read due to a lot of platform specific #ifdefs. - there's a possibility to pass a mumble "superuser password" to the server via a command line parameter, which is unsafe, because the command line can be read by all other users in the system. This is only one option though, there's also an approach to pass it to mumble-server's stdin. - SSL is used for the network communication. I did not look more closely into this aspect, since this bug is about the D-Bus component of the program. - The D-Bus interface is not enabled by default and if it is enabled then it suggests running on the session bus instead of on the system bus. - The D-Bus service component does not implement authorization checks. The provided methods allow retrieving a lot of data and also manipulating the runtime state of the server, partly directly operating on a SQL database backend. - Due to the latter it is not really a good idea to run this service on the system bus. Any user in the system would be able to mess with mumble-server. It turns out that the use case for running this D-Bus service on the system bus is unclear. Even more so, the D-Bus configuration file will never work, because it uses a wrong username. I have created an issue upstream to understand better what the purpose of the system wide D-Bus service should be: https://github.com/mumble-voip/mumble/issues/6098 At the moment my suggestion is *not* to whitelist this configuration, because it is broken, seemingly unnecessary and if used it would be rather worrying security wise. You can continue packaging this update by simply deleting the D-Bus configuration from the package. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208462] NetworkManager, bridge reconnection fails
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1208462 https://bugzilla.suse.com/show_bug.cgi?id=1208462#c11 --- Comment #11 from Episteme PROMENEUR <epistemepromeneur(a)free.fr> --- I disabled the automatic connection for the bridge. Only the slave gets an automatic connection. There is no more problem. For a non-techie person, all the good parameters must be set by default when creating a bridge. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1210085] New: systemd-networkd: wireguard device no longer properly setup when using dracut-sshd
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1210085 Bug ID: 1210085 Summary: systemd-networkd: wireguard device no longer properly setup when using dracut-sshd Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- the server is boosted via dracut-sshd to unlock the encrypted root device. during that phase the setup of the wireguard devices fails with ``` Apr 03 12:37:16 fortizar systemd-networkd[687]: wg_darix: netdev could not be created: Operation not supported ``` though after the initrd is done and the normal system the devices are not being tried to set up again. a simple `networkctl reconfigure wg_darix` after logging in per ssh fixes it. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1146936] New: nmcli-examples: add examples of bonding + vlan + bridge
by bugzilla_noreply＠novell.com 04 Apr '23

04 Apr '23

http://bugzilla.suse.com/show_bug.cgi?id=1146936 Bug ID: 1146936 Summary: nmcli-examples: add examples of bonding + vlan + bridge Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: william.brown(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Configuring a bond + vlan + bridge is not completely straightforward or clear with nmcli. An example should be added such as: nmcli conn add type bond con-name bond0 ifname bond0 mode 802.3ad ipv4.method disabled ipv6.method ignore nmcli connection add type ethernet con-name bond0-eth1 ifname eth1 master bond0 slave-type bond nmcli connection add type ethernet con-name bond0-eth2 ifname eth2 master bond0 slave-type bond nmcli connection add type bridge con-name net_18 ifname net_18 ipv4.method disabled ipv6.method ignore nmcli connection add type vlan con-name bond0.18 ifname bond0.18 dev bond0 id 18 master net_18 slave-type bridge This is suitable for libvirt/vms to use the bridges. -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1176818] New: Wrong public keys in openSUSE-build-key for verifying container image signatures
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1176818 Bug ID: 1176818 Summary: Wrong public keys in openSUSE-build-key for verifying container image signatures Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: meissner(a)suse.com Reporter: rhafer(a)suse.com QA Contact: qa-bugs(a)suse.de CC: sgrunert(a)suse.com Found By: --- Blocker: --- The openSUSE-build-keys package contains /usr/lib/rpm/gnupg/keys/opensuse-container-key.asc and /usr/lib/rpm/gnupg/keys/suse-container-key.asc which symlink to the "openSUSE Project Signing Key <opensuse(a)opensuse.org>" and "SuSE Package Signing Key <build(a)suse.de>" but apparently the images we provide on registry.opensuse.org are signed by some other key. When enabling signature verification for "registry.opensuse.org" using the key "/usr/lib/rpm/gnupg/keys/opensuse-container-key.asc" all images fail to verify because the images are signed with a different key. Looking into the signatures, which are fetched from "https://registry.opensuse.org/sigstore/" it seem the images are signed by a key with the ID "D754694F9AB48CE9". The key in /usr/lib/rpm/gnupg/keys/opensuse-container-key.asc however AFAICS is: "B88B2FD43DBDC284". So something is wrong here. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1210071] yast2 crash - no qt platform plugin initialized
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1210071 https://bugzilla.suse.com/show_bug.cgi?id=1210071#c1 Stefan Hundhammer <shundhammer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |INVALID --- Comment #1 from Stefan Hundhammer <shundhammer(a)suse.com> --- If you don't install the needed components for a GUI, you don't get a GUI. The log messages tell you that. And no, we are not optimizing for the pathological case. If you choose not to install any of those libs, you should know what you can expect and what you can't. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1205664] Lack of gdm-fingerprint PAM file.
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1205664 https://bugzilla.suse.com/show_bug.cgi?id=1205664#c5 --- Comment #5 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-RU-2023:1742-1: An update that contains one feature and has one recommended fix can now be installed. Category: recommended (moderate) Bug References: 1205664 Jira References: PED-1719 Sources used: openSUSE Leap 15.4 (src): gdm-41.3-150400.4.6.1 Desktop Applications Module 15-SP4 (src): gdm-41.3-150400.4.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1209985] Secure boot violation
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209985 https://bugzilla.suse.com/show_bug.cgi?id=1209985#c20 --- Comment #20 from Julia Faltenbacher <julia.faltenbacher(a)suse.com> --- [in reply to #15] blkid /dev/mapper/system-swap: UUID="e2a1b8f2-6926-47ff-bca1-177fe34f2b3c" TYPE="swap" /dev/nvme0n1p1: UUID="2AF2-E83C" BLOCK_SIZE="512" TYPE="vfat" PARTUUID="a6944199-4d90-4c5a-a920-70181216dea6" /dev/nvme0n1p2: UUID="365c60cb-ac6c-480f-9464-b62aedc54e03" TYPE="crypto_LUKS" PARTUUID="3565df54-e870-4c89-9c14-e0c5f1efd0fa" /dev/mapper/system-root: UUID="92760c3c-52e1-4cbb-9c64-2edc6f61cca6" UUID_SUB="703838b9-9956-4203-a23a-298ac11ea0f0" BLOCK_SIZE="4096" TYPE="btrfs" /dev/mapper/cr_nvme-WDC_PC_SN530_SDBPMPZ-512G-1001_21023T470222-part2: UUID="fcKmkV-QD9d-gfGU-kyaG-S7l6-iNAM-IBLmfF" TYPE="LVM2_member" lsblk -f NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS nvme0n1 �� nvme0n1p1 �� vfat FAT32 2AF2-E83C 504.6M 1% /boot/efi ��nvme0n1p2 crypto 1 365c60cb-ac6c-480f-9464-b62aedc54e03 ��cr_nvme-WDC_PC_SN530_SDBPMPZ-512G-1001_21023T470222-part2 LVM2_m LVM2 fcKmkV-QD9d-gfGU-kyaG-S7l6-iNAM-IBLmfF ��system-swap �� swap 1 e2a1b8f2-6926-47ff-bca1-177fe34f2b3c [SWAP] ��system-root btrfs 92760c3c-52e1-4cbb-9c64-2edc6f61cca6 136.5G 70% /var /usr/local /tmp /root /srv /opt /home /boot/grub2/x86_64-efi /boot/grub2/i386-pc /.snapshots -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1209656] New: gthumb displays thumbnails only on first 50 images
by bugzilla_noreply＠suse.com 04 Apr '23

04 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209656 Bug ID: 1209656 Summary: gthumb displays thumbnails only on first 50 images Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: heiko.rommel(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 865774 --> https://bugzilla.suse.com/attachment.cgi?id=865774&action=edit screenshot of gthumb not rendering all thumbnails I am using gthumb-3.12.0-bp154.1.118 from Main Repository. When using gthumb on large folders, only the first 50 images are rendered. See attached screenshot. How to reproduce: gthumb /usr/share/icons/gnome/32x32/apps/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1