June 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1226122] TW installation leaves /boot empty
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226122 https://bugzilla.suse.com/show_bug.cgi?id=1226122#c22 Lukas Ocilka <locilka(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.wilck(a)suse.com --- Comment #22 from Lukas Ocilka <locilka(a)suse.com> --- The last change in suse-module-tools-scriptlets * Wed May 22 14:00:00 2024 Martin Wilck <mwilck(a)suse.com> - Update to version 16.0.44: * Include unblacklist in initramfs (bsc#1224320) * regenerate-initrd-posttrans: run update-bootloader --refresh for XEN (bsc#1223278) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226151] Missing lxqt-qtplugin and libfm-qt qt5 versions for qt5 integration in lxqt 2.0.x
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226151 https://bugzilla.suse.com/show_bug.cgi?id=1226151#c7 --- Comment #7 from Shawn Dunn <sfalken(a)cloverleaf-linux.org> --- SR's submitted to :Factory 1180018 1180019 1180020 1180022 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226083] AUDIT-WHITELIST: valkey: new sysctl files and user+group
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226083 https://bugzilla.suse.com/show_bug.cgi?id=1226083#c4 --- Comment #4 from Wolfgang Frisch <wolfgang.frisch(a)suse.com> --- Whitelisting in progress: https://github.com/rpm-software-management/rpmlint/pull/1236 It might take a while until it lands in openSUSE:Factory, but usually not more than 1-2 days. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193596] No graphical display in Plymouth on Raspberry Pi 4
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1193596 https://bugzilla.suse.com/show_bug.cgi?id=1193596#c33 --- Comment #33 from Jonas Kvinge <jonaski(a)opensuse.org> --- I've finally solved this. Plymouth most likely gets interrupted while switching framebuffer driver, so the solution is just to add ShowDelay=3 to /etc/plymouth/plymouthd.conf, re-run dracut -f. I've tested different seconds for ShowDelay, 1 does not work, 2 and more works. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226173] virt-manager: Browse local does not work anymore
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226173 Charles Arnold <carnold(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |carnold(a)suse.com Assignee|virt-bugs(a)suse.de |carnold(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1215689] New: postfix: deamon_directory is invalid
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1215689 Bug ID: 1215689 Summary: postfix: deamon_directory is invalid Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: varkoly(a)suse.com Reporter: amajer(a)suse.com QA Contact: qa-bugs(a)suse.de CC: chris(a)computersalat.de Target Milestone: --- Found By: --- Blocker: --- Seems the default directory is wrong. # postconf -d daemon_directory daemon_directory = /usr/libexec/postfix I'm assuming this is suppose to be /usr/lib/postfix/bin ? # rpm -q postfix postfix-3.8.1-2.1.aarch64 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1226083] AUDIT-WHITELIST: valkey: new sysctl files and user+group
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226083 https://bugzilla.suse.com/show_bug.cgi?id=1226083#c3 --- Comment #3 from Wolfgang Frisch <wolfgang.frisch(a)suse.com> --- OBS project: server:database/valkey Upstream: https://github.com/valkey-io/valkey Original upstream: https://github.com/redis/redis We concluded our initial review. Due to the size and complexity, a full audit of valkey was not feasible at this point. We focused our review on a few key points: - differences from the original redis - sysctl settings - systemd unit - file system permissions - default config ### Differences from the original Redis valkey-7.2.4 is an exact copy of redis-7.2.4. The first differences arise with (this) release 7.2.5. We went through the complete diff and found no obvious security-related changes. Most changes are just debranding and API compatibility fixes. There were a few commits missing in valkey-7.2.5 (compared to redis-7.2.5): - Missing fix for: https://github.com/redis/redis/issues/12864 - Missing unit tests for: https://github.com/redis/redis/pull/13004 - Missing bug fix: https://github.com/redis/redis/commit/b3aaa0a1362d229ba1ecd44629655f76c7730… - Missing bug fix: https://github.com/redis/redis/commit/bad33f8738b4be5f58c4439a0c78312e4afbe… - Missing bug fix: https://github.com/redis/redis/commit/1e8dc1da0de0add40d56fcbab9b64a3c5e61b… As far as we can tell, none of this is security-related. OK from a security PoV. ### sysctl settings The two sysctl settings are identical to Redis. It's a bit unfortunate that `vm.overcommit_memory=1` is set system-wide just by installing this package. As it was already noted by mgerstner in another bug, it would be an improvement to just set this sysctl option in a systemd unit, when valkey is actually started. If valkey ran as root, it would be simple with ``` ExecStartPre=sysctl vm.overcommit_memory=1 ``` However, since the valkey service (correctly) drops its privileges, this would have to be implemented in a separate systemd unit. Not a problem from a security PoV though. OK from our side. ### systemd unit Upstream's systemd unit lacks systemd hardenings and doesn't drop privileges by default but fortunately the (open)SUSE package ships its own much improved systemd. Good! I tested a few additional hardenings with no apparent problems: ``` --- valkey@.service.orig 2024-06-11 11:13:59.169323953 +0200 +++ valkey@.service 2024-06-06 20:26:20.000000000 +0200 @@ -8,8 +8,6 @@ User=valkey Group=valkey PrivateTmp=true -# added automatically, for details please see -# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort ProtectSystem=full ProtectHome=true PrivateDevices=true @@ -20,7 +18,11 @@ ProtectKernelLogs=true ProtectControlGroups=true RestrictRealtime=true -# end of automatic additions +MemoryDenyWriteExecute=true +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=true +RestrictSUIDSGID=true + PIDFile=/run/valkey/%i.pid ExecStart=/usr/bin/val ``` ``` --- valkey-sentinel@.service.orig 2024-06-11 11:15:04.960116608 +0200 +++ valkey-sentinel@.service 2024-06-11 11:15:35.650486709 +0200 @@ -8,8 +8,6 @@ User=valkey Group=valkey PrivateTmp=true -# added automatically, for details please see -# https://en.opensuse.org/openSUSE:Security_Features#Systemd_hardening_effort ProtectSystem=full ProtectHome=true PrivateDevices=true @@ -20,7 +18,11 @@ ProtectKernelLogs=true ProtectControlGroups=true RestrictRealtime=true -# end of automatic additions +MemoryDenyWriteExecute=true +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=true +RestrictSUIDSGID=true + ReadWritePaths=/etc/valkey PIDFile=/run/valkey/sentinel-%i.pid ExecStart=/usr/bin/valkey-sentinel /etc/valkey/sentinel-%i.conf ``` It would be great if you could include these changes, even though they're not strictly necessary. We will whitelist the package either way. ### File system permissions No problems here. OK. ### Default config Valkey's default config is well-documented with sane defaults. - Binds to localhost only by default. Good! - In all cases where the user is asked to create files or directories, correct file system permissions are mentioned. Good! ## Summary We might conduct an in-depth audit in the future, but for now we can safely whitelist this package. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226186] VUL-0: CVE-2024-5480: python-torch: remote code execution in torch.distributed.rpc framework
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226186 Camila Camargo de Matos <camila.matos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|security-team(a)suse.de |wolfgang.engel(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226186] VUL-0: CVE-2024-5480: python-torch: remote code execution in torch.distributed.rpc framework
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226186 Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226186] VUL-0: CVE-2024-5480: python-torch: remote code execution in torch.distributed.rpc framework
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226186 SMASH SMASH <smash_bz(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |CVSSv3.1:SUSE:CVE-2024-5480 | |:9.8:(AV:N/AC:L/PR:N/UI:N/S | |:U/C:H/I:H/A:H) -- You are receiving this mail because: You are on the CC list for the bug.

1 0