August 2024

RFC: SELinux as default MAC system on new Tumbleweed installations
by Cathy Hu 18 Feb '25

18 Feb '25

Hi all, *see TL;DR down below* SELinux is being adopted more and more as the main Mandatory Access Control (MAC) system in openSUSE distributions and SUSE products. The SUSE SELinux working group would like to announce the plan to switch new Tumbleweed installations to SELinux as default MAC system *by the end of this year*. Currently, new Tumbleweed installations select AppArmor in the installer as default MAC system. After this change, new Tumbleweed installations will select SELinux in … [View More]enforcing mode as default MAC system. Users will still be able to select AppArmor as MAC system in the installer. Existing installations will *not* be affected. If you would like to migrate your existing system from AppArmor to SELinux, we have a guide on what to consider and how to do that here [0]. *What does it mean for users?* Our SELinux policy contains many policy modules, which confine most well-known services. Switching to SELinux means more services are confined by default, which means enhanced security. On the other hand, more confinement also means that in the early phase of the adoption there could be more bugs caused by SELinux denying legitimate accesses. We perform both manual and automated tests via openQA, to ensure that our policy works seamlessly. We also rely on you, the community, to create bugreports so that we can adapt the policy to any scenarios that we did not foresee. We have a page on how to report bugs here: https://en.opensuse.org/openSUSE:Bugreport_SELinux To learn more about SELinux, we also have a Portal in the openSUSE wiki: https://en.opensuse.org/Portal:SELinux Please feel free to reply to this email in case you have any questions or concerns. We plan to do the change earliest in September 2024, and latest by the end of the year. Separate announcements will follow just before and after the change. TL;DR: - The Tumbleweed installer will select SELinux in enforcing mode as default on new installations - When: by the end of 2024, earliest in September, we will do separate announcements before and after - AppArmor can still be selected in the installer as an alternative - Existing installations will *not* change - Leap 15.x is not affected in any way Thank you very much :) Kind regards, Cathy [0] https://en.opensuse.org/Portal:SELinux/Setup#Setup_SELinux_on_existing_tumb… -- Cathy Hu <cahu(a)suse.de> SELinux Security Engineer GPG: 5873 CFD1 8C0E A6D4 9CBB F6C4 062A 1016 1505 A08A SUSE Software Solutions Germany GmbH Frankenstrasse 146 90461 Nürnberg Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg) [View Less]

16 33

Disabling /dev/fb0 on TW
by Thomas Zimmermann 06 Feb '25

06 Feb '25

tl;dr: Disable fbdev userspace interfaces on TW Hi, the upcoming Linux kernel v6.6 will contain the option to disable fbdev userspace interfaces in the kernel configuration. [1] I intent to enable this and thereby switch off /dev/fb0 et al. The tracker bug is boo#1212947. [2] * Why? The old fbdev subsystem is an endless source of bugs. For example, we recently had an out-of-bounds access in the fbdev emulation, where userspace could write beyond the end of the framebuffer memory. [3] … [View More]Fbdev is under-maintained. I've been doing improvements in recent kernel releases, but only where it benefits the DRM subsystem. Disabling fbdev userspace interfaces will also help weeding out any programs that still contain hard dependencies on them. * What changes? Enabling the new kernel option disables all fbdev userspace interfaces. These are * the device files, such as /dev/fb0 * the sys files under /sys/class/graphics/fb[0-9]+ * /proc/fb * What are the effects on userspace programs? Userspace applications run on the desktop via Wayland or X. There will be no change to them. Xorg and Wayland compositors run on DRM interfaces. A few programs run on SDL, which has no dependency on fbdev either. Any fbdev support in these mid-layer components should be disabled as well. There's one known affected program: TW's text-mode installer can use the tool fbiterm to display CJK symbols during installation. This comes from a time when some low-end systems where not able to boot graphics installation. fbiterm has been unmaintained for >15 years and is ready for retirement. But there's no good drop-in replacement. I propose to simply remove fbiterm and let the graphics installer handle CJK. * What about the framebuffer console? The kernel-provided framebuffer console does not change. The kernel will still show the regular console. Userspace interfaces in /sys/class/graphics/fbcon are still available. For questions and discussion, please comment here or in boo#1212947. Best regards Thomas [1] https://elixir.bootlin.com/linux/v6.6-rc1/source/drivers/video/fbdev/core/K… [2] https://bugzilla.opensuse.org/show_bug.cgi?id=1212947 [3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Frankenstrasse 146, 90461 Nuernberg, Germany GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman HRB 36809 (AG Nuernberg) [View Less]

13 44

Cyclic dependencies between RPM packages
by Xu Zhao 26 Dec '24

26 Dec '24

Hello openSUSE, I recently ran a couple of dependency analysis on openSUSE RPM packages, and found it unintuitive that the RPM package dependency graph is not a DAG (Directed Acyclic Graph). Instead there are dependency cycles between them, for example: ``` $ rpm -q --requires terminfo-base | grep ncurses ncurses >= 6.5.20240713 $ rpm -q --requires libncurses6|grep terminfo terminfo-base ``` ``` $ rpm -q --requires sonnet libKF5SonnetCore.so.5()(64bit) $ rpm -q --requires … [View More]

10 21

How to file bugs
by Ed Goforth 05 Dec '24

05 Dec '24

Whenever I try to log in to https://bugzilla.opensuse.org I get themessage "There is already an account with the login name sh33p(a)blisteringsheep.com."

4 3

Issues with suspend not actually suspending?
by Johannes Kastl 20 Nov '24

20 Nov '24

Hi all, did/does anyone else experience issues with suspending on Tumbleweed/MicroOS/Kalpa? Normally I can suspend my laptop by using the suspend buttons in Plasma6 or by issuing "systemctl suspend". Now it only works every third or fourth time. I works more reliably if I shut programs like Firefox and Thunderbird, but it still is not bullet-proof 100% working. It shows the look screen, freezes from some (20) seconds and then the login screen is shown again and the mouse responds again. I … [View More]

5 15

Plan to delete vagrant & Virtualization:vagrant by the end of November
by Dan Čermák 18 Oct '24

18 Oct '24

Dear all, due to Hashicorp changing the license of vagrant to the BUSL, we can no longer update vagrant in openSUSE. I don't have the cycles to maintain vagrant myself indefinitely and plan to send a delete request at the end of November to Factory. Once that goes in, I also plan to remove the Virtualization:vagrant project to reduce the number of rubygems we have in openSUSE. If you don't like this plan and decide to scream at me, please scream an actionable plan that involves you :-) … [View More]

6 14

Pushing a fix for ksanecore/Leap
by Javier Llorente 09 Oct '24

09 Oct '24

Hello everyone, I would like to push a fix for ksanecore in both openSUSE Leap 15.5 and 15.6. Could anyone please take a look at request #1177805? It's been in review state for several months. Thanks, -- Javier Llorente

2 6

Re: Snapshot 20240622 again broke my system
by ASSI 05 Oct '24

05 Oct '24

ASSI writes: > ASSI writes: > Had it happen again: the process that hangs is > plasma-fallback-session-save. This is on a machine where I only use a > manually saved session, so really it should not even try to save > something when I shutdown (via a hotkey I should add, I'll try to use > the session menu tomorrow). The other machine where it doesn't happen > has whatever the default session setup is and since I have not set up a > hotkey there I shut it down via the … [View More]session menu. Of my four Tumbleweed installations, three have this problem and one does not. The one that works as expected is an installation from just one month ago, while the other ones are older. The hotkey setup is by now identical on all of them, so the failure to leave the plasma session in any way (and have plasma-fallback-session-save hang) must be with some other setting that was most likely converted from Plasma 5 and does not work correctly anymore. The whole shutdown procedure looks totally normal and leaves no errors in the system log until it stops doing anything, then killing the hanging process (expectedly) gives: --8<---------------cut here---------------start------------->8--- Jun 29 21:21:37 Gerda plasma-shutdown[18023]: org.kde.plasma.shutdown: plasma-fallback-session-save failed with return code -1 --8<---------------cut here---------------end--------------->8--- The rest of the shutdown does not show any errors other than a few that seem to be connected to me force-ending this process: --8<---------------cut here---------------start------------->8--- Jun 29 21:21:37 Gerda startplasma-x11[2129]: org.kde.startup: "kdeinit5_shutdown" QList() exited with code 255 Jun 29 21:21:37 Gerda kded6[2280]: XIO: fatal IO error 4 (Interrupted system call) on X server ":0" Jun 29 21:21:37 Gerda kded6[2280]: after 695 requests (695 known processed) with 0 events remaining. Jun 29 21:21:37 Gerda kwalletd6[2128]: The X11 connection broke (error 1). Did the X11 server die? Jun 29 21:21:37 Gerda kded6[2280]: The X11 connection broke: I/O error (code 1) Jun 29 21:21:37 Gerda kded6[2280]: org.kde.pulseaudio: No object for name "alsa_output.pci-0000_34_00.1.hdmi-stereo-extra1" Jun 29 21:21:37 Gerda kded6[2280]: org.kde.pulseaudio: No object for name "alsa_output.pci-0000_34_00.1.hdmi-stereo-extra1" Jun 29 21:21:37 Gerda kded6[2280]: org.kde.pulseaudio: No object for name "alsa_output.pci-0000_34_00.1.hdmi-stereo-extra1" Jun 29 21:21:37 Gerda systemd[2113]: xdg-desktop-portal-gtk.service: Main process exited, code=exited, status=1/FAILURE Jun 29 21:21:37 Gerda systemd[2113]: xdg-desktop-portal-gtk.service: Failed with result 'exit-code'. Jun 29 21:21:37 Gerda systemd[2113]: plasma-kwin_x11.service: Main process exited, code=exited, status=15/n/a Jun 29 21:21:37 Gerda systemd[2113]: plasma-kwin_x11.service: Failed with result 'exit-code'. Jun 29 21:21:37 Gerda systemd[2113]: Stopped KDE Window Manager. Jun 29 21:21:37 Gerda systemd[2113]: plasma-kwin_x11.service: Consumed 2min 19.383s CPU time. Jun 29 21:21:37 Gerda systemd[2113]: Stopped KDE Session Management Server. Jun 29 21:21:37 Gerda systemd[2113]: plasma-kded6.service: Main process exited, code=exited, status=1/FAILURE Jun 29 21:21:37 Gerda systemd[2113]: plasma-kded6.service: Failed with result 'exit-code'. --8<---------------cut here---------------end--------------->8--- Does anybody have an idea of where else to look? I notice that the whole thing now goes through systemd units/services, so possibly there might be a dependency problem as well. Regards, Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+ [View Less]

1 1

akonadi crashes on latest KDE update
by Axel Braun 12 Sep '24

12 Sep '24

Updated TW to latest version today. since then akonadi using postgresql keeps crashing (log at https://paste.opensuse.org/pastes/6fba37d8ddbe) There was briefly a message popping up about a dbus issue - could not find a log for this unfortunately Anyone else seeing this? Cheers Axel

4 4

various /run/credentials/... tmpfs mounts lingering
by Patrick Schaaf 08 Sep '24

08 Sep '24

Dear tumbleweeders, I just noticed that with recent tw updates, probably starting with systemd 256, quite a number of tmpfs instances remain mounted after booting, with names corresponding to systemd services. Some of these services are one-shot and long gone. Shouldn't at least these, then vanish again? See below for what I mean. I haven't checked whether that would be upstream behaviour but thought I mention it regardless, here, as it's bound to be seen by others. best regards Patrick … [View More]

4 3

Main

Development

Information

Community

Social Media

Other

openSUSE Factory