December 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1232244] New: AUDIT-0: xfce4-power-manager: New PolKit rules added
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1232244 Bug ID: 1232244 Summary: AUDIT-0: xfce4-power-manager: New PolKit rules added Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: manfred.h(a)gmx.net QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 878186 --> https://bugzilla.suse.com/attachment.cgi?id=878186&action=edit Full build log xfce4-power-manager-4.19.3 has added polkit rules [ 43s] RPMLINT report: [ 43s] =============== [ 44s] xfce4-power-manager.x86_64: E: polkit-unauthorized-privilege (Badness: 10000) org.xfce.power.xfce4-pm-helper (auth_admin:auth_admin:yes) [ 44s] The package allows unprivileged users to carry out privileged operations [ 44s] without authentication. This could cause security problems if not done [ 44s] carefully. If the package is intended for inclusion in any SUSE product please [ 44s] open a bug report to request review of the package by the security team. [ 44s] Please refer to [ 44s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for [ 44s] more information. [ 44s] [ 44s] (none): E: badness 10000 exceeds threshold 1000, aborting. OBS repo: https://build.opensuse.org/package/show/home:manfred-h:X11:xfce:4.19/xfce4-… -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1234632] openssh-server-config-rootlogin is not preinstalled but root ssh login is still possible
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234632 https://bugzilla.suse.com/show_bug.cgi?id=1234632#c4 Thorsten Kukuk <kukuk(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |INVALID --- Comment #4 from Thorsten Kukuk <kukuk(a)suse.com> --- (In reply to Zaoliang Luo from comment #3) > If you want to reproduce it, please use > openSUSE-Tumbleweed-ARM-JeOS-raspberrypi.aarch64-2024.12.13-Snapshot20241215. > raw.xz Why was this really important information missing in the initial bug report? "Install Tumbleweed on my RPi 4 Model B" sounded like you used YaST and not a disk image. Thus invalid, since it is even documented that this file exists and why: #====================================== # Latest openssh disables root login by default # Re-enable it as we do not use 1st boot for now, # so root is the only account by default #-------------------------------------- cat > /etc/ssh/sshd_config.d/PermitRootLogin.conf <<EOF # Allow root login on ssh PermitRootLogin yes EOF (In reply to Zaoliang Luo from comment #3) > (In reply to Michael Pujos from comment #2) > > Urgh, I missed the last part of your message. > > > > I have no /etc/ssh/sshd_config.d/PermitRootLogin.conf file on my system, > > which has been updated for 5 years. > > If you want to reproduce it, please use > openSUSE-Tumbleweed-ARM-JeOS-raspberrypi.aarch64-2024.12.13-Snapshot20241215. > raw.xz -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234448] When sharing Yubikey from the host, I get "can't set config #1, error -32"
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234448 https://bugzilla.suse.com/show_bug.cgi?id=1234448#c2 Alberto Planas Dominguez <aplanas(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(aplanas(a)suse.com) | --- Comment #2 from Alberto Planas Dominguez <aplanas(a)suse.com> --- Interesting, no. Fails in my system: "g-exec-error-quark: Could not redirect Yubico YubiKey OTP+FIDO+CCID [1050:0407] at 1-68: Failed to execute child process "/usr/bin/spice-client-glib-usb-acl-helper" (Permission denied) (3)" -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234621] [SELinux] full relabelling required after booting to recovery/single-user mode
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234621 https://bugzilla.suse.com/show_bug.cgi?id=1234621#c4 --- Comment #4 from Thorsten Kukuk <kukuk(a)suse.com> --- (In reply to pallas wept from comment #2) > > as the default for Tumbleweed is AppArmor and not SELinux. > > Pardon me if I've misunderstood, but for new installations, I understood > that the default would be SELinux since recently? > ( https://bugzilla.opensuse.org/show_bug.cgi?id=1230118 ) Doesn't matter, the default LSM in the kernel is AppArmor on Tumbleweed and "security=selinux" needs always be set, else AppArmor is enabled and SELinux stays disabled. Changing the kernel default is not possible as this would break all existing systems out there. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234448] When sharing Yubikey from the host, I get "can't set config #1, error -32"
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234448 https://bugzilla.suse.com/show_bug.cgi?id=1234448#c1 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(aplanas(a)suse.com) CC| |aplanas(a)suse.com, | |fvogt(a)suse.com --- Comment #1 from Fabian Vogt <fvogt(a)suse.com> --- I tried it using the runtime redirection here (VM menu -> USB redirection) and it worked fine. Can you confirm? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234632] openssh-server-config-rootlogin is not preinstalled but root ssh login is still possible
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234632 Zaoliang Luo <zluo(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Hardware|Other |aarch64 OS|Other |openSUSE Tumbleweed -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234632] openssh-server-config-rootlogin is not preinstalled but root ssh login is still possible
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234632 https://bugzilla.suse.com/show_bug.cgi?id=1234632#c3 --- Comment #3 from Zaoliang Luo <zluo(a)suse.com> --- (In reply to Michael Pujos from comment #2) > Urgh, I missed the last part of your message. > > I have no /etc/ssh/sshd_config.d/PermitRootLogin.conf file on my system, > which has been updated for 5 years. If you want to reproduce it, please use openSUSE-Tumbleweed-ARM-JeOS-raspberrypi.aarch64-2024.12.13-Snapshot20241215.raw.xz -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232244] AUDIT-WHITELIST: xfce4-power-manager: new polkit action to pkexec xfce4-pm-helper
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1232244 https://bugzilla.suse.com/show_bug.cgi?id=1232244#c11 Wolfgang Frisch <wolfgang.frisch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(wolfgang.frisch@s | |use.com) | --- Comment #11 from Wolfgang Frisch <wolfgang.frisch(a)suse.com> --- (In reply to Manfred Hollstein from comment #10) > What is the process if such requests for other distros? Will there be an > update for e.g. openSUSE Leap 15.6? Without such an update > xfce4-power-manager fails to build for 15.6 :-( We maintain a branch of polkit-default-privs for Leap 15.6 [1]. The whitelisting process is basically the same, but only performed when a maintainer requests it explicitly. > FWIW, Xfce 4.20 has been released today, so I'd like to get the environment > clarified for Leap 15.6, too ;-) I just backported the whitelisting to Leap [2]. It can take a few days until it's released. I hope this answers your question :) [1] https://github.com/openSUSE/polkit-default-privs/tree/SLE-15-SP6 [2] https://github.com/openSUSE/polkit-default-privs/commit/01daf2cf81039625615… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234502] VUL-0: CVE-2024-45337: traefik2: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234502 https://bugzilla.suse.com/show_bug.cgi?id=1234502#c2 Johannes Weberhofer <jweberhofer(a)weberhofer.at> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P3 - Medium |P5 - None Status|NEW |RESOLVED Resolution|--- |UPSTREAM --- Comment #2 from Johannes Weberhofer <jweberhofer(a)weberhofer.at> --- The response came from the upstream developers. I have updated the release for thumbleweed, which will soon become available. > Thank you for reaching out. > > We are releasing new versions with an up-to-date version of Go that fixes the CVE. > However, Traefik has not been impacted (we are not using the SSH package). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234632] New: openssh-server-config-rootlogin is not preinstalled but root ssh login is still possible
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234632 Bug ID: 1234632 Summary: openssh-server-config-rootlogin is not preinstalled but root ssh login is still possible Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: zluo(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- install Tumbleweed on my RPi 4 Model B Mac-mini:Downloads Zaoliang$ ssh root(a)192.168.8.148 The authenticity of host '192.168.8.148 (192.168.8.148)' can't be established. ED25519 key fingerprint is SHA256:v8Q0XOxpOEqvfRlStUOVOH/LhJV7X0Zzxjlq980xkYA. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.8.148' (ED25519) to the list of known hosts. (root(a)192.168.8.148) Password: Have a lot of fun... localhost:~ # zypper se login Retrieving repository 'Open H.264 Codec (openSUSE Tumbleweed)' metadata .............................................[done] Building repository 'Open H.264 Codec (openSUSE Tumbleweed)' cache ..................................................[done] Retrieving repository 'openSUSE-Tumbleweed-Oss' metadata ............................................................[done] Building repository 'openSUSE-Tumbleweed-Oss' cache .................................................................[done] Retrieving repository 'openSUSE-Tumbleweed-Update' metadata .........................................................[done] Building repository 'openSUSE-Tumbleweed-Update' cache ..............................................................[done] Loading repository data... Reading installed packages... S | Name | Summary | Type ---+---------------------------------+-----------------------------------------------------------------------+-------- | google-guest-oslogin | Google Cloud Guest OS Login | package | kubelogin | Kubernetes client credential plugin implementing Azure authentication | package i | login_defs | The login.defs configuration file | package | openssh-server-config-rootlogin | Config to permit root logins to sshd | package | python310-Flask-Login | User session management for Flask | package | python310-oktaloginwrapper | Okta login without API token | package | python311-Flask-Login | User session management for Flask | package | python311-oktaloginwrapper | Okta login without API token | package | python312-Flask-Login | User session management for Flask | package | python312-oktaloginwrapper | Okta login without API token | package | python313-Flask-Login | User session management for Flask | package | python313-oktaloginwrapper | Okta login without API token | package | update-test-relogin-suggested | Test update that requires a session restart | package | update-test-relogin-suggested | Test-update for openSUSE Tumbleweed | patch | xlogin | xlogin, xtelnet | package localhost:~ # cat /etc/os-release NAME="openSUSE Tumbleweed" # VERSION="20241215" ID="opensuse-tumbleweed" ID_LIKE="opensuse suse" VERSION_ID="20241215" PRETTY_NAME="openSUSE Tumbleweed" ANSI_COLOR="0;32" # CPE 2.3 format, boo#1217921 CPE_NAME="cpe:2.3:o:opensuse:tumbleweed:20241215:*:*:*:*:*:*:*" #CPE 2.2 format #CPE_NAME="cpe:/o:opensuse:tumbleweed:20241215" BUG_REPORT_URL="https://bugzilla.opensuse.org" SUPPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org" DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed" LOGO="distributor-logo-Tumbleweed" localhost:~ # cat /etc/ssh/sshd_config.d/PermitRootLogin.conf # Allow root login on ssh PermitRootLogin yes -- This is surprising me really. -- You are receiving this mail because: You are on the CC list for the bug.

1 2