January 2025

RFC: SELinux as default MAC system on new Tumbleweed installations
by Cathy Hu 18 Feb '25

18 Feb '25

Hi all, *see TL;DR down below* SELinux is being adopted more and more as the main Mandatory Access Control (MAC) system in openSUSE distributions and SUSE products. The SUSE SELinux working group would like to announce the plan to switch new Tumbleweed installations to SELinux as default MAC system *by the end of this year*. Currently, new Tumbleweed installations select AppArmor in the installer as default MAC system. After this change, new Tumbleweed installations will select SELinux in … [View More]enforcing mode as default MAC system. Users will still be able to select AppArmor as MAC system in the installer. Existing installations will *not* be affected. If you would like to migrate your existing system from AppArmor to SELinux, we have a guide on what to consider and how to do that here [0]. *What does it mean for users?* Our SELinux policy contains many policy modules, which confine most well-known services. Switching to SELinux means more services are confined by default, which means enhanced security. On the other hand, more confinement also means that in the early phase of the adoption there could be more bugs caused by SELinux denying legitimate accesses. We perform both manual and automated tests via openQA, to ensure that our policy works seamlessly. We also rely on you, the community, to create bugreports so that we can adapt the policy to any scenarios that we did not foresee. We have a page on how to report bugs here: https://en.opensuse.org/openSUSE:Bugreport_SELinux To learn more about SELinux, we also have a Portal in the openSUSE wiki: https://en.opensuse.org/Portal:SELinux Please feel free to reply to this email in case you have any questions or concerns. We plan to do the change earliest in September 2024, and latest by the end of the year. Separate announcements will follow just before and after the change. TL;DR: - The Tumbleweed installer will select SELinux in enforcing mode as default on new installations - When: by the end of 2024, earliest in September, we will do separate announcements before and after - AppArmor can still be selected in the installer as an alternative - Existing installations will *not* change - Leap 15.x is not affected in any way Thank you very much :) Kind regards, Cathy [0] https://en.opensuse.org/Portal:SELinux/Setup#Setup_SELinux_on_existing_tumb… -- Cathy Hu <cahu(a)suse.de> SELinux Security Engineer GPG: 5873 CFD1 8C0E A6D4 9CBB F6C4 062A 1016 1505 A08A SUSE Software Solutions Germany GmbH Frankenstrasse 146 90461 Nürnberg Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg) [View Less]

16 33

Disabling /dev/fb0 on TW
by Thomas Zimmermann 06 Feb '25

06 Feb '25

tl;dr: Disable fbdev userspace interfaces on TW Hi, the upcoming Linux kernel v6.6 will contain the option to disable fbdev userspace interfaces in the kernel configuration. [1] I intent to enable this and thereby switch off /dev/fb0 et al. The tracker bug is boo#1212947. [2] * Why? The old fbdev subsystem is an endless source of bugs. For example, we recently had an out-of-bounds access in the fbdev emulation, where userspace could write beyond the end of the framebuffer memory. [3] … [View More]Fbdev is under-maintained. I've been doing improvements in recent kernel releases, but only where it benefits the DRM subsystem. Disabling fbdev userspace interfaces will also help weeding out any programs that still contain hard dependencies on them. * What changes? Enabling the new kernel option disables all fbdev userspace interfaces. These are * the device files, such as /dev/fb0 * the sys files under /sys/class/graphics/fb[0-9]+ * /proc/fb * What are the effects on userspace programs? Userspace applications run on the desktop via Wayland or X. There will be no change to them. Xorg and Wayland compositors run on DRM interfaces. A few programs run on SDL, which has no dependency on fbdev either. Any fbdev support in these mid-layer components should be disabled as well. There's one known affected program: TW's text-mode installer can use the tool fbiterm to display CJK symbols during installation. This comes from a time when some low-end systems where not able to boot graphics installation. fbiterm has been unmaintained for >15 years and is ready for retirement. But there's no good drop-in replacement. I propose to simply remove fbiterm and let the graphics installer handle CJK. * What about the framebuffer console? The kernel-provided framebuffer console does not change. The kernel will still show the regular console. Userspace interfaces in /sys/class/graphics/fbcon are still available. For questions and discussion, please comment here or in boo#1212947. Best regards Thomas [1] https://elixir.bootlin.com/linux/v6.6-rc1/source/drivers/video/fbdev/core/K… [2] https://bugzilla.opensuse.org/show_bug.cgi?id=1212947 [3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Frankenstrasse 146, 90461 Nuernberg, Germany GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman HRB 36809 (AG Nuernberg) [View Less]

13 44

python2 is gone
by Bernhard M. Wiedemann 02 Feb '25

02 Feb '25

Dear fellow Geekos, Today it is my honor to inform you that https://build.opensuse.org/request/show/1240106 was accepted, so only 5 years after it became EOL [1], python2 is finally gone and not used anymore for anything in openSUSE. The openSUSE:Factory:python package had exactly 200 revisions since 2006-12-18 (starting at version 2.5) Rest In Peace Ciao Bernhard M. [1] https://www.python.org/doc/sunset-python-2/

12 20

New Tumbleweed snapshot 20250130 released!
by Dominique Leuenberger 31 Jan '25

31 Jan '25

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/… [View More]openSUSE:Submitting_bug_reports Packages changed: bash-completion cifs-utils gnome-maps (47.3 -> 47.4) gnome-text-editor (47.2 -> 47.3) hostname (3.23 -> 3.25) irqbalance kf6-kpty libchewing libsecret (0.21.5 -> 0.21.6+5) libshumate (1.3.1 -> 1.3.2) libstorage-ng (4.5.226 -> 4.5.227) mcelog meson (1.6.1 -> 1.7.0) net-snmp net-tools openSUSE-release (20250128 -> 20250130) polkit-default-privs (1550+20250121.7deadcd -> 1550+20250128.968956c) postgresql17 python-distro python-linux-procfs python-pygit2 (1.16.0 -> 1.17.0) rebootmgr (2.6+git20241108.fc0c103 -> 3.0+git20250129.eed876f) rubygem-gem2rpm sdbootutil (1+git20241217.5aeb4e9 -> 1+git20250130.2bcbf46) sendmail systemd-presets-common-SUSE sysuser-tools timezone (2024b -> 2025a) virt-manager wpa_supplicant yast2-services-manager (5.0.0 -> 5.0.1) yast2-users (5.0.3 -> 5.0.4) === Details === ==== bash-completion ==== - No longer ship completion for secret-tool, which belongs to libsecret and newly brings the completions by itself. https://github.com/scop/bash-completion/issues/1317 ==== cifs-utils ==== - Require a cifs.idmap plugin, suggest wb-cifs-idmap-plugin as default (idmapwb.so) ==== gnome-maps ==== Version update (47.3 -> 47.4) Subpackages: gnome-maps-lang - Update to version 47.4: + Fix parsing of geo: URIs. + Fix departure and arrival location names when searching by arrival time when using Transitous/MOTIS2. ==== gnome-text-editor ==== Version update (47.2 -> 47.3) Subpackages: gnome-text-editor-lang - Update to version 47.3: + Ensure search context is disposed to help avoid background work after a tab has been closed + Use weak refs when searching asynchronously to ensure tabs may be disposed during background work + Close language dialong when Escape is pressed + Fix a potentially NULL tooltip + Updated translations. ==== hostname ==== Version update (3.23 -> 3.25) - update to 3.25: * Removed old rule that moved file from /usr/bin to /bin. (Closes: #1056978) hostname 3.24: [ Gioele Barabucci ] * d/control: Add VCS URLs (Closes: #1050091) * Makefile: Adopt GNU/debhelper conventions * d/rules: Simplify using debhelper 13 (Closes: #1050093) * d/rules: Extract program version using sed * d/control: Update standards version to 4.6.2, no changes needed * d/control: Specify Rules-Requires-Root: no [ binlingyu ] * Fix memory leak [ lingyu bin ] * Update .gitlab-ci.yml file [ Michael Meskes ] * Fixed VCS information * Enable build with ubuntu suffixes. Thanks to Matthias Klose <doko(a)ubuntu.com> (Closes: #995889) * Update standards version to 4.7.0, no changes needed * Release 3.24 hostname 3.23+nmu1: * Non-maintainer upload. * Convert d/copyright to machine-readable format. (Closes: #1013131) * Upgrade to 3.0 source format. (Closes: #1007059) ==== irqbalance ==== Subpackages: irqbalance-ui - Drop rcFOO symlinks for CODE16 (PED-266). ==== kf6-kpty ==== Subpackages: libKF6Pty6 libKF6Pty6-lang - Remove libutempter, it doesn't work anymore with the switch from utmp to systemd-logind ==== libchewing ==== Subpackages: chewing-data libchewing3 - fix search path for dictionaries ==== libsecret ==== Version update (0.21.5 -> 0.21.6+5) Subpackages: libsecret-1-0 libsecret-lang typelib-1_0-Secret-1 - Update to version 0.21.6+5: + Integrate external extended bash-completion script + Fix man section number in the secret-tool completion file + Update secret-value.c - Update to version 0.21.6: + meson: - Make dbus-run-session optional - Actually include bash-completion subdir - Add pkgconfig(bash-completion) BuildRequires: New optional dependency, following this, add new sub-package secret-tool-bash-completion. ==== libshumate ==== Version update (1.3.1 -> 1.3.2) Subpackages: libshumate-1_0-1 libshumate-lang typelib-1_0-Shumate-1_0 - Update to version 1.3.2: + Fix building with GCC 15. ==== libstorage-ng ==== Version update (4.5.226 -> 4.5.227) Subpackages: libstorage-ng-lang libstorage-ng-ruby libstorage-ng1 - merge gh#openSUSE/libstorage-ng#1009 - fixed typo - 4.5.227 ==== mcelog ==== - Drop rcFOO symlinks for CODE16 (PED-266). ==== meson ==== Version update (1.6.1 -> 1.7.0) Subpackages: meson-vim - Update to version 1.7.0: + Call for testing for next release + New custom dependency for atomic + `--cap-lints allow` used for Cargo subprojects + Cargo features are resolved globally + Meson can run "clippy" on Rust projects + Devenv support in external project module + Fixed `sizeof` and `find_library` methods for Fortran compilers + format command now accept stdin argument + "machine" entry in target introspection data + Add new language Linear Asm + Control the number of child processes with an environment variable + Support for Rust 2024 + Support TASKING VX-Toolset + Test targets no longer built by default + Install vcs_tag() output - Rebase extend-test-timeout-on-qemu-builds.patch. ==== net-snmp ==== Subpackages: libsnmp40 perl-SNMP snmp-mibs - Drop rcFOO symlinks for CODE16 (PED-266). ==== net-tools ==== Subpackages: net-tools-lang - hostname is not required anymore [bsc#1236061] ==== openSUSE-release ==== Version update (20250128 -> 20250130) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== polkit-default-privs ==== Version update (1550+20250121.7deadcd -> 1550+20250128.968956c) - Update to version 1550+20250128.968956c: * profiles: add tuned-ppd renames / minor changes (bsc#1236029) ==== postgresql17 ==== Subpackages: libpq5 postgresql17-contrib postgresql17-llvmjit postgresql17-server - Apply postgresql-tzdata2025a.patch regardless of whether LLVM JIT is enabled - Fix build, add postgresql-tzdata2025a.patch ==== python-distro ==== - Use libalternatives instead of update-alternatives, bsc#1235785 ==== python-linux-procfs ==== - Switch to pyproject macros. - No more greedy globs in %files. ==== python-pygit2 ==== Version update (1.16.0 -> 1.17.0) - Remove upstreamed const-parents.patch. - Update to 1.17.0 * Upgrade to libgit2 1.9 * Add certificate_check callback to Remote.ls_remotes(...) * Fix build with GCC 14 * Documentation: fix typo in Repository.status(...) docstring * Fix tests with Python 3.13.1 ==== rebootmgr ==== Version update (2.6+git20241108.fc0c103 -> 3.0+git20250129.eed876f) - Update to version 3.0+git20250129.eed876f: * Release version 3.1 * rebootmgrd: fix check if new strategy is valid - Update to version 3.0+git20250128.8fa577c: * Import version 3.0 based on sd-varlink - Update to version 3.0+git20250127.73667d7: * rebootmgrctl: implement verbose dump-config verb * Fix search path for vendor config file * Add CI with openSUSE container * Add new methods and use UID auth - Add timezone to BuildRequires for test suite - Update to version 3.0+git20250114.f74a9d5: * Add bash-completion for rebootmgrctl - Update to version 3.0+git20241219.7166827: * Remove left overs from dbus related manual page * Use int64 to parse JSON for time_t * Set varlink info * Move announce_ready() call to a later place * Require libeconf 0.7.5 * Free event loop in destroy context. * Add missing error reply * Remove unused log_type variable * Add internal error to varlink interface * Move varlink definition into own file * Update manual pages ==== rubygem-gem2rpm ==== - add new gem2rpm.yml setting to have the runtime deps as buildrequires: :runtime_deps_as_buildrequires: true disabled by default implements https://github.com/openSUSE/gem2rpm/issues/20 ==== sdbootutil ==== Version update (1+git20241217.5aeb4e9 -> 1+git20250130.2bcbf46) Subpackages: sdbootutil-snapper sdbootutil-tukit - Update to version 1+git20250130.2bcbf46: * Recognize set-timeout -1 in systemd-boot (bsc#1236578) * Drop unused parameters * Remove interactive leftover * Add bash completions * Export options definition to function * Export command definition to function * Export bootctl evaluation to function * export image name setting to function * Remove UI command help * Mount devices and subvolumes for chroot * Set permission for new keys * Regenerate initrd if missing * Remove old initrd * Accept spaces or tabs when parsing crypttab * add info to --help about how to ignore devices * Do not include command line parameters before initrd= and BOOT_IMAGE= This is necessary because the kernel can inject command line options that are placed in front of these parameters. sdbootutil then picks these up on the next run and causes duplication of them, as the kernel will again inject the option. Now sdbootutil ignores these injected parameters. * Do not fail if the parent is missing * Drop extra echo * Fix 'if' expression * Fix enrollment method variable * Drop unused variables for TUI * Remove TUI components * Add --removable as alias for --portable * Show dracut output in verbose mode * Make if-else case statement * Add --pcr cli option ==== sendmail ==== Subpackages: libmilter1_0 - Allow libmilter to be installed without local MTA as it can be used with a remote MTA as well - reduce requires smtp_daemon to recommends, to allow e.g. smaller clamav footprints. ==== systemd-presets-common-SUSE ==== - Enable wtmpdbd.socket to start wtmpdbd via socket activation. A seperate daemon for wtmpdb access is required to solve https://sourceware.org/bugzilla/show_bug.cgi?id=24492 ==== sysuser-tools ==== - Add support for "u!" with useradd (shadow). busybox has no support for account/password expiration ==== timezone ==== Version update (2024b -> 2025a) Subpackages: tzselect - Update to 2025a: * Paraguay adopts permanent -03 starting spring 2024 * Improve pre-1991 data for the Philippines * Etc/Unknown is now reserved ==== virt-manager ==== Subpackages: virt-install virt-manager-common - Upstream bug fixes (bsc#1027942) (jsc#PED-8910) 001-cli-Support-cpu-maximum.patch 002-gui-Support-maximum-CPU-mode.patch 003-cpu-Prefer-maximum-mode-for-many-emulated-guests.patch 004-domcaps-get-list-of-supported-panic-device-models.patch 005-tests-Update-capabilities-for-advertisting-panic-device-models.patch 006-addhardware-panic-Fill-in-model-combo-with-advertised-values-by-libvirt.patch 007-cli-man-Always-list-osinfo-before-os-variant.patch 008-snapshots-default-to-same-snapshot-mode-as-currently-used-snapshot.patch 009-snapshots-warn-users-to-not-mix-snapshot-modes.patch - Drop virtinst-dont-use-special-copy-cpu-features.patch - Fix issue being able to detect SLES 16 media (jsc#PED-8910) See also bsc#1236252 virtinst-add-sle16-detection-support.patch ==== wpa_supplicant ==== - Drop rcFOO symlinks for CODE16 (PED-266). ==== yast2-services-manager ==== Version update (5.0.0 -> 5.0.1) - Remove nscd-related code (bsc#1236308) - 5.0.1 ==== yast2-users ==== Version update (5.0.3 -> 5.0.4) - Remove nscd-related code (bsc#1236308) - 5.0.4 [View Less]

1 0

Tumbleweed - Review of the week 2025/05
by Dominique Leuenberger 31 Jan '25

31 Jan '25

Dear Tumbleweed users and hackers, It seemed like a quiet week to me. Probably people are getting ready to meet up in Brussels for FOSDEM. Make sure to visit the booth area and talk to the people there. We have managed to release 4 snapshots (0124, 0125, 0127, and 0128) The most relevant changes delivered this week are: * Mesa 24.3.4 * Mozilla Firefox 134.0.2 * Drop of nscd * Systemd 257.2 * FWupd 2.0.4+4 * Wine 10.0 * Removal of python 2 The outlook for the future sounds … [View More]

1 0

please include me to the project (GitHub -> aneisner)
by antonio.eisner＠suse.com 31 Jan '25

31 Jan '25

Hi Guys, I work at the SUSE company, my colleague has asked me to join the openSUSE project so that I can contribute to the code if needed. My GitHub name is: aneisner Thanks Best Regards Toni

2 1

Any good usecases for Xen on Leap?
by Lubos Kocman 31 Jan '25

31 Jan '25

Hello openSUSE! are you using Xen with Leap and could you please share your use case in https://code.opensuse.org/leap/features/issue/189 ? Many thanks -- Best regards Luboš Kocman openSUSE Leap Release Manager

2 1

[opensuse-factory] reproducible builds status 2025-01
by Bernhard M. Wiedemann 31 Jan '25

31 Jan '25

Hi, This month, the number of verified packages increased a lot. This has two reasons: 1. I added a 'nachbauall' script to handle multibuild packages. 2. on 2025-01-10 a lot of packages were rebuilt for the removal of python310. This helped because I use the osc build -p (prefer) option and it has limitations. e.g. if a package was built with go1.22 and I provide that old rpm, it will still use go1.23 for the build. Also prjconf changes can cause issues. Verified packages are those where … [View More]

1 0

Drop virt-sandbox
by Jim Fehlig 30 Jan '25

30 Jan '25

Are there any objections to dropping virt-sandbox from Factory. The upstream project libvirt-sandbox [1] is no longer active and has been archived. The last release of libvirt-sandbox was over 6 years ago and there have been no meaningful commits since late 2020. I'd be surprised if there were any users of this package, but wanted to check before submitting a deleterequest. Cheers, Jim [1] https://gitlab.com/libvirt/libvirt-sandbox

2 2

New Slowroll update 20250130T0239 released!
by bernhardout＠lsmod.de 30 Jan '25

30 Jan '25

Please note that this mail was generated by a script. A collection of maintenance updates was released for Slowroll. Released 37 packages: * MozillaThunderbird * apache2-mod_security2 * btrfsmaintenance * ca-certificates-mozilla * chrony * clusterctl * deepin-movie * firewalld * gap-recog * go1.24 * govulncheck-vulndb * gupnp * iperf * kernel-firmware * libexif * libzypp * nodejs22 * openbao * openvpn * owasp-modsecurity-crs * pam_pkcs11 * paps * python-cymem * python-httpretty * python-ligo-… [View More]

1 0

Main

Development

Information

Community

Social Media

Other

openSUSE Factory