[Bug 1191571] New: After upgrade to Leap 15.3, hylafax not running anymore / link across device borders
http://bugzilla.opensuse.org/show_bug.cgi?id=1191571 Bug ID: 1191571 Summary: After upgrade to Leap 15.3, hylafax not running anymore / link across device borders Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Upgrade Problems Assignee: screening-team-bugs@suse.de Reporter: axel.braun@gmx.de QA Contact: jsrain@suse.com Found By: --- Blocker: --- hylafax+ was running properly since years, however, after upgrade to Leap 15.3 its broken. Started all over with a new installation, and while running faxsetup I get the message: /usr/bin/ln: Die harte Verkn�pfung '/var/spool/hylafax/etc/setup.modem' => '/etc/hylafax/setup.modem' konnte nicht angelegt werden: Ung�ltiger Link �ber Ger�tegrenzen hinweg /usr/bin/ln: Die harte Verkn�pfung '/var/spool/hylafax/etc/setup.cache' => '/etc/hylafax/setup.cache' konnte nicht angelegt werden: Ung�ltiger Link �ber Ger�tegrenzen hinweg (Translation: Hard link ... could not be created - invalid link across device borders) Disk layout is standard: southpole:/home/axel # more /etc/fstab UUID=c8fb8c4a-8c3c-4225-9742-450573aac089 swap swap defaults 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac / btrfs defaults 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /boot/grub2/i386-pc btrfs subvol=@/boot/grub2/i386-pc 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /boot/grub2/x86_64-efi btrfs subvol=@/boot/grub2/x86_64-efi 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /opt btrfs subvol=@/opt 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /srv btrfs subvol=@/srv 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /tmp btrfs subvol=@/tmp 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /usr/local btrfs subvol=@/usr/local 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /var/cache btrfs subvol=@/var/cache 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /var/crash btrfs subvol=@/var/crash 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /var/lib/libvirt/images btrfs subvol=@/var/lib/libvirt/images 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /var/lib/machines btrfs subvol=@/var/lib/machines 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /var/lib/mailman btrfs subvol=@/var/lib/mailman 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /var/lib/mariadb btrfs subvol=@/var/lib/mariadb 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /var/lib/mysql btrfs subvol=@/var/lib/mysql 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /var/lib/named btrfs subvol=@/var/lib/named 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /var/lib/pgsql btrfs subvol=@/var/lib/pgsql 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /var/log btrfs subvol=@/var/log 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /var/opt btrfs subvol=@/var/opt 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /var/spool btrfs subvol=@/var/spool 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /var/tmp btrfs subvol=@/var/tmp 0 0 UUID=b05f8473-3b49-4724-88e3-b75f0f069cac /.snapshots btrfs subvol=@/.snapshots 0 0 UUID=50F1-50BB /boot/efi vfat umask=0002,utf8=true 0 0 UUID=a72b88fc-ea8f-42b4-87f4-369848842cdd /daten xfs defaults 0 0 UUID=66b30a37-0630-41ad-ae6a-6f6e042e530f /home xfs defaults 0 0 # /dev/system/daten /daten ext4 defaults 1 2 # /dev/system/home /home ext4 defaults 1 2 Something seems to be treated different in SLE vs. Leap... -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1191571 http://bugzilla.opensuse.org/show_bug.cgi?id=1191571#c1 --- Comment #1 from Axel Braun <axel.braun@gmx.de> --- Answer from the author of hylafax: This stems from attempts to address CVE-2020-15397. See: https://nvd.nist.gov/vuln/detail/CVE-2020-15397 The various commits that were undertaken to address this are: https://sourceforge.net/p/hylafax/HylaFAX+/2534/ https://sourceforge.net/p/hylafax/HylaFAX+/2557/ https://sourceforge.net/p/hylafax/HylaFAX+/2569/ https://sourceforge.net/p/hylafax/HylaFAX+/2574/ Basically the issue is that setup.cache and setup.modem get included/invoked by both root and the fax user (often "uucp"), and we need to ensure that if the fax user gets compromised and rewrites /var/spool/hylafax/etc/setup.(cache|modem) that any use by root will not be affected. The use of a hard link facilitates the necessary security since root uses setup.cache in DIR_LIBDATA and the fax user uses setup.cache in /var/spool/hylafax/etc. If the fax user rewrites its copy then it necessarily breaks the hard link and root will not be using the compromised version. A soft link will probably function adequately most of the time - and appears to be the only solution for systems where DIR_LIBDATA is on a different filesystem from /var/spool/hylafax/etc. However, soft links will not function for the rare instances (client use) where for some reason hfaxd-client operating in a chroot jail needs to include/invoke setup.(cache|modem). I've now addressed this matter here which should prevent other reports of this in the future (yours was not the first, unfortunately): https://sourceforge.net/p/hylafax/HylaFAX+/2647/ In case you're interested in other similar issues that were raised at the same time as CVE-2020-15397 see: https://sourceforge.net/p/hylafax/HylaFAX+/2551/ https://sourceforge.net/p/hylafax/HylaFAX+/2552/ https://sourceforge.net/p/hylafax/HylaFAX+/2553/ There is also another somewhat similar issue that I'll be looking at addressing soon: https://bugzilla.redhat.com/show_bug.cgi?id=2008654 -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1191571 http://bugzilla.opensuse.org/show_bug.cgi?id=1191571#c3 --- Comment #3 from OBSbugzilla Bot <bwiedemann+obsbugzillabot@suse.com> --- This is an autogenerated message for OBS integration: This bug (1191571) was mentioned in https://build.opensuse.org/request/show/926513 15.2 / hylafax+ https://build.opensuse.org/request/show/926514 15.3 / hylafax+ -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1191571 http://bugzilla.opensuse.org/show_bug.cgi?id=1191571#c10 --- Comment #10 from OBSbugzilla Bot <bwiedemann+obsbugzillabot@suse.com> --- This is an autogenerated message for OBS integration: This bug (1191571) was mentioned in https://build.opensuse.org/request/show/966560 15.3 / hylafax+ -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1191571 http://bugzilla.opensuse.org/show_bug.cgi?id=1191571#c11 Axel Braun <axel.braun@gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #11 from Axel Braun <axel.braun@gmx.de> --- As this is running in between I tend to close this bug -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com