July 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1228659] Snapshot 20240730 - unbootable after transactional-update dup
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228659 Steffen Winterfeldt <snwint(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |snwint(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228425] Trace in sysfs during setup of hvc with kernel-source 6.10.2-1.1
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228425 https://bugzilla.suse.com/show_bug.cgi?id=1228425#c10 --- Comment #10 from LTC BugProxy <bugproxy(a)us.ibm.com> --- ------- Comment From h.carstens(a)de.ibm.com 2024-07-31 10:38 EDT------- > If you take my word for it, the patch fixes it. I just tested it. I assume > Heiko Carstens will send the patch upstream and once I have some upstream > reference, I will push it to stable branch. Yes, I will take care of upstreaming this. If you want to have Tested-by and/or Reported-by tags please provide them here, and I'll add them to the patch. Thanks a lot for reporting, analyzing, and verifying! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228083] Not Sound after headset Bluetooth disconnected
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228083 https://bugzilla.suse.com/show_bug.cgi?id=1228083#c5 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #5 from Takashi Iwai <tiwai(a)suse.com> --- Good to hear. Let's close. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228425] Trace in sysfs during setup of hvc with kernel-source 6.10.2-1.1
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228425 https://bugzilla.suse.com/show_bug.cgi?id=1228425#c9 --- Comment #9 from Miroslav Franc <miroslav.franc(a)suse.com> --- (In reply to Sarah Kriesch from comment #7) > @Miroslav, can you support us in testing the patch, please? > > If we as a community want to test it, the patch has to be added to the > kernel-source project, the iso image has to be built based on it and then we > would be able to test it in openQA. If you take my word for it, the patch fixes it. I just tested it. I assume Heiko Carstens will send the patch upstream and once I have some upstream reference, I will push it to stable branch. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228425] Trace in sysfs during setup of hvc with kernel-source 6.10.2-1.1
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228425 https://bugzilla.suse.com/show_bug.cgi?id=1228425#c8 --- Comment #8 from Miroslav Franc <miroslav.franc(a)suse.com> --- (In reply to LTC BugProxy from comment #6) > Created attachment 876396 [details] > Replace dev_set_name() all > > > ------- Comment on attachment From h.carstens(a)de.ibm.com 2024-07-31 03:55 > EDT------- > > > Can you give the attched patch a try, please? Thanks a lot, not only it makes sense, but it fixes the issue, I just tried the kernel with it. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228385] New: [SELinux] denial ppp interface during boot
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228385 Bug ID: 1228385 Summary: [SELinux] denial ppp interface during boot Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: conde.philippe(a)skynet.be QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 876304 --> https://bugzilla.suse.com/attachment.cgi?id=876304&action=edit Network setting (ip a + ip r s) I have a server with latest openSUSE tumbleweed with KDE. The kernel is the xen kernel. During boot the network is started via systemd-networkd : 3 network devices eno1, eno2, eno3 When the network is up, the boot starts a ppp@.service which generate a additional device ppp0 and set a new route via ppp0 see output "ip a" and "ip_r s" ( I have sanitized the external ip address) This setting is working sicne 2 years now. I have enabled SELinux following your document https://en.opensuse.org/Portal:SELinux/Setup#Tumbleweed SELinux is in permissive mode. During the boot I see in journalctl and in audit.log a lot of AVC and denied for ppp. I'll attach 1. the related journalctl log and sealert output for some errors. 2. output of ausearch -ts today -m avc related to ppp. There are some other errors related to xen that I have removed -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1228372] New: selinux denied named access to /var/lib/named/log/dnsquery.log
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228372 Bug ID: 1228372 Summary: selinux denied named access to /var/lib/named/log/dnsquery.log Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: conde.philippe(a)skynet.be QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I have enabled SELinux in permissive mode and I receive an alert about isc-net-000x. This is related to named logging dns queries. Named is running in a jail (chroot) in journalctl I have Jul 21 08:17:50 hpprol2 setroubleshoot[197668]: SELinux is preventing isc-net-0000 from getattr access on the file /var/lib/named/log/dnsquery.log. For complete SELinux messages run: sealert -l cfcc5252-aabf-4b70-ac82-88311000965e Jul 21 08:17:50 hpprol2 setroubleshoot[197668]: SELinux is preventing isc-net-0000 from getattr access on the file /var/lib/named/log/dnsquery.log. ***** Plugin catchall_labels (83.8 confidence) suggests ******************* If you want to allow isc-net-0000 to have getattr access on the dnsquery.log file Then you need to change the label on /var/lib/named/log/dnsquery.log Do # semanage fcontext -a -t FILE_TYPE '/var/lib/named/log/dnsquery.log' where FILE_TYPE is one of the following: NetworkManager_log_t, NetworkManager_tmp_t, abrt_helper_exec_t, abrt_tmp_t, abrt_upload_watch_tmp_t, abrt_var_cache_t, abrt_var_log_t, abrt_var_run_t, acct_data_t, admin_crontab_tm> Then execute: restorecon -v '/var/lib/named/log/dnsquery.log' ***** Plugin catchall (17.1 confidence) suggests ************************** If you believe that isc-net-0000 should be allowed getattr access on the dnsquery.log file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'isc-net-0000' --raw | audit2allow -M my-iscnet0000 # semodule -X 300 -i my-iscnet0000.pp and using ausearch I havr hpprol2:/var/log/audit # ausearch -c 'isc-net-0000' --raw type=AVC msg=audit(1721495763.334:1954): avc: denied { append } for pid=2121 comm="isc-net-0000" path="/var/lib/named/log/dnsquery.log" dev="sdb2" ino=4719263 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file permissive=1 type=AVC msg=audit(1721495763.334:1955): avc: denied { getattr } for pid=2121 comm="isc-net-0000" path="/var/lib/named/log/dnsquery.log" dev="sdb2" ino=4719263 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file permissive=1 type=AVC msg=audit(1721496290.999:1960): avc: denied { append } for pid=2121 comm="isc-net-0004" path="/var/lib/named/log/dnsquery.log" dev="sdb2" ino=4719263 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file permissive=1 type=AVC msg=audit(1721496290.999:1961): avc: denied { getattr } for pid=2121 comm="isc-net-0004" path="/var/lib/named/log/dnsquery.log" dev="sdb2" ino=4719263 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file permissive=1 type=AVC msg=audit(1721498401.530:1966): avc: denied { append } for pid=2121 comm="isc-net-0002" path="/var/lib/named/log/dnsquery.log" dev="sdb2" ino=4719263 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file permissive=1 type=AVC msg=audit(1721498401.530:1967): avc: denied { getattr } for pid=2121 comm="isc-net-0002" path="/var/lib/named/log/dnsquery.log" dev="sdb2" ino=4719263 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file permissive=1 type=AVC msg=audit(1721498910.678:1975): avc: denied { append } for pid=2121 comm="isc-net-0001" path="/var/lib/named/log/dnsquery.log" dev="sdb2" ino=4719263 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file permissive=1 type=AVC msg=audit(1721498910.678:1976): avc: denied { getattr } for pid=2121 comm="isc-net-0001" path="/var/lib/named/log/dnsquery.log" dev="sdb2" ino=4719263 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file permissive=1 I found this workaround hpprol2: # semanage fcontext -a -t named_log_t "/var/lib/named/log(/.*)?" hpprol2:/var/log/audit # ls -dZ /var/lib/named/log system_u:object_r:var_lib_t:s0 /var/lib/named/log hpprol2: # restorecon -R -v /var/lib/named/log Relabeled /var/lib/named/log from system_u:object_r:var_lib_t:s0 to system_u:object_r:named_log_t:s0 Relabeled /var/lib/named/log/rpz.log from system_u:object_r:var_lib_t:s0 to system_u:object_r:named_log_t:s0 Relabeled /var/lib/named/log/dnsquery.log.1 from system_u:object_r:var_lib_t:s0 to system_u:object_r:named_log_t:s0 Relabeled /var/lib/named/log/dnsquery.log.0 from system_u:object_r:var_lib_t:s0 to system_u:object_r:named_log_t:s0 Relabeled /var/lib/named/log/xfer.log from system_u:object_r:var_lib_t:s0 to system_u:object_r:named_log_t:s0 Relabeled /var/lib/named/log/dnsquery.log from system_u:object_r:var_lib_t:s0 to system_u:object_r:named_log_t:s0 Relabeled /var/lib/named/log/dnsquery.log.2 from system_u:object_r:var_lib_t:s0 to system_u:object_r:named_log_t:s0 I think that a context is missing in this case see also https://forums.opensuse.org/t/selinux-named-and-dnsquery-log/177212 Regards Philippe -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1228659] Snapshot 20240730 - unbootable after transactional-update dup
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228659 Alberto Planas Dominguez <aplanas(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|aplanas(a)suse.com |rbrown(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228659] Snapshot 20240730 - unbootable after transactional-update dup
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228659 https://bugzilla.suse.com/show_bug.cgi?id=1228659#c2 --- Comment #2 from Alberto Planas Dominguez <aplanas(a)suse.com> --- Richard please, do not assign me Aeon issues. If I break stuff in sdbootutil or disk-encryption-tool I will address them ASAP, with high priority. It is OK to put me in CC and I will happy invest time on it for other issues that is not clear. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193273] VUL-1: CVE-2021-41190: opencontainers: OCI manifest and index parsing confusion
by bugzilla_noreply＠suse.com 31 Jul '24

31 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1193273 https://bugzilla.suse.com/show_bug.cgi?id=1193273#c19 Alexandre Vicenzi <alexandre.vicenzi(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alexandre.vicenzi(a)suse.com, | |containers-bugowner(a)suse.de Assignee|containers-bugowner(a)suse.de |security-team(a)suse.de --- Comment #19 from Alexandre Vicenzi <alexandre.vicenzi(a)suse.com> --- This issue is fixed in containerd, docker, and podman packages because in SLE 15 SP2 they have github.com/opencontainers/image-spec 1.0.1 or higher. SLE 15 SP1 is EOL, but it should not be affected as well. -- You are receiving this mail because: You are on the CC list for the bug.

1 0