November 2023 - openSUSE Factory - openSUSE Mailing Lists

[opensuse-factory] Leap 42.3 Build 0312 released!
by Ludwig Nussel 25 Apr '24

25 Apr '24

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&version=42.3&bui… https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Distribution&q… When you reply to discuss some issues, make sure to change the subject. Please use the test plan at https://docs.google.com/spreadsheets/d/1AGKijKpKiJCB616-bHVoNQuhWHpQLHPWCb3… to record your testing efforts and use bugzilla to report bugs. Packages changed: biosdevname btrfsmaintenance conduit gconf2-branding-openSUSE (42.1 -> 42.3) ibus kactivitymanagerd kde-user-manager kernel-source (4.4.73 -> 4.4.74) libxml2 libzypp (16.12.0 -> 16.13.0) lightdm marble mc plasma5-integration plasma5-openSUSE postgresql (9.4 -> 9.6) python-coverage (3.7.1 -> 4.3.4) ucode-intel (20160714 -> 20170511) yast2-bootloader (3.2.22 -> 3.2.23) yast2-ntp-client (3.2.9 -> 3.2.12) === Details === ==== biosdevname ==== - Duplicate naming of SRIOV VFs by biosdevname when VPD_DCM Strings are present in VFs (bsc#1042185) * Add: biosdevname_avoid_duplicates.patch ==== btrfsmaintenance ==== - Require btrfsprogs (bsc#1047226) - update to 0.2 - updated documentation - no hardcoded paths to external utilities - fixed logger name typos for 'journal' target - defrag fixes (sysconfig, find arguments) - Removed patch: balance-typo.patch - Added patch: sysconfig-override-trim.diff - Add balance-typo.patch (bnc#986543) - version 0.1.1 - fix typo and make journal logging target work - cron refresh: remove bashism - Removed patches: * 0003-Add-COPYING-file.patch * 0011-cron-refresh-remove-debuggiong-output.patch - cron script symlinks are not created on first installation (bsc#907343) - add COPYING to package - refresh script: remove extra messages - add uninstall targets - fix refresh service - adjust sysconfig defaults - Add more package dependencies (cron, zypp-plugin) - minor bugfixes - Add supplements(btrfsprogs) - initial version 0.1 ==== conduit ==== Subpackages: conduit-lang - Use python-vobject instead of vobject per python-vobject change in 42.3. ==== gconf2-branding-openSUSE ==== Version update (42.1 -> 42.3) - do not build novell-sound-theme in the gconf2-branding-SLED build to prevent duplicated binaries in openSUSE Leap. The novell-sound-theme is taken from gconf2-branding-SLES sources on both the SLED product and the SLES WE module. bsc#1046099 - bump versions ==== ibus ==== Subpackages: ibus-branding-openSUSE-KDE ibus-gtk ibus-gtk-32bit ibus-gtk3 ibus-lang libibus-1_0-5 libibus-1_0-5-32bit python-ibus typelib-1_0-IBus-1_0 - Update ibus.spec: copy auto-start files to SOURCE directory to enable modifications before compile. - Add ibus-disable-engines-preload-in-GNOME.patch: Disable load preload-engines actions in SLE, which is unnecessary for mono IMF in SLE and may cause CJK user login failed (bsc#1036729). ==== kactivitymanagerd ==== - Recommend -lang package ==== kde-user-manager ==== - Recommend -lang package ==== kernel-source ==== Version update (4.4.73 -> 4.4.74) Subpackages: kernel-default kernel-default-devel kernel-devel kernel-docs kernel-macros kernel-syms - Delete patches.kabi/kabi-fix-for-kvm-x86-fix-singlestepping-over-syscall. No need for kABI fix yet for Leap 42.3. - commit f0a86d9 - Fix kABI breakage by KVM CVE fix (bsc#1045922). - commit c0308f6 - powerpc/perf: Fix branch event code for power9 (fate#321438, Pending SUSE Kernel Fixes). - commit e954af6 - powerpc: Fix /proc/cpuinfo revision for POWER9 DD2 (bsc#1046789). - commit 444247f - Refresh metadata patches.drivers/ibmvnic-a2-Fix-assignment-of-RX-TX-IRQ-s.patch. - commit be32be9 - drm/i915: Serialize GTT/Aperture accesses on BXT (bsc#1046821). - commit b263fef - Bluetooth: hidp: fix possible might sleep error in hidp_session_thread (bsc#1031784). - Refresh patches.suse/kgr-0008-mark-task_safe-in-some-kthreads.patch. - commit 18c6f3e - KVM: x86: fix singlestepping over syscall (CVE-2017-7518 bsc#1045922). - commit d989643 - nvme/pci: Fix stuck nvme reset (bsc#1043805). - commit 7afe4f0 - Refresh fadump patches to upstream and add metadata patches.arch/powerpc-fadump-add-reschedule-point-while-releasing-memory.patch. patches.arch/powerpc-fadump-avoid-duplicates-in-crash-memory-ranges.patch patches.arch/powerpc-fadump-avoid-holes-in-boot-memory-area-when-fadump-is-registered.patch patches.arch/powerpc-fadump-provide-a-helpful-error-message.patch - commit f0fb5c3 - blacklist.conf: Remove duplicated entries - commit cb960d2 - Remove duplicated blacklist entries and put git-commit tag to patches - commit 12a0cb2 - blacklist.conf: Remove duplicated entry. - commit 561ddb1 - ibmvnic: Fix assignment of RX/TX IRQ's (bsc#1046589). - commit 5fa38bf - blacklist.conf: blacklist 570d8e939801 we do not care about the code in Documentation all that much, do we? - commit 69d5811 - blacklist.conf: blaclist 5380e5644afb it is just not worth backporting without any explicit report where a silently truncated success would lead to a real bug. - commit fc28626 - blacklist.conf: unnecessary patch The bug triggers only upon a malformed descriptor and the comparison is so that our buffer would be too large not too small so no overflow. The device would not work, but it won't anyway. - commit 99f8a16 - Rearrange the previous patches for hpsa and smartpqi to the right position. - commit a1f1f27 - Update patches.fixes/xfs-split-default-quota-limits-by-quota-type.patch (bsc#1040941). Fix the bug nr used. - commit 115ba75 - printk: Correctly handle preemption in console_unlock() (bsc#1046434). - commit 0a3c2a4 - printk/xen: Force printk sync mode when migrating Xen guest (bsc#1043347). - commit e13596b - btrfs: disable possible cause of premature ENOSPC (bsc#1040182) - commit 8bf31da - rbd: make sure pages are freed by libceph (bsc#1045596). - rbd: drop extra rbd_img_request_get (bsc#1045596). - commit c8719f2 - dm-raid: Do not call BUG() in __rdev_sectors() (bsc#1046264). - commit 0b1aab0 - btrfs: Round down values which are written for total_bytes_size (bsc#1043912). - btrfs: Manually implement device_total_bytes getter/setter (bsc#1043912). - commit c4d2eb7 - pipe: cap initial pipe capacity according to pipe-max-size limit (bsc#1045330). - commit 4ee3ec2 - Blacklist drivers/net/ethernet/ibm/emac We do not build the driver. - commit d432b2b - blacklist.conf: this patch breaks the API It disallows some operations that are now allowed - commit 98325c2 - arm64: Update config files. (bsc#1036737) Disable XGENE_PMU. - commit 7bb0115 - Disable Xilinx network drivers (bsc#1046170). - commit 656fc83 - hwpoison, memcg: forcibly uncharge LRU pages (bnc#1046105). - commit 2b252e1 - blacklist.conf: blacklist 570d8e939801 the issue is visible only when 80df554275c2 is applied (4.7+ and not backported to our trees) - commit 47b83ce - config/x86_64: make CONFIG_SERIAL_8250_DW and *_MID built-in (bsc#1024449) - commit 2e3ca7e - Refresh patches.drivers/0477-nvme-add-hostid-token-to-fabric-options.patch. Update mainline references. - commit eee1109 - fs/exec.c: account for argv/envp pointers (bnc#1039354, CVE-2017-1000365). - commit 7418d0f - Refresh ibmvnic patch metadata patches.drivers/ibmvnic-98-ibmvnic-Correct-return-code-checking-for-ibmvnic_init-during-probe.patch. patches.drivers/ibmvnic-a0-ibmvnic-Fix-incorrectly-defined-ibmvnic_request_map_rsp-structure.patch. patches.drivers/ibmvnic-a1-ibmvnic-Fix-error-handling-when-registering-long-term-mapped-buffers.patch. - commit babc17a - Refresh metadata patches.fixes/powerpc-tm-Fix-stack-pointer-corruption-in-__tm_recheckpoint. - commit 0b5bdc6 - powerpc/ftrace: Pass the correct stack pointer for DYNAMIC_FTRACE_WITH_REGS (FATE#322421). - commit 936e653 - nvme: add hostid token to fabric options (bsc#1045293). - commit 52dffb9 - iw_cxgb4: Fix error return code in c4iw_rdev_open() (bsc#1026570). - RDMA/iw_cxgb4: Always wake up waiter in c4iw_peer_abort_intr() (bsc#1026570). - commit 2ce43b1 - clocksource/drivers/arm_arch_timer: Fix read and iounmap of incorrect variable (bsc#1045937). - commit 594f037 - Linux 4.4.74 (CVE-2017-1000364 bnc#1012382 bnc#1039348 bnc#1045340 bsc#1031717 bsc#1043231). - Delete patches.drivers/media-pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze. - Delete patches.drivers/media-vb2-Fix-an-off-by-one-error-in-vb2_plane_vaddr. - Delete patches.drivers/staging-rtl8188eu-prevent-an-underflow-in-rtw_check_. - Delete patches.fixes/mm-fix-new-crash-in-unmapped_area_topdown.patch. - Delete patches.fixes/mm-larger-stack-guard-gap-between-vmas.patch. - commit 5e41880 - tty: Fix ldisc crash on reopened tty (bnc#1043488). - commit 04cca20 - tty: Destroy ldisc instance on hangup (bnc#1043488). - tty: Refactor tty_ldisc_reinit() for reuse (bnc#1043488). - tty: Use 'disc' for line discipline index name (bnc#1043488). - tty: Move tty_ldisc_kill() (bnc#1043488). - tty: Handle NULL tty->ldisc (bnc#1043488). - tty: Prepare for destroying line discipline on hangup (bnc#1043488). - tty: Reset c_line from driver's init_termios (bnc#1043488). - tty: Simplify tty_set_ldisc() exit handling (bnc#1043488). - commit c016cca - kabi: ignore fs_info parameter for tracepoints that didn't have it (bsc#1044912). - commit 24869ea ==== libxml2 ==== Subpackages: libxml2-2 libxml2-2-32bit libxml2-devel libxml2-tools - Security fix: * libxml2-CVE-2017-7376.patch [bsc#1044887, CVE-2017-7376] * Increase buffer space for port in HTTP redirect support - Security fix: * libxml2-CVE-2017-7375.patch [bsc#1044894, CVE-2017-7375] * Prevent unwanted external entity reference - Upstream patches updated and with tests: * libxml2-CVE-2017-9047.patch and libxml2-CVE-2017-9048.patch merged into libxml2-CVE-2017-9047.patch [bsc#1039066, bsc#1039661] * libxml2-CVE-2017-9049.patch and libxml2-CVE-2017-9050.patch merged into libxml2-CVE-2017-9049.patch [bsc#1039063, bsc#1039064] ==== libzypp ==== Version update (16.12.0 -> 16.13.0) - Adapt loop mounting of iso images (bsc#1038132, bsc#1033236) - Adjust zypp.conf for openSUSE Tumbleweed (bsc#1031756) - Change arch variable names conflicting with compiler macros (fixes #70) - Fix potential crash if repo has no baseurl (bnc#1043218) - version 16.13.0 (0) ==== lightdm ==== Subpackages: liblightdm-gobject-1-0 lightdm-lang - Augment patch to also resolve the target of symlink sessions for detemining the preselected option: * ignore-known-symlink-sessions.patch ==== marble ==== Subpackages: libastro1 libmarblewidget-qt5-27 marble-data marble-devel marble-doc marble-kde marble-lang - Add Fix-utm-enum-value.patch and reverse-apply it, this upstream commit causes a crash when adding bookmarks if switched to UTM view angles because the necessary handler functions for the dialog are not implemented yet (boo#1044747, kde#381872) - Add Fix-plain-map-and-political-map-showing-no-content.patch to fix the plain map and the political map being not displayed at all (kde#379297) ==== mc ==== Subpackages: mc-lang - sftp.patch: Backport upstream fixes for SFTP (boo#1004280, boo#1042797) ==== plasma5-integration ==== - Move the Recommends: %{name}-plugin-lang to the plasma5-integration-plugin sub package, otherwise the translations won't get installed as there is no main package (boo#1027925) - Actually apply the aforementioned patch (shouldn't the source validator have warned?) ==== plasma5-openSUSE ==== Subpackages: plasma5-defaults-openSUSE plasma5-theme-openSUSE plasma5-workspace-branding-openSUSE sddm-theme-openSUSE - Fix installation of the sddm theme files (boo#1047254) ==== postgresql ==== Version update (9.4 -> 9.6) Subpackages: postgresql-contrib postgresql-devel postgresql-docs postgresql-server - Bump version and defaultpackage to 9.6. - Move ~postgres/.bash_profile to postgresql-server to avoid a file conflict between the versioned server packages. - Bump version and defaultpackage to 9.4. - Bump version and defaultpackage to 9.3. - Change license string to PostgreSQL. - Make all dummy packages noarch. - Make PostgreSQL 9.2 the default. - Reduce the postgresql packages with unversioned names to dummy packages that require the respective versioned package names. ==== python-coverage ==== Version update (3.7.1 -> 4.3.4) - uninstall alternatives in %postun - update for singlespec - update to 4.3.4: - Using the --skip-covered option on an HTML report with 100% coverage would cause a ?No data to report? error, as reported in issue 549. This is now fixed; thanks, Lo�c Dachary. - If-statements can be optimized away during compilation, for example, if 0: or if __debug__:. Coverage.py had problems properly understanding these statements which existed in the source, but not in the compiled bytecode. This problem, reported in issue 522, is now fixed. - If you specified --source as a directory, then coverage.py would look for importable Python files in that directory, and could identify ones that had never been executed at all. But if you specified it as a package name, that detection wasn?t performed. Now it is, closing issue 426. Thanks to Lo�c Dachary for the fix. - If you started and stopped coverage measurement thousands of times in your process, you could crash Python with a ?Fatal Python error: deallocating None? error. This is now fixed. Thanks to Alex Groce for the bug report. - On PyPy, measuring coverage in subprocesses could produce a warning: ?Trace function changed, measurement is likely wrong: None?. This was spurious, and has been suppressed. - Previously, coverage.py couldn?t start on Jython, due to that implementation missing the multiprocessing module (issue 551). This problem has now been fixed. Also, issue 322 about not being able to invoke coverage conveniently, seems much better: jython -m coverage run myprog.py works properly. - Let?s say you ran the HTML report over and over again in the same output directory, with --skip-covered. And imagine due to your heroic test-writing efforts, a file just acheived the goal of 100% coverage. With coverage.py 4.3, the old HTML file with the less-than-100% coverage would be left behind. This file is now properly deleted. - update to Version 4.3.1 ? 2016-12-28: - Some environments couldn?t install 4.3, as described in issue 540. This is now fixed. - The check for conflicting --source and --include was too simple in a few different ways, breaking a few perfectly reasonable use cases, described in issue 541. The check has been reverted while we re-think the fix for issue 265. - update to Version 4.3 ? 2016-12-27: Special thanks to Lo�c Dachary, who took an extraordinary interest in coverage.py and contributed a number of improvements in this release. - The HTML report now supports a --skip-covered option like the other reporting commands. Thanks, Lo�c Dachary for the implementation, closing issue 433. - Subprocesses that are measured with automatic subprocess measurement used to read in any pre-existing data file. This meant data would be incorrectly carried forward from run to run. Now those files are not read, so each subprocess only writes its own data. Fixes issue 510. - Coverage.py wouldn?t execute sys.excepthook when an exception happened in your program. Now it does, thanks to Andrew Hoos. Closes issue 535. - The coverage combine command will now fail if there are no data files to combine. The combine changes in 4.2 meant that multiple combines could lose data, leaving you with an empty .coverage data file. Fixes issues issue 525, issue 412, issue 516, and probably issue 511. - The branch coverage issues described in issue 493, issue 496, and issue 502 are now fixed, thanks to Lo�c Dachary. - Options can now be read from a tox.ini file, if any. Like setup.cfg, sections are prefixed with ?coverage:?, so [run] options will be read from the [coverage:run] section of tox.ini. Implements part of issue 519. Thanks, Stephen Finucane. - Specifying both --source and --include no longer silently ignores the include setting, instead it fails with a message. Thanks, Nathan Land and Lo�c Dachary. Closes issue 265. - Coverage.py can now search .pex files for source, just as it can .zip and .egg. Thanks, Peter Ebden. - update to 4.2: - Since ``concurrency=multiprocessing`` uses subprocesses, options specified on the coverage.py command line will not be communicated down to them. Only options in the configuration file will apply to the subprocesses. Previously, the options didn't apply to the subprocesses, but there was no indication. Now it is an error to use ``--concurrency=multiprocessing`` and other run-affecting options on the command line. This prevents failures like those reported in `issue 495`_. - Filtering the HTML report is now faster, thanks to Ville Skytt�. - update to 4.0.3: - Fixed a mysterious problem that manifested in different ways: sometimes hanging the process (`issue 420`_), sometimes making database connections fail (`issue 445`_). - The XML report now has correct ``<source>`` elements when using a ``--source=`` option somewhere besides the current directory. This fixes `issue 439`_. Thanks, Arcady Ivanov. - Fixed an unusual edge case of detecting source encodings, described in `issue 443`_. - Help messages that mention the command to use now properly use the actual command name, which might be different than "coverage". Thanks to Ben Finney, this closes `issue 438`_. - add LICENSE.txt - Pre require coreutils. This package is needed for the rm call in the pre section. Subprocess failed. Error: RPM failed: /var/tmp/rpm-tmp.gONanE: line 3: rm: command not found - specfile: * updated license * updated update-alternatives * README.txt -> README.rst - update to version 4.0: (long list, see http://coverage.readthedocs.org/en/latest/changes.html) - fix rhel deps by depending on /usr/sbin/update-alternatives ==== ucode-intel ==== Version update (20160714 -> 20170511) - Update to version 20170511 - Update to version 20161104. ==== yast2-bootloader ==== Version update (3.2.22 -> 3.2.23) - AuotYaST configuration: Set StorageDevices flag disks_valid to true. So libstorage can scan valid disks and "/" partition can be found. (bnc#1043132) - 3.2.23 ==== yast2-ntp-client ==== Version update (3.2.9 -> 3.2.12) - Resrict records are written at the end but the default file and most profiles use them at the beginning, which mangles the file completely (bsc#983486). To fix it we have just changed the order of writing. - 3.2.12 - AutoYaST: Fix crash when trying to sanitize not string values, for example initial_sync. - AutoYaST: Sanitize comments by only removing blank spaces at the beginning and adding line break. This avoids augeas parse errors (bsc#1045777). - 3.2.11 - AutoYaST: Fix crash in CFA when creating a command record with some key value option is given (bsc#1045968) - 3.2.10 - AutoYaST: Comments from autoyast profile should not be sanitized to avoid entries without space between value and comment (e.g trustedkey 1# coment). This is caused by a bug in augeas adding new entries. -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

2 1

[opensuse-factory] acpid requires systemd?
by Felix Miata 25 Apr '24

25 Apr '24

Can this be true? If so, why? Zypper won't let me upgrade acpid without breakage unless systemd is installed too. I have systemd locked out, as I'd rather test things I can understand in Factory, not major overhaul stuff. -- "The wise are known for their understanding, and pleasant words are persuasive." Proverbs 16:21 (New Living Translation) Team OS/2 ** Reg. Linux User #211409 ** a11y rocks! Felix Miata *** http://fm.no-ip.com/ -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-factory+help(a)opensuse.org

4 3

enabling reproducible builds in Factory and ALP
by Jan Zerebecki 15 Mar '24

15 Mar '24

Hi *, to support https://en.opensuse.org/openSUSE:Reproducible_Builds I plan to get the following project configuration for Factory and ALP enabled: Macros: %source_date_epoch_from_changelog Y %clamp_mtime_to_source_date_epoch Y %use_source_date_epoch_as_buildtime Y %_buildhost reproducible :Macros I'm still waiting to get https://github.com/openSUSE/product-builder/pull/26 merged to prevent a bug with mirrors that will otherwise happen. Afterwards a time of the build is still in the HTTP header Last-Modified when requesting the rpm file. HTTP mtime is a few seconds earlier than end time of the build (seen in OBS web UI only as start + duration). I didn't double check, but it should also be recorded in the Tumbleweed archive Bernhard keeps, which can with a bit of work be looked up by content hash or name including version of the rpm file if its not on the normal mirrors anymore. Both the build time and host can also still be seen in the build log. Comments welcome. -- Best regards, Jan Zerebecki

4 6

Proposal: amend the packaging guidelines for %fillup_only
by Dan Čermák 02 Mar '24

02 Mar '24

Hi list, our packaging guidelines for %fillup_only [1] currently do not suggest anything for the %files section for the files generated in `/etc/sysconfig/`. I would like to suggest that we start adding the newly generated file `/etc/sysconfig/$pkgname` as follows to the %files section: --8<---------------cut here---------------start------------->8--- %files %ghost %config(noreplace) %attr(0600,root,root) /etc/sysconfig/%{name} %dir /etc/sysconfig --8<---------------cut here---------------end--------------->8--- This ensures that rpm is aware of the files as configuration files. Thoughts, opinions? Cheers, Dan Footnotes: [1] https://en.opensuse.org/openSUSE:Packaging_Conventions_RPM_Macros#%fillup_o… -- Dan Čermák <dcermak(a)suse.com> Software Engineer Development tools SUSE Software Solutions Germany GmbH Frankenstr. 146 90461 Nürnberg Germany www.suse.com Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg)

3 3

wine and zlib
by Joe Salmeri 22 Feb '24

22 Feb '24

I did a fresh install of TW 20230222 on a new PC. My main desktop which was installed back in 2021 has also been updated ( zypper dup ) to 20230222. I found something odd when comparing packages between the 2 machines. Both PC's have wine installed, however... On my main desktop when the original install in 2021 of wine was done it installed libz1-32bit ( as per the zypper history logs ) and it still has that installed after it was updated to 20230222. On the new PC fresh install of 20230222 when wine was installed it installed libz-ng-compat1-32bit. The libz-ng-compat1-32bit version looks like it was forked in 2021, just after my main machine was originally built so that would explain why it has libz1-32bit but shouldn't it have been updated by zypper dup ??? Is this a bug that I should report? If so, which system is wrong / which version should be used? Thanks!

5 6

Recent e2fsprogs update flag changes
by Patrick Schaaf 22 Feb '24

22 Feb '24

Hi, as I haven't found discussion by searching, I thought I bring up a gotcha I ran into today, on a host recently updated to tumbleweed 20230801 level. With a somewhat recent update to e2fsprogs, now at 1.47.0 compared to May '23 at 1.46.5, the set of mkfs flags has changed: --- /root/mke2fs.conf.20230512 2023-08-09 12:00:14.379476597 +0200 +++ /etc/mke2fs.conf 2023-06-14 19:20:22.000000000 +0200 @@ -14 +14 @@ - features = has_journal,extent,huge_file,flex_bg,metadata_csum,64bit,dir_nlink,extra_isize + features = has_journal,extent,huge_file,flex_bg,metadata_csum,metadata_csum_seed,64bit,dir_nlink,extra_isize,orphan_file For me, this resulted in an otherwise fine virtual machine with 20230512 userlevel, not booting after an "rsync copy migration" into a fresh root filesystem mkfs'ed with these new flags. Reason being that 3 months older fsck - the sytemd boot time rootfs service actually - goes "failed". I guess I'll need just use flag override options going forward, to cope with that, but thought I'd bring it to attention here at least. best regards Patrick

3 4

Tighten permissions for DRM render nodes (/dev/dri/renderD128)
by Wolfgang Frisch 11 Feb '24

11 Feb '24

Hi, DRM render nodes [1] provide an interface for unprivileged GPU operations such as video encoding or off-screen rendering. They are currently world-writable in Factory: > crw-rw-rw- root:render /dev/dri/renderD128 This configuration allows every user, even `nobody`, to access the GPU drivers, cause load on the hardware and exploit hypothetical driver bugs. To our *current knowledge* this does not represent a security vulnerability. But given enough time and energy it very well might. It certainly does increase a local attack surface unnecessarily. Given the complexity of graphics drivers, maintaining such open permissions seems imprudent. While mode 0666 is the default [2], upstream has also been supporting an alternative configuration with mode 0660 and uaccess ACLs [3]. For context, here's how other distributions manage this: > Debian: mode 660 with uaccess > Ubuntu: mode 660 with uaccess > Fedora: mode 666 A submission [4] is underway to switch openSUSE Factory to this alternative configuration. This will result in Factory having these permissions: > crw-rw----+ root:render /dev/dri/renderD128 The impact of this change is likely to be zero for most users. If you have any workloads that depend on unprivileged GPU operations, you can simply add your user to the `render` group. Specific scenarios include: - Remote GPU access via ssh - Local GPU access by non-interactive users that aren't part of the render group yet, e.g. system users, cron jobs or `su` to another user. Best regards Wolfgang [1] https://dri.freedesktop.org/docs/drm/gpu/drm-uapi.html#render-nodes [2] https://github.com/systemd/systemd/blob/a3f5976ded023257f6299ca07b9749fd148… [3] https://github.com/systemd/systemd/blob/a3f5976ded023257f6299ca07b9749fd148… [4] https://build.opensuse.org/request/show/1128161 -- Wolfgang Frisch <wolfgang.frisch(a)suse.com> Security Engineer OpenPGP fingerprint: A2E6 B7D4 53E9 544F BC13 D26B D9B3 56BD 4D4A 2D15 SUSE Software Solutions Germany GmbH Maxfeldstr. 5, 90409 Nuremberg, Germany (HRB 36809, AG Nürnberg) Managing Director: Felix Imendörffer

6 10

snapd applications not working on Tumbleweed (20230613)
by Jim Henderson 19 Jan '24

19 Jan '24

Wondering if anyone else is seeing this. I attempted to launch two apps (slack and spotify) installed with snapd, and the launch failed. Troubleshooting it, I removed all of the snaps from the system, uninstalled and reinstalled snapd, and I get the following output: --- $ snap install spotify error: cannot perform the following tasks: - Run configure hook of "spotify" snap if present (run hook "configure": ----- go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Matcha-dark-sea /snap/spotify/67/data-dir/themes/Matcha-dark-sea none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Matcha-sea /snap/spotify/67/data-dir/themes/Matcha-sea none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Materia-compact /snap/spotify/67/data-dir/themes/Materia-compact none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Materia-dark-compact /snap/spotify/67/data-dir/themes/Materia-dark-compact none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Materia-dark /snap/spotify/67/data-dir/themes/Materia-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Materia-light-compact /snap/spotify/67/data-dir/themes/Materia-light-compact none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Materia-light /snap/spotify/67/data-dir/themes/Materia-light none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Materia /snap/spotify/67/data-dir/themes/Materia none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Radiance /snap/spotify/67/data-dir/themes/Radiance none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Radiant-MATE /snap/spotify/67/data-dir/themes/Radiant-MATE none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-dark /snap/spotify/67/data-dir/themes/Yaru-MATE-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-light /snap/spotify/67/data-dir/themes/Yaru-MATE-light none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-bark-dark /snap/spotify/67/data-dir/themes/Yaru-bark-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-bark /snap/spotify/67/data-dir/themes/Yaru-bark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-blue-dark /snap/spotify/67/data-dir/themes/Yaru-blue-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-blue /snap/spotify/67/data-dir/themes/Yaru-blue none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-dark /snap/spotify/67/data-dir/themes/Yaru-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-light /snap/spotify/67/data-dir/themes/Yaru-light none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-magenta-dark /snap/spotify/67/data-dir/themes/Yaru-magenta-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-magenta /snap/spotify/67/data-dir/themes/Yaru-magenta none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-mate-dark /snap/spotify/67/data-dir/themes/Yaru-mate-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-mate /snap/spotify/67/data-dir/themes/Yaru-mate none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-olive-dark /snap/spotify/67/data-dir/themes/Yaru-olive-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-olive /snap/spotify/67/data-dir/themes/Yaru-olive none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen-dark /snap/spotify/67/data-dir/themes/Yaru-prussiangreen-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen /snap/spotify/67/data-dir/themes/Yaru-prussiangreen none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-purple-dark /snap/spotify/67/data-dir/themes/Yaru-purple-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-purple /snap/spotify/67/data-dir/themes/Yaru-purple none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-red-dark /snap/spotify/67/data-dir/themes/Yaru-red-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-red /snap/spotify/67/data-dir/themes/Yaru-red none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-sage-dark /snap/spotify/67/data-dir/themes/Yaru-sage-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-sage /snap/spotify/67/data-dir/themes/Yaru-sage none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-viridian-dark /snap/spotify/67/data-dir/themes/Yaru-viridian-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-viridian /snap/spotify/67/data-dir/themes/Yaru-viridian none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru /snap/spotify/67/data-dir/themes/Yaru none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/elementary /snap/spotify/67/data-dir/themes/elementary none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied cannot update snap namespace: cannot create writable mimic over "/usr/lib/x86_64-linux-gnu": permission denied snap-update-ns failed with code 1 -----) --- The execution of both programs prior to the reinstallation did the same thing. I did note that /usr/lib/x86_64-linux-gnu does not exist on my system. Happy to report a bug on bugzilla, but wanted to see if anyone else had noticed this. -- Jim Henderson Please keep on-topic replies on the list so everyone benefits

5 10

Plan to delete vagrant & Virtualization:vagrant by the end of November
by Dan Čermák 20 Dec '23

20 Dec '23

Dear all, due to Hashicorp changing the license of vagrant to the BUSL, we can no longer update vagrant in openSUSE. I don't have the cycles to maintain vagrant myself indefinitely and plan to send a delete request at the end of November to Factory. Once that goes in, I also plan to remove the Virtualization:vagrant project to reduce the number of rubygems we have in openSUSE. If you don't like this plan and decide to scream at me, please scream an actionable plan that involves you :-) Cheers, Dan -- Dan Čermák <dcermak(a)suse.com> Software Engineer Development tools SUSE Software Solutions Germany GmbH Frankenstr. 146 90461 Nürnberg Germany www.suse.com Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg)

6 12

Is it possible for Slowroll to officially support the integrity of NVidia and VMWare modules?
by Xu Zhao 19 Dec '23

19 Dec '23

Hello all, I am a 5-years Tumbleweed user. I am also the maintainer of many Tumbeweed packages such as telegram-desktop, chezscheme, amdvlk, and yacreader. I have both AMD and NVIDIA desktops with openSUSE Tumbleweed installed. NVidia closed-source GPU driver integration has always been a pain for rolling release like Tumbleweed because: 1) kernel's API keeps changing and it often takes NVidia 1~2 weeks to follow-up the latest kernel release in their new driver version (see http://rglinuxtech.com/ ); 2) people who don't care about NVidia do not want to slow down the rolling of kernel versions For example, even today the version of nvidia-open-driver-G06-signed-kmp-default(https://build.opensuse.org/packag…, 535.113.01) is not compatible with nvidia-video-G06 (https://download.nvidia.com/opensuse/tumbleweed/x86_64/, 535.104) on Tumbleweed. I am wondering if we can attract some users to Slowroll if it only releases snapshots whose kernel version is compatible with the NVidia GPU driver? At least I will be very interested to try it out on my Nvidia desktop. Similar case should apply for VMWare kernel modules, but if it takes too much additional efforts, I think we should priortize NVidia module integrity. Best, Xu -- Xu Zhao i(a)xuzhao.net

10 16