November 2024

RFC: SELinux as default MAC system on new Tumbleweed installations
by Cathy Hu 18 Feb '25

18 Feb '25

Hi all, *see TL;DR down below* SELinux is being adopted more and more as the main Mandatory Access Control (MAC) system in openSUSE distributions and SUSE products. The SUSE SELinux working group would like to announce the plan to switch new Tumbleweed installations to SELinux as default MAC system *by the end of this year*. Currently, new Tumbleweed installations select AppArmor in the installer as default MAC system. After this change, new Tumbleweed installations will select SELinux in … [View More]enforcing mode as default MAC system. Users will still be able to select AppArmor as MAC system in the installer. Existing installations will *not* be affected. If you would like to migrate your existing system from AppArmor to SELinux, we have a guide on what to consider and how to do that here [0]. *What does it mean for users?* Our SELinux policy contains many policy modules, which confine most well-known services. Switching to SELinux means more services are confined by default, which means enhanced security. On the other hand, more confinement also means that in the early phase of the adoption there could be more bugs caused by SELinux denying legitimate accesses. We perform both manual and automated tests via openQA, to ensure that our policy works seamlessly. We also rely on you, the community, to create bugreports so that we can adapt the policy to any scenarios that we did not foresee. We have a page on how to report bugs here: https://en.opensuse.org/openSUSE:Bugreport_SELinux To learn more about SELinux, we also have a Portal in the openSUSE wiki: https://en.opensuse.org/Portal:SELinux Please feel free to reply to this email in case you have any questions or concerns. We plan to do the change earliest in September 2024, and latest by the end of the year. Separate announcements will follow just before and after the change. TL;DR: - The Tumbleweed installer will select SELinux in enforcing mode as default on new installations - When: by the end of 2024, earliest in September, we will do separate announcements before and after - AppArmor can still be selected in the installer as an alternative - Existing installations will *not* change - Leap 15.x is not affected in any way Thank you very much :) Kind regards, Cathy [0] https://en.opensuse.org/Portal:SELinux/Setup#Setup_SELinux_on_existing_tumb… -- Cathy Hu <cahu(a)suse.de> SELinux Security Engineer GPG: 5873 CFD1 8C0E A6D4 9CBB F6C4 062A 1016 1505 A08A SUSE Software Solutions Germany GmbH Frankenstrasse 146 90461 Nürnberg Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg) [View Less]

16 33

Disabling /dev/fb0 on TW
by Thomas Zimmermann 06 Feb '25

06 Feb '25

tl;dr: Disable fbdev userspace interfaces on TW Hi, the upcoming Linux kernel v6.6 will contain the option to disable fbdev userspace interfaces in the kernel configuration. [1] I intent to enable this and thereby switch off /dev/fb0 et al. The tracker bug is boo#1212947. [2] * Why? The old fbdev subsystem is an endless source of bugs. For example, we recently had an out-of-bounds access in the fbdev emulation, where userspace could write beyond the end of the framebuffer memory. [3] … [View More]Fbdev is under-maintained. I've been doing improvements in recent kernel releases, but only where it benefits the DRM subsystem. Disabling fbdev userspace interfaces will also help weeding out any programs that still contain hard dependencies on them. * What changes? Enabling the new kernel option disables all fbdev userspace interfaces. These are * the device files, such as /dev/fb0 * the sys files under /sys/class/graphics/fb[0-9]+ * /proc/fb * What are the effects on userspace programs? Userspace applications run on the desktop via Wayland or X. There will be no change to them. Xorg and Wayland compositors run on DRM interfaces. A few programs run on SDL, which has no dependency on fbdev either. Any fbdev support in these mid-layer components should be disabled as well. There's one known affected program: TW's text-mode installer can use the tool fbiterm to display CJK symbols during installation. This comes from a time when some low-end systems where not able to boot graphics installation. fbiterm has been unmaintained for >15 years and is ready for retirement. But there's no good drop-in replacement. I propose to simply remove fbiterm and let the graphics installer handle CJK. * What about the framebuffer console? The kernel-provided framebuffer console does not change. The kernel will still show the regular console. Userspace interfaces in /sys/class/graphics/fbcon are still available. For questions and discussion, please comment here or in boo#1212947. Best regards Thomas [1] https://elixir.bootlin.com/linux/v6.6-rc1/source/drivers/video/fbdev/core/K… [2] https://bugzilla.opensuse.org/show_bug.cgi?id=1212947 [3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Frankenstrasse 146, 90461 Nuernberg, Germany GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman HRB 36809 (AG Nuernberg) [View Less]

13 44

Cyclic dependencies between RPM packages
by Xu Zhao 26 Dec '24

26 Dec '24

Hello openSUSE, I recently ran a couple of dependency analysis on openSUSE RPM packages, and found it unintuitive that the RPM package dependency graph is not a DAG (Directed Acyclic Graph). Instead there are dependency cycles between them, for example: ``` $ rpm -q --requires terminfo-base | grep ncurses ncurses >= 6.5.20240713 $ rpm -q --requires libncurses6|grep terminfo terminfo-base ``` ``` $ rpm -q --requires sonnet libKF5SonnetCore.so.5()(64bit) $ rpm -q --requires … [View More]

10 21

How to file bugs
by Ed Goforth 05 Dec '24

05 Dec '24

Whenever I try to log in to https://bugzilla.opensuse.org I get themessage "There is already an account with the login name sh33p(a)blisteringsheep.com."

4 3

Is it time to deprecate plymouth in TW?
by Frank Krüger 05 Dec '24

05 Dec '24

Hi there, After the recent mess with plymouth, I wonder if it is still needed in Tumbleweed. Regards, Frank

23 53

openSUSE:Factory - Build fail notification
by DimStar / Dominique Leuenberger 04 Dec '24

04 Dec '24

Dear Package maintainers and hackers. Below package(s) in openSUSE:Factory have had problems for at least 4 weeks. We tried to send out notifications to the configured bugowner/maintainers of the package(s), but so far no fix has been submitted. This probably means that the maintainer/bugowner did not yet find the time to look into the matter and he/she would certainly appreciate help to get this sorted. - NumCpp: Fails to build - OOKiedokie: Fails to build - Regina-REXX: Fails to build - … [View More]asusfan: Fails to build - authselect: Fails to build - cgdb: Fails to build - cinnamon-branding-openSUSE: Fails to build - ckermit: Fails to build - clustduct: Fails to build - cmpi-bindings: Fails to build - compface: Fails to build - compiz-plugins-extra: Fails to build - compsize: Fails to build - dump1090-fa: Fails to build - eciadsl-usermode: Fails to build - eekboard: Fails to build - erldash: Fails to build - fairymax: Fails to build - fdo-client: Fails to build - ffsb: Fails to build - frink: Fails to build - fritzing: Fails to build - galene: Fails to build - gammu: Fails to build - gcad3d: Fails to build - genders: Fails to build - gimp-gap: Fails to build - gnu-cobol: Fails to build - goldendict-ng: Fails to build - gqlplus: Fails to build - gtk-sharp3: Fails to build - hcode: Fails to build - hoard: Fails to build - iasimage: Fails to build - ibus-kkc: Fails to build - input-pad: Fails to build - interbench: Fails to build - kubeconform: Fails to build - lastpass-cli: Fails to build - latrace: Fails to build - ldapvi: Fails to build - leftwm: Fails to build - lemon: Fails to build - libGLC: Fails to build - libargtable2: Fails to build - libclaw: Fails to build - libcli: Fails to build - libfm: Fails to build - libisds: Fails to build - librep: Fails to build - libskk: Fails to build - libstfl: Fails to build - lmarbles: Fails to build - luvcview: Fails to build - macchina: Fails to build - maelstrom: Fails to build - manaplus: Fails to build - matrix-quaternion: Uninstallable: nothing provides libQuotientQt6.so.0.8()(64bit) needed by matrix-quaternion-0.0.95.84+git.20230827.3d7083a.x86_64 - mined: Fails to build - monitoring-plugins-mysql_health: Fails to build - moolticute: Fails to build - mozilla-zilla-slab-fonts: Fails to build - mozldap: Fails to build - mp: Fails to build - mrsh: Fails to build - ncftp: Fails to build - ncspot: Fails to build - netdate: Fails to build - nfswatch: Fails to build - nim: Fails to build - notmuch: Fails to build - obconf: Fails to build - octave-forge-tisean: Fails to build - octave-forge-vrml: Fails to build - openlierox: Fails to build - openvas-smb: Fails to build - openvino: Uninstallable: nothing provides libprotobuf-lite.so.25.4.0()(64bit) needed by libopenvino_onnx_frontend2440-2024.4.0.x86_64 - oto: Fails to build - owncloud-client: Fails to build - packETH: Fails to build - parsec: Fails to build - pcsc-gempc: Fails to build - perl-Authen-SASL-Cyrus: Fails to build - perl-DateTime-Format-Flexible: Fails to build - perl-GnuPG-Interface: Fails to build - perl-Inline-Python: Fails to build - perl-Net-AMQP-RabbitMQ: Fails to build - perl-Net-IDN-Encode: Fails to build - perl-UNIVERSAL-moniker: Fails to build - pidgin-sipe: Fails to build - pingtunnel: Fails to build - pocketsphinx: Fails to build - pongix: Fails to build - postfish: Fails to build - prelude-lml-rules: Fails to build - python-Kivy: Fails to build - python-aws-xray-sdk: Fails to build - python-dbus_fast: Fails to build - python-django-bootstrap3: Fails to build - python-django-contrib-comments: Fails to build - python-django-extensions: Fails to build - python-django-seed: Fails to build - python-django-sortedm2m: Fails to build - python-gpt4all: Fails to build - python-jenkinsapi: Fails to build - python-neovim: Fails to build - python-novaclient: Fails to build - python-pip-tools: Fails to build - python-pscript: Fails to build - python-py-gitea-opensuse-org: Fails to build - python-py-moneyed: Fails to build - qdl: Fails to build - qxmledit: Fails to build - reaim: Fails to build - rep-gtk: Fails to build - resample: Fails to build - rinetd: Fails to build - rox-filer: Fails to build - schedtool: Fails to build - scim-skk: Fails to build - scmon: Fails to build - sdcv: Fails to build - sgrep: Fails to build - sleuth: Fails to build - slrn: Fails to build - snack: Fails to build - softhsm: Fails to build - spacefm: Fails to build - sphinx: Fails to build - sphinxbase: Fails to build - sphinxbase5: Fails to build - stardict: Fails to build - taigo: Fails to build - terminus: Fails to build - thttpd: Fails to build - tint2: Fails to build - tktable: Fails to build - torsocks: Fails to build - ttf2pt1: Fails to build - upm: Fails to build - veyon: Fails to build - virt-scenario: Fails to build - vocal: Fails to build - wine-nine-standalone: Fails to build - xar: Fails to build - xbench: Fails to build - xcolors: Fails to build - xengine: Fails to build - xf86-video-fbturbo: Fails to build - xf86-video-fbturbo-live: Fails to build - xmgrace: Fails to build - xmorph: Fails to build - xroach: Fails to build - zile: Fails to build Unless somebody is stepping up and submitting fixes, the listed package(s) are going to be removed from openSUSE:Factory. Kind regards, DimStar / Dominique Leuenberger <dimstar(a)opensuse.org> [View Less]

8 8

Proposal: Update default build flags to enable frame pointers
by Neal Gompa 03 Dec '24

03 Dec '24

Hello, I would like to change openSUSE's default build flags in rpm and rpm-config-SUSE to incorporate frame pointers (and equivalents on other architectures) to support real-time profiling and observability on SUSE distributions. In practice, this would mean essentially adopting the same tunables that exist in Fedora[1] for openSUSE to turn them on by default and to allow packages or OBS projects to selectively opt out as needed. The reasons to do so are threefold: * It is a major … [View More]

13 57

openSUSE:Factory - Build fail notification
by DimStar / Dominique Leuenberger 03 Dec '24

03 Dec '24

Dear Package maintainers and hackers. Below package(s) in openSUSE:Factory have had problems for at least 4 weeks. We tried to send out notifications to the configured bugowner/maintainers of the package(s), but so far no fix has been submitted. This probably means that the maintainer/bugowner did not yet find the time to look into the matter and he/she would certainly appreciate help to get this sorted. - python-Nuitka: Fails to build Unless somebody is stepping up and submitting fixes, the … [View More]

2 1

Tumbleweed snapshot 20241127 update issue
by Ulf 30 Nov '24

30 Nov '24

During the update, following issue is visible (desktop switch to another tty with the logoff screen (tty1). But with <Ctrl>+<Alt>+<F3> switching to the running sessin in tty3 is still possible. The zypper dup - darcut script in the tmux session shows %posttrans(kernel-firmware-all-20241125-1.1.noarch) script output: /usr/lib/tmpfiles.d/connman_resolvconf.conf:1: Line references path below legacy directory /var/run/, updating /var/run/connman → /run/connman; please update … [View More]

7 7

Obscure RPM error on LoongArch
by John Paul Adrian Glaubitz 30 Nov '24

30 Nov '24

Hello, I'm almost done with my openSUSE LoongArch bootstrap. Unfortunately, I'm now running into an obscure RPM error which doesn't seem to be document anywhere [1]: [ 12s] error: .init_b_cache/compat-usrmerge-tools.rpm: invalid signature tag (unknown) (257) [ 12s] error: .init_b_cache/compat-usrmerge-tools.rpm cannot be installed Does anyone know what could trigger this particular problem? Thanks, Adrian > [1] https://build.opensuse.org/package/live_build_log/devel:LoongArch:Factory/f…

4 6

Main

Development

Information

Community

Social Media

Other

openSUSE Factory