- openSUSE Bugs

[Bug 1234632] openssh-server-config-rootlogin is not preinstalled but root ssh login is still possible
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234632 https://bugzilla.suse.com/show_bug.cgi?id=1234632#c3 --- Comment #3 from Zaoliang Luo <zluo(a)suse.com> --- (In reply to Michael Pujos from comment #2) > Urgh, I missed the last part of your message. > > I have no /etc/ssh/sshd_config.d/PermitRootLogin.conf file on my system, > which has been updated for 5 years. If you want to reproduce it, please use openSUSE-Tumbleweed-ARM-JeOS-raspberrypi.aarch64-2024.12.13-Snapshot20241215.raw.xz -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232244] AUDIT-WHITELIST: xfce4-power-manager: new polkit action to pkexec xfce4-pm-helper
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1232244 https://bugzilla.suse.com/show_bug.cgi?id=1232244#c11 Wolfgang Frisch <wolfgang.frisch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(wolfgang.frisch@s | |use.com) | --- Comment #11 from Wolfgang Frisch <wolfgang.frisch(a)suse.com> --- (In reply to Manfred Hollstein from comment #10) > What is the process if such requests for other distros? Will there be an > update for e.g. openSUSE Leap 15.6? Without such an update > xfce4-power-manager fails to build for 15.6 :-( We maintain a branch of polkit-default-privs for Leap 15.6 [1]. The whitelisting process is basically the same, but only performed when a maintainer requests it explicitly. > FWIW, Xfce 4.20 has been released today, so I'd like to get the environment > clarified for Leap 15.6, too ;-) I just backported the whitelisting to Leap [2]. It can take a few days until it's released. I hope this answers your question :) [1] https://github.com/openSUSE/polkit-default-privs/tree/SLE-15-SP6 [2] https://github.com/openSUSE/polkit-default-privs/commit/01daf2cf81039625615… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234502] VUL-0: CVE-2024-45337: traefik2: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234502 https://bugzilla.suse.com/show_bug.cgi?id=1234502#c2 Johannes Weberhofer <jweberhofer(a)weberhofer.at> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P3 - Medium |P5 - None Status|NEW |RESOLVED Resolution|--- |UPSTREAM --- Comment #2 from Johannes Weberhofer <jweberhofer(a)weberhofer.at> --- The response came from the upstream developers. I have updated the release for thumbleweed, which will soon become available. > Thank you for reaching out. > > We are releasing new versions with an up-to-date version of Go that fixes the CVE. > However, Traefik has not been impacted (we are not using the SSH package). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234632] New: openssh-server-config-rootlogin is not preinstalled but root ssh login is still possible
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234632 Bug ID: 1234632 Summary: openssh-server-config-rootlogin is not preinstalled but root ssh login is still possible Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: zluo(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- install Tumbleweed on my RPi 4 Model B Mac-mini:Downloads Zaoliang$ ssh root(a)192.168.8.148 The authenticity of host '192.168.8.148 (192.168.8.148)' can't be established. ED25519 key fingerprint is SHA256:v8Q0XOxpOEqvfRlStUOVOH/LhJV7X0Zzxjlq980xkYA. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.8.148' (ED25519) to the list of known hosts. (root(a)192.168.8.148) Password: Have a lot of fun... localhost:~ # zypper se login Retrieving repository 'Open H.264 Codec (openSUSE Tumbleweed)' metadata .............................................[done] Building repository 'Open H.264 Codec (openSUSE Tumbleweed)' cache ..................................................[done] Retrieving repository 'openSUSE-Tumbleweed-Oss' metadata ............................................................[done] Building repository 'openSUSE-Tumbleweed-Oss' cache .................................................................[done] Retrieving repository 'openSUSE-Tumbleweed-Update' metadata .........................................................[done] Building repository 'openSUSE-Tumbleweed-Update' cache ..............................................................[done] Loading repository data... Reading installed packages... S | Name | Summary | Type ---+---------------------------------+-----------------------------------------------------------------------+-------- | google-guest-oslogin | Google Cloud Guest OS Login | package | kubelogin | Kubernetes client credential plugin implementing Azure authentication | package i | login_defs | The login.defs configuration file | package | openssh-server-config-rootlogin | Config to permit root logins to sshd | package | python310-Flask-Login | User session management for Flask | package | python310-oktaloginwrapper | Okta login without API token | package | python311-Flask-Login | User session management for Flask | package | python311-oktaloginwrapper | Okta login without API token | package | python312-Flask-Login | User session management for Flask | package | python312-oktaloginwrapper | Okta login without API token | package | python313-Flask-Login | User session management for Flask | package | python313-oktaloginwrapper | Okta login without API token | package | update-test-relogin-suggested | Test update that requires a session restart | package | update-test-relogin-suggested | Test-update for openSUSE Tumbleweed | patch | xlogin | xlogin, xtelnet | package localhost:~ # cat /etc/os-release NAME="openSUSE Tumbleweed" # VERSION="20241215" ID="opensuse-tumbleweed" ID_LIKE="opensuse suse" VERSION_ID="20241215" PRETTY_NAME="openSUSE Tumbleweed" ANSI_COLOR="0;32" # CPE 2.3 format, boo#1217921 CPE_NAME="cpe:2.3:o:opensuse:tumbleweed:20241215:*:*:*:*:*:*:*" #CPE 2.2 format #CPE_NAME="cpe:/o:opensuse:tumbleweed:20241215" BUG_REPORT_URL="https://bugzilla.opensuse.org" SUPPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org" DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed" LOGO="distributor-logo-Tumbleweed" localhost:~ # cat /etc/ssh/sshd_config.d/PermitRootLogin.conf # Allow root login on ssh PermitRootLogin yes -- This is surprising me really. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1233963] VUL-0: CVE-2024-11738: juliaup: rustls: accept`
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233963 https://bugzilla.suse.com/show_bug.cgi?id=1233963#c2 --- Comment #2 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1233963) was mentioned in https://build.opensuse.org/request/show/1231407 Factory / juliaup -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234621] [SELinux] full relabelling required after booting to recovery/single-user mode
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234621 https://bugzilla.suse.com/show_bug.cgi?id=1234621#c3 Filippo Bonazzi <filippo.bonazzi(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |filippo.bonazzi(a)suse.com --- Comment #3 from Filippo Bonazzi <filippo.bonazzi(a)suse.com> --- > Pardon me if I've misunderstood, but for new installations, I understood that the default would be SELinux since recently? ( https://bugzilla.opensuse.org/show_bug.cgi?id=1230118 ) That is not in effect yet. We are still working on it (as you can see the bug is in progress and all). It will be officially announced once it is (sometime next year). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234638] New: nmcli cannot start bridge-slave anymore if network cable got unplugged
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234638 Bug ID: 1234638 Summary: nmcli cannot start bridge-slave anymore if network cable got unplugged Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: zluo(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- My workstation Tumbleweed running on Lenovo Ryzen Notebook connected with docking station. docking station has wired connection directly with my router. I created a network bridge on my Tumbleweed by following: nmcli con add type bridge ifname br0 nmcli con add type bridge-slave ifname enp197s0f4u1u1 master br0 nmcli con up bridge-slave-enp197s0f4u1u1 br0 device is working and can be accessed by ip address, so far so good. Lenovo has also a working Wi-Fi connection. Then I unplugged cable of docking station because I want to move notebook. After that I plug the cable of docking station again. I see that wired connection is there, but bridge device br0 is down. So I tried to activate bridge-slave: thinkpad:~ # nmcli con show NAME UUID TYPE DEVICE enp197s0f4u1u1 5c43a6fe-c036-3651-b684-3b276f1ab084 ethernet enp197s0f4u1u1 wlp1s0 e9b2e828-a459-3f77-b373-cfd55925316b wifi wlp1s0 bridge-br0 1af4089e-3a5f-4f66-81b9-b4b52ea72695 bridge br0 lo c6c4ff25-8ab2-4a27-8905-0501f95adde3 loopback lo GL-B1300-895-5G c6b67496-ce2c-4bf3-a64a-b3b2c79556f4 wifi -- bridge-slave-enp197s0f3u1u1 6974ec15-19f7-4712-9ad3-3f2d85ea6501 ethernet -- thinkpad:~ # nmcli con up bridge-br0 Connection successfully activated (controller waiting for ports) (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/8) thinkpad:~ # nmcli con up bridge-slave-enp197s0f3u1u1 Error: Connection activation failed: No suitable device found for this connection (device enp197s0f4u1u1 not available because profile is not compatible with device (mismatching interface name)). Please let me know if you need specific logs, thanks! -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1234621] [SELinux] full relabelling required after booting to recovery/single-user mode
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234621 https://bugzilla.suse.com/show_bug.cgi?id=1234621#c2 --- Comment #2 from pallas wept <pallaswept(a)proton.me> --- (In reply to Thorsten Kukuk from comment #1) Thanks for your help Thorsten :) I tried to be brief (Poor Cathy has heard me talk enough haha) but I think I left out too much detail. > You need to add "security=selinux" to all boot entries, I followed these instructions for my migration: https://en.opensuse.org/Portal:SELinux/Setup#Setup_SELinux_on_existing_tumb… So I have that param in GRUB_CMDLINE_LINUX_DEFAULT, and that way, it will be applied to all boot entries. Except, that doesn't work for the recovery mode entries, so if we have some kind of disaster, then use recovery mode, it breaks selinux, and we need to relabel. That is the problem I hoped to resolve here, that using these recovery mode entries in grub, requires manual relabelling afterwards. To avoid this, I thought that I could add the param to GRUB_CMDLINE_LINUX_RECOVERY, but that does not exist yet, soi it felt like maybe I would be 'doing it wrong'. I also considered that, rather than putting the param in both of those entries, I could just use GRUB_CMDLINE_LINUX, which applies both to normal boot and also recovery mode, and is already present in the grub config file. However, that does not appear to be editable by yast, so I thought that the _RECOVERY entry might be best. > as the default for Tumbleweed is AppArmor and not SELinux. Pardon me if I've misunderstood, but for new installations, I understood that the default would be SELinux since recently? ( https://bugzilla.opensuse.org/show_bug.cgi?id=1230118 ) It was my intention to configure my machine as it would be for selinux on a new installation, since I assume this problem would not exist there, but I am unsure how the configuration is applied. I can see that it definitely isn't in the grub package (there, the GRUB_CMDLINE_LINUX* entries are just empty), but otherwise, I'm unsure. Perhaps this problem with recovery mode also exists in new installations? Perhaps it is intentional, to disable selinux in recovery mode, so that selinux problems can not prevent it from being functional? If so, perhaps the grub 30_os-prober script could make two entries for recovery mode, one with selinux, and one without? Sorry I'm a bit fuzzy on the details. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1220270] Leap 15.6 many haskell build failures after haskell maintenance update
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1220270 https://bugzilla.suse.com/show_bug.cgi?id=1220270#c6 Peter Simons <peter.simons(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #6 from Peter Simons <peter.simons(a)suse.com> --- Fixed by maintenance update earlier this year. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1233673] New: Update nvidia driver to latest 550.135 release
by bugzilla_noreply＠suse.com 16 Dec '24

16 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233673 Bug ID: 1233673 Summary: Update nvidia driver to latest 550.135 release Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 3rd Party Driver Assignee: gfx-bugs(a)suse.de Reporter: sndirsch(a)suse.com QA Contact: sndirsch(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Update nvidia driver to latest 550.135 release -- You are receiving this mail because: You are on the CC list for the bug.

1 4