September 2024

RFC: SELinux as default MAC system on new Tumbleweed installations
by Cathy Hu 18 Feb '25

18 Feb '25

Hi all, *see TL;DR down below* SELinux is being adopted more and more as the main Mandatory Access Control (MAC) system in openSUSE distributions and SUSE products. The SUSE SELinux working group would like to announce the plan to switch new Tumbleweed installations to SELinux as default MAC system *by the end of this year*. Currently, new Tumbleweed installations select AppArmor in the installer as default MAC system. After this change, new Tumbleweed installations will select SELinux in … [View More]enforcing mode as default MAC system. Users will still be able to select AppArmor as MAC system in the installer. Existing installations will *not* be affected. If you would like to migrate your existing system from AppArmor to SELinux, we have a guide on what to consider and how to do that here [0]. *What does it mean for users?* Our SELinux policy contains many policy modules, which confine most well-known services. Switching to SELinux means more services are confined by default, which means enhanced security. On the other hand, more confinement also means that in the early phase of the adoption there could be more bugs caused by SELinux denying legitimate accesses. We perform both manual and automated tests via openQA, to ensure that our policy works seamlessly. We also rely on you, the community, to create bugreports so that we can adapt the policy to any scenarios that we did not foresee. We have a page on how to report bugs here: https://en.opensuse.org/openSUSE:Bugreport_SELinux To learn more about SELinux, we also have a Portal in the openSUSE wiki: https://en.opensuse.org/Portal:SELinux Please feel free to reply to this email in case you have any questions or concerns. We plan to do the change earliest in September 2024, and latest by the end of the year. Separate announcements will follow just before and after the change. TL;DR: - The Tumbleweed installer will select SELinux in enforcing mode as default on new installations - When: by the end of 2024, earliest in September, we will do separate announcements before and after - AppArmor can still be selected in the installer as an alternative - Existing installations will *not* change - Leap 15.x is not affected in any way Thank you very much :) Kind regards, Cathy [0] https://en.opensuse.org/Portal:SELinux/Setup#Setup_SELinux_on_existing_tumb… -- Cathy Hu <cahu(a)suse.de> SELinux Security Engineer GPG: 5873 CFD1 8C0E A6D4 9CBB F6C4 062A 1016 1505 A08A SUSE Software Solutions Germany GmbH Frankenstrasse 146 90461 Nürnberg Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg) [View Less]

16 33

Disabling /dev/fb0 on TW
by Thomas Zimmermann 06 Feb '25

06 Feb '25

tl;dr: Disable fbdev userspace interfaces on TW Hi, the upcoming Linux kernel v6.6 will contain the option to disable fbdev userspace interfaces in the kernel configuration. [1] I intent to enable this and thereby switch off /dev/fb0 et al. The tracker bug is boo#1212947. [2] * Why? The old fbdev subsystem is an endless source of bugs. For example, we recently had an out-of-bounds access in the fbdev emulation, where userspace could write beyond the end of the framebuffer memory. [3] … [View More]Fbdev is under-maintained. I've been doing improvements in recent kernel releases, but only where it benefits the DRM subsystem. Disabling fbdev userspace interfaces will also help weeding out any programs that still contain hard dependencies on them. * What changes? Enabling the new kernel option disables all fbdev userspace interfaces. These are * the device files, such as /dev/fb0 * the sys files under /sys/class/graphics/fb[0-9]+ * /proc/fb * What are the effects on userspace programs? Userspace applications run on the desktop via Wayland or X. There will be no change to them. Xorg and Wayland compositors run on DRM interfaces. A few programs run on SDL, which has no dependency on fbdev either. Any fbdev support in these mid-layer components should be disabled as well. There's one known affected program: TW's text-mode installer can use the tool fbiterm to display CJK symbols during installation. This comes from a time when some low-end systems where not able to boot graphics installation. fbiterm has been unmaintained for >15 years and is ready for retirement. But there's no good drop-in replacement. I propose to simply remove fbiterm and let the graphics installer handle CJK. * What about the framebuffer console? The kernel-provided framebuffer console does not change. The kernel will still show the regular console. Userspace interfaces in /sys/class/graphics/fbcon are still available. For questions and discussion, please comment here or in boo#1212947. Best regards Thomas [1] https://elixir.bootlin.com/linux/v6.6-rc1/source/drivers/video/fbdev/core/K… [2] https://bugzilla.opensuse.org/show_bug.cgi?id=1212947 [3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Frankenstrasse 146, 90461 Nuernberg, Germany GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman HRB 36809 (AG Nuernberg) [View Less]

13 44

Cyclic dependencies between RPM packages
by Xu Zhao 26 Dec '24

26 Dec '24

Hello openSUSE, I recently ran a couple of dependency analysis on openSUSE RPM packages, and found it unintuitive that the RPM package dependency graph is not a DAG (Directed Acyclic Graph). Instead there are dependency cycles between them, for example: ``` $ rpm -q --requires terminfo-base | grep ncurses ncurses >= 6.5.20240713 $ rpm -q --requires libncurses6|grep terminfo terminfo-base ``` ``` $ rpm -q --requires sonnet libKF5SonnetCore.so.5()(64bit) $ rpm -q --requires … [View More]

10 21

How to file bugs
by Ed Goforth 05 Dec '24

05 Dec '24

Whenever I try to log in to https://bugzilla.opensuse.org I get themessage "There is already an account with the login name sh33p(a)blisteringsheep.com."

4 3

Issues with suspend not actually suspending?
by Johannes Kastl 20 Nov '24

20 Nov '24

Hi all, did/does anyone else experience issues with suspending on Tumbleweed/MicroOS/Kalpa? Normally I can suspend my laptop by using the suspend buttons in Plasma6 or by issuing "systemctl suspend". Now it only works every third or fourth time. I works more reliably if I shut programs like Firefox and Thunderbird, but it still is not bullet-proof 100% working. It shows the look screen, freezes from some (20) seconds and then the login screen is shown again and the mouse responds again. I … [View More]

5 15

Plan to delete vagrant & Virtualization:vagrant by the end of November
by Dan Čermák 18 Oct '24

18 Oct '24

Dear all, due to Hashicorp changing the license of vagrant to the BUSL, we can no longer update vagrant in openSUSE. I don't have the cycles to maintain vagrant myself indefinitely and plan to send a delete request at the end of November to Factory. Once that goes in, I also plan to remove the Virtualization:vagrant project to reduce the number of rubygems we have in openSUSE. If you don't like this plan and decide to scream at me, please scream an actionable plan that involves you :-) … [View More]

6 14

Pushing a fix for ksanecore/Leap
by Javier Llorente 09 Oct '24

09 Oct '24

Hello everyone, I would like to push a fix for ksanecore in both openSUSE Leap 15.5 and 15.6. Could anyone please take a look at request #1177805? It's been in review state for several months. Thanks, -- Javier Llorente

2 6

Re: Snapshot 20240622 again broke my system
by ASSI 05 Oct '24

05 Oct '24

ASSI writes: > ASSI writes: > Had it happen again: the process that hangs is > plasma-fallback-session-save. This is on a machine where I only use a > manually saved session, so really it should not even try to save > something when I shutdown (via a hotkey I should add, I'll try to use > the session menu tomorrow). The other machine where it doesn't happen > has whatever the default session setup is and since I have not set up a > hotkey there I shut it down via the … [View More]session menu. Of my four Tumbleweed installations, three have this problem and one does not. The one that works as expected is an installation from just one month ago, while the other ones are older. The hotkey setup is by now identical on all of them, so the failure to leave the plasma session in any way (and have plasma-fallback-session-save hang) must be with some other setting that was most likely converted from Plasma 5 and does not work correctly anymore. The whole shutdown procedure looks totally normal and leaves no errors in the system log until it stops doing anything, then killing the hanging process (expectedly) gives: --8<---------------cut here---------------start------------->8--- Jun 29 21:21:37 Gerda plasma-shutdown[18023]: org.kde.plasma.shutdown: plasma-fallback-session-save failed with return code -1 --8<---------------cut here---------------end--------------->8--- The rest of the shutdown does not show any errors other than a few that seem to be connected to me force-ending this process: --8<---------------cut here---------------start------------->8--- Jun 29 21:21:37 Gerda startplasma-x11[2129]: org.kde.startup: "kdeinit5_shutdown" QList() exited with code 255 Jun 29 21:21:37 Gerda kded6[2280]: XIO: fatal IO error 4 (Interrupted system call) on X server ":0" Jun 29 21:21:37 Gerda kded6[2280]: after 695 requests (695 known processed) with 0 events remaining. Jun 29 21:21:37 Gerda kwalletd6[2128]: The X11 connection broke (error 1). Did the X11 server die? Jun 29 21:21:37 Gerda kded6[2280]: The X11 connection broke: I/O error (code 1) Jun 29 21:21:37 Gerda kded6[2280]: org.kde.pulseaudio: No object for name "alsa_output.pci-0000_34_00.1.hdmi-stereo-extra1" Jun 29 21:21:37 Gerda kded6[2280]: org.kde.pulseaudio: No object for name "alsa_output.pci-0000_34_00.1.hdmi-stereo-extra1" Jun 29 21:21:37 Gerda kded6[2280]: org.kde.pulseaudio: No object for name "alsa_output.pci-0000_34_00.1.hdmi-stereo-extra1" Jun 29 21:21:37 Gerda systemd[2113]: xdg-desktop-portal-gtk.service: Main process exited, code=exited, status=1/FAILURE Jun 29 21:21:37 Gerda systemd[2113]: xdg-desktop-portal-gtk.service: Failed with result 'exit-code'. Jun 29 21:21:37 Gerda systemd[2113]: plasma-kwin_x11.service: Main process exited, code=exited, status=15/n/a Jun 29 21:21:37 Gerda systemd[2113]: plasma-kwin_x11.service: Failed with result 'exit-code'. Jun 29 21:21:37 Gerda systemd[2113]: Stopped KDE Window Manager. Jun 29 21:21:37 Gerda systemd[2113]: plasma-kwin_x11.service: Consumed 2min 19.383s CPU time. Jun 29 21:21:37 Gerda systemd[2113]: Stopped KDE Session Management Server. Jun 29 21:21:37 Gerda systemd[2113]: plasma-kded6.service: Main process exited, code=exited, status=1/FAILURE Jun 29 21:21:37 Gerda systemd[2113]: plasma-kded6.service: Failed with result 'exit-code'. --8<---------------cut here---------------end--------------->8--- Does anybody have an idea of where else to look? I notice that the whole thing now goes through systemd units/services, so possibly there might be a dependency problem as well. Regards, Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+ [View Less]

1 1

New Tumbleweed snapshot 20240929 released!
by Dominique Leuenberger 30 Sep '24

30 Sep '24

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/… [View More]openSUSE:Submitting_bug_reports Packages changed: apache2-mod_php8 (8.3.11 -> 8.3.12) atftp flashrom (1.3.0 -> 1.4.0) libnetfilter_conntrack (1.0.9 -> 1.1.0) libopenmpt (0.7.9 -> 0.7.10) libreoffice (24.8.1.2 -> 24.8.2.1) mariadb openSUSE-release (20240927 -> 20240929) perl-IO-Socket-SSL (2.88.0 -> 2.89.0) php8 (8.3.11 -> 8.3.12) python-greenlet (3.1.0 -> 3.1.1) ruby-common subversion tigervnc === Details === ==== apache2-mod_php8 ==== Version update (8.3.11 -> 8.3.12) - Add /srv/www directories to filelist [bsc#1231027] - version update to 8.3.12 CGI: Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926) Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927) Core: Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer). Fixed bug GH-15515 (Configure error grep illegal option q). Fixed bug GH-15514 (Configure error: genif.sh: syntax error). Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found). Fixed bug GH-15587 (CRC32 API build error on arm 32-bit). Fixed bug GH-15330 (Do not scan generator frames more than once). Fixed uninitialized lineno in constant AST of internal enums. Curl: Fixed bug GH-15547 (curl_multi_select overflow on timeout argument). DOM: Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h). Fixed bug GH-15654 (Signed integer overflow in ext/dom/nodelist.c). Fileinfo: Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument). FPM: Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026) MySQLnd: Fixed bug GH-15432 (Heap corruption when querying a vector). Opcache: Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c). Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h). SAPI: Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925) Standard: Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c). Streams: Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated). ==== atftp ==== - Delete /usr/sbin/rc* symlink & specfile housekeeping - Make atftpd.socket listen on AF_INET6 as well - Deactivate FORTIFY_SOURCE for the time being due to a glibc bug ==== flashrom ==== Version update (1.3.0 -> 1.4.0) - Add doc and bash-completion subpackages - Update to 1.4.0: - Full changelog: https://www.flashrom.org/release_notes/v_1_4.html ==== libnetfilter_conntrack ==== Version update (1.0.9 -> 1.1.0) - Update to release 1.1.0 * Enhancements for filtering dump and flush commands, see struct nfct_filter_dump and nfct_nlmsg_build_filter(). * ctnetlink event BPF fixes (endianness issue, IPv6 matching) and enhancements (zone matching). ==== libopenmpt ==== Version update (0.7.9 -> 0.7.10) - Update to 0.7.10: * [Change] FST was added to the list of supported file extension. AMP uses this extension for multichannel MODs. * [Bug] The Android NDK build system did not enable C++20 when available. * Fixed inconsistency in length calculation and actual playback length with tempo commands below 32 BPM in various formats (MDL, MED among others). * MED: Command 09 (set speed) was limited to 20 ticks per row instead of 32 ticks per row. * MED: Allow tempo parameters < 32 BPM. * MED: Disallow free panning if hardware mixing is enabled. * For MOD-style vibrato, a speed parameter of 0 was not treated as effect memory. Vibrato speed is now correct for both vibrato commands. * MED: Fix pattern index exhaustion in modules with multiple subsongs. * OKT: Don't drop global commands when setting paired channel volume, and try to write channel volume on the next row in this situation. * PTM: Use square root pan law, like in XM files. * SFX: Ignore unused data at end of oneshot samples which sometimes caused clicky noises. * SFX: More accurate implementation of arpeggio effect. ==== libreoffice ==== Version update (24.8.1.2 -> 24.8.2.1) Subpackages: libreoffice-base libreoffice-calc libreoffice-draw libreoffice-filters-optional libreoffice-gnome libreoffice-gtk3 libreoffice-icon-themes libreoffice-impress libreoffice-l10n-cs libreoffice-l10n-da libreoffice-l10n-de libreoffice-l10n-el libreoffice-l10n-en libreoffice-l10n-en_GB libreoffice-l10n-es libreoffice-l10n-fr libreoffice-l10n-hu libreoffice-l10n-it libreoffice-l10n-ja libreoffice-l10n-pl libreoffice-l10n-pt_BR libreoffice-l10n-ru libreoffice-l10n-zh_CN libreoffice-l10n-zh_TW libreoffice-mailmerge libreoffice-math libreoffice-pyuno libreoffice-qt5 libreoffice-qt6 libreoffice-writer libreofficekit - Update to 24.8.2.1 (24.8.2 final) * Release notes: https://wiki.documentfoundation.org/Releases/24.8.2/RC1 - Update bundled dependencies: * curl 8.9.1 -> 8.10.1 * tiff 4.6.0t -> 4.7.0 ==== mariadb ==== Subpackages: libmariadbd19 mariadb-client mariadb-errormessages - Read defaults during mysql_upgrade to respect client configuration ==== openSUSE-release ==== Version update (20240927 -> 20240929) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== perl-IO-Socket-SSL ==== Version update (2.88.0 -> 2.89.0) - updated to 2.89.0 (2.089) see /usr/share/doc/packages/perl-IO-Socket-SSL/Changes 2.089 2024/08/29 - new option SSL_force_fingerprint to enforce fingerprint matching even if certificate validation would be successful without - document _get_ssl_object and _get_ctx_object for cases, where direct use of Net::SSLeay functions is needed ==== php8 ==== Version update (8.3.11 -> 8.3.12) Subpackages: php8-ctype php8-dom php8-iconv php8-openssl php8-pdo php8-sqlite php8-tokenizer php8-xmlreader php8-xmlwriter - Add /srv/www directories to filelist [bsc#1231027] - version update to 8.3.12 CGI: Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926) Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927) Core: Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer). Fixed bug GH-15515 (Configure error grep illegal option q). Fixed bug GH-15514 (Configure error: genif.sh: syntax error). Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found). Fixed bug GH-15587 (CRC32 API build error on arm 32-bit). Fixed bug GH-15330 (Do not scan generator frames more than once). Fixed uninitialized lineno in constant AST of internal enums. Curl: Fixed bug GH-15547 (curl_multi_select overflow on timeout argument). DOM: Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h). Fixed bug GH-15654 (Signed integer overflow in ext/dom/nodelist.c). Fileinfo: Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument). FPM: Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026) MySQLnd: Fixed bug GH-15432 (Heap corruption when querying a vector). Opcache: Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c). Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h). SAPI: Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925) Standard: Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c). Streams: Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated). ==== python-greenlet ==== Version update (3.1.0 -> 3.1.1) - Fix build error under Leap. - Update to 3.1.1 * Fix crashes on 32-bit PPC Linux. Note that there is no CI for this, and support is best effort; there may be other issues lurking. * Remove unnecessary logging sometimes during interpreter shutdown. * Fix some crashes on 32-bit PPC MacOS. This is a very old platform, and is only known to be tested on beta versions of an operating system that was never released, using the GCC 14 only provided by MacPorts; it may or may not work on the final MacOS X release that supported 32-bit PowerPC. It has the known issue of leaking memory when greenlets are used in multiple threads. Help debugging this would be appreciated. ==== ruby-common ==== - update gem_packages.spec.erb: dont strip the newline at the end of main:filelist output ==== subversion ==== Subpackages: libsvn_auth_gnome_keyring-1-0 libsvn_auth_kwallet-1-0 subversion-bash-completion subversion-perl - Use strip-nondeterminism to normalize jar mtimes ==== tigervnc ==== Subpackages: libXvnc1 xorg-x11-Xvnc xorg-x11-Xvnc-module - Added patch: * n_tigervnc-reproducible-jar-mtime.patch + Use SOURCE_DATE_EPOCH for reproducible jar mtime + Applied if building with Java >= 17 [View Less]

1 0

New Slowroll update 20240930T1550 released!
by bernhardout＠lsmod.de 30 Sep '24

30 Sep '24

Please note that this mail was generated by a script. A collection of maintenance updates was released for Slowroll. Released 104 packages: * OpenIPMI * antlr3 * apache-commons-jxpath * argocd-cli * arkade * asciidoc * brltty * cairo * crmsh * cyrus-sasl * dd_rescue * docker-compose * elixir * fence-agents * fnott * gajim * gettext-runtime * hsqldb * jcuber * jffi * jisp2 * jline3 * juniversalchardet * jwordsplitter * kxml * kyverno * libreadline-java * maven-bundle-plugin * maven-jar-plugin *… [View More]

1 0

Main

Development

Information

Community

Social Media

Other

openSUSE Factory