October 2024

RFC: SELinux as default MAC system on new Tumbleweed installations
by Cathy Hu 18 Feb '25

18 Feb '25

Hi all, *see TL;DR down below* SELinux is being adopted more and more as the main Mandatory Access Control (MAC) system in openSUSE distributions and SUSE products. The SUSE SELinux working group would like to announce the plan to switch new Tumbleweed installations to SELinux as default MAC system *by the end of this year*. Currently, new Tumbleweed installations select AppArmor in the installer as default MAC system. After this change, new Tumbleweed installations will select SELinux in … [View More]enforcing mode as default MAC system. Users will still be able to select AppArmor as MAC system in the installer. Existing installations will *not* be affected. If you would like to migrate your existing system from AppArmor to SELinux, we have a guide on what to consider and how to do that here [0]. *What does it mean for users?* Our SELinux policy contains many policy modules, which confine most well-known services. Switching to SELinux means more services are confined by default, which means enhanced security. On the other hand, more confinement also means that in the early phase of the adoption there could be more bugs caused by SELinux denying legitimate accesses. We perform both manual and automated tests via openQA, to ensure that our policy works seamlessly. We also rely on you, the community, to create bugreports so that we can adapt the policy to any scenarios that we did not foresee. We have a page on how to report bugs here: https://en.opensuse.org/openSUSE:Bugreport_SELinux To learn more about SELinux, we also have a Portal in the openSUSE wiki: https://en.opensuse.org/Portal:SELinux Please feel free to reply to this email in case you have any questions or concerns. We plan to do the change earliest in September 2024, and latest by the end of the year. Separate announcements will follow just before and after the change. TL;DR: - The Tumbleweed installer will select SELinux in enforcing mode as default on new installations - When: by the end of 2024, earliest in September, we will do separate announcements before and after - AppArmor can still be selected in the installer as an alternative - Existing installations will *not* change - Leap 15.x is not affected in any way Thank you very much :) Kind regards, Cathy [0] https://en.opensuse.org/Portal:SELinux/Setup#Setup_SELinux_on_existing_tumb… -- Cathy Hu <cahu(a)suse.de> SELinux Security Engineer GPG: 5873 CFD1 8C0E A6D4 9CBB F6C4 062A 1016 1505 A08A SUSE Software Solutions Germany GmbH Frankenstrasse 146 90461 Nürnberg Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg) [View Less]

16 33

Disabling /dev/fb0 on TW
by Thomas Zimmermann 06 Feb '25

06 Feb '25

tl;dr: Disable fbdev userspace interfaces on TW Hi, the upcoming Linux kernel v6.6 will contain the option to disable fbdev userspace interfaces in the kernel configuration. [1] I intent to enable this and thereby switch off /dev/fb0 et al. The tracker bug is boo#1212947. [2] * Why? The old fbdev subsystem is an endless source of bugs. For example, we recently had an out-of-bounds access in the fbdev emulation, where userspace could write beyond the end of the framebuffer memory. [3] … [View More]Fbdev is under-maintained. I've been doing improvements in recent kernel releases, but only where it benefits the DRM subsystem. Disabling fbdev userspace interfaces will also help weeding out any programs that still contain hard dependencies on them. * What changes? Enabling the new kernel option disables all fbdev userspace interfaces. These are * the device files, such as /dev/fb0 * the sys files under /sys/class/graphics/fb[0-9]+ * /proc/fb * What are the effects on userspace programs? Userspace applications run on the desktop via Wayland or X. There will be no change to them. Xorg and Wayland compositors run on DRM interfaces. A few programs run on SDL, which has no dependency on fbdev either. Any fbdev support in these mid-layer components should be disabled as well. There's one known affected program: TW's text-mode installer can use the tool fbiterm to display CJK symbols during installation. This comes from a time when some low-end systems where not able to boot graphics installation. fbiterm has been unmaintained for >15 years and is ready for retirement. But there's no good drop-in replacement. I propose to simply remove fbiterm and let the graphics installer handle CJK. * What about the framebuffer console? The kernel-provided framebuffer console does not change. The kernel will still show the regular console. Userspace interfaces in /sys/class/graphics/fbcon are still available. For questions and discussion, please comment here or in boo#1212947. Best regards Thomas [1] https://elixir.bootlin.com/linux/v6.6-rc1/source/drivers/video/fbdev/core/K… [2] https://bugzilla.opensuse.org/show_bug.cgi?id=1212947 [3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Frankenstrasse 146, 90461 Nuernberg, Germany GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman HRB 36809 (AG Nuernberg) [View Less]

13 44

Cyclic dependencies between RPM packages
by Xu Zhao 26 Dec '24

26 Dec '24

Hello openSUSE, I recently ran a couple of dependency analysis on openSUSE RPM packages, and found it unintuitive that the RPM package dependency graph is not a DAG (Directed Acyclic Graph). Instead there are dependency cycles between them, for example: ``` $ rpm -q --requires terminfo-base | grep ncurses ncurses >= 6.5.20240713 $ rpm -q --requires libncurses6|grep terminfo terminfo-base ``` ``` $ rpm -q --requires sonnet libKF5SonnetCore.so.5()(64bit) $ rpm -q --requires … [View More]

10 21

How to file bugs
by Ed Goforth 05 Dec '24

05 Dec '24

Whenever I try to log in to https://bugzilla.opensuse.org I get themessage "There is already an account with the login name sh33p(a)blisteringsheep.com."

4 3

Issues with suspend not actually suspending?
by Johannes Kastl 20 Nov '24

20 Nov '24

Hi all, did/does anyone else experience issues with suspending on Tumbleweed/MicroOS/Kalpa? Normally I can suspend my laptop by using the suspend buttons in Plasma6 or by issuing "systemctl suspend". Now it only works every third or fourth time. I works more reliably if I shut programs like Firefox and Thunderbird, but it still is not bullet-proof 100% working. It shows the look screen, freezes from some (20) seconds and then the login screen is shown again and the mouse responds again. I … [View More]

5 15

New Slowroll update 20241030T2221 released!
by bernhardout＠lsmod.de 06 Nov '24

06 Nov '24

Please note that this mail was generated by a script. A collection of maintenance updates was released for Slowroll. Released 29 packages: * VirtualGL * containerized-data-importer * dtc * gap-design * jersey * kbd * kubevirt * mesheryctl * neatvnc * neovide * openssl-3 * patterns-base * procs * python-Werkzeug * python-astroid * python-astropy-iers-data * python-bracex * python-click-aliases * python-coverage * python-dill * python-google-ai-generativelanguage * python-isort * python-kiwi * … [View More]

6 8

Error: Bootloader not detected. /etc/sysconfig/bootloader has LOADER_TYPE="grub2-efi", but only "systemd-boot" or "grub2-bls" are recognized.
by ASSI 02 Nov '24

02 Nov '24

This happened on one of my systems after updating them this morning (the others are fine with grub2-efi as the bootloader) and I can't seem to find out what it is actually complaining about or which package to (re-)install to get it fixed. Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

6 14

openSUSE:Factory - Build fail notification
by DimStar / Dominique Leuenberger 31 Oct '24

31 Oct '24

Dear Package maintainers and hackers. Below package(s) in openSUSE:Factory have had problems for at least 4 weeks. We tried to send out notifications to the configured bugowner/maintainers of the package(s), but so far no fix has been submitted. This probably means that the maintainer/bugowner did not yet find the time to look into the matter and he/she would certainly appreciate help to get this sorted. - codelite: Uninstallable: nothing provides libwx_baseu-suse.so.11.0.0()(64bit) needed by … [View More]

1 0

New Slowroll update 20241031T2031 released!
by bernhardout＠lsmod.de 31 Oct '24

31 Oct '24

Please note that this mail was generated by a script. A collection of maintenance updates was released for Slowroll. Released 62 packages: * MozillaThunderbird * ansible-core * ansible-core-2.16 * ansible-documentation * ansible-runner * audacious-plugins * brasero * cargo-audit-advisory-db * chromium * coppwr * dino * drumstick * element-desktop * element-web * fcft * gawk * gnome-branding-Aeon * gnome-pomodoro * gowitness * gpgme * gstreamer-plugins-good * gtk4 * less * libcryptui * minizip-… [View More]

1 0

issue with libQt6Core.so.6 don't let me to dup my Tumbleweed
by victorhck 31 Oct '24

31 Oct '24

Hello listmates Since a couple of weeks (or so, cant't remember the date) I can't zypper dup my tumbleweed + Plasma system. Everytime I lauch the command zypper says that "telegram-desktop-5.5.5-1.2.x86_64 installed requires libQt6Core.so.6(Qt_6.7.3_PRIVATE_API)(64bit)" I have options: keep obsolete libQt6Core6-6.7.3-1.1.x86_64 libQt6Gui6-6.7.3-1.1.x86_64 libQt6Widgets6-6.7.3-1.1.x86_64 libQt6DBus6-6.7.3-1.1.x86_64 libQt6OpenGL6-6.7.3-1.1.x86_64 uninstall telegram-dektop (nope!) brake … [View More]

7 9

Main

Development

Information

Community

Social Media

Other

openSUSE Factory