- openSUSE Bugs

[Bug 1234448] When sharing Yubikey from the host, I get "can't set config #1, error -32"
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234448 https://bugzilla.suse.com/show_bug.cgi?id=1234448#c5 --- Comment #5 from Fabian Vogt <fvogt(a)suse.com> --- (In reply to Alberto Planas Dominguez from comment #4) > (In reply to Fabian Vogt from comment #3) > > Right, that's unrelated and means your user is not member of the "kvm" > > group. > > I see, now I have: > > spice-client-error-quark: Could not redirect Yubico YubiKey OTP+FIDO+CCID > [1050:0407] at 1-73: Device is in use by another application (0) > > For what I read this is similar to the -EPIPE error that I had? One > explanation is that libusb is not able to delegate ownership. Did you remove the device from the static redirection to the VM? If yes, it might be some other process that has the usb device opened: fuser sudo fuser /dev/bus/usb/001/XXX (with XXX being the device number of the yubikey on that bus). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234448] When sharing Yubikey from the host, I get "can't set config #1, error -32"
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234448 https://bugzilla.suse.com/show_bug.cgi?id=1234448#c4 Alberto Planas Dominguez <aplanas(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(aplanas(a)suse.com) | --- Comment #4 from Alberto Planas Dominguez <aplanas(a)suse.com> --- (In reply to Fabian Vogt from comment #3) > Right, that's unrelated and means your user is not member of the "kvm" > group. I see, now I have: spice-client-error-quark: Could not redirect Yubico YubiKey OTP+FIDO+CCID [1050:0407] at 1-73: Device is in use by another application (0) For what I read this is similar to the -EPIPE error that I had? One explanation is that libusb is not able to delegate ownership. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1233149] New: System got stuck in "setting up" screen on first boot
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233149 Bug ID: 1233149 Summary: System got stuck in "setting up" screen on first boot Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: rbrown(a)suse.com Reporter: lzcoder(a)proton.me QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 878470 --> https://bugzilla.suse.com/attachment.cgi?id=878470&action=edit journalctl -p crit After installing the system with 20241106 image, it got stuck at the “setting up” screen on first boot. In my case I waited more than 30 minutes (in previous installations I didn't have to wait that long) and after waiting I restarted my system and everything seems to work correctly. -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1234448] When sharing Yubikey from the host, I get "can't set config #1, error -32"
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234448 https://bugzilla.suse.com/show_bug.cgi?id=1234448#c3 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(aplanas(a)suse.com) --- Comment #3 from Fabian Vogt <fvogt(a)suse.com> --- (In reply to Alberto Planas Dominguez from comment #2) > Interesting, no. Fails in my system: > > "g-exec-error-quark: Could not redirect Yubico YubiKey OTP+FIDO+CCID > [1050:0407] at 1-68: Failed to execute child process > "/usr/bin/spice-client-glib-usb-acl-helper" (Permission denied) (3)" Right, that's unrelated and means your user is not member of the "kvm" group. You could also do sudo setfacl -m u:$USER:rwx /usr/bin/spice-client-glib-usb-acl-helper temporarily. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1230118] [SELinux] Select SELinux as default MAC in enforcing mode in the tumbleweed installer
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1230118 https://bugzilla.suse.com/show_bug.cgi?id=1230118#c14 --- Comment #14 from Cathy Hu <cathy.hu(a)suse.com> --- pasting the progress update from the email to factory: Progress Update: SELinux as default MAC system on new Tumbleweed installations We would like to give you a progress update about the change of the default mandatory access control (MAC) system selection in the Tumbleweed installer from AppArmor to SELinux. For context, please refer to the email: "RFC: SELinux as default MAC system on new Tumbleweed installations" sent to this list on 2024-07-19. What has been done so far: We have prepared the change [0] in the Yast installer, which selects SELinux in enforcing mode as the default MAC system instead of AppArmor. ** This change, however, is *not* in Tumbleweed yet. This means that the MAC system selected by default in the installer is still AppArmor at this time. ** During testing, we found and fixed multiple bugs on the distribution side, with major help from different teams and people, especially Fabian Vogt from the Future Technologies team (thanks!). However, there is still a long way to go, as there are still blockers on the list [1], so it will take some more time. Additionally, openQA tests were assuming AppArmor as the only MAC system in some cases, so they needed to be adjusted to the change, and additional tests added for SELinux. Thanks to the openQA devs, especially the qe-core squad, multiple tickets have already been resolved. However, same as on the distribution side, there are still a lot of topics open [2]. Timeline update: We announced in our last email that we aimed to make this change latest by the end of 2024. Unfortunately, this goal was too optimistic and there is still a lot of work to do. Moving forward, we want to make the change in 2025, and I will provide you with further updates about the progress. TL;DR: - The default MAC system selected by the Tumbleweed installer at this time is still AppArmor. - During testing, we found some bugs on the distribution side, many of which have been resolved by now, but some are still open blockers. - openQA tests are being adjusted to the change as well, but there are still some that are not done yet. - We will move forward with a different timeline (2025, instead of end of 2024). - We are not introducing any other change to the previous plan. [0] https://build.opensuse.org/request/show/1198720 [1] https://bugzilla.suse.com/show_bug.cgi?id=1230118 [2] https://progress.opensuse.org/issues/166613 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232244] New: AUDIT-0: xfce4-power-manager: New PolKit rules added
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1232244 Bug ID: 1232244 Summary: AUDIT-0: xfce4-power-manager: New PolKit rules added Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: manfred.h(a)gmx.net QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 878186 --> https://bugzilla.suse.com/attachment.cgi?id=878186&action=edit Full build log xfce4-power-manager-4.19.3 has added polkit rules [ 43s] RPMLINT report: [ 43s] =============== [ 44s] xfce4-power-manager.x86_64: E: polkit-unauthorized-privilege (Badness: 10000) org.xfce.power.xfce4-pm-helper (auth_admin:auth_admin:yes) [ 44s] The package allows unprivileged users to carry out privileged operations [ 44s] without authentication. This could cause security problems if not done [ 44s] carefully. If the package is intended for inclusion in any SUSE product please [ 44s] open a bug report to request review of the package by the security team. [ 44s] Please refer to [ 44s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for [ 44s] more information. [ 44s] [ 44s] (none): E: badness 10000 exceeds threshold 1000, aborting. OBS repo: https://build.opensuse.org/package/show/home:manfred-h:X11:xfce:4.19/xfce4-… -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1234632] openssh-server-config-rootlogin is not preinstalled but root ssh login is still possible
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234632 https://bugzilla.suse.com/show_bug.cgi?id=1234632#c4 Thorsten Kukuk <kukuk(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |INVALID --- Comment #4 from Thorsten Kukuk <kukuk(a)suse.com> --- (In reply to Zaoliang Luo from comment #3) > If you want to reproduce it, please use > openSUSE-Tumbleweed-ARM-JeOS-raspberrypi.aarch64-2024.12.13-Snapshot20241215. > raw.xz Why was this really important information missing in the initial bug report? "Install Tumbleweed on my RPi 4 Model B" sounded like you used YaST and not a disk image. Thus invalid, since it is even documented that this file exists and why: #====================================== # Latest openssh disables root login by default # Re-enable it as we do not use 1st boot for now, # so root is the only account by default #-------------------------------------- cat > /etc/ssh/sshd_config.d/PermitRootLogin.conf <<EOF # Allow root login on ssh PermitRootLogin yes EOF (In reply to Zaoliang Luo from comment #3) > (In reply to Michael Pujos from comment #2) > > Urgh, I missed the last part of your message. > > > > I have no /etc/ssh/sshd_config.d/PermitRootLogin.conf file on my system, > > which has been updated for 5 years. > > If you want to reproduce it, please use > openSUSE-Tumbleweed-ARM-JeOS-raspberrypi.aarch64-2024.12.13-Snapshot20241215. > raw.xz -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234448] When sharing Yubikey from the host, I get "can't set config #1, error -32"
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234448 https://bugzilla.suse.com/show_bug.cgi?id=1234448#c2 Alberto Planas Dominguez <aplanas(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(aplanas(a)suse.com) | --- Comment #2 from Alberto Planas Dominguez <aplanas(a)suse.com> --- Interesting, no. Fails in my system: "g-exec-error-quark: Could not redirect Yubico YubiKey OTP+FIDO+CCID [1050:0407] at 1-68: Failed to execute child process "/usr/bin/spice-client-glib-usb-acl-helper" (Permission denied) (3)" -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234621] [SELinux] full relabelling required after booting to recovery/single-user mode
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234621 https://bugzilla.suse.com/show_bug.cgi?id=1234621#c4 --- Comment #4 from Thorsten Kukuk <kukuk(a)suse.com> --- (In reply to pallas wept from comment #2) > > as the default for Tumbleweed is AppArmor and not SELinux. > > Pardon me if I've misunderstood, but for new installations, I understood > that the default would be SELinux since recently? > ( https://bugzilla.opensuse.org/show_bug.cgi?id=1230118 ) Doesn't matter, the default LSM in the kernel is AppArmor on Tumbleweed and "security=selinux" needs always be set, else AppArmor is enabled and SELinux stays disabled. Changing the kernel default is not possible as this would break all existing systems out there. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234448] When sharing Yubikey from the host, I get "can't set config #1, error -32"
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234448 https://bugzilla.suse.com/show_bug.cgi?id=1234448#c1 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(aplanas(a)suse.com) CC| |aplanas(a)suse.com, | |fvogt(a)suse.com --- Comment #1 from Fabian Vogt <fvogt(a)suse.com> --- I tried it using the runtime redirection here (VM menu -> USB redirection) and it worked fine. Can you confirm? -- You are receiving this mail because: You are on the CC list for the bug.

1 0