October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1231581] New: missing manifest files under /usr/share/dotnet/sdk-manifests/8.0.100/workloadsets/
by bugzilla_noreply＠suse.com 17 Oct '24

17 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231581 Bug ID: 1231581 Summary: missing manifest files under /usr/share/dotnet/sdk-manifests/8.0.100/workloadsets/ Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: linux(a)ejr-online.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0 Build Identifier: projects of a solution are not loaded in IDE because of [MSB4242] Fehler bei SDK-Resolver: "Ausfall beim Versuch des SDK-Resolver "Microsoft.DotNet.MSBuildWorkloadSdkResolver", das SDK "Microsoft.NET.SDK.WorkloadAutoImportPropsLocator" aufzulösen. Ausnahme: "System.InvalidOperationException: No workload set information found in: /usr/share/dotnet/sdk-manifests/8.0.100/workloadsets/8.0.301-baseline.24272.10 at Microsoft.NET.Sdk.WorkloadManifestReader.WorkloadSet.FromWorkloadSetFolder(String path, String workloadSetVersion, SdkFeatureBand defaultFeatureBand) at Microsoft.NET.Sdk.WorkloadManifestReader.SdkDirectoryWorkloadManifestProvider. g__AddWorkloadSetsForFeatureBand|27_0(Dictionary`2 availableWorkloadSets, String featureBandDirectory) at Microsoft.NET.Sdk.WorkloadManifestReader.SdkDirectoryWorkloadManifestProvider.GetAvailableWorkloadSetsInternal(Nullable`1 workloadSetFeatureBand) at Microsoft.NET.Sdk.WorkloadManifestReader.SdkDirectoryWorkloadManifestProvider.RefreshWorkloadManifests() at Microsoft.NET.Sdk.WorkloadManifestReader.SdkDirectoryWorkloadManifestProvider..ctor(String sdkRootPath, String sdkVersion, Func`2 getEnvironmentVariable, String userProfileDir, String globalJsonPath, String workloadSetVersion) at Microsoft.NET.Sdk.WorkloadManifestReader.SdkDirectoryWorkloadManifestProvider..ctor(String sdkRootPath, String sdkVersion, String userProfileDir, String globalJsonPath) at Microsoft.NET.Sdk.WorkloadMSBuildSdkResolver.CachingWorkloadResolver.Resolve(String sdkReferenceName, String dotnetRootPath, String sdkVersion, String userProfileDir, String globalJsonPath) at Microsoft.NET.Sdk.WorkloadMSBuildSdkResolver.WorkloadSdkResolver.Resolve(SdkReference sdkReference, SdkResolverContext resolverContext, SdkResultFactory factory) at Microsoft.Build.BackEnd.SdkResolution.SdkResolverService.TryResolveSdkUsingSpecifiedResolvers(IReadOnlyList`1 resolvers, Int32 submissionId, SdkReference sdk, LoggingContext loggingContext, ElementLocation sdkReferenceLocation, String solutionPath, String projectPath, Boolean interactive, Boolean isRunningInVisualStudio, SdkResult& sdkResult, IEnumerable`1& errors, IEnumerable`1& warnings)"" /usr/share/dotnet/sdk/8.0.403/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.Sdk.ImportWorkloads.props at (14:38) Related Actions and Settings: Open Microsoft.NET.Sdk.ImportWorkloads.props Open Ausprobieren.csproj Reproducible: Always Steps to Reproduce: 1. open existing dotnet solution in IDE (here Jetbrains Rider) 2. 3. Actual Results: projects files are not loaded. No work on develope projects in IDE possible. Expected Results: projects are loaded in IDE Issue arised after TW update at least three days ago (before Oct 9). Exact update not known since I didn't work on dotnet projects at these days. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1231338] [Build 40.1] Leap 16.0 fails to build on ppc64le
by bugzilla_noreply＠suse.com 17 Oct '24

17 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231338 https://bugzilla.suse.com/show_bug.cgi?id=1231338#c2 Michal Suchanek <msuchanek(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(msuchanek(a)suse.co | |m) | --- Comment #2 from Michal Suchanek <msuchanek(a)suse.com> --- Yes, looks like it. Make sure you have the kiwi updates. Kiwi maintainers are prone to not put bug references into the package changelog so it's not as easy as it could be. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231494] [Build 20241008-SELinux] openQA test fails in rsync_server: rsyncd cant start
by bugzilla_noreply＠suse.com 17 Oct '24

17 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231494 https://bugzilla.suse.com/show_bug.cgi?id=1231494#c2 Cathy Hu <cathy.hu(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|security-team(a)suse.de |jsegitz(a)suse.com --- Comment #2 from Cathy Hu <cathy.hu(a)suse.com> --- @Johannes, i think it might have to do with the fix for bsc#1209890, could you have a look? feel free to unassign yourself if you dont have the time ;D my theory is when rsyncd is called by systemd, it transitions into rsync_t and then tries to execute the rsyncd wrapper from bsc#1209890, see: https://gitlab.suse.de/selinux/selinux-policy/-/blob/factory/policy/modules… https://build.opensuse.org/projects/network/packages/rsync/files/rsyncd?exp… when i run in permissive at least it looks like it: ---- time->Thu Oct 17 18:35:16 2024 type=AVC msg=audit(1729182916.865:1742): avc: denied { execute } for pid=242836 comm="rsyncd" path="/usr/bin/bash" dev="vda3" ino=924322 scontext=system_u:system_r:rsync_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=1 ---- time->Thu Oct 17 18:35:16 2024 type=AVC msg=audit(1729182916.868:1743): avc: denied { execute } for pid=242836 comm="rsyncd" name="rsync" dev="vda3" ino=924189 scontext=system_u:system_r:rsync_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1 ---- time->Thu Oct 17 18:35:16 2024 type=AVC msg=audit(1729182916.868:1744): avc: denied { execute_no_trans } for pid=242836 comm="rsyncd" path="/usr/bin/rsync" dev="vda3" ino=924189 scontext=system_u:system_r:rsync_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=1 ---- time->Thu Oct 17 18:35:16 2024 type=AVC msg=audit(1729182916.868:1745): avc: denied { open } for pid=242836 comm="rsync" path="/var/log/rsyncd.log" dev="vda3" ino=1181678 scontext=system_u:system_r:rsync_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=file permissive=1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231494] [Build 20241008-SELinux] openQA test fails in rsync_server: rsyncd cant start
by bugzilla_noreply＠suse.com 17 Oct '24

17 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231494 https://bugzilla.suse.com/show_bug.cgi?id=1231494#c1 --- Comment #1 from Cathy Hu <cathy.hu(a)suse.com> --- Reproducer: install rsync add this to /etc/rsyncd.conf https://github.com/os-autoinst/os-autoinst-distri-opensuse/blob/master/data… echo "test42:424242" >> /etc/rsyncd.secrets systemctl start rsyncd Oct 17 18:01:11 localhost systemd[1]: Started Start the rsync server daemon. Oct 17 18:01:11 localhost systemd[1]: rsyncd.service: Main process exited, code=killed, status=11/SEGV Oct 17 18:01:11 localhost systemd[1]: rsyncd.service: Failed with result 'signal'. avc: ---- time->Thu Oct 17 18:01:11 2024 type=AVC msg=audit(1729180871.679:1520): avc: denied { execute } for pid=241492 comm="rsyncd" path="/usr/bin/bash" dev="vda3" ino=924322 scontext=system_u:system_r:rsync_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231381] AUDIT-0: libcgroup: permissions.d drop-in snippet, pam-file-unauthorize, non-standard-gid /usr/bin/cgexec cgred
by bugzilla_noreply＠suse.com 17 Oct '24

17 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231381 https://bugzilla.suse.com/show_bug.cgi?id=1231381#c3 Matthias Gerstner <matthias.gerstner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|security-team(a)suse.de |matthias.gerstner(a)suse.com --- Comment #3 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- I will work on this review on the side while doing another larger review. The sensitive components are: - cgexec setgid binary (~500 lines of code) - pam_cgroup PAM module (~150 lines of code) Should not take forever to review this, unless it pulls in plenty of library code. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1230018] AUDIT-0: deepin-system-monitor: new dbus services of deepin-system-monitor
by bugzilla_noreply＠suse.com 17 Oct '24

17 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1230018 https://bugzilla.suse.com/show_bug.cgi?id=1230018#c4 --- Comment #4 from Wolfgang Frisch <wolfgang.frisch(a)suse.com> --- Whitelisting in progress. I'll ping you when it's done. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231465] Kernel 6.11.2-1 only a fraction of ram is available
by bugzilla_noreply＠suse.com 17 Oct '24

17 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231465 https://bugzilla.suse.com/show_bug.cgi?id=1231465#c33 --- Comment #33 from Jiri Slaby <jslaby(a)suse.com> --- (In reply to Jiri Slaby from comment #32) > (In reply to Felix Niederwanger from comment #31) > > I forgot the KASAN sequence: > > > > > (poweroff) > > > 6.11.3-5-KASAN: error > > > 6.11.3-5-KASAN: error > > > 6.11.3-5-KASAN: error > > > > This kernel fails to boot from cold. FWIW I enabled kasan in my kernel, so that it contains both the workaround and KASAN: home:jirislaby:kernel-bsc1231465 It might be worth trying too. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231465] Kernel 6.11.2-1 only a fraction of ram is available
by bugzilla_noreply＠suse.com 17 Oct '24

17 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231465 https://bugzilla.suse.com/show_bug.cgi?id=1231465#c32 Jiri Slaby <jslaby(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(felix.niederwange | |r(a)suse.com) --- Comment #32 from Jiri Slaby <jslaby(a)suse.com> --- (In reply to Felix Niederwanger from comment #31) > I forgot the KASAN sequence: > > > (poweroff) > > 6.11.3-5-KASAN: error > > 6.11.3-5-KASAN: error > > 6.11.3-5-KASAN: error > > This kernel fails to boot from cold. It might die well due to the bug. Or not. Did you boot with "quiet" in cmdline? Can you see any messages if not? Or any chance it managed to store the kernel messages into the journal? Or would it be possible to boot with init=/bin/bash and look into the dmesg directly (I am not sure if it's not too late -- perhaps boot with rd.break, but that might be too late too)? But you at least confirmed 6.11.0 is ok and 6.11.2 is not. What about 6.12? And I've just pushed 6.11.4 -- still the same? Sorry, but I am not clever from this bug at all. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231720] New: [SELinux] policy can not be loaded in tumbleweed sdboot image
by bugzilla_noreply＠suse.com 17 Oct '24

17 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231720 Bug ID: 1231720 Summary: [SELinux] policy can not be loaded in tumbleweed sdboot image Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: cathy.hu(a)suse.com Reporter: cathy.hu(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- [ 3.306060][ T1] systemd[1]: Failed to load SELinux policy :Input/output error [ 3.307252][ T1] systemd[1]: Freezing execution. Reproduce: 1. Download http://download.opensuse.org/tumbleweed/appliances/openSUSE-Tumbleweed-Mini… 2. zypper in -t pattern selinux 3. add selinux options to kernel cmdline pbl --add-option "security=selinux selinux=1 enforcing=1" sdbootutil add-all-kernels (check in /boot/efi/loader/entries/ if "security=selinux selinux=1 enforcing=1" was added to the "options" section, should be) sdbootutil mkinitrd might be related to bsc#1231490 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1230018] AUDIT-0: deepin-system-monitor: new dbus services of deepin-system-monitor
by bugzilla_noreply＠suse.com 17 Oct '24

17 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1230018 https://bugzilla.suse.com/show_bug.cgi?id=1230018#c3 --- Comment #3 from Wolfgang Frisch <wolfgang.frisch(a)suse.com> --- Overview ======== The package is a system monitor for the Deepin Desktop Environment. It is written in Qt-style C++. First impressions ----------------- In order to compile it on Tumbleweed, multiple patches have to be applied. For example, the wrong C++ standard is set in some CMakeFiles. This is not major problem but it clearly shows the work in progress nature of this package. deepin-system-monitor implements two D-Bus services, one each on the system and on the session bus. Only the former requires elevated privileges, though both were investigated in this audit. System D-Bus: org.deepin.SystemMonitorSystemServer -------------------------------------------------- This service contains just one method, implemented in `src/systemdbusserver.cpp`: `setServiceEnable(String serviceName, Boolean enable) -> String` Its sole purpose is to enable and disable systemd services. There are a number of authorization checks, implemented in `SystemDBusServer::checkCaller()`: - It only allows callers with the executable path `/usr/bin/deepin-system-monitor` This check is theoretically prone to PID race. I cannot see a way to exploit this in a meaningful way. A successful attempt would be mitigated by subsequent checks anyway: - Input validation: disallows [; ] in serviceName - Input validation: allows services listed in `systemctl list-units --type=service` only - PolKit authorization check, configured in `deepin-system-monitor-system-server/misc/org.deepin.deepin-system-monitor-system-server.policy` ``` <defaults> <allow_any>no</allow_any> <allow_inactive>no</allow_inactive> <allow_active>auth_admin_keep</allow_active> </defaults> ``` The PID race on its own could be problematic, but not in combination with the other security mechanisms. OK. Session D-Bus: org.deepin.SystemMonitorDaemon --------------------------------------------- This service provides a collection of methods, for retrieving system resource usage information, and for configuring alarms related to the same. It is implemented in `deepin-system-monitor-daemon/src/systemmonitorservice.cpp`. ``` interface org.deepin.SystemMonitorDaemon { methods: getSystemProtectionStatus(out b arg_0); setSystemProtectionStatus(in b status); getCpuUsage(out i arg_0); getMemoryUsage(out i arg_0); getAlarmMsgInterval(out i arg_0); setAlarmMsgInterval(in i interval); getAlarmUsageOfCpu(out i arg_0); setAlarmUsageOfCpu(in i usage); getAlarmUsageOfMemory(out i arg_0); setAlarmUsageOfMemory(in i usage); showDeepinSystemMoniter(); changeAlarmItem(in s item, in v value); setAlaramLastTimeInterval(in x lastTime); onMonitorTimeout(); signals: alarmItemChanged(s item, v value); properties: }; ``` There are no apparent security problems in these methods. Input validation is scattered across multiple functions, but ultimately functional. Non-security observations ------------------------- - The low memory alarm notification involves spawning a subprocess weighing in at 60 MB of resident memory. Not a bug, but obviously counterproductive. - The systemd unit uses an obsolete directive: `MemoryLimit=`. Conclusion ---------- There is no strong argument against whitelisting the D-Bus services of this package. -- You are receiving this mail because: You are on the CC list for the bug.

1 0