July 2024

RFC: SELinux as default MAC system on new Tumbleweed installations
by Cathy Hu 18 Feb '25

18 Feb '25

Hi all, *see TL;DR down below* SELinux is being adopted more and more as the main Mandatory Access Control (MAC) system in openSUSE distributions and SUSE products. The SUSE SELinux working group would like to announce the plan to switch new Tumbleweed installations to SELinux as default MAC system *by the end of this year*. Currently, new Tumbleweed installations select AppArmor in the installer as default MAC system. After this change, new Tumbleweed installations will select SELinux in … [View More]enforcing mode as default MAC system. Users will still be able to select AppArmor as MAC system in the installer. Existing installations will *not* be affected. If you would like to migrate your existing system from AppArmor to SELinux, we have a guide on what to consider and how to do that here [0]. *What does it mean for users?* Our SELinux policy contains many policy modules, which confine most well-known services. Switching to SELinux means more services are confined by default, which means enhanced security. On the other hand, more confinement also means that in the early phase of the adoption there could be more bugs caused by SELinux denying legitimate accesses. We perform both manual and automated tests via openQA, to ensure that our policy works seamlessly. We also rely on you, the community, to create bugreports so that we can adapt the policy to any scenarios that we did not foresee. We have a page on how to report bugs here: https://en.opensuse.org/openSUSE:Bugreport_SELinux To learn more about SELinux, we also have a Portal in the openSUSE wiki: https://en.opensuse.org/Portal:SELinux Please feel free to reply to this email in case you have any questions or concerns. We plan to do the change earliest in September 2024, and latest by the end of the year. Separate announcements will follow just before and after the change. TL;DR: - The Tumbleweed installer will select SELinux in enforcing mode as default on new installations - When: by the end of 2024, earliest in September, we will do separate announcements before and after - AppArmor can still be selected in the installer as an alternative - Existing installations will *not* change - Leap 15.x is not affected in any way Thank you very much :) Kind regards, Cathy [0] https://en.opensuse.org/Portal:SELinux/Setup#Setup_SELinux_on_existing_tumb… -- Cathy Hu <cahu(a)suse.de> SELinux Security Engineer GPG: 5873 CFD1 8C0E A6D4 9CBB F6C4 062A 1016 1505 A08A SUSE Software Solutions Germany GmbH Frankenstrasse 146 90461 Nürnberg Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg) [View Less]

16 33

Disabling /dev/fb0 on TW
by Thomas Zimmermann 06 Feb '25

06 Feb '25

tl;dr: Disable fbdev userspace interfaces on TW Hi, the upcoming Linux kernel v6.6 will contain the option to disable fbdev userspace interfaces in the kernel configuration. [1] I intent to enable this and thereby switch off /dev/fb0 et al. The tracker bug is boo#1212947. [2] * Why? The old fbdev subsystem is an endless source of bugs. For example, we recently had an out-of-bounds access in the fbdev emulation, where userspace could write beyond the end of the framebuffer memory. [3] … [View More]Fbdev is under-maintained. I've been doing improvements in recent kernel releases, but only where it benefits the DRM subsystem. Disabling fbdev userspace interfaces will also help weeding out any programs that still contain hard dependencies on them. * What changes? Enabling the new kernel option disables all fbdev userspace interfaces. These are * the device files, such as /dev/fb0 * the sys files under /sys/class/graphics/fb[0-9]+ * /proc/fb * What are the effects on userspace programs? Userspace applications run on the desktop via Wayland or X. There will be no change to them. Xorg and Wayland compositors run on DRM interfaces. A few programs run on SDL, which has no dependency on fbdev either. Any fbdev support in these mid-layer components should be disabled as well. There's one known affected program: TW's text-mode installer can use the tool fbiterm to display CJK symbols during installation. This comes from a time when some low-end systems where not able to boot graphics installation. fbiterm has been unmaintained for >15 years and is ready for retirement. But there's no good drop-in replacement. I propose to simply remove fbiterm and let the graphics installer handle CJK. * What about the framebuffer console? The kernel-provided framebuffer console does not change. The kernel will still show the regular console. Userspace interfaces in /sys/class/graphics/fbcon are still available. For questions and discussion, please comment here or in boo#1212947. Best regards Thomas [1] https://elixir.bootlin.com/linux/v6.6-rc1/source/drivers/video/fbdev/core/K… [2] https://bugzilla.opensuse.org/show_bug.cgi?id=1212947 [3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Frankenstrasse 146, 90461 Nuernberg, Germany GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman HRB 36809 (AG Nuernberg) [View Less]

13 44

How to file bugs
by Ed Goforth 05 Dec '24

05 Dec '24

Whenever I try to log in to https://bugzilla.opensuse.org I get themessage "There is already an account with the login name sh33p(a)blisteringsheep.com."

4 3

Issues with suspend not actually suspending?
by Johannes Kastl 20 Nov '24

20 Nov '24

Hi all, did/does anyone else experience issues with suspending on Tumbleweed/MicroOS/Kalpa? Normally I can suspend my laptop by using the suspend buttons in Plasma6 or by issuing "systemctl suspend". Now it only works every third or fourth time. I works more reliably if I shut programs like Firefox and Thunderbird, but it still is not bullet-proof 100% working. It shows the look screen, freezes from some (20) seconds and then the login screen is shown again and the mouse responds again. I … [View More]

5 15

Plan to delete vagrant & Virtualization:vagrant by the end of November
by Dan Čermák 18 Oct '24

18 Oct '24

Dear all, due to Hashicorp changing the license of vagrant to the BUSL, we can no longer update vagrant in openSUSE. I don't have the cycles to maintain vagrant myself indefinitely and plan to send a delete request at the end of November to Factory. Once that goes in, I also plan to remove the Virtualization:vagrant project to reduce the number of rubygems we have in openSUSE. If you don't like this plan and decide to scream at me, please scream an actionable plan that involves you :-) … [View More]

6 14

Re: Snapshot 20240622 again broke my system
by ASSI 05 Oct '24

05 Oct '24

ASSI writes: > ASSI writes: > Had it happen again: the process that hangs is > plasma-fallback-session-save. This is on a machine where I only use a > manually saved session, so really it should not even try to save > something when I shutdown (via a hotkey I should add, I'll try to use > the session menu tomorrow). The other machine where it doesn't happen > has whatever the default session setup is and since I have not set up a > hotkey there I shut it down via the … [View More]session menu. Of my four Tumbleweed installations, three have this problem and one does not. The one that works as expected is an installation from just one month ago, while the other ones are older. The hotkey setup is by now identical on all of them, so the failure to leave the plasma session in any way (and have plasma-fallback-session-save hang) must be with some other setting that was most likely converted from Plasma 5 and does not work correctly anymore. The whole shutdown procedure looks totally normal and leaves no errors in the system log until it stops doing anything, then killing the hanging process (expectedly) gives: --8<---------------cut here---------------start------------->8--- Jun 29 21:21:37 Gerda plasma-shutdown[18023]: org.kde.plasma.shutdown: plasma-fallback-session-save failed with return code -1 --8<---------------cut here---------------end--------------->8--- The rest of the shutdown does not show any errors other than a few that seem to be connected to me force-ending this process: --8<---------------cut here---------------start------------->8--- Jun 29 21:21:37 Gerda startplasma-x11[2129]: org.kde.startup: "kdeinit5_shutdown" QList() exited with code 255 Jun 29 21:21:37 Gerda kded6[2280]: XIO: fatal IO error 4 (Interrupted system call) on X server ":0" Jun 29 21:21:37 Gerda kded6[2280]: after 695 requests (695 known processed) with 0 events remaining. Jun 29 21:21:37 Gerda kwalletd6[2128]: The X11 connection broke (error 1). Did the X11 server die? Jun 29 21:21:37 Gerda kded6[2280]: The X11 connection broke: I/O error (code 1) Jun 29 21:21:37 Gerda kded6[2280]: org.kde.pulseaudio: No object for name "alsa_output.pci-0000_34_00.1.hdmi-stereo-extra1" Jun 29 21:21:37 Gerda kded6[2280]: org.kde.pulseaudio: No object for name "alsa_output.pci-0000_34_00.1.hdmi-stereo-extra1" Jun 29 21:21:37 Gerda kded6[2280]: org.kde.pulseaudio: No object for name "alsa_output.pci-0000_34_00.1.hdmi-stereo-extra1" Jun 29 21:21:37 Gerda systemd[2113]: xdg-desktop-portal-gtk.service: Main process exited, code=exited, status=1/FAILURE Jun 29 21:21:37 Gerda systemd[2113]: xdg-desktop-portal-gtk.service: Failed with result 'exit-code'. Jun 29 21:21:37 Gerda systemd[2113]: plasma-kwin_x11.service: Main process exited, code=exited, status=15/n/a Jun 29 21:21:37 Gerda systemd[2113]: plasma-kwin_x11.service: Failed with result 'exit-code'. Jun 29 21:21:37 Gerda systemd[2113]: Stopped KDE Window Manager. Jun 29 21:21:37 Gerda systemd[2113]: plasma-kwin_x11.service: Consumed 2min 19.383s CPU time. Jun 29 21:21:37 Gerda systemd[2113]: Stopped KDE Session Management Server. Jun 29 21:21:37 Gerda systemd[2113]: plasma-kded6.service: Main process exited, code=exited, status=1/FAILURE Jun 29 21:21:37 Gerda systemd[2113]: plasma-kded6.service: Failed with result 'exit-code'. --8<---------------cut here---------------end--------------->8--- Does anybody have an idea of where else to look? I notice that the whole thing now goes through systemd units/services, so possibly there might be a dependency problem as well. Regards, Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+ [View Less]

1 1

Glitches in Plasma6
by Jogchum Reitsma 18 Aug '24

18 Aug '24

Hi, I've posted this messages March 18, but while I see it in the archive, apparently it did not make it to my mailbox- no idea how that is possible. I'll give it try here again, slightly modified: Some small glitches after doing the upgrade to plasma 6: -The icon of the program starter is covered by the icon some program sitting on the task bar. I did not find out yes what the "algorithm" is, but so far the only way to get the correct icon is to enter the Edit mode for the … [View More]

3 4

New Tumbleweed snapshot 20240110 released!
by Dominique Leuenberger 15 Aug '24

15 Aug '24

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/… [View More]openSUSE:Submitting_bug_reports Packages changed: certmonger (0.79.15 -> 0.79.19) eog (45.1 -> 45.2) git gnome-remote-desktop (45.0 -> 45.1) gnome-shell (45.2 -> 45.3) gvfs (1.52.1 -> 1.52.2) hwdata (0.377 -> 0.378) libgxps (0.3.2 -> 0.3.2+5) libstorage-ng (4.5.170 -> 4.5.171) libxkbcommon mutter (45.2 -> 45.3) nodejs21 (21.4.0 -> 21.5.0) publicsuffix (20231213 -> 20240107) redis (7.2.3 -> 7.2.4) sg3_utils (1.48+6.7f43e14 -> 1.48+7.63e63cb) transmission (4.0.4 -> 4.0.5) yast2-packager (5.0.1 -> 5.0.2) === Details === ==== certmonger ==== Version update (0.79.15 -> 0.79.19) - Update to 0.79.19 - Removed 0001-Disable-DSA-in-the-RPM-spec.patch - Added 0001-Update-tests-to-be-compatible-with-OpenSSL-3.2.patch ==== eog ==== Version update (45.1 -> 45.2) Subpackages: eog-lang - Update to version 45.2: + data: Update appdata. + Updated translations. ==== git ==== Subpackages: git-core git-email git-web perl-Git - gitweb AppArmor profile: allow reading etc/gitweb-common.conf (boo#1218664) ==== gnome-remote-desktop ==== Version update (45.0 -> 45.1) Subpackages: gnome-remote-desktop-lang - Update to version 45.1: + session: - Assert region size to be greater than 0 - Add debug message to also output new EI regions - Scale absolute pointer position with respect to the EI region - Clear all EI related instances before dbus session stop call - Only notify keysym when EI keyboard is available - Add struct for absolute pointer motion events + vnc-pipewire-stream: Don't remove buffer while dequeueing it + rdp-pipewire-stream: Don't remove buffer while dequeueing it + Adapt usage of abs pointer motion events to GrdEventPointerMotionAbs + Updated translations. ==== gnome-shell ==== Version update (45.2 -> 45.3) Subpackages: gnome-extensions gnome-shell-calendar gnome-shell-lang - Update to version 45.3: + Allow any enter key to be used to screenshot. + Fix spinner in light style variant. + Improve formatting of extension errors. + Fixed crash. + Misc. bug fixes and cleanups. + Updated translations. - Drop gnome-shell_nb_fix_trans.patch: fixed upstream. ==== gvfs ==== Version update (1.52.1 -> 1.52.2) Subpackages: gvfs-backend-afc gvfs-backend-goa gvfs-backend-samba gvfs-backends gvfs-fuse gvfs-lang - Update to version 1.52.2: + smb: Fix livelock when mounting share without enough permissions. + smb: Fi moving files across filesystem boundaries. + Updated transltions. ==== hwdata ==== Version update (0.377 -> 0.378) - update to 0.378: * Update pci, usb and vendor ids ==== libgxps ==== Version update (0.3.2 -> 0.3.2+5) - Update to version 0.3.2+5: + DOAP: Fix 'bug-database' value to point to GNOME GitLab Issues + images: - For jpeg images try to get the image resolution from exif first - Add support for jpeg images with CMYK color space + Fix compiler warnings + Fix meson warnings - Switch to git checkout via source service, use explicit commit. - Use ldconfig_scriptlets macro for post(un) handling. - Update URL to new home. - Drop no longer needed libgxps-rpmlintrc. ==== libstorage-ng ==== Version update (4.5.170 -> 4.5.171) Subpackages: libstorage-ng-lang libstorage-ng-ruby libstorage-ng1 - merge gh#openSUSE/libstorage-ng#977 - provide light_probe function with SystemInfo parameter - 4.5.171 ==== libxkbcommon ==== Subpackages: libxkbcommon-x11-0 libxkbcommon0 libxkbregistry0 - add libxkbregistry-devel to baselibs for use by wine-32bit. (bsc#1218640) ==== mutter ==== Version update (45.2 -> 45.3) Subpackages: mutter-lang - Update to version 45.3: + Fix handling of relative mode for tablets. + Fix forcing EGLStream with NVIDIA proprietary driver. + Sync geometry only when window is mapped. + Improve repick due to transform changes. + wayland/client: Add make_desktop() method. + Fix occasional artifacts at top of X11 fullscreen windows. + background: Fix background color around image. + Fixed crashes. + Plugged leaks. + Misc. bug fixes and cleanups. + Updated translations. ==== nodejs21 ==== Version update (21.4.0 -> 21.5.0) Subpackages: npm21 - Update to 21.5.0: * module: merge config with package_json_reader * src: move package resolver to c++ * doc: + deprecate hash constructor + deprecate dirent.path - linker_lto_jobs.patch: refreshed ==== publicsuffix ==== Version update (20231213 -> 20240107) - Update to version 20240107: * Remove homeoffice.gov.uk (#1909) * util: gTLD data autopull updates for 2024-01-06T15:12:04 UTC (#1918) ==== redis ==== Version update (7.2.3 -> 7.2.4) - redis 7.2.4: (boo#1218646) - Security fixes - (CVE-2023-41056) In some cases, Redis may incorrectly handle resizing of memory buffers which can result in incorrect accounting of buffer sizes and lead to heap overflow and potential remote code execution. - Bug fixes - Fix crashes of cluster commands clusters with mixed versions of 7.0 and 7.2 (#12805, #12832) - Fix slot ownership not being properly handled when deleting a slot from a node (#12564) - Fix atomicity issues with the RedisModuleEvent_Key module API event (#12733) ==== sg3_utils ==== Version update (1.48+6.7f43e14 -> 1.48+7.63e63cb) Subpackages: libsgutils2-1_48-2 - Fix spurious warning for non-SCSI devices (boo#1218666) ==== transmission ==== Version update (4.0.4 -> 4.0.5) Subpackages: transmission-common transmission-gtk transmission-gtk-lang - Update to version 4.0.5: + Fixed 4.0.0 bug where the IP address field in UDP announces were not encoded in network byte order. + Fixed a bug that incorrectly escaped JSON strings in some locales. + Fixed 4.0.4 decreased download speeds for people who set a low upload bandwidth limit. + Fixed bug that prevented editing trackers on magnet links. + Fixed HTTP tracker announces and scrapes sometimes failing after adding a torrent file by HTTPS URL. + In RPC responses, change the default sort order of torrents to match Transmission 3.00. + Fixed tr_sys_path_copy() behavior on some Synology Devices. + Fix: only append .added suffix to watchdir files. + Fixed crash when opening torrent file from "Recently used" section in GTK 4. ==== yast2-packager ==== Version update (5.0.1 -> 5.0.2) - After installation disable the empty installation repository from the SLE15 Online medium (bsc#1182303) - 5.0.2 [View Less]

9 9

openSUSE Release Engineering meeting 13.03.2024
by Lubos Kocman 07 Aug '24

07 Aug '24

!!! HEADS UP WE ARE BACK USING JITSI !!! https://meet.opensuse.org/ReleaseEngineeringMeeting How to join the meeting? https://calendar.opensuse.org/teams/release/events/opensuse_release_enginee… All meeting minutes can be found here: https://etherpad.opensuse.org/p/ReleaseEngineering-meeting ## Attendees ana,guillaumeg, DimStar, lkocman, DocB, bmwiedemann,maxlin ## Leap Leap 15.6 Beta build Build630.1 bringing fix to Virtualbox was published yesterday in the evening. Publishing seem to … [View More]

2 1

mkosi-initrd: initial enablement for Tumbleweed
by Antonio Feijoo 02 Aug '24

02 Aug '24

Hi! For those of you who want to experiment with an alternative initrd generator, I've prepared the initial enablement of mkosi-initrd for Tumbleweed. Why is it interesting and different from other initrd generators? Mainly, because it builds the initrd from distro packages instead of picking everything from your local host. Analysis and instructions: https://en.opensuse.org/Mkosi-initrd *A big warning here*: this is just a proof of concept, an incomplete initrd can break the system boot, … [View More]

2 1

Main

Development

Information

Community

Social Media

Other

openSUSE Factory