Heads up: blacklisted file systems on Factory
TL;DR: If you need any of the file systems listed below _for booting your system_, please make sure that those file systems you need are un- blacklisted in /etc/modprobe.d. In particular, if you haven't updated suse-module-tools since 15.1.0 or older (Feb. 2019), please update it to the current version (15.4.x) before updating to the future version 16.0.x. List of file systems disabled by default: adfs affs bfs befs cramfs efs erofs freevxfs hpfs jfs minix nilfs2 omfs qnx4 qnx6 sysv ufs (Others which are currently not even shipped: exofs hfs ntfs) Full story: The file systems listed above have been blacklisted by default in SUSE and openSUSE distributions since suse-module-tools 15.1.10 (released in Factory in Feb, 2019). Technically, this was done by adding files in /etc/modprobe.conf blacklisting these file systems. The rationale was to avoid auto-loading of these file system modules by the kernel, because attackers might be able to exploit security holes by crafting e.g. USB sticks with specifically prepared file systems. The blacklisting would force users to load the file system support explicitly using e.g. "modprobe minix". (For historical background, see the thread https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/N...) The conf files were designed to be modified by users, so that users could manually un-blacklist file systems they needed. In order to avoid severe regressions (systems failing to boot after a suse-module-tools update), we added logic in the %post scripts of suse-module-tools that would detect currently loaded modules at installation time and un- blacklist these automatically. With a forthcoming additional suse-module-tools update, we'll move the default configuration files from /etc to (/usr)/lib. While this is a good thing and long overdue, it has the side effect that the automatic un-blacklisting during %post can't be achieved as it used to any more, and re-implementing it would be difficult and error-prone, and uglify the scriptlets of this package even more. Therefore the current plan is to _stop un-blacklisting file system modules automatically_. Modules that have already been un-blacklisted, either manually by users or by the current automation in suse-module- tools, will of course remain so. But there's a caveat (see TL;DR above). To partly compensate for this, we've figured out a "modprobe hook" that will ask a user running (e.g.) "modprobe minix" whether she wants to un-blacklist the minix file system permanently. Details: https://github.com/openSUSE/suse-module-tools/tree/no-more-etc Interested people can have a look at https://build.opensuse.org/project/show/home:mwilck:suse-module-tools Regards Martin
participants (1)
-
Martin Wilck