May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1211374] AUDIT-WHITELIST: deepin-app-services: new dbus services of deepin-app-services
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1211374 https://bugzilla.suse.com/show_bug.cgi?id=1211374#c15 --- Comment #15 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- Sorry to warm this up again, but looking into the D-Bus API once more, I see that it _still_ allows to open arbitrary JSON files. This still works through the `appid` argument: gdbus call -y -d org.desktopspec.ConfigManager -o / \ -m org.desktopspec.ConfigManager.acquireManager \ /../../../../../../../var/lib/nobody myfile myfile This results in the following strace calls in the daemon: [pid 3856] access("/usr/share/dsg/configs//../../../../../../../var/lib/nobody/myfile.json", F_OK) = 0 [pid 3856] openat(AT_FDCWD, "/usr/share/dsg/configs//../../../../../../../var/lib/nobody/myfile.json", O_RDONLY|O_CLOEXEC) = 8 Apart from this I wonder why the daemon user's home directory is world-readable: $ ls -lhd /var/lib/dde-dconfig-daemon drwxr-xr-x 6 dde-dconfig-daemon dde-dconfig-daemon 4.0K May 2 11:45 /var/lib/dde-dconfig-daemon Also the home directory contains the skeleton entries: $ find /var/lib/dde-dconfig-daemon dde-dconfig-daemon/ dde-dconfig-daemon/.bashrc dde-dconfig-daemon/.local dde-dconfig-daemon/.local/share dde-dconfig-daemon/.local/share/fonts dde-dconfig-daemon/.local/bin dde-dconfig-daemon/.local/state dde-dconfig-daemon/bin dde-dconfig-daemon/.emacs dde-dconfig-daemon/.bash_history dde-dconfig-daemon/.config dde-dconfig-daemon/.profile dde-dconfig-daemon/.inputrc dde-dconfig-daemon/.i18n dde-dconfig-daemon/.xim.template dde-dconfig-daemon/.cache dde-dconfig-daemon/.cache/deepin dde-dconfig-daemon/.cache/deepin/dde-dconfig-daemon dde-dconfig-daemon/.cache/deepin/dde-dconfig-daemon/dde-dconfig-daemon.log I'm not sure how that happens, but it is unclean. This is a service user that should not have these skeleton files or any other regular home directory data. The ".cache" directory has mode 0700 at least, so the log file found in there won't be world-readable at least. Please address the remaining D-Bus issue, also have a look into acquireManagerV2 if it contains any such problems. Also have a look into the home directory curiosity, if it can be improved. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1175678] complete packages --unneeded featureset (mostly "apt-mark auto")
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1175678 https://bugzilla.suse.com/show_bug.cgi?id=1175678#c13 --- Comment #13 from Michael Andres <ma(a)suse.com> --- (In reply to Moritz Duge from comment #12) > Unfortunately zypper is still missing an "apt-mark auto" equivalent > (workaround below). Yes, this together with a 'remove unneeded' got interrupted (again) by more urgent tasks. I hope we can finish it after the vacations. Also new and hopefully useful to cleanup orphaned/dropped packages: zypper dup --remove-orphaned > BY THE WAY: > I didn't know that one yet :-) > zypper install-new-recommends IMO best as `zypper inr --no-recommends`, so it's restricted to new hardware, filesystem and language supporting packages. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223673] kubernetes update
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223673 Dan Čermák <dcermak(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |containers-bugowner(a)suse.de Assignee|containers-bugowner(a)suse.de |priyanka.saggu(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223534] VUL-1: CVE-2024-34020: hcode: out-of-bounds write in putSDN()
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223534 https://bugzilla.suse.com/show_bug.cgi?id=1223534#c9 Wolfgang Frisch <wolfgang.frisch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|IN_PROGRESS |RESOLVED --- Comment #9 from Wolfgang Frisch <wolfgang.frisch(a)suse.com> --- Patch accepted by Factory -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223169] gcc14 compilation fails
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223169 Bernhard Wiedemann <bwiedemann(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |https://gcc.gnu.org/bugzill | |a/show_bug.cgi?id=114895 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223169] gcc14 compilation fails
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223169 Richard Biener <rguenther(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://gcc.gnu.org/bugzill | |a/show_bug.cgi?id=114895 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223623] New: [15.6-DVD-Backports] openQA test fails in orphaned_packages_check - There have been unexpected orphans detected
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223623 Bug ID: 1223623 Summary: [15.6-DVD-Backports] openQA test fails in orphaned_packages_check - There have been unexpected orphans detected Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: deepthi.venkatachala(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- There have been unexpected orphans detected, phonon4qt5-backend-gstreamer,phonon4qt5-backend-gstreamer-lang Please find the openqa test results as below: opensuse-15.6-DVD-Backports-Incidents-x86_64-Build20240325-1-install_with_updates_kde@uefi-2G [orphaned_packages_check](https://openqa.opensuse.org/tests/4036510#step/orp… Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223444] New virt-v2v dependency on btrfsprogs causes error with zypper dup on systems without btrfs installed
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223444 https://bugzilla.suse.com/show_bug.cgi?id=1223444#c6 --- Comment #6 from Claudio Fontana <claudio.fontana(a)suse.com> --- (In reply to Rodney Baker from comment #5) > Surely this can be dealt with through documentation and/or a warning: "You > must have the relevant filesystem tools installed for the filesystems used > by the guest VM you are about to convert", or words to that effect. No, It would be almost impossible for users to track down the nest of runtime requirements. If you don't want virt-v2v, do not install it. If you want a functional virt-v2v, you need all required runtime dependencies, or the conversions _will_ fail. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223169] gcc14 compilation fails
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223169 https://bugzilla.suse.com/show_bug.cgi?id=1223169#c11 Bernhard Wiedemann <bwiedemann(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|WORKSFORME |--- --- Comment #11 from Bernhard Wiedemann <bwiedemann(a)suse.com> --- Found the correct reproducer now: osc build --noservice --vm-type=kvm \ --build-opt=--vm-custom-opt=-rtc\ base=2038-01-20T00:00:00 standard x86_64 while a 2037 build worked fine, so (surpisingly) it is a year-2038 issue. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223444] New virt-v2v dependency on btrfsprogs causes error with zypper dup on systems without btrfs installed
by bugzilla_noreply＠suse.com 02 May '24

02 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223444 https://bugzilla.suse.com/show_bug.cgi?id=1223444#c5 --- Comment #5 from Rodney Baker <rodney.baker(a)iinet.net.au> --- Surely this can be dealt with through documentation and/or a warning: "You must have the relevant filesystem tools installed for the filesystems used by the guest VM you are about to convert", or words to that effect. -- You are receiving this mail because: You are on the CC list for the bug.

1 0