[Bug 1033296] New: AUDIT-0: kwalletmanager5: new DBus service org.kde.kcontrol.kcmkwallet5

newer
[Bug 939460] devel:gcc/gcc5: Bug...

bugzilla_noreply＠novell.com

10 Apr 2017 10 Apr '17

15:16

http://bugzilla.suse.com/show_bug.cgi?id=1033296 Bug ID: 1033296 Summary: AUDIT-0: kwalletmanager5: new DBus service org.kde.kcontrol.kcmkwallet5 Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: matthias.gerstner@suse.com QA Contact: qa-bugs@suse.de CC: lbeltrame@kde.org Found By: --- Blocker: --- It's come to the attention of the security team that the package KDE:Applications/kwalletmanager5 slipped into openSUSE:Factory and openSUSE:Leap 42.{1,2} without going through a proper DBus/polkit review. It is against policy to override the rpmlint messages for DBus/polkit via rpmlintrc. It seems this was already reviewed in bug 849739. The service obviously got renamed from kcmwallet to kcmwallet5. But maybe there's more to it. -- You are receiving this mail because: You are on the CC list for the bug.

Attachments:

attachment.htm (text/html — 3.0 KB)

Show replies by date

bugzilla_noreply＠novell.com

10 Apr 10 Apr

15:20

New subject: [Bug 1033296] AUDIT-0: kwalletmanager5: new DBus service org.kde.kcontrol.kcmkwallet5

http://bugzilla.suse.com/show_bug.cgi?id=1033296 http://bugzilla.suse.com/show_bug.cgi?id=1033296#c1 --- Comment #1 from Luca Beltrame --- As far as I can remember, it was a pure rename to allow co-existence of kcmwallet (kdelibs version) and kcmwallet5 (KF5) services on the same machine. There should be no functional changes (upstream is even considering providing a single service for both). -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

15:21

New subject: [Bug 1033296] AUDIT-0: kwalletmanager5: new DBus service org.kde.kcontrol.kcmkwallet5

http://bugzilla.suse.com/show_bug.cgi?id=1033296 http://bugzilla.suse.com/show_bug.cgi?id=1033296#c2 Luca Beltrame changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fabian@ritter-vogt.de, | |tittiatcoke@gmail.com --- Comment #2 from Luca Beltrame --- I added two more team members in case you need further information. Raymond, do you remember if it was just a rename? -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

15:26

New subject: [Bug 1033296] AUDIT-0: kwalletmanager5: new DBus service org.kde.kcontrol.kcmkwallet5

http://bugzilla.suse.com/show_bug.cgi?id=1033296 Matthias Gerstner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |matthias.gerstner@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

15:28

New subject: [Bug 1033296] AUDIT-0: kwalletmanager5: new DBus service org.kde.kcontrol.kcmkwallet5

http://bugzilla.suse.com/show_bug.cgi?id=1033296 http://bugzilla.suse.com/show_bug.cgi?id=1033296#c3 Fabian Vogt changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fvogt@suse.com --- Comment #3 from Fabian Vogt --- (In reply to Matthias Gerstner from comment #0)

...

It's come to the attention of the security team that the package KDE:Applications/kwalletmanager5 slipped into openSUSE:Factory and openSUSE:Leap 42.{1,2} without going through a proper DBus/polkit review.

It is against policy to override the rpmlint messages for DBus/polkit via rpmlintrc.

I don't see an rpmlintrc in the package, so how did that happen?

...

It seems this was already reviewed in bug 849739. The service obviously got renamed from kcmwallet to kcmwallet5. But maybe there's more to it.

Yes it did. The services do coexist for now, an implementation of kcmwallet in kwalletmanager5 is being worked on. -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

15:35

New subject: [Bug 1033296] AUDIT-0: kwalletmanager5: new DBus service org.kde.kcontrol.kcmkwallet5

http://bugzilla.suse.com/show_bug.cgi?id=1033296 http://bugzilla.suse.com/show_bug.cgi?id=1033296#c4 --- Comment #4 from Matthias Gerstner --- (In reply to fvogt@suse.com from comment #3)

...

...
It is against policy to override the rpmlint messages for DBus/polkit via rpmlintrc.

I don't see an rpmlintrc in the package, so how did that happen?

The rpmlintrc is created on-the-fly via %install section of the spec file. -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

15:58

New subject: [Bug 1033296] AUDIT-0: kwalletmanager5: new DBus service org.kde.kcontrol.kcmkwallet5

http://bugzilla.suse.com/show_bug.cgi?id=1033296 http://bugzilla.suse.com/show_bug.cgi?id=1033296#c5 --- Comment #5 from Luca Beltrame --- Proof that the files are identical: https://git.reviewboard.kde.org/r/115218/ -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

16:52

New subject: [Bug 1033296] AUDIT-0: kwalletmanager5: new DBus service org.kde.kcontrol.kcmkwallet5

http://bugzilla.suse.com/show_bug.cgi?id=1033296 http://bugzilla.suse.com/show_bug.cgi?id=1033296#c6 --- Comment #6 from Fabian Vogt --- (In reply to Matthias Gerstner from comment #4)

...

(In reply to fvogt@suse.com from comment #3)

...
...
It is against policy to override the rpmlint messages for DBus/polkit via rpmlintrc.

I don't see an rpmlintrc in the package, so how did that happen?

The rpmlintrc is created on-the-fly via %install section of the spec file.

Oh god, that's truly awful :-/ -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

11 Apr 11 Apr