April 2017 - openSUSE Factory - openSUSE Mailing Lists

[opensuse-factory] Reminder: Dealing with security related rpmlint messages in packages (DBus services, polkit rules, ...)
by Matthias Gerstner 06 Apr '17

06 Apr '17

Hi, due to the results of a recent security audit for the package Archiving:Backup/backintime the SUSE security team wants to make everyone aware how to deal with security related rpmlint messages in packages. If during the build of a package messages like these turn up: - backintime-qt4.noarch: E: suse-dbus-unauthorized-service - backintime-qt4.noarch: I: polkit-untracked-privilege net.launchpad.backintime.qt4gui then these packages must not be accepted into openSUSE:Factory before the security team reviewed the package. After successful review the dbus services / polkit rules in question will be whitelisted by us and the rpmlint messages disappear. These messages *must not* be disabled via the rpmlintrc file of the package. Please don't create or accept such submissions. DBus services and polkit rules can easily create loopholes in the distribution, thus we need to review them before taking them in. In case of backintime the package slipped into factory, leap 42.{1,2} (messages disabled via rpmlintrc) and only now we've found security implications. Thank you Matthias SUSE security team -- Matthias Gerstner <matthias.gerstner(a)suse.de> Dipl.-Wirtsch.-Inf. (FH), Security Engineer https://www.suse.com/security Telefon: +49 911 740 53 290 SUSE Linux GmbH GF: Felix Imendörffer, Jane Smithard, Graham Norton HRB 21284 (AG Nuernberg)

1 0

[opensuse-factory] openSUSE Minimal system to "fat", solution for libcurl/libicu?
by Thorsten Kukuk 06 Apr '17

06 Apr '17

Hi, I'm currently trying to port SLE MicroOS (real minimal system to run container, similar to JeOS) and the new SLES base container to openSUSE Tumbleweed. The results are not really looking good for openSUSE Tumbleweed :( SLE MicroOS: about 500 MB openSUSE MicroOS: about 800 MB SLES base container: 82 MB openSUSE Tumbleweed base container: 127 MB The increase in size is really significant and always over 50%! For the MicroOS, there are two reason: kernel-default-base is completly unuseable and libicu. For the container, a big problem is libicu, too. Not sure yet where the rest is coming from, but libicu sums up to over 30MB alone. Why is libicu57_1 and libicu57_1-ledata required? It goes down via libpsl5 to libcurl4, which is used by zypper and other tools. Why I can understand libpsl5 for desktops, in a container together with libicu57, this does not make any sense to me. Same for a minimal installation. Any idea how we can solve this? Thorsten -- Thorsten Kukuk, Distinguished Engineer, Senior Architect SLES & CaaSP SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany GF: Felix Imendoerffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nuernberg) -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

3 3

Re: [opensuse-factory] Expiration of the final US patents covering MP3 and inclusion of libmad in Leap 42.3
by Martin Pluskal 06 Apr '17

06 Apr '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Thu, 2017-04-06 at 12:45 +0200, tsuroerusu(a)gmail.com wrote: > Great to hear. :-) After all the hassle that MP3 support has been > over > the years, I think we can all agree that it is a good day when we > finally can have libmad in the distributions' main repositories. > After all, MP3 playback is something that we have been able to do > with > 100% free software for close to two decades, and yet most > distributions have not been able to include libmad. So yeah, that > should be a rather symbolic feature for Leap 42.3. Will it be in the > release notes? :-P Hello Well only if package is accepted to factory and somebody updates release notes Cheers Martin P.S For more details see: https://build.opensuse.org/request/show/461911 https://build.opensuse.org/request/show/461912 -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEwQnJ+Ps8HqIKhK3yWyRdZ/3eaFcFAljmJXYACgkQWyRdZ/3e aFfO3g/7B8JKneLWBHWg9SMXAfEr6J7iOE1uY/uzcjnhyMKUF+WAcxhvt5qKKtoG +uyKgVKMEcatv6EmHDr75AguAWGscbpANWBCnPtwu8/A2RKiDuo8TApEZ2R+cDfn shBpz997IAToFIhAKFUpFjNtnwWZJ4S9y3Ah24ngHGi0hMR9v1PPJ8ENRJ7qkdca ARd0344xDWj3nH33DTH+kxS1xovY5+JPv/7cgUckiJyio5DFzb/I3A9e6cqnKRqt A49IB3+o2JRRW5DRKt8sPd1qy9P53Z4TVvmEkcoYq7b3YDGB+GUOkcJ/jXwROpC4 WQ1UDa0nSYmyo9bvQTLqpze5FUf7hZmwGb8hHeF2flB85BWPeV1pwIL5bMSbTIWP 4NdZvdUSA/vspT5Ku96YLe3OSFMEPZ1jUMWtSnhwSIQ/a/7x/Tc0k/+zpEKLB5Rg dhi05cErMEWsc6UohGN3Ci+X3DQIEehJSyL6vMEVW323TPJsx9lhMht4YiHLSmka Vx0B4aENgybnJwo4cRowRO4sBKvW2HbpqghE0z6wIpn59RyESaytZ5Xh3RVK+jlS sKDTOPekLKlHxx/sl11KUSkOgEg11terFga/IgY1YFUVMQmA/i9GQCVYJ1BNeYBw Ajj5SThilMfD3PH+J3YNgiMsIFCzNtOGuxRmdfXIbHB1Kx0qzzI= =GnG1 -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

2 1

[opensuse-factory] Leap upgrade issues Re: [security-announce] Advanced discontinuation notice for openSUSE Leap 42.1
by Wolfgang Rosenauer 06 Apr '17

06 Apr '17

Hi, Am 20.03.2017 um 17:18 schrieb Marcus Meissner: > Note that the openSUSE Leap 42 class of distributions is designed to be easily > upgradable within minor versions, so Leap 42.1 to Leap 42.2 update should > be easy and seemless. and if they are not? That list does not look too bad but it's just for the "Upgrade" component. There may be others. https://bugzilla.opensuse.org/buglist.cgi?classification=openSUSE&component… What concerns me is that almost all are NEW. At least one of them made me stop ugprading my remaining 42.1 systems at least temporarily in the hope that there might be patches coming up. Wolfgang -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

20 64

[opensuse-factory] Expiration of the final US patents covering MP3 and inclusion of libmad in Leap 42.3
by tsuroerusu＠gmail.com 06 Apr '17

06 Apr '17

Earlier today, I recalled that the final US patents covering the MP3 were due to expire this year, and I did a quick Google search, and found this list at OSNews (Scroll down to get the table): http://www.osnews.com/story/24954/US_Patent_Expiration_for_MP3_MPEG-2_H_264/ It also links to other lists that point to the same date, the 16th of April 2017, for the final US patent related to the MP3 format to expire. I would think that this could allow for Leap 42.3 to legally include libmad, and thereby enable full MP3 support across the distribution without any non-free code (Like Fluendo GStreamer plugins etc.). I must confess I rarely hang out on the mailing lists, but I just thought I would put this idea out there, since we are a good few months away from the release of 42.3, and if I happened to be correct it could be very useful to FINALLY have libmad included in the distribution's own package set. This is especially true since VLC itself is actually included. -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

2 1

[opensuse-factory] libvirt broken?
by Michael Ströder 05 Apr '17

05 Apr '17

HI! After the last Tumbleweed update starting the VMs does not work anymore: error: internal error: child reported: Kernel does not provide mount namespace: Permission denied Any clue how to work around that? Ciao, Michael.

3 7

[opensuse-factory] New Tumbleweed snapshot 20170403 released!
by Dominique Leuenberger 05 Apr '17

05 Apr '17

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… When you reply to report some issues, make sure to change the subject. It is not helpful to keep the release announcement subject in a thread while discussing a specific problem. Packages changed: acl build (20170209 -> 20170320) bzip2 gzip kernel-source (4.10.5 -> 4.10.8) keyutils lynx nano (2.7.5 -> 2.8.0) ncurses rpm sysdig (0.15.0_k4.10.5_1 -> 0.15.1_k4.10.8_1) tar timezone (2017a -> 2017b) timezone-java (2017a -> 2017b) update-alternatives (1.18.10 -> 1.18.23) xine-lib === Details === ==== acl ==== Subpackages: libacl1 libacl1-32bit - Make it possible to disable tests (for Ring0) - Add BuildRequires: system-user-daemon for the testsuite ==== build ==== Version update (20170209 -> 20170320) Subpackages: build-mkbaselibs build-mkdrpms - fix usage of the right service generated files. - debootstrap: Also mount sysfs - Fileprovides should only match package names, not provides - avoid export of build results of sym links pointing to external files - support build of different flavors via multibuild - experimental AppImage build support - reworked openstack support (still experimental) ==== bzip2 ==== Subpackages: libbz2-1 libbz2-1-32bit libbz2-devel - cleanup with spec-cleaner ==== gzip ==== - cleanup with spec-cleaner - use loop with a range instead of a number list ==== kernel-source ==== Version update (4.10.5 -> 4.10.8) Subpackages: kernel-default kernel-default-devel kernel-devel kernel-docs kernel-macros kernel-syms - Update patches.kernel.org/patch-4.10.7-8 references (add CVE-2017-7184 bsc#1030573). - commit ea9dcd4 - tcp: mark skbs with SCM_TIMESTAMPING_OPT_STATS (CVE-2017-7277 bsc#1031265). - tcp: fix SCM_TIMESTAMPING_OPT_STATS for normal skbs (CVE-2017-7277 bsc#1031265). - commit 37681e8 - net/packet: fix overflow in check for tp_reserve (CVE-2017-7308 bsc#1031579). - net/packet: fix overflow in check for tp_frame_nr (CVE-2017-7308 bsc#1031579). - net/packet: fix overflow in check for priv area size (CVE-2017-7308 bsc#1031579). - commit fbe9fc9 - ping: implement proper locking (bsc#1031003). - commit 3ea493f - Linux 4.10.8 (bnc#1012628). - commit fd89662 - drm/i915: disable KASAN for handlers (bnc#1025903). - commit 0161cd4 - Linux 4.10.7 (bnc#1007962 bnc#1012628 bsc#1013576 bsc#1028489 bsc#1000619). - Delete patches.drivers/drm-reference-count-event-completion. - Delete patches.drivers/fbcon-Fix-vc-attr-at-deinit. - Delete patches.fixes/crypto-algif_hash-avoid-zero-sized-array.patch. - Delete patches.fixes/genetlink-fix-counting-regression-on-ctrl_dumpfamily.patch. - commit 24e2bda - Linux 4.10.6 (bnc#1012628 bnc#1025903). - Delete patches.rpmify/give-up-on-gcc-ilog2-constant-optimizations.patch. - commit e326586 - genetlink: fix counting regression on ctrl_dumpfamily() (bsc#1028489). - commit 5182272 ==== keyutils ==== Subpackages: keyutils-devel libkeyutils1 libkeyutils1-32bit - move binaries from /bin to /usr/bin (bsc#1029969) - keyutils-usr-move.patch: also adjust the request-key.conf file ==== lynx ==== - fix typo in url - Update project Url as well as Url path of source tar ball - Add patch lynx-2.8.8-ncurses-6.0-20170318.patch to work around internal header definition of ncurses-6.0-20170318 ==== nano ==== Version update (2.7.5 -> 2.8.0) Subpackages: nano-lang - Update to version 2.8.0 * the Up and Down keys now step from visual row to visual row instead of jumping between logical lines * the Home and End keys now move to the start and end of a row, and only when already there, then to the start and end of the logical line * the screen can now scroll per row instead of always per logical line * makes use of gnulib, to make it build on more platforms ==== ncurses ==== Subpackages: libncurses6 libncurses6-32bit ncurses-devel ncurses-utils tack terminfo terminfo-base - Add ncurses patch 20170325 + fix a memory leak in the window-list when creating multiple screens (reports by Andres Martinelli, Debian #783486). + reviewed calls from link_test.c, added a few more null-pointer checks. + add a null-pointer check in ungetmouse, in case mousemask was not called (report by "Kau"). + updated curs_sp_funcs.3x for new functions. - Add ncurses patch 20170318 + change TERMINAL structure in term.h to make it opaque. Some applications misuse its members, e.g., directly modifying it rather than using def_prog_mode(). + modify utility headers such as tic.h to make it clearer which are externals that are used by tack. + improve curs_slk.3x in particular its discussion of portability. + fix cut/paste in legacy_encoding.3x + add prototype for find_pair() to new_pair.3x (report by Branden Robinson). + fix a couple of broken links in generated man-html documentation. + regenerate man-html documentation. - Add tack patch 1.07.20170318 * init.c: use def_prog_mode() to eliminate two internal details from ncurses * edit.c, tack.h: accommodate opaque TERMINAL structure in ncurses * tack.h: update copyright to match version * config.sub: 2017-02-07 * config.guess: 2017-03-05 - Add ncurses patch 20170311 + modify vt100 rs2 string to reset vt52 mode and scrolling regions (report/analysis by Robert King) -TD + add vt100+4bsd building block, use that for older terminals rather than "vt100" which is now mostly used as a building block for terminal emulators -TD + correct a few spelling errors in terminfo.src comments -TD + add fbterm -TD + fix a typo in ncurses.c test_attr legend (patch by Petr Vanek). + changed internal colorpair_t to a struct, eliminating an internal 8-bit limit on colors + add ncurses/new_pair.h + add ncurses/base/new_pair.c with alloc_pair(), find_pair() and free_pair() functions + add test/demo_new_pair.c - Add ncurses patch 20170304 + improve terminfo manual description of terminfo syntax. + clarify the use of wint_t vs wchar_t in curs_get_wstr.3x + improve description of endwin() in manual. + modify setcchar() and getcchar() to treat negative color-pair as an error. + fix a typo in include/hashed_db.h (Andre Sa). - Add ncurses patch 20170225 + fixes for CF_CC_ENV_FLAGS (report by Ross Burton). ==== rpm ==== Subpackages: rpm-32bit rpm-build rpm-devel - Convert rpmconfigcheck init script to systemd unit - Tweak debugsubpkg.diff to no longer use obsoleted RPM interfaces and add support for debuginfo compressed by DWZ. - Add %_find_debuginfo_dwz_opts and DWZ limits to macrosin.diff. - Add dwz requires to rpm-build. [fate#322957] ==== sysdig ==== Version update (0.15.0_k4.10.5_1 -> 0.15.1_k4.10.8_1) - Update to version 0.15.1 (boo#1032025): * Bug fixes: + Fixed driver compilation issues on armv6l + Fixes on Kubernetes support + Regression on rkt detection #748 + Fixed high cpu usage when sysdig was used with -M parameter, #783 + Fixed a memory leak #772 ==== tar ==== - move binaries from /bin to /usr/bin [bsc#1029977] * refresh tar-backup-spec-fix-paths.patch to change path of the tar binary from TAR=/bin/tar to TAR=/usr/bin/tar - use spec-cleaner ==== timezone ==== Version update (2017a -> 2017b) - timezone update 2017b: * Haiti resumed observance of DST in 2017 (bsc#1030417) * Liberia changed from -004430 to +00 on 1972-01-07, not 1972-05-01. * Use "MMT" to abbreviate Liberia's time zone before 1972, as "-004430" is one byte over the POSIX limit ==== timezone-java ==== Version update (2017a -> 2017b) - timezone update 2017b: * Haiti resumed observance of DST in 2017 (bsc#1030417) * Liberia changed from -004430 to +00 on 1972-01-07, not 1972-05-01. * Use "MMT" to abbreviate Liberia's time zone before 1972, as "-004430" is one byte over the POSIX limit ==== update-alternatives ==== Version update (1.18.10 -> 1.18.23) - Update to 1.18.23: * Various small fixes and memleaks removed - Make sure to generate manpage - Refresh patch update-alternatives-suse.patch ==== xine-lib ==== Subpackages: libxine-devel libxine2 libxine2-pulse - fix build with ImageMagick 7 + xine-lib-ImageMagick7.patch -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

1 0

[opensuse-factory] openSUSE:Leap:42.3 started
by Ludwig Nussel 05 Apr '17

05 Apr '17

Hi, 42.2 is out of the door, time to relax and wait for the Christmas holidays, right? Well, far from that. We have to prepare for the next release. So for the Leap 42 line that means 42.3 based on SLE12 SP3. In anticipation of that OBS already has openSUSE:Leap:42.3 set up as copy of 42.2. It already accepts submissions. Right now mostly to directly integrate 42.2 maintenance updates. With regard to the schedule SUSE plans to release SLE12 SP3 earlier than the usual November date. It's beneficial for Leap if we get the changes we need into SLE and therefore are able to share sources. So I think it makes sense to follow suit and have our development phase with SP3 too, ie move the release date earlier as well. Due to the shortened development time I don't expect big changes in the base system. 42.3 should keep the promise of continuing an LTS line and mostly collect all 42.2 maintenance updates until then plus even more packages and selected updates from Tumbleweed. I'll propose a more concrete schedule when I know more about SP3. cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.com/ SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg) -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

7 14

[opensuse-factory] postinstall script of syslog-ng-3.9.1-16.2.i586.rpm failed
by Peter Czanik 04 Apr '17

04 Apr '17

Hi, Recently I started to see syslog-ng package failing on Tumbleweed. Looking at the logs I see, that the packages are generated, but at the end: [ 359s] ... testing for pre/postinstall scripts that are not idempotent [ 359s] Updating /etc/sysconfig/syslog ... [ 359s] chown: invalid user: 'news:news' [ 359s] postinstall script of syslog-ng-3.9.1-16.2.i586.rpm failed The offending part of the syslog-ng post install script seems to be: " test -f var/log/news && mv -f var/log/news var/log/news.bak mkdir -p -m 0750 var/log/news chown news:news var/log/news touch var/log/news/news.crit; chmod 640 var/log/news/news.crit chown news:news var/log/news/news.crit touch var/log/news/news.err; chmod 640 var/log/news/news.err chown news:news var/log/news/news.err touch var/log/news/news.notice; chmod 640 var/log/news/news.notice chown news:news var/log/news/news.notice " Question: what is the correct fix here? Is "news" completely depreciated? In that case I can remove this section completely. Or the files are necessary, but news was removed from the password file and I should just remove the chown part? Bye, CzP -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

6 7

[opensuse-factory] wickedd and /etc/sysconfig/network/if-up.d/
by Till Dörges 04 Apr '17

04 Apr '17

Hello all, not sure if this is the right place to ask, but ... With sysconfig-network (openSUSE 13.1) I could place a script in /etc/sysconfig/network/if-up.d/ and it would be executed for every 'ifup <interface>'. Nowadays sysconfig-network has been replaced by wicked-service. And with wicked-service the scripts in /etc/sysconfig/network/if-up.d/ seem to be ignored. I've found https://forums.opensuse.org/showthread.php/509920-How-to-get-a-script-in-et… but that only hints at a *per* interface configuration via PRE_UP_SCRIPT, POST_UP_SCRIPT, PRE_DOWN_SCRIPT and POST_DOWN_SCRIPT. The question is, are *global* scripts in /etc/sysconfig/network/if-up.d/ supported by wickedd? And if yes, how do I enable this feature? I'm trying this with wicked-service-0.6.39-4.1.x86_64 on openSUSE Leap 42.2. Thanks and regards -- Till -- Dipl.-Inform. Till Dörges doerges(a)pre-sense.de Tel. +49 - 40 - 244 2407 - 14 Fax +49 - 40 - 244 2407 - 24 PRESENSE Technologies GmbH Sachsenstr. 5, D-20097 HH Geschäftsführer/Managing Directors AG Hamburg, HRB 107844 Till Dörges, Jürgen Sander USt-IdNr.: DE263765024 Wir sind wieder auf dem BSI IT-Sicherheitskongress 16.-18. Mai 2017 – Bonn -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

1 1