May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1223538] [SELinux] Installing selinux-policy-targeted with recommends enabled brings in 600 packages
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223538 https://bugzilla.suse.com/show_bug.cgi?id=1223538#c6 Filippo Bonazzi <filippo.bonazzi(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #6 from Filippo Bonazzi <filippo.bonazzi(a)suse.com> --- Yeah that looks right. I'll keep tabs on the Factory request until it's merged. I'm closing this bug now, but feel free to reopen if the issue should persist. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1194510] telegraf fails to pass legal review
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1194510 https://bugzilla.suse.com/show_bug.cgi?id=1194510#c3 Wolfgang Engel <wolfgang.engel(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|IN_PROGRESS |RESOLVED --- Comment #3 from Wolfgang Engel <wolfgang.engel(a)suse.com> --- Looks like the bugreport can be closed since telegraf got updated. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223538] [SELinux] Installing selinux-policy-targeted with recommends enabled brings in 600 packages
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223538 https://bugzilla.suse.com/show_bug.cgi?id=1223538#c5 --- Comment #5 from Alexandru Bradatan <alex.bradatan85(a)yahoo.it> --- Created attachment 874623 --> https://bugzilla.suse.com/attachment.cgi?id=874623&action=edit Zypper output with networkx as suggets -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223538] [SELinux] Installing selinux-policy-targeted with recommends enabled brings in 600 packages
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223538 https://bugzilla.suse.com/show_bug.cgi?id=1223538#c4 --- Comment #4 from Alexandru Bradatan <alex.bradatan85(a)yahoo.it> --- (In reply to Filippo Bonazzi from comment #3) > Sorry, wrong copy-paste. > > The fix is on its way to Factory in > https://build.opensuse.org/request/show/1171339 > > In the meantime, if you want you can test by installing setools from the > devel project > https://build.opensuse.org/package/show/security:SELinux/setools Tested installing selinux-policy on a fresh distrobox container with the devel repo enabled and can confirm that now it pulls down what is expected (40-ish packages and ~100MB of installed size). I am attaching the zypper output in any case, if you want to check it. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223457] zypper fails to search for modalias supplements.
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223457 https://bugzilla.suse.com/show_bug.cgi?id=1223457#c1 Michael Andres <ma(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low --- Comment #1 from Michael Andres <ma(a)suse.com> --- We probably need a different case for handling namespace dependencies. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223457] zypper fails to search for modalias supplements.
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223457 Michael Andres <ma(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CONFIRMED -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1134132] AUDIT-STALE: deepin-file-manager: new dbus of deepin-file-manager
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1134132 https://bugzilla.suse.com/show_bug.cgi?id=1134132#c18 --- Comment #18 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- (In reply to matthias.gerstner(a)suse.com from comment #2) > This dde-file-manager-daemon is a security nightmare! None of the D-Bus > methods it exports are protected by polkit so just any user can call them. > While this is not generally a problem it *is* a problem here, because the > exported methods allow a bunch of privileged operations to everybody. > > Findings about the daemon in general: > > - in the D-Bus configuration file com.deepin.filemanager.daemon.conf we find > the following: > > ``` >  > <policy user="root"> > <allow own="com.deepin.filemanager.daemon"/> > </policy> > >  > <policy context="default"> > <allow own="com.deepin.filemanager.daemon"/> > ``` > > There are two "own=" lines one for root and one for everybody else. This > allows any user to register this daemon (or actually: any program) on the > D-Bus system bus. It allows to hijack other users' D-Bus connections. This > is especially bad since for example in the method `setUserSharePassword` > cleartext passwords are passed. This is still the same in the current package. This needs to be fixed. > - the daemon creates a log file in `/var/cache/deepin/dde-file-manager-daemon`. > First of all this is not the right place for a log file. Log files belong to > /var/log or /var/lib at best. Furthermore the log file is world readable > which should be avoided for logs originating from privileged programs. The file seems not to be created any more, but I don't know what is used instead. Probably into the systemd journal? > - the checkAuthorization() call (which is unused actually at the moment) uses > the deprecated polkit UnixProcessSubject with PIDs again. Like in the other > Deepin programs this needs to be changed to use the D-Bus SystemBusName > subject. This is now used and also uses the system bus name. Looks okay. > Findings in the UserShareManager interface: > > - setUserSharePassword: allows to set arbitrary users' smd password. Changes > the database in /var/lib/samba/private. If at all then this must only be > allowed for the caller's username. This is now Polkit authenticated. The name is still passed unfiltered to `smbpasswd`, though. It could be a command line parameter "--evil". This should be filtered. > - addGroup: calls `groupadd` so regular users can create arbitrary groups. Not > acceptable. Not acceptable interface without admin protection. > - addUserToGroup: allows arbitrary users to add arbitrary other users to > arbitrary other groups. Luckily doesn't work on SUSE, because > `/usr/sbin/adduser` is called but we have `useradd`. Not acceptable > interface without admin-protection. > - restartSambaService calls `smbd restart`, shouldn't this go out to systemd > instead? Must also be authenticated. These methods no longer exist. > Findings in the TagManagerDaemon: > > - disposeClientData: manages some tags for files that are stored in a per > filesystem SQLite database. Doesn't look trustworthy. Why should everybody > be able to fiddle with tags? This no longer seems to exist. > Findings in UsbFormatter: > > - mkfs: create jfs, ext2/3/4, btrfs, swap, hfs, dosfs, xfs, reiserfs on > arbitrary paths. This can overwrite arbitrary regular files, too, if they > are large enough. Not acceptable interface without admin-authentication. This no longer seems to exist. > Findings in DeviceInfoManager: > > The methods in this interface are somehwat okay but they still allow to call > lsblk and various low level file system information tools on arbitrary block > devices or other paths. This no longer seems to exist. Newly added D-Bus methods: - com.deepin.filemanager.daemon.MountControl.Mount: allows to mount file systems, not Polkit authenticated. There is support for "common" file systems, which is not implemented though. Then there's "cifs" which allows pretty much freedom about passing strings to "mkdir()" and to "mount()", creates directories with user controlled data in /media/<username>/samba. In principle allows "../" elements in paths, only the `mkdir()` luckily fails to follow them. Then there's a "dlnfs" file system plugin which looks for a "dlnfs" program before continuing. I couldn't find out what program this is supposed to be. It's not packaged on openSUSE anyway. A user controlled path is passed as command line argument to this program, which might allow privilege escalation, but I cannot say for sure, since I don't know the program. - com.deepin.filemanager.daemon.MountControl.Unmount: allows to unmount some file systems. The plugins that deal with this use libmount mtab for finding out about already existing mounts. This could be tricked by users that are allowed to mount FUSE based file systems. They can choose arbitrary strings as "source device" that might confuse the logic in the plugins. - com.deepin.filemanager.daemon.UserShareManager.CloseSmbShareByShareName: this tries to unmount a share via "smbcontrol smbd close-share %1", where %1 is a user controlled string. There is no Polkit authentication. There are some checks that the resulting path is not a symlink or an escape out of /var/lib/samba/usershares. If somebody managed to mount a samba share under a weird name like "myshare --extra-parameter=this", then the resulting QProcess execution of smbcontrol might result in side effects. - com.deepin.filemanager.daemon.UserShareManager.EnableSmbServices: allow to enable smbd and nmbd without authentication. This must be authenticated. - com.deepin.filemanager.daemon.AccessControlManager: + SetAccessPolicy(): uses an unsafe utils::isValidInvoker() helper function that checks the callers /proc/%1/exe. This is a racy check that can we circumvented by unprivileged callers by replacing their process with one of the whitelisted ones. + SetVaultAccessPolicy(): use the same unsafe check + Chmod(): Allows to change the mode of arbitrary paths. Luckily Polkit authenticated. But there is a file existence check issue in there. If the file doesn't exist, then the call exists early without authenticating. Thus a caller can determine whether certain files exist or not, by observing whether Polkit authentication requests are sent out or not. Overall this service still isn't fit for inclusion for a lot of reasons. Most if not all of the D-Bus methods need to Polkit authenticated (they can have a 'yes' setting for active users, if the methods don't allow highly privileged things. But nobody & friends should not be allowed to call all these methods. Other shaky authentication tests should be dropped like this utils::isValidInvoker(). The D-Bus configuration "own" line still needs to be fixed. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1222345] Laptop wakes from suspend once the user closes the lid
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1222345 https://bugzilla.suse.com/show_bug.cgi?id=1222345#c16 --- Comment #16 from Takashi Iwai <tiwai(a)suse.com> --- Ah interesting. Tristan, could you check whether the workaround mentioned for Arch works for you, too? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1221361] /etc/profile.d/alljava.csh sets JAVA_HOME incorrectly
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1221361 https://bugzilla.suse.com/show_bug.cgi?id=1221361#c14 --- Comment #14 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-RU-2024:1487-1: An update that has four fixes can now be installed. Category: recommended (moderate) Bug References: 1211721, 1221361, 1221407, 1222547 Maintenance Incident: [SUSE:Maintenance:32998](https://smelt.suse.de/incident/32998/) Sources used: openSUSE Leap Micro 5.3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 openSUSE Leap Micro 5.4 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 openSUSE Leap 15.5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise Micro for Rancher 5.3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise Micro 5.3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise Micro for Rancher 5.4 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise Micro 5.4 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise Micro 5.5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 Basesystem Module 15-SP5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 Development Tools Module 15-SP5 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Manager Proxy 4.3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Manager Retail Branch Server 4.3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Manager Server 4.3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Enterprise Storage 7.1 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise Micro 5.2 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 SUSE Linux Enterprise Micro for Rancher 5.2 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 openSUSE Leap 15.3 (src): aaa_base-84.87+git20180409.04c9dae-150300.10.17.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1222929] nsjail fails to build on Leap 15.6 error: variable or field 'LogHandler' declared void
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1222929 https://bugzilla.suse.com/show_bug.cgi?id=1222929#c1 Johannes Segitz <jsegitz(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #1 from Johannes Segitz <jsegitz(a)suse.com> --- yes, thanks for the report -- You are receiving this mail because: You are on the CC list for the bug.

1 0