May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1221557] New: flatpak runtime org.kde.Platform 6.6 does not reliably verify SSL certs
by bugzilla_noreply＠suse.com 09 Aug '24

09 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1221557 Bug ID: 1221557 Summary: flatpak runtime org.kde.Platform 6.6 does not reliably verify SSL certs Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Flatpak Assignee: rbrown(a)suse.com Reporter: vortex(a)z-ray.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0 Build Identifier: Hello there this came to my attention as OBS Studio updated their flatpak from 30.0.2 to 30.1.0 where they also changed the used runtime form KDE Platform 6.5 to 6.6. Since that update browser sources and browser docks do no longer work if they are pointing at an HTTPS protected site. While with runtime 6.5 it still works fine (more details below). Browser docks are only available in a X11 session due to bugs under Wayland but also the only one to actually show an error message while browser sources are completely silent and simply keep empty. Beside the steps to reproduce other findings made in the meantime before reporting here. This happens on openSUSE Leap 15.6, openSUSE Tumbleweed, openSUSE Aeon and openSUSE Kalpa. Running the OBS Studio flatpak on virtually any other Linux distribution (Tested Ubuntu 22.04, Fedora 39, Arch Linux) does work just fine. Nevertheless I report the bug for Aeon as Aeon and Kalpa heavily rely on flatpaks and this issue is more imminent for them than for regular Tumbleweed and Leap. Other things I tried was running the OBS Studio 30.1.0 *.dep package from inside a Ubuntu 22.04 distrobox container running on my openSUSE Aeon host. Browser sources and docks worked just fine. Also I ran a Ubuntu 22.04 VM on my openSUSE Aeon host using Gnome Boxes and the flatpak version of OBS Studio, browser sources and docks worked just fine too. Furthermore I build the OBS Studio flatpak locally using fkatpab-builder from inside a openSUSE Tumbleweed distrobox using runtime 6.5 instead of 6.6. That OBS Studio flatpak did worked just fine on my openSUSE Aeon and inside the openSUSE Tumlbeweed distrobox container. Whilst building it with 6.6 was broken again. To build OBS Studio with a different runtime do the following: 1) git clone --recursive https://github.com/obsproject/obs-studio.git 2) Change the content of obs-studio/build-aux/com.obsproject.Studio to ruse runtime 6.5 instead of 6.6 (line 4) 3) flatpak-builder --force-clean --install-deps-from=flathub --user --install --ccache --mirror-screenshots-url=https://dl.flathub.org/media/ build-dir build-aux/com.obsproject.Studio.json --user --install Reproducible: Always Steps to Reproduce: 1. Install OBS Studio flatpak 30.1.0 2. Add a browser dock or a browser source pointing to an https site 3. See nothing or in case of a dock the error: ERR_CERT_AUTHORITY_INVALID URL: https://obsproject.com/browser-source Actual Results: Empty browser source or a browser dock showing ERR_CERT_AUTHORITY_INVALID URL: https://obsproject.com/browser-source Expected Results: Browser sources and docks to work Thsi bug was firstly reported to OBS Studio where we found out it's actually the runtime causeing the issue: https://github.com/obsproject/obs-studio/issues/10385 And reported to KDE where they asked me to better open up the issue directly for openSUSE as other distributions are not affected over here: https://bugs.kde.org/show_bug.cgi?id=483746 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1224457] New: Kernel: Sound: AMD cpu with graphics + ASUS motherboard with ALC 887
by bugzilla_noreply＠suse.com 08 Aug '24

08 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1224457 Bug ID: 1224457 Summary: Kernel: Sound: AMD cpu with graphics + ASUS motherboard with ALC 887 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: x86-64 OS: openSUSE Leap 15.5 Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: andrwlms(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Installation of Leap 15.5 or Tumbleweed on a machine with an AMD APU on an ASUS Prime B550-Plus (uses Realtek ALC 887 for sound) results in no sound from the motherboard. This is discussed in a thread on openSuSE forums: English language, Hardware forum, "5700G+ALC887" thread title. This has been explored with aplay -l, inxi -Axx, dmesg | grep snd_hda, lsmod and modprobe. It is apparently a matter of detection of the motherboard sound "card" in the presence of the CPU's integrated sound "card". This is apparently a bug in the kernel, not openSuSE, since installation of Linux Mint on the same hardware causes exactly the same problem, including identical output from aplay -l, inxi -Axx and dmesg | grep snd_hda. -- You are receiving this mail because: You are on the CC list for the bug.

1 54

[Bug 1213495] New: Mariadb: InnoDB: Unable to find charset-collation for X
by bugzilla_noreply＠suse.com 08 Aug '24

08 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1213495 Bug ID: 1213495 Summary: Mariadb: InnoDB: Unable to find charset-collation for X Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: suse(a)rettich.bayern QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- There is an upstream bug in Mariadb 11.0.2 (currently distributed in Tumbleweed): https://jira.mariadb.org/browse/MDEV-31443 The bug prevents Mariadb to successfully upgrade from 10 to 11 on database that contains older tables. Can you upgrade the package in the Tumbleweed repository to 11.0.3? -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1225317] New: AUDIT-0: systemd: Please review the new DBUS /polkit stuff brought by v256
by bugzilla_noreply＠suse.com 07 Aug '24

07 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1225317 Bug ID: 1225317 Summary: AUDIT-0: systemd: Please review the new DBUS /polkit stuff brought by v256 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: fbui(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hello, The next major version of system (v256) will come with a host of new features and thus a bunch of methods/actions to review. Could you please review them ? I created the following project that will be used as the devel project for v256: https://build.opensuse.org/package/live_build_log/home:fbui:systemd:v256/sy… You should find the build logs there where the list of methods/actions to review is detailed. Please note that the integration is still WIP hence most of the new stuff has been temporarily packaged in the systemd-experimental subpackage. But some of them will be moved in different subpackages once the integration will be finished. Thanks in advance. -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1214053] New: Wrong Permissions for Package xmrig-6.18.1-bp155.1.8.x86_64.rpm (Download Error)
by bugzilla_noreply＠suse.com 07 Aug '24

07 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1214053 Bug ID: 1214053 Summary: Wrong Permissions for Package xmrig-6.18.1-bp155.1.8.x86_64.rpm (Download Error) Classification: openSUSE Product: openSUSE Backports Version: SLE-15-SP5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Packages Assignee: packagehub-bugs(a)suse.com Reporter: stephan.kreuz(a)bwi.de QA Contact: packagehub-bugs(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Sine 07/01/23 (not sure when problem occure first Time) I get Permission denied for Package xmrig-6.18.1-bp155.1.8.x86_64.rpm from suse-packagehub-15-sp5-backports-pool-x86_64(-sap). Please verify that the correct Permisions set for that Package. kind regards Stephan -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 1224308] New: VUL-0: CVE-2024-4068: traefik: the npm package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion
by bugzilla_noreply＠suse.com 07 Aug '24

07 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1224308 Bug ID: 1224308 Summary: VUL-0: CVE-2024-4068: traefik: the npm package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/405385/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: alexandre.vicenzi(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: gabriele.sonnu(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- The NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-4068 https://www.cve.org/CVERecord?id=CVE-2024-4068 https://devhub.checkmarx.com/cve-details/CVE-2024-4068/ https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5d… https://github.com/micromatch/braces/issues/35 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1217488] New: pynfs CID* tests fails: OP_SETCLIENTID should return NFS4_OK, instead got NFS4ERR_DELAY
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1217488 Bug ID: 1217488 Summary: pynfs CID* tests fails: OP_SETCLIENTID should return NFS4_OK, instead got NFS4ERR_DELAY Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel:Filesystems Assignee: nfbrown(a)suse.com Reporter: petr.vorel(a)suse.com QA Contact: petr.vorel(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Although we start due #1217128 testing via cdmackay/pynfs.git, which has fix for "nfs4lib.BadCompoundRes: operation OP_SETCLIENTID should return NFS4_OK [1], instead got NFS4ERR_DELAY", we still get 9 tests failing with this error on Tumbleweed. Any idea what could be wrong now? O I can ask Calum Mackay on linux-nfs if you're busy with more important stuff. [1] https://git.linux-nfs.org/?p=cdmackay/pynfs.git;a=commit;h=0d4d3fd0bb7a6386… -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1224149] New: [SELinux] sdbootutil (snapperd_t) failes to execute systemd-pcrlock (init_exec_t)
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1224149 Bug ID: 1224149 Summary: [SELinux] sdbootutil (snapperd_t) failes to execute systemd-pcrlock (init_exec_t) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: arvidjaar(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Operating System: openSUSE MicroOS 10:~ # sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: enforcing Mode from config file: enforcing Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: actual (secure) Max kernel policy version: 33 10:~ # zypper info selinux-policy Loading repository data... Reading installed packages... Information for package selinux-policy: --------------------------------------- Repository : openSUSE-Tumbleweed-Oss Name : selinux-policy Version : 20240321-1.2 Arch : noarch Vendor : openSUSE Installed Size : 24.8 KiB Installed : Yes (automatically) Status : up-to-date Source package : selinux-policy-20240321-1.2.src Upstream URL : https://github.com/fedora-selinux/selinux-policy.git Summary : SELinux policy configuration Description : SELinux Reference Policy. A complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. 10:~ # rpm -q sdbootutil sdbootutil-1+git20240506.573a6a4-1.1.x86_64 10:~ # rpm -qf /usr/lib/systemd/systemd-pcrlock systemd-experimental-255.4-3.1.x86_64 10:~ # ls -l /etc/systemd/tpm2-pcr-public-key.pem /etc/systemd/tpm2-pcr-private-key.pem ls: cannot access '/etc/systemd/tpm2-pcr-public-key.pem': No such file or directory ls: cannot access '/etc/systemd/tpm2-pcr-private-key.pem': No such file or directory 10:~ # sdbootutil defaults to systemd-pcrlock if is is present and no previous keypair for the signed policy is present. 10:~ # semodule -DB 10:~ # systemctl start snapper-cleanup.service 10:~ # semodule -B 10:~ # ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -ts boot ---- time->Sun May 12 08:54:27 2024 type=AVC msg=audit(1715493267.232:132): avc: denied { execute } for pid=1325 comm="sdbootutil" name="systemd-pcrlock" dev="dm-0" ino=57169 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=0 ---- time->Sun May 12 08:54:27 2024 type=AVC msg=audit(1715493267.232:133): avc: denied { execute } for pid=1325 comm="sdbootutil" name="systemd-pcrlock" dev="dm-0" ino=57169 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=0 10:~ # Other denials for snapper_t are list in boo#1224120 for which I have local policy override. -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1223435] New: Get "nothing provides 'python3-packaging >= 20.9' needed by the to be installed azure-cli-core-2.36.0-150200.9.3.2.noarch" error messsage during updates
by bugzilla_noreply＠suse.com 05 Aug '24

05 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1223435 Bug ID: 1223435 Summary: Get "nothing provides 'python3-packaging >= 20.9' needed by the to be installed azure-cli-core-2.36.0-150200.9.3.2.noarch" error messsage during updates Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Cloud:Tools Assignee: public-cloud-maintainers(a)suse.de Reporter: kvanderveer(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 874524 --> https://bugzilla.suse.com/attachment.cgi?id=874524&action=edit Error from the UI When I run the update from KDE UI in the system tray, I get the following error: nothing provides 'python3-packaging >= 20.9' needed by the to be installed azure-cli-core-2.36.0-150200.9.3.2.noarch I've poked around, and tried a recommendation to install the azure-cli from CloudTools. I've got the 2.17.1 version of the azure-cli. When I ran the install, I got: Reading installed packages... There is an update candidate for 'azure-cli' from vendor 'obs://build.opensuse.org/Cloud', while the current vendor is 'SUSE LLC <https://www.suse.com/>'. Use 'zypper install azure-cli-2.59.0-144.4.noarch' to install this candidate. Resolving package dependencies... Problem: 1: nothing provides 'python3-packaging >= 20.9' needed by the to be installed azure-cli-2.36.0-150200.9.3.2.noarch Solution 1: do not install azure-cli-2.36.0-150200.9.3.2.noarch Solution 2: break azure-cli-2.36.0-150200.9.3.2.noarch by ignoring some of its dependencies I just canceled out. But I did try to install the 2.59.0 version, and essentially got the same thing. -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1225397] New: postfix gives warnings about deprecated parameters
by bugzilla_noreply＠suse.com 01 Aug '24

01 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1225397 Bug ID: 1225397 Summary: postfix gives warnings about deprecated parameters Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: freek(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- postfix gives warnings about deprecated parameters May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf: warning: /etc/postfix/main.cf: support for parameter "smtp_enforce_tls" will be removed; instead, specify "smtp_tls_security_level" May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf: warning: /etc/postfix/main.cf: support for parameter "smtpd_enforce_tls" will be removed; instead, specify "smtpd_tls_security_level" May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf: warning: /etc/postfix/main.cf: support for parameter "smtp_use_tls" will be removed; instead, specify "smtp_tls_security_level" May 27 12:27:56 localhost.localdomain cond_slp[1447]: /usr/sbin/postconf: warning: /etc/postfix/main.cf: support for parameter "smtpd_use_tls" will be removed; instead, specify "smtpd_tls_security_level" These parameters are introduced in /sbin/config.postfix The attached patch file removes this introduction, the replacements are already present in config.postfix. Also a bug in the naming of backups in /var/adm/backups/postfix is addressed. In principle "$POSTFIX_SMTP_TLS_CLIENT" == "must" should not be expanded in $PCONF -e "smtp_tls_security_level = encrypt". This is a global definition. It should be expanded in smtp_tls_policy_maps = lmdb:/etc/postfix/tls_policy and only for specific destinations in /etc/postfix/tls_policy. So the possibility "must" should be accompanied by specific destinations. -- You are receiving this mail because: You are on the CC list for the bug.

1 6