November 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1226346] New: No audio in Controller Intel Tiger Lake-LP
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1226346 Bug ID: 1226346 Summary: No audio in Controller Intel Tiger Lake-LP Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: rhusdel(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Multimedia audio controller Intel Corporation Tiger Lake-LP Smart Sound Technology Audio Controller Hardware is not detected. lspci | grep -i audio 00:1f.3 Multimedia audio controller: Intel Corporation Tiger Lake-LP Smart Sound Technology Audio Controller (rev 20) -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1233687] New: no way to depend on new enough wxPython
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233687 Bug ID: 1233687 Summary: no way to depend on new enough wxPython Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: msuchanek(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The wxPython has its own version independent of wxWidgets version the bindings are built against. However, some applications require wxPython build against new enough wxWidgets, and this dependency cannot be expressed. -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1233850] New: VUL-0: CVE-2024-21538: python-pydata-sphinx-theme: cross-spawn: regular expression denial of service
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233850 Bug ID: 1233850 Summary: VUL-0: CVE-2024-21538: python-pydata-sphinx-theme: cross-spawn: regular expression denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/427356/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-21538:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: python-maintainers(a)suse.com Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1233843 Target Milestone: --- Found By: --- Blocker: --- Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-21538 https://www.cve.org/CVERecord?id=CVE-2024-21538 https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d80… https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601… https://github.com/moxystudio/node-cross-spawn/pull/160 https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349 https://bugzilla.redhat.com/show_bug.cgi?id=2324550 https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/21xxx/CVE-2024… -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1229122] New: go1.23 release tracking
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229122 Bug ID: 1229122 Summary: go1.23 release tracking Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: jkowalczyk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- go1.23 (expected August 2024) is a major release of Go. Minor releases of go1.23.x will be provided through August 2025. This issue tracks go1.23.x releases packaged and submitted initially to openSUSE:Factory and can be referenced in submissions to additional repositories. Go Release Cycle https://github.com/golang/go/wiki/Go-Release-Cycle Go Release history https://golang.org/doc/devel/release.html -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1218424] New: go1.22 release tracking
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1218424 Bug ID: 1218424 Summary: go1.22 release tracking Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: jkowalczyk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- go1.22 (expected February 2024) is a major release of Go. Minor releases of go1.22.x will be provided through February 2025. This issue tracks go1.22.x releases packaged and submitted initially to openSUSE:Factory and can be referenced in submissions to additional repositories. Go Release Cycle https://github.com/golang/go/wiki/Go-Release-Cycle Go Release history https://golang.org/doc/devel/release.html -- You are receiving this mail because: You are on the CC list for the bug.

1 16

[Bug 1232527] New: [SELinux] "systemd-bless-boot good" fail during boot time
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1232527 Bug ID: 1232527 Summary: [SELinux] "systemd-bless-boot good" fail during boot time Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: danilo.spinella(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Operating System: openSUSE MicroOS SELinux status, mode and policy name: enabled, enforcing, targeted SELinux policy version and repository: 20241021-1.1, openSUSE-Tumbleweed-Oss The software (incl. version) that is affected by the SELinux issue and the error message: systemd 256.7, systemd-bless-boot, "Failed to rename '/loader/entries/opensuse-microos-6.11.5-1-default-1+2-1.conf' to '/loader/entries/opensuse-microos-6.11.5-1-default-1.conf': Permission Denied" SELinux Audit log: type=AVC msg=audit(1730195064.486:34): avc: denied { rename } for pid=1142 comm="systemd-bless-b" name="opensuse-microos-6.11.5-1-default-1+2-1.conf" dev="vda2" ino=11 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=0 Any other important details: N/A -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1228165] New: Position of SUSE Python interpreters on Externally managed environments
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1228165 Bug ID: 1228165 Summary: Position of SUSE Python interpreters on Externally managed environments Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: mcepl(a)suse.com QA Contact: qa-bugs(a)suse.de CC: dmueller(a)suse.com Target Milestone: --- Found By: --- Blocker: --- https://packaging.python.org/en/latest/specifications/externally-managed-en… This linked specification presents the use case rather well. Unlimited installation of Python packages can cause a serious damage, when the system component imports incompatible version of Python package instead of the intended one. (A parallel thought: are there any initiatives to port low-level components like firewalld to compiled languages? I know about firewalld-recode [1], but it seems to be quite dead). This specification tries to alleviate the problem by making it more difficult and painfully obvious that installing packages outside of the using system package manager is a wrong idea. That might be a good idea for normal users, but it seems like quite a bother for people who create containers, where the designers of such systems usually know what they are doing and who can check and test that nothing has been broken. The purpose of this bug is to discuss, whether we could produce some better solution to the problem, which wouldn’t be that obnoxious to our customers. One possible improvement would be to change our default hashbang to include `-s` parameter to calling our Python interpreters, so that modules in `$HOME` are not considered. Any possible improvements? [1] https://web.archive.org/web/20160318144103/https://fedorahosted.org/firewal… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1233738] New: SELINUX prevents XRDP from working when in enforcing mode
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233738 Bug ID: 1233738 Summary: SELINUX prevents XRDP from working when in enforcing mode Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: jmscdba(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hi Cathy, In my test TW system that is using selinux I found that xrdp is not working. When you attempt to RDP after entering your credentials a dialog is displayed which says the login is successful but then it says VNC error - problem connecting some problem Error conneting to user session If I run "setenforce 0" after booting then xrdp works fine. If I watch the journal when selinux is enforcing I find: xrdp-sesman[6092]: pam_unix(xrdp-sesman:session): session opened for user denise(uid=1001) by (uid=0) xrdp-sesman[6092]: pam_kwallet5(xrdp-sesman:session): pam_kwallet5: pam_sm_open_session xrdp-sesman[6149]: pam_kwallet5: final socket path: /run/user/1001/kwallet5.socket xrdp-sesman[6150]: pam_kwallet5: could not execute kwalletd from /usr/bin/kwalletd6 xrdp-sesman[6092]: pam_systemd(xrdp-sesman:session): New sd-bus connection (system-bus-pam-systemd-6092) opened. xrdp-sesman[6092]: pam_unix(xrdp-sesman:session): session closed for user denise xrdp-sesman[6092]: pam_kwallet5(xrdp-sesman:session): pam_kwallet5: pam_sm_close_session xrdp-sesman[6092]: pam_kwallet5(xrdp-sesman:setcred): pam_kwallet5: pam_sm_setcred systemd[1]: session-c7.scope: Deactivated successfully. ausearch shows these denied messages ausearch -ts boot | grep -i denied type=AVC msg=audit(1732232293.658:185): avc: denied { transition } for pid=2613 comm="xrdp-sesman" path="/usr/bin/kwalletd6" dev="sda2" ino=1779042 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process permissive=0 type=AVC msg=audit(1732232293.658:188): avc: denied { transition } for pid=2616 comm="xrdp-sesman" path="/usr/bin/bash" dev="sda2" ino=1719714 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process permissive=0 type=AVC msg=audit(1732232303.435:189): avc: denied { transition } for pid=2621 comm="xrdp-sesman" path="/usr/sbin/xrdp-chansrv" dev="sda2" ino=1455897 scontext=system_u:system_r:unconfined_service_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process permissive=0 I'm still getting up to speed with selinux but it seems to me that xrdp tries to launch /usr/bin/xrdp-chansrv it is denied because there is no selinux policy to allow it, however, I thought when TARGETED mode was used then selinux would have allowed it ? Or does the package need to be updated to include a policy to allow xrdp so that it works in enforcing mode. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1233358] New: [SELinux] AVC denial for sdbootutil during snapper cleanup
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233358 Bug ID: 1233358 Summary: [SELinux] AVC denial for sdbootutil during snapper cleanup Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: fvogt(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- On my Tumbleweed system with systemd-boot + TPM backed FDE and the SELinux targeted policy in enforcing mode, I found some AVC denials which were triggered by snapper-cleanup.service. snapper cleanup runs sdbootutil which in turn executes systemd-pcrlock: type=AVC msg=audit(14.11.2024 10:13:13.145:227) : avc: denied { execute } for pid=6038 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(14.11.2024 10:13:13.145:228) : avc: denied { execute } for pid=6038 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(14.11.2024 10:13:13.319:229) : avc: denied { execute } for pid=6082 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(14.11.2024 10:13:13.319:230) : avc: denied { execute } for pid=6082 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(14.11.2024 10:13:13.482:231) : avc: denied { execute } for pid=6126 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(14.11.2024 10:13:13.482:232) : avc: denied { execute } for pid=6126 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(14.11.2024 10:13:13.652:233) : avc: denied { execute } for pid=6170 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(14.11.2024 10:13:13.652:234) : avc: denied { execute } for pid=6170 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(14.11.2024 10:13:13.829:235) : avc: denied { execute } for pid=6214 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(14.11.2024 10:13:13.829:236) : avc: denied { execute } for pid=6214 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(14.11.2024 10:13:13.999:237) : avc: denied { execute } for pid=6258 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(14.11.2024 10:13:13.999:238) : avc: denied { execute } for pid=6258 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(14.11.2024 10:13:14.175:239) : avc: denied { execute } for pid=6302 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 type=AVC msg=audit(14.11.2024 10:13:14.175:240) : avc: denied { execute } for pid=6302 comm=sdbootutil name=systemd-pcrlock dev="dm-0" ino=659797 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:systemd_pcrlock_exec_t:s0 tclass=file permissive=0 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1232670] New: [SELinux] importctl cannot write to /var/lib/extensions
by bugzilla_noreply＠suse.com 04 Dec '24

04 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1232670 Bug ID: 1232670 Summary: [SELinux] importctl cannot write to /var/lib/extensions Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Importing sysext images with importctl does not work, since SELinux blocks writing in that directory: node122:~ # importctl pull-raw --class=sysext https://download.opensuse.org/repositories/home:/kukuk:/sysext/mkosi/gcc-20… --verify=no Enqueued transfer job 1. Press C-c to continue download in background. Pulling 'https://download.opensuse.org/repositories/home:/kukuk:/sysext/mkosi/gcc-20…', saving as 'gcc-20.2.x86-64'. Operating on image directory '/var/lib/extensions'. Failed to create /var/lib/extensions/.#verityebe0580e99f54026: Permission denied Verity integrity file could not be retrieved, proceeding without. Failed to create /var/lib/extensions/.#roothash96cdb063d430dc58: Permission denied Root hash file could not be retrieved, proceeding without. Failed to create /var/lib/extensions/.#roothash.p7s70c3902ea1954e95: Permission denied Root hash signature file could not be retrieved, proceeding without. Downloading 241.2M for https://download.opensuse.org/repositories/home:/kukuk:/sysext/mkosi/gcc-20…. Failed to create /var/lib/extensions/.#rawd292069b0f58e5ea: Permission denied Failed to retrieve image file. Exiting. type=SERVICE_START msg=audit(1730372760.872:336): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-importd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' type=AVC msg=audit(1730372764.279:337): avc: denied { write } for pid=2413 comm="systemd-pull" name="extensions" dev="dm-0" ino=143939 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1730372764.282:338): avc: denied { write } for pid=2413 comm="systemd-pull" name="extensions" dev="dm-0" ino=143939 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1730372764.289:339): avc: denied { write } for pid=2413 comm="systemd-pull" name="extensions" dev="dm-0" ino=143939 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=AVC msg=audit(1730372767.479:340): avc: denied { write } for pid=2413 comm="systemd-pull" name="extensions" dev="dm-0" ino=143939 scontext=system_u:system_r:systemd_importd_t:s0 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=dir permissive=0 type=SERVICE_STOP msg=audit(1730372797.529:341): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-importd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' -- You are receiving this mail because: You are on the CC list for the bug.

1 5