August 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1228380] New: [SELinux] extreme grub error flood, grub2-mkrelpath and grub2-script-check
by bugzilla_noreply＠suse.com 01 Aug '24

01 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228380 Bug ID: 1228380 Summary: [SELinux] extreme grub error flood, grub2-mkrelpath and grub2-script-check Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: pallaswept(a)proton.me QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- This one is hammering my logs quite badly. Any assistance would be greatly appreciated. SELinux status, mode and policy name: enabled, targeted, enforcing SELinux policy version and repository: repo-oss selinux-policy The software (incl. version) that is affected by the SELinux issue and the error message: grub SELinux Audit log: The log is impossibly large due to the density of these messages. These are the two messages: Hundreds per second, in bursts ---- time->Sun Jul 28 08:00:13 2024 type=AVC msg=audit(1722117613.981:2165): avc: denied { execute } for pid=51597 comm="grub" name="grub2-mkrelpath" dev="nvme0n1p2" ino=4261726 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:bootloader_exec_t:s0 tclass=file permissive=0 Once per minute, every minute ---- time->Sun Jul 28 08:00:13 2024 type=AVC msg=audit(1722117613.985:2166): avc: denied { execute } for pid=51600 comm="grub" name="grub2-script-check" dev="nvme0n1p2" ino=4261732 scontext=system_u:system_r:snapperd_t:s0 tcontext=system_u:object_r:bootloader_exec_t:s0 tclass=file permissive=0 ---- Any other important details: Installed SElinux on existing TW system using this doc https://en.opensuse.org/Portal:SELinux/Setup#Setup_SELinux_on_existing_tumb… Thanks! -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1227739] chromium 126 keeps dumping core
by bugzilla_noreply＠suse.com 01 Aug '24

01 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1227739 https://bugzilla.suse.com/show_bug.cgi?id=1227739#c21 --- Comment #21 from Callum Farmer <gmbr3(a)opensuse.org> --- I'll be honest I have no time for this for at least 12 days Callum F -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228691] YaST2 cannot display Chinese characters properly.
by bugzilla_noreply＠suse.com 01 Aug '24

01 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228691 https://bugzilla.suse.com/show_bug.cgi?id=1228691#c7 --- Comment #7 from Steffen Winterfeldt <snwint(a)suse.com> --- Created attachment 876435 --> https://bugzilla.suse.com/attachment.cgi?id=876435&action=edit first installer screen with Chinese selected in installer If you start with English and then switch to Chinese in the installer, you see a mix of bitmap glyphs and truetype glyphs. This was done with an old Tumbleweed version (20240131). With current Tumbleweed you get missing glyphs at places where bitmap glyphs used to be. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228691] YaST2 cannot display Chinese characters properly.
by bugzilla_noreply＠suse.com 01 Aug '24

01 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228691 https://bugzilla.suse.com/show_bug.cgi?id=1228691#c6 --- Comment #6 from Steffen Winterfeldt <snwint(a)suse.com> --- Created attachment 876434 --> https://bugzilla.suse.com/attachment.cgi?id=876434&action=edit first installer screen with Chinese selected in boot loader If you have Chinese pre-selected everything looks fine. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228691] YaST2 cannot display Chinese characters properly.
by bugzilla_noreply＠suse.com 01 Aug '24

01 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228691 https://bugzilla.suse.com/show_bug.cgi?id=1228691#c5 --- Comment #5 from Steffen Winterfeldt <snwint(a)suse.com> --- The issue here is that for languages like Chinese (and Japanese, Korean) YaST dynamically loads the font package (arphic-uming-fonts.rpm for Chinese). Then parts of the UI start using uming.ttc, and some parts don't. Not sure if you have to 'refresh' QT widgets to make it aware of an updated font config or something similar. The problem is apparently not new and is also present in older Tumbleweed versions - but not so visible. I'll attach two screenshots to demonstrate the issue. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228380] [SELinux] extreme grub error flood, grub2-mkrelpath and grub2-script-check
by bugzilla_noreply＠suse.com 01 Aug '24

01 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228380 https://bugzilla.suse.com/show_bug.cgi?id=1228380#c9 --- Comment #9 from pallas wept <pallaswept(a)proton.me> --- Created attachment 876433 --> https://bugzilla.suse.com/attachment.cgi?id=876433&action=edit sudo ausearch -m AVC,USER_AVC -ts today |rg -e snapper -e grub -C 1 >~/Desktop/AVC.txt AVCs mentioning grub or snapper today. This should encapsulate behaviour before 0726 policies, with the audit2allow policy, then without; then after 0726 policies, before relabelling, and after. It is mostly the same few messages repeated, I'll see if I can find a way to avoid that in future -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228728] system marked as tainted: unmerged-bin
by bugzilla_noreply＠suse.com 01 Aug '24

01 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228728 https://bugzilla.suse.com/show_bug.cgi?id=1228728#c1 Antonio Feijoo <antonio.feijoo(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|screening-team-bugs(a)suse.de |systemd-maintainers(a)suse.de CC| |antonio.feijoo(a)suse.com --- Comment #1 from Antonio Feijoo <antonio.feijoo(a)suse.com> --- Yes, this is made on purpose since systemd-v256 by https://github.com/systemd/systemd/commit/844863c61e7b501097da84a1e4d1e4a6a… Upstream reason behind this warning: "gentle push for downstreams to merge their bin+sbin" -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1218062] python-pycurl:test test fail with curl 8.5.0
by bugzilla_noreply＠suse.com 01 Aug '24

01 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1218062 https://bugzilla.suse.com/show_bug.cgi?id=1218062#c7 --- Comment #7 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-RU-2024:2690-1: An update that contains one feature and has two fixes can now be installed. URL: https://www.suse.com/support/update/announcement/2024/suse-ru-20242690-1 Category: recommended (moderate) Bug References: 1218062, 1224797 Jira References: PED-8887 Maintenance Incident: [SUSE:Maintenance:34832](https://smelt.suse.de/incident/34832/) Sources used: openSUSE Leap 15.4 (src): python-pycurl-7.45.2-150400.13.6.3, fence-agents-4.9.0+git.1624456340.8d746be9-150400.6.7.1, python-ptyprocess-0.7.0-150400.11.5.3, python-pexpect-4.8.0-150400.15.7.3, python-pycurl-test-7.45.2-150400.13.6.3 openSUSE Leap 15.5 (src): python-pycurl-7.45.2-150400.13.6.3, python-pexpect-4.8.0-150400.15.7.3, python-pycurl-test-7.45.2-150400.13.6.3, python-ptyprocess-0.7.0-150400.11.5.3 openSUSE Leap 15.6 (src): python-pexpect-4.8.0-150400.15.7.3, python-ptyprocess-0.7.0-150400.11.5.3 Public Cloud Module 15-SP4 (src): python-pycurl-7.45.2-150400.13.6.3, python-pexpect-4.8.0-150400.15.7.3, python-pycurl-test-7.45.2-150400.13.6.3, python-ptyprocess-0.7.0-150400.11.5.3 Python 3 Module 15-SP5 (src): python-pycurl-7.45.2-150400.13.6.3, python-pexpect-4.8.0-150400.15.7.3, python-pycurl-test-7.45.2-150400.13.6.3, python-ptyprocess-0.7.0-150400.11.5.3 Python 3 Module 15-SP6 (src): python-pexpect-4.8.0-150400.15.7.3, python-ptyprocess-0.7.0-150400.11.5.3 SUSE Linux Enterprise High Availability Extension 15 SP4 (src): fence-agents-4.9.0+git.1624456340.8d746be9-150400.6.7.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): python-pycurl-7.45.2-150400.13.6.3, python-pexpect-4.8.0-150400.15.7.3, python-pycurl-test-7.45.2-150400.13.6.3, python-ptyprocess-0.7.0-150400.11.5.3 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): python-pycurl-7.45.2-150400.13.6.3, python-pexpect-4.8.0-150400.15.7.3, python-pycurl-test-7.45.2-150400.13.6.3, python-ptyprocess-0.7.0-150400.11.5.3 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): python-pycurl-7.45.2-150400.13.6.3, python-pexpect-4.8.0-150400.15.7.3, python-pycurl-test-7.45.2-150400.13.6.3, python-ptyprocess-0.7.0-150400.11.5.3 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): python-pycurl-7.45.2-150400.13.6.3, python-pexpect-4.8.0-150400.15.7.3, python-pycurl-test-7.45.2-150400.13.6.3, python-ptyprocess-0.7.0-150400.11.5.3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): python-pycurl-7.45.2-150400.13.6.3, python-pexpect-4.8.0-150400.15.7.3, python-pycurl-test-7.45.2-150400.13.6.3, python-ptyprocess-0.7.0-150400.11.5.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228380] [SELinux] extreme grub error flood, grub2-mkrelpath and grub2-script-check
by bugzilla_noreply＠suse.com 01 Aug '24

01 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228380 https://bugzilla.suse.com/show_bug.cgi?id=1228380#c8 --- Comment #8 from Cathy Hu <cathy.hu(a)suse.com> --- > ---- > time->Thu Aug 1 19:17:34 2024 > type=AVC msg=audit(1722503854.212:204): avc: denied { search } for > pid=14253 comm="grub" name="nscd" dev="tmpfs" ino=4234 > scontext=system_u:system_r:snapper_grub_plugin_t:s0 > tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir permissive=0 > ---- > time->Thu Aug 1 19:17:34 2024 > type=AVC msg=audit(1722503854.212:205): avc: denied { search } for > pid=14253 comm="grub" name="nscd" dev="tmpfs" ino=4234 > scontext=system_u:system_r:snapper_grub_plugin_t:s0 > tcontext=system_u:object_r:nscd_var_run_t:s0 tclass=dir permissive=0 > ---- > > This looks different, is less in volume, and the original two messages are > gone, should I file a new bug for that? ah thanks, yes these are new, i opened another bug: https://bugzilla.suse.com/show_bug.cgi?id=1228745 > > I'm sorry I'm a bit noob at this, would you mind telling me the command to > get the file to attach? > > I was going to attach the output of > ` sudo ausearch -m AVC,USER_AVC -c snapper -c grub >~/Desktop/ausearch.txt ` > It's ~7MB and I feel like maybe I'm doing it wrong, perhaps there's a way to > filter out all the dupes? I could filter it to just today, and that will > capture all the different states. just filter with `-ts <time>`, e.g. `ausearch -m avc -ts 19:17', i actually dont know if you could filter out duplicates with ausearch, maybe pipe into grep. or just attach the whole file :D -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228380] [SELinux] extreme grub error flood, grub2-mkrelpath and grub2-script-check
by bugzilla_noreply＠suse.com 01 Aug '24

01 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228380 Cathy Hu <cathy.hu(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1228745 -- You are receiving this mail because: You are on the CC list for the bug.

1 0