April 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1209985] Secure boot violation
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209985 https://bugzilla.suse.com/show_bug.cgi?id=1209985#c17 --- Comment #17 from Fabian Vogt <fvogt(a)suse.com> --- (In reply to Andrei Borzenkov from comment #16) > Oh, and what is the actual error in the first place? We may be facing > entirely different issue here. I made a screenshot of the initial error with verbose shim boot enabled. The main messages were: shim.sle, 1, ..., 15.4, mail:security-team@suse.de ... component shim, generation 1, was revoked by SbatLevel variable Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation Question is how the new shim was installed and executed at least once and later the old one took over again, from some mystery location. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1208943] New: intel compute driver aka intel-opencl
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1208943 Bug ID: 1208943 Summary: intel compute driver aka intel-opencl Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 3rd Party Driver Assignee: gfx-bugs(a)suse.de Reporter: dani.mackiol(a)web.de QA Contact: sndirsch(a)suse.com Found By: --- Blocker: --- Hallo, is it possible to update the intel driver to the latest version? So that the new Intel Arc cards are supported with kernel 6.2. igc ( intel-graphic-compiler) is necessary. I try to compile it myself in OBS, but fail with error messages. Even Blender refuses to work with reference to the old module: linux driver version xx.xx.23904 or newer. currently is version 23.05.25593. Thanks -- You are receiving this mail because: You are on the CC list for the bug.

1 19

[Bug 1209985] Secure boot violation
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209985 https://bugzilla.suse.com/show_bug.cgi?id=1209985#c16 --- Comment #16 from Andrei Borzenkov <arvidjaar(a)gmail.com> --- Oh, and what is the actual error in the first place? We may be facing entirely different issue here. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1209985] Secure boot violation
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209985 https://bugzilla.suse.com/show_bug.cgi?id=1209985#c15 --- Comment #15 from Andrei Borzenkov <arvidjaar(a)gmail.com> --- And to add to the last comment Output of "blkid" and ""lsblk -f" would be useful What is the content of /sys/firmware/efi/efivars/SbatLevelRT-605dab50-e046-4300-abb6-3dd810dd8b23 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1209985] Secure boot violation
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209985 https://bugzilla.suse.com/show_bug.cgi?id=1209985#c14 --- Comment #14 from Fabian Vogt <fvogt(a)suse.com> --- > BootOrder: 0001,0000,0010,0011,0012,0013,0014,0017,0018,0019,001A,001B,001C,001D > Boot0000* opensuse-secureboot HD(1,GPT,3fe41252-3fdc-476c-9520-034fd1bef10f,0x800,0x100000)/File(\EFI\opensuse\shim.efi) > Boot0001* opensuse-secureboot HD(1,GPT,a6944199-4d90-4c5a-a920-70181216dea6,0x800,0x100000)/File(\EFI\opensuse\shim.efi) That looks a bit suspicious - why two entries with different partition GUID if there is only one ESP? lsblk says: nvme0n1 259:0 0 476.9G 0 disk ��nvme0n1p1 259:1 0 512M 0 part /boot/efi ��nvme0n1p2 259:2 0 476.4G 0 part ��cr_nvme-WDC_PC_SN530_SDBPMPZ-512G-1001_21023T470222-part2 254:0 0 476.4G 0 crypt ��system-swap 254:1 0 14.9G 0 lvm [SWAP] ��system-root 254:2 0 461.6G 0 lvm /var ... sgdisk --print /dev/nvme0n1 -i 1 says: Disk /dev/nvme0n1: 1000215216 sectors, 476.9 GiB Model: WDC PC SN530 SDBPMPZ-512G-1001 Sector size (logical/physical): 512/512 bytes Disk identifier (GUID): 7C56EC3D-4445-4A0C-999A-40FA74E15942 ... Number Start (sector) End (sector) Size Code Name 1 2048 1050623 512.0 MiB EF00 2 1050624 1000215182 476.4 GiB 8E00 Partition GUID code: C12A7328-F81F-11D2-BA4B-00A0C93EC93B (EFI system partition) Partition unique GUID: A6944199-4D90-4C5A-A920-70181216DEA6 First sector: 2048 (at 1024.0 KiB) Last sector: 1050623 (at 513.0 MiB) Partition size: 1048576 sectors (512.0 MiB) Attribute flags: 0000000000000000 Partition name: '' so Boot0001 has the right GUID and is also the first in the BootOrder, so it should work. Question is where this weird Boot0000 is coming from. lsblk doesn't show any other block devices which might host another ESP. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1209985] New: Secure boot violation
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1209985 Bug ID: 1209985 Summary: Secure boot violation Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: screening-team-bugs(a)suse.de Reporter: nwr10cst-oslnx(a)yahoo.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Build Identifier: Booting today, I got a message: Something has gone wrong. Security violation. It mentioned "shim", so I assume it was problem with validating "shim.efi". The message goes past very quickly, so it is hard to get the exact wording. After that it shuts the system down. Microsoft Windows 8.1 still boots normally. However, I get this failure with both the Tumbleweed/openSUSE shim and with Leap/SUSE shim. Earlier today, I booted to Tumbleweed. That boot used the shim from Leap 15.4. I then updated Tumbleweed (previous update was 2 weeks earlier). On rebooting after that update, I ran into this problem. I'm suspecting that something happened during the update to cause this -- perhaps NVRAM corruption. But that's only a guess. Disabling secure-boot allows me to use the system again. Looking at various keys with "mokutil", I cannot see anything with a date that expires today. The problem might be hardware dependent. Secure-boot works as expected in a KVM virtual machine. Reproducible: Always -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1208462] NetworkManager, bridge reconnection fails
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1208462 https://bugzilla.suse.com/show_bug.cgi?id=1208462#c9 --- Comment #9 from Jonathan Kang <songchuan.kang(a)suse.com> --- It seems that you need activate the slaved connection as well. This isn't well documented by NetworkManager. But the following wiki does indicate this is needed. > $ nmcli connection up bridge-br0 > $ nmcli connection up bridge-slave-enp30s0 * https://wiki.archlinux.org/title/network_bridge#With_NetworkManager -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1209985] Secure boot violation
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1209985 https://bugzilla.suse.com/show_bug.cgi?id=1209985#c13 --- Comment #13 from Julia Faltenbacher <julia.faltenbacher(a)suse.com> --- [in reply to comment #12] sudo efibootmgr -v BootCurrent: 0019 Timeout: 0 seconds BootOrder: 0001,0000,0010,0011,0012,0013,0014,0017,0018,0019,001A,001B,001C,001D Boot0000* opensuse-secureboot HD(1,GPT,3fe41252-3fdc-476c-9520-034fd1bef10f,0x800,0x100000)/File(\EFI\opensuse\shim.efi) Boot0001* opensuse-secureboot HD(1,GPT,a6944199-4d90-4c5a-a920-70181216dea6,0x800,0x100000)/File(\EFI\opensuse\shim.efi) Boot0010 Setup FvFile(721c8b66-426c-4e86-8e99-3457c46ab0b9) Boot0011 Boot Menu FvFile(126a762d-5758-4fca-8531-201a7f57f850) Boot0012 Diagnostic Splash Screen FvFile(a7d8d9a6-6ab0-4aeb-ad9d-163e59a7a380) Boot0013 Lenovo Diagnostics FvFile(3f7e615b-0d45-4f80-88dc-26b234958560) Boot0014 ThinkShield secure wipe FvFile(3593a0d5-bd52-43a0-808e-cbff5ece2477) Boot0015 Startup Interrupt Menu FvFile(f46ee6f4-4785-43a3-923d-7f786c3c8479) Boot0016 Rescue and Recovery FvFile(665d3f60-ad3e-4cad-8e26-db46eee9f1b5) Boot0017* USB CD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,86701296aa5a7848b66cd49dd3ba6a55) Boot0018* USB FDD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,6ff015a28830b543a8b8641009461e49) Boot0019* NVMe0 VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,001c199932d94c4eae9aa0b6e98eb8a400) Boot001A* ATA HDD0 VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,91af625956449f41a7b91f4f892ab0f600) Boot001B* USB HDD VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,33e821aaaf33bc4789bd419f88c50803) Boot001C* PXE BOOT VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,78a84aaf2b2afc4ea79cf5cc8f3d3803) Boot001D Regulatory Information FvFile(478c92a0-2622-42b7-a65d-5894169e4d24) Boot001E* Boot Next Boot Option VenMsg(bc7838d2-0f82-4d60-8316-c068ee79d25b,a7ca6d35b2c2684783721826a7404894) ls -lR /boot/efi /boot/efi: total 4 drwxr-xr-x 4 root root 4096 Feb 1 14:03 EFI /boot/efi/EFI: total 8 drwxr-xr-x 2 root root 4096 Apr 3 08:47 boot drwxr-xr-x 2 root root 4096 Apr 3 08:44 opensuse /boot/efi/EFI/boot: total 3108 -rwxr-xr-x 1 root root 953800 Apr 3 08:47 bootx64.efi -rwxr-xr-x 1 root root 86352 Feb 1 14:03 fallback.efi -rwxr-xr-x 1 root root 203 Apr 3 08:47 grub.cfg -rwxr-xr-x 1 root root 1275904 Apr 3 08:47 grub.efi -rwxr-xr-x 1 root root 852408 Apr 3 08:47 MokManager.efi /boot/efi/EFI/opensuse: total 3416 -rwxr-xr-x 1 root root 58 Apr 3 08:47 boot.csv -rwxr-xr-x 1 root root 203 Apr 3 08:47 grub.cfg -rwxr-xr-x 1 root root 1275904 Apr 3 08:47 grub.efi -rwxr-xr-x 1 root root 401408 Apr 3 08:47 grubx64.efi -rwxr-xr-x 1 root root 852408 Apr 3 08:47 MokManager.efi -rwxr-xr-x 1 root root 953800 Apr 3 08:47 shim.efi rpm -q shim shim-15.7-150300.4.11.1.x86_64 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202792] New: OpenVPN in Leap 15.4 seems to be built without --enable-iproute2
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1202792 Bug ID: 1202792 Summary: OpenVPN in Leap 15.4 seems to be built without --enable-iproute2 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: georg.jansing(a)web.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I am using OpenVPN for several years on openSUSE (42.2 or so?) and always used a setup with a non-root user as advertized in https://openvpn.net/community-resources/how-to/#security (Unprivileged mode) This requires "--enable-iproute2" to be passed to configure at build time (at least as per current documentation). Either this was not the case in the Leap 15.3 version (2.4.x) or it was disabled in the 15.4 version for some reason. Could this flag be enabled (again) for the 15.4 package or is there a strong reason against it? From a -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1205996] 389 ds crash after running: dsconf <inst> replication enable
by bugzilla_noreply＠suse.com 03 Apr '23

03 Apr '23

https://bugzilla.suse.com/show_bug.cgi?id=1205996 https://bugzilla.suse.com/show_bug.cgi?id=1205996#c10 --- Comment #10 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-RU-2023:1727-1: An update that has two recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1205996, 1206563 Sources used: openSUSE Leap 15.4 (src): 389-ds-2.0.17~git20.ff6dbd9-150400.3.23.1 Server Applications Module 15-SP4 (src): 389-ds-2.0.17~git20.ff6dbd9-150400.3.23.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0