November 2009 - openSUSE Features - openSUSE Mailing Lists

[openFATE 305301] Central Regulatory Domain Agent (for 802.11)
by fate_noreply＠suse.de 04 Nov '09

04 Nov '09

Feature changed by: Jiri Benc (jbenc) Feature #305301, revision 37 Title: Central Regulatory Domain Agent (for 802.11) openSUSE-11.2: Rejected by (cthiel1) reject date: 2009-10-27 16:08:49 reject reason: not done for 11.2. Priority Requester: Important Projectmanager: Important + openSUSE-11.3: New + Priority + Requester: Mandatory Requested by: Vladimir Botka (vbotka) Description: The regulatroy domain handling for wireless cards was done by each driver seperately before mac80211/cfg80211. cfg80211 is used to unify the handling of regulatory domains for wireless devices. However cfg80211 depends on the user space configuring the regulatory domain. A user space daemon is currently developed (see [1]). It basically provides the allowed channels for all known regulatory domains. Additionally it would be nice to allow the configuration of the regulatory domain from the Yast network module. [1] http://wireless.kernel.org/en/developers/Regulatory/CRDA Partly based on bnc#392853 Relations: - wpa_supplicant in factory seems to ignore an country=DE setting in its config (novell/bugzilla/id: 537708) https://bugzilla.novell.com/show_bug.cgi?id=537708 Discussion: #1: Helmut Schaa (hschaa) (2009-02-03 12:04:57) I've already packaged crda and wireless-regdb in my buildservice project home:hschaa:CRDA. #2: Helmut Schaa (hschaa) (2009-02-09 11:37:20) What we additionally need for this feature is some integration with Yast or NetworkManager such that the user is able to set the regulatory domain (maybe based on the selected time zone). A command line tool for setting the domain is already available (iw) but needs to be updated. #3: Helmut Schaa (hschaa) (2009-02-09 16:09:28) (reply to #2) Just submitted an update for Factory. #4: Helmut Schaa (hschaa) (2009-02-10 10:59:40) (reply to #2) wpa_supplicant 0.6.7 already has support for setting the regulatory domain. We'll get that with the next version update. #5: Helmut Schaa (hschaa) (2009-02-10 13:40:25) (reply to #2) iw, crda and wireless-regdb are part of factory now #6: Kshitij Kulshreshtha (polyconvex) (2009-03-25 11:53:33) Sometimes on a short visit abroad a user might not bother to update their timezone information on their laptop but still want to use a wireless network. In this case setting the regulatory domain based on timezone is not the right thing to do. Why not let the networkmanager applet ask the user himself to provide the country as a part of the dialog to setup the network? (A map similar to the yast timezone selector built into KNetworkManager?) #7: Marius Tomaschewski (mtomaschewski) (2009-06-08 11:27:49) We've already another enhancement bugs for sysconfig/wireless... so let's just add it for 11.2. Helmut, let's speak in the next days about the requirements on the sysconfig side (I guess it is just one optional variable) and add this together with the another enhancements. Michal (yast2 network) requires the sysconfig support to implement it on the yast2 side. #11: Marius Tomaschewski (mtomaschewski) (2009-09-08 15:56:43) (reply to #9) Let's define the sysconfig ifcfg -file variable as: WIRELESS_REGULATORY_DOMAIN='00' The '00' value is the ISO / IEC 3166 alpha2 country code as used in the regdb / wpa_supplicant / iw tool. The _sysconfig_ default is '' , that is empty string. #12: Marius Tomaschewski (mtomaschewski) (2009-09-08 16:39:46) (reply to #11) Hmm... it looks like the reg domain is a global and not a per-interface setting, in iw: reg set <ISO/IEC 3166-1 alpha2> reg get this means it has to go to network/config and not into ifcfg file. Is this correct? #15: Jiri Benc (jbenc) (2009-09-09 13:23:09) (reply to #12) Yes, this is a system-wide setting. On purpose, you don't usually have you computer in two different regulatory zones ;-) I don't see what's the problem with using the timezone setting, though. Yes, it would require a translation table (to map e.g. Europe/Prague to CZ), but other than that, it should provide all the information we need: in what country we are located. #16: Marius Tomaschewski (mtomaschewski) (2009-09-09 13:53:06) (reply to #15) OK, thanks for verifying this! I don't have any problem when yast2 is setting the WIRELESS_REGULATORY_DOMAIN='CZ' value based on the TIMEZONE='Europe/Prague' setting by default / as preselection. But I need the correct, valid and final value for the utilities and don't want to provide any translation table and waste e.g. boot time in sysconfig. It also makes sense to check that the alpha-2 code is in the wireless-regdb and perhaps propose an another value if possible or reject & reset it -- in sysconfig it is too late to do this or ask the user what to do. The package implementing this is in Base:System/sysconfig project and goes to factory today. When iw reg set is used, the value is applied correctly to the crda/kernel. When it is set via wpa_supplicant config, there is no attempt to set it visible in udev -- seems to be a wpa_supplicant bug -> bugzilla. #17: Jiri Benc (jbenc) (2009-09-09 14:01:13) (reply to #16) Yes, all of that makes sense to me. #18: Vladimir Botka (vbotka) (2009-09-09 20:34:24) (reply to #16) Part of the project http://linuxwireless.org/en/developers/Documentation/nl80211 is also an wpa_supplicant with -Dnl80211 which will solves this problem. The yast module can set both the WIRELESS_REGULATORY_DOMAIN in sysconfig and country= in wpa_supplicant.conf. #20: Marius Tomaschewski (mtomaschewski) (2009-09-09 22:40:21) (reply to #18) Stop :-) sysconfg / ifup is not using /etc/.../wpa_supplicant.conf -- it generates one per interface from network/config and network/ifcfg* settings. So just set the WIRELESS_REGULATORY_DOMAIN, ifup-wireless will add the (expanded) "country=$WIRELESS_REGULATORY_DOMAIN" statement to the generated wpa_supplicant config. #19: Vladimir Botka (vbotka) (2009-09-09 21:34:26) (reply to #16) The new nl80211 extension is already available in Factory. # wpa_supplicant -c /etc/wpa_supplicant/wpa_supplicant.conf -i wlan0 -dd - Dnl80211 Initializing interface 'wlan0' conf '/etc/wpa_supplicant/wpa_supplicant.conf' driver 'nl80211' ctrl_interface 'N/A' bridge 'N/A' Configuration file '/etc/wpa_supplicant/wpa_supplicant.conf' -> '/etc/wpa_supplicant/wpa_supplicant.conf' Reading configuration file '/etc/wpa_supplicant/wpa_supplicant.conf' country='CZ' #21: Marius Tomaschewski (mtomaschewski) (2009-09-09 22:42:34) (reply to #19) Yes I know already about the new driver. Question is if we can switch to use this driver already. Let's continue with the driver details in bugzilla. #22: Marius Tomaschewski (mtomaschewski) (2009-10-02 08:52:57) FYI: The sysconfig-0.72.4 version in openSUSE:Factory / 11.2 implements this feature. It provides the WIRELESS_REGULATORY_DOMAIN variable and adds it to the per-interface wpa_supplicant.conf as well as sets it via iw command in case of old (iwconfig) setup. It does not change to the new nl80211 driver (or another one supporting it) by default, the user has to set WIRELESS_WPA_DRIVER="nl80211" per interface or wpa_supplicant will ignore it. + #25: Jiri Benc (jbenc) (2009-11-04 11:56:30) + Opening for 11.3 and setting as mandatory for requester, as without the + feature wifi cards are not fully usable outside of the US (and in some + cases not even there). -- openSUSE Feature: https://features.opensuse.org/305301

1 0

[New: openFATE 308290] Easy way to reset yast2 module written configurations to defaults and start over
by fate_noreply＠suse.de 04 Nov '09

04 Nov '09

Feature added by: Jan-Simon Möller (dl9pf) Feature #308290, revision 1 Title: Easy way to reset yast2 module written configurations to defaults and start over openSUSE-11.3: Unconfirmed Priority Requester: Important Requested by: Jan-Simon Möller (dl9pf) Description: Let me show my point by example: I install a yast2 module like yast2-xyz-server and run it for the 1st time. I see a wizard, can enter my data and so on. What if I want to start over from scratch (badly misconfigured, new setup, whatever). Currently the common answer is: deinstall xyz and yast2-xyz-server package, search and remove any config you find and install package again and retry (and hope you didn't miss a config file ;) ). My proposal is now: Provide a way in yast to reset the config to "factory-default" and let the user start over in an easy and convenient way. -- openSUSE Feature: https://features.opensuse.org/308290

1 1

[openFATE 302047] Integrated package searching for YaST and build service
by fate_noreply＠suse.de 04 Nov '09

04 Nov '09

Feature changed by: Rémy Marquis (Spyhawk) Feature #302047, revision 34 Title: Integrated package searching for YaST and build service openSUSE-10.3: Rejected by Andreas Jaeger (a_jaeger) reject date: 2007-10-05 14:30:28 reject reason: still open partly - postpone the rest. Priority Requester: Important Projectmanager: Important openSUSE-11.0: Rejected by Michael Loeffler (sprudel24) reject date: 2008-06-10 14:01:45 reject reason: not done for 11.0 Priority Requester: Important Projectmanager: Important openSUSE-11.1: Rejected by Adrian Schröter (adriansuse) reject date: 2008-09-04 18:17:10 reject reason: No time for it, but we have the one-click installation supported from web interface. Priority Requester: Important Projectmanager: Desirable + openSUSE-11.3: Unconfirmed + Priority + Requester: Desirable Requested by: Duncan Mac-Vicar (dmacvicar) Description: You perhaps remember the hacks Benjamin did to support "click and install" packages (similar to Click'n run) [1] Benjamin has another article in his blog that is worth to read. He has been providing a wepage to search packages from repositories like packman and build service. Now he presents an architecture to desentralize the system, using web services an indexers, and he shows working prototypes of YaST modules for searching, and others like web and irc-bot clients http://blogs.warwick.ac.uk/bweber/entry/package_search_developments/ I hope we can provide a strategy and roadmap to integrate these cool ideas and _code_. [1]: http://blogs.warwick.ac.uk/bweber/entry/next_generation_package/ Discussion: #1: Juergen Weigert (jnweiger) (2007-05-03 15:29:13) see also 300898 For 10.3 the installer should be able to make use of an external list of repositories. I suggest to host such a list at http://packages.opensuse-community.org/ together with the search engine, which is already there. #3: Klaas Freitag (kfreitag) (2007-07-12 10:46:54) Implementation on openSUSE BS already started, Adrian knows the details. #4: Adrian Schröter (adriansuse) (2007-07-12 11:30:04) We work on two approaches atm: * YaST will support (thanks to mvidner) additional repository offers during installation. The list gets hosted on our servers, the open question is how to maintain this list. * The build service End-User interface will offer .ymp files based on pattern submissions for easy installation. #5: Stanislav Visnovsky (visnov) (2007-07-30 20:13:09) (reply to #4) Adrian, please, drive this. The feature for YaST should be done now (let me know if anything is missing). #6: Michael Loeffler (sprudel24) (2007-11-22 11:26:30) This sounds like very useful. And it might be possible the community (in this case Benji) helps implementing this. #7: Andreas Jaeger (a_jaeger) (2008-06-06 10:56:28) Apparently not done - please reject and postpone for 11.1. #9: Adrian Schröter (adriansuse) (2008-06-18 17:08:16) This is something what we should bind to the new upcomming software portal. The software portal will be the End-User interface for searcing and installing software and replace http://software.opensuse.org/search . However it is still in development and not yet set up. Therefore I am unsure if this can happen in time for 11.1. On the other side, the 1-click-installation and integration into the web interface is done since quite some time. The user can use the cool technologies from Benjamin since 10.3. -- openSUSE Feature: https://features.opensuse.org/302047

1 0

[openFATE 303678] New yast module - LIRC configuration
by fate_noreply＠suse.de 04 Nov '09

04 Nov '09

Feature changed by: Dean Hilkewich (deanjo13) Feature #303678, revision 25 Title: New yast module - LIRC configuration openSUSE-11.1: Rejected by Stanislav Visnovsky (visnov) reject date: 2008-06-24 15:31:30 reject reason: More urgent stuff to cover. Priority Requester: Desirable openSUSE-11.2: Rejected by Stanislav Visnovsky (visnov) reject date: 2009-02-02 13:29:45 reject reason: Out of scope. Postponing. Priority Requester: Desirable openSUSE-11.3: New Priority Requester: Desirable Requested by: Ladislav Slezak (lslezak) Description: Create a new Yast module for configuring IR receivers and remote controls. * irrecord support * ir-kbd-i2c, ir-kbd-gpio support as in tv module already * reading users' config to find out what buttons were defined (only if /home partition left from last installation) * support for lirc's options in /etc/sysconfig See bug https://bugzilla.novell.com/show_bug.cgi?id=381641 + Discussion: + #4: Dean Hilkewich (deanjo13) (2009-11-04 06:28:29) + I really hope this accepted with 11.3. It just took me a couple of + hours to realize that my old lirc config wouldn't work in 11.2 that I + used in 11.1. The device was now /dev/lirc0 instead of /dev/lirc like + it was in 11.1. + -- openSUSE Feature: https://features.opensuse.org/303678

1 0

[openFATE 308205] Include openvz in server area
by fate_noreply＠suse.de 03 Nov '09

03 Nov '09

Feature added by: fsk aio (fasiko) Feature #308205, revision 1 Title: Include openvz in server area openSUSE-11.3: Unconfirmed Priority Requester: Important Requested by: fsk aio (fasiko) Description: Include a optimized openvz kernel for isolation. if possible, integrated into yast for an easy administration -- openSUSE Feature: https://features.opensuse.org/308205

1 2

[New: openFATE 308262] repo naming convention
by fate_noreply＠suse.de 03 Nov '09

03 Nov '09

Feature added by: Ralph Ulrich (ulenrich) Feature #308262, revision 1 Title: repo naming convention openSUSE-11.3: Unconfirmed Priority Requester: Important Requested by: Ralph Ulrich (ulenrich) Description: Please openSUSE do make yourself easy to understand. The repo namings are in such a state that even openSUSE long time users get confused. So nobody can edit the wiki to inform users right now. examples: a) http://download.opensuse.org/distribution/openSUSE-current/ ? is more than a year old. ? same as: http://download.opensuse.org/distribution/openSUSE-stable/ b) http://download.opensuse.org/distribution/11.2-RC2/ ? same as: http://download.opensuse.org/factory-snapshot/ but coolo said: "factory and 11.2 are two distinct projects since" Factory is normally rolling... But what is a rolling snapshot ??? Solution: Some naming convention: 1. never name a release current but stable 2. name repo before release testing (like Debian) 3. rename factory unstable (like Debian) "snapshot" normally is a repository of a point in the past and should not point to the future (as now with 11.2 you have empty snapshots to be released tomorrow). -- openSUSE Feature: https://features.opensuse.org/308262

1 3

[openFATE 305657] finer grained PolicyKit support for Networkmanager
by fate_noreply＠suse.de 03 Nov '09

03 Nov '09

Feature changed by: Ludwig Nussel (lnussel) Feature #305657, revision 51 Title: finer grained PolicyKit support for Networkmanager openSUSE-11.2: Candidate Priority Requester: Important Projectmanager: Desirable Requested by: Ludwig Nussel (lnussel) Description: NetworkManager currently only supports one PolicyKit privilege. That is whether a user is allowed to modify administrator defined connections or not. There is no way to disallow users to define their own network configurations. NetworkManager should at least support one additional PolicyKit privilege that defines whether or not users are allowed to bring their own network configuration or whether they mere are allowed to use administrator defined ones. Use Case: - disallow workers on centrally administered machines to configure different network settings - protect home users that only ever connect to a few well known nets from accidently changing their setup Discussion: #1: Matthias Nagorni (mnagorni) (2009-08-21 14:26:22) If this can be done with little effort I would be even tempted to rate it Mandatory. #2: Stefan Behlert (sbehlert) (2009-08-25 16:37:57) Alex, is there soemone on your team who could look at that? MAybe with some support form Tambet? #3: Li Bin (binli) (2009-08-26 05:58:01) I and lance wang would like to take care of it. We still don't know the requirement clearly. 1. disallow workers on centrally administered machines to configure different network settings The workers mean the users in administered machines? Does it right that when workers configure network settings it prompt they are no permission? If so I thought we could change the PolicyKit's configuration file to complete it. 2. protect home users that only ever connect to a few well known nets from accidently changing their setup How to distinguish home users from workers? Does it mean don't allow the user to configure the other users connections? #4: Ludwig Nussel (lnussel) (2009-08-26 08:40:53) (reply to #3) Currently there's only org.freedesktop.network-manager-settings.system. modify, introduce something like org.freedesktop.network-manager- settings.user.modify so NM can determine whether it should accept user settings. #16: Wang Lance (lzwang) (2009-09-25 11:26:20) (reply to #4) Hi Ludwig Nussel I have added the following policy action: org.freedesktop.network-manager-settings.user.wired.apply org.freedesktop.network-manager-settings.user.wireless.apply org.freedesktop.network-manager-settings.user.mobile.apply org.freedesktop.network-manager-settings.user.vpn.apply org.freedesktop.network-manager-settings.user.dsl.apply . NM now can determine whether it should apply the user settings to devices by type. Does the implementation meet your request? I need your feedback to determine what should to do next step. Thanks, Lance Wang #17: Ludwig Nussel (lnussel) (2009-09-25 11:58:50) (reply to #16) Sure, that's even more than I had wished for. Would it be possible to also have a separate privilege for the connection sharing thingy? In contrast to the other configurations that one also messes with iptables and starts a DHCP daemon. #5: JP Rosevear (jproseve) (2009-08-26 17:06:51) (reply to #3) My suggestion would be to look at something like the following: org. freedesktop.network-manager-settings.system.modify org.freedesktop. network-manager-settings.system.add org.freedesktop.network-manager- settings.system.delete and the same for .user - you may even want to specifically allow or disallow adding for specific network types like wired, wireless, etc. You probably also want to have the ability to enable/disable wireless in general and enable/disable networking covered. You can default all of these to the current settings, but adding these would allow more lockdown opportunities. #6: Li Bin (binli) (2009-08-31 11:22:12) Well, We'll works on this feature in this week, know about the PolicyKit and NetworkManager, write the patch if time is okay. Tambet, Do you have any idea about this feature? #7: Luis Medinas (lmedinas) (2009-08-31 18:40:51) (reply to #6) Might worth looking at NM 0.8 (git master), it supports the latest polkit-1 and it should be released before 11.2. Maybe some of this features were introduced. #8: Tambet Ingo (tambet) (2009-09-01 09:40:05) (reply to #7) NM 0.8 will not be out before 11.2, it'll be out for the next Fedora release which will happen after 11.2. Also, current git master does not have any work for this feature, it's just been converted to use the newer, incompatible polkit API. #9: Tambet Ingo (tambet) (2009-09-01 09:43:56) (reply to #6) The upstream has been planning on having similar feature for a while now, but no work has been done on it yet. I strongly suggest to have a discussion with the upstream maintainer before any work gets done, otherwise our effort might end up thrown away as soon as upstream implements it. #10: Li Bin (binli) (2009-09-01 09:14:24) Yes, I talk with the upstream today, just wait for response. You can follow it from below link. Thanks! http://mail.gnome.org/archives/networkmanager-list/2009-September/date.html #11: Stephan Kulow (coolo) (2009-09-07 13:39:17) (reply to #10) didn't see a lot of replies. #12: Li Bin (binli) (2009-09-10 05:24:05) The upstream maintainer Dan already reply this issue, and it's no user case for seperating add, modify and delete permission, and the others was agreed. Lanc wang with me work the sled11 and upstream now, we'll provide a patch in this week. #13: Wang Lance (lzwang) (2009-09-15 08:10:43) Hi I add five policy like the following : org.freedesktop.network-manager- settings.system.wired.modify org.freedesktop.network-manager-settings. system.wireless.modify org.freedesktop.network-manager-settings.system. mobile.modify org.freedesktop.network-manager-settings.system.vpn. modify org.freedesktop.network-manager-settings.system.dsl.modify. As you know there will be one policy one type. I make a patch which works. But I feel a little confused on the user settings. As the user settings are saved in the gconf, so adding someting like manager- settings.user.*.modify make no sense. As far as I know user can always edit their gconf settings. I think what should be done may be the policy that determine if the users can apply their settings to the system devices throught dbus. Given we do it like that, should the nm-applet display the user setting in the menu, when a normal user can not apply his or her settings to system devices? I think it is better that nm-applet show both system settings and user settings, and it will show error dialog if a user try to apply user settings when the user does not have the right do that. Hi Tambet, what do you think? #14: Li Bin (binli) (2009-09-17 11:18:37) (reply to #13) Tambet reply in the mailinglist, we just lock the /system/networking path in gconf and the settings can't be changed. #15: Michael Meeks (michael_meeks) (2009-09-23 16:55:40) We should also add the case mentioned in bug #522742 - to allow disabling the "Create new wireless network" functionality. This is of particular concern to the security team, and I'd like to see it addressed as part of the same work if possible. Otherwise, this looks great - thanks Li Bin :-) #18: Li Bin (binli) (2009-09-25 12:03:28) (reply to #15) Michael, I've viewed the bug#522742, it talk more about sharing, and we don't need to disable "Create new wireless network", user can add it, but when they wanna to apply it by click the connection, check org. freedesktop.network-manager-settings.user.wireless.apply permission like the Lance describe in #16. Does it okay? #19: Michael Meeks (michael_meeks) (2009-09-28 10:10:26) (reply to #18) No - connecting to a new wireless network is -very- different from sharing all your existing connections over your current wireless network; I can see why people would want to allow one and not allow the other. We should (ideally) have a different policy setting for this - if possible. Thanks #25: Wang Lance (lzwang) (2009-10-28 11:49:58) (reply to #15) Hi Michael I have read bnc #522742. And it is about sharing network. I wonder that why only the "Create new wireless network" need a policy, since all kinds type connection can be shared. As far as I know in nm-applet 7.0 the "Create new wireless network" is only for adhoc wireless connection. Did you mean that sharing adhoc wireless connection have security problem? And other type connections do not ? Thanks, Lance Wang. - #20: Tanja Roth (ta-ro) (2009-10-05 15:01:26) Can you please confirm what the final policy names (identifiers) are going to be for 11.2 and what can be influenced with them? (a short description as available from the Description field in polkit-gnome- authorization would be sufficient). I would like to mention this in the 11.2 docs about NetworkManager, but so far, I only found the one policy that relates to modifying administrator defined connections (org.freedesktop.network-manager- settings.system.modify). From your comments above I'm not sure if the names mentioned in #16 are the final ones for the newly added policies (and if the list is complete). Please advise asap as the translation deadline for this chapter is approaching. Thanks! #22: (binli) (2009-10-12 11:27:53) (reply to #20) Tanja, Just come back from holiday, sorry for late. Now this feature is still not in the upstream, I'm still working on it. I prepare to seperate the permission into more fined like, org.freedesktop.network-manager-settings.system.wireless.modify - Modify system wired connections org.freedesktop.network-manager-settings.system.wired.modify - Modify system wireless connections the description follow the policy. The #16 is now for the SLED 11-SP1 for temporary resolving usercase, I'm not sure if it could be received by upstream which is used for 11.2. So what's your translation deadline? I'll inform you when I confirm it with upstream. #23: (ta-ro) (2009-10-12 12:25:30) (reply to #22) Lin Bi, thanks very much for clarifying! :) Our localization deadline is Oct 15th but as the files have to go through language proofreading before, I have to finish the chapter today, I'm afraid. But don't worry, to be on the safe side (whatever the upstream decision may be), we can handle it as follows: for now, I'll only mention that there *are* policies for NetworkManager and where to find them in PolicyKit. We can then add more details for the next release of the docs (presumably SLE 11 SP1). #24: (ta-ro) (2009-10-12 13:18:21) (reply to #23) Removing the needinfo status. #26: Wang Lance (lzwang) (2009-11-02 08:51:11) Hi Ludwig Nussel Could you test this new functions in SLED11. I made the packages with the function. These are the URLs https://api.suse.de/build/home:lzwang:branches:SUSE:SLE-11:Update:Test/stan… https://api.suse.de/build/home:lzwang:branches:SUSE:SLE-11:Update:Test/stan… https://api.suse.de/build/home:lzwang:branches:SUSE:SLE-11:Update:Test/stan… I implemented the following policy: "org.freedesktop.network-manager-settings.system.wired.modify" "org. freedesktop.network-manager-settings.system.wireless.modify" "org. freedesktop.network-manager-settings.system.mobile.modify" "org. freedesktop.network-manager-settings.system.vpn.modify" "org. freedesktop.network-manager-settings.system.dsl.modify" "org.freedesktop.network-manager-settings.user.wired.apply" "org. freedesktop.network-manager-settings.user.wireless.apply" "org. freedesktop.network-manager-settings.user.mobile.apply" "org. freedesktop.network-manager-settings.user.vpn.apply" "org.freedesktop. network-manager-settings.user.dsl.apply" . And *.modify are the policy for the editing adding and deleting of the system connections. And *.apply are the policy for applying the user connection to activate the devices. You can see the default settings in /usr/share/PolicyKit/policy/org. freedesktop.network-manager-settings.system.policy, which make the NM behave like the one without those policy. Thanks, Lance Wang + #27: Ludwig Nussel (lnussel) (2009-11-03 16:17:45) (reply to #26) + I've tried it on openSUSE 11.1 now. Works great AFAICT. However I think + the usability could be enhanced by creating system connections by + default, at least when user connections are restricted. That way the + user would not need to authenticate each time he wants to connect. + wrt separate policy for shared connections, I think that should be + doable by checking another condition in + is_user_request_connection_type_authorized(), right? -- openSUSE Feature: https://features.opensuse.org/305657

1 0

[openFATE 305885] Handle the metadata "dirty" bit when an ISW array contains the root file system
by fate_noreply＠suse.de 02 Nov '09

02 Nov '09

Feature changed by: Michal Marek (michal-m) Feature #305885, revision 15 Title: Handle the metadata "dirty" bit when an ISW array contains the root file system openSUSE-11.2: Candidate Priority Requester: Important Projectmanager: Important + openSUSE-11.3: Done + Priority + Requester: Important + Projectmanager: Important Requested by: Marc Ruehrschneck (macrue) Partner organization: openSUSE.org Description: Shutdown scripts need to wait until all the MDRAID arrays are marked clean: The dirty bit dictates whether an array needs to be resynced. The OS must block writes to the array until the dirty bit is set, and it should allow for the bit to be cleared as a part of the system shutdown process. For rootfs-raid the metadata handler will need to be started in the early userspace environment as even mounting the root- filesystem read-only may cause writes to be issued due to journal recovery. This involves including mdmon in the initrd and and using the "--switch-root" option to switch the monitor to the final rootfs environment. At shutdown the OS must allow for the metadata handler to stay running across the "mark root-filesystem readonly" event, i.e. it must be excluded from the general killall events. Once all filesystems are readonly a call to "mdadm --wait-clean --scan" will quiesce all writes and clear the metadata dirty bit. Business case (Partner benefit): openSUSE.org: Enable feature parity with the Windows IMSM stack for Linux customers Discussion: #4: Thorsten Kukuk (kukuk) (2009-10-07 10:04:05) Something for boot.md... + #5: Michal Marek (michal-m) (2009-11-02 17:13:22) + Done in Factory, please reject for 11.2 -- openSUSE Feature: https://features.opensuse.org/305885

1 0

[openFATE 305657] finer grained PolicyKit support for Networkmanager
by fate_noreply＠suse.de 02 Nov '09

02 Nov '09

Feature changed by: Wang Lance (lzwang) Feature #305657, revision 50 Title: finer grained PolicyKit support for Networkmanager openSUSE-11.2: Candidate Priority Requester: Important Projectmanager: Desirable Requested by: Ludwig Nussel (lnussel) Description: NetworkManager currently only supports one PolicyKit privilege. That is whether a user is allowed to modify administrator defined connections or not. There is no way to disallow users to define their own network configurations. NetworkManager should at least support one additional PolicyKit privilege that defines whether or not users are allowed to bring their own network configuration or whether they mere are allowed to use administrator defined ones. Use Case: - disallow workers on centrally administered machines to configure different network settings - protect home users that only ever connect to a few well known nets from accidently changing their setup Discussion: #1: Matthias Nagorni (mnagorni) (2009-08-21 14:26:22) If this can be done with little effort I would be even tempted to rate it Mandatory. #2: Stefan Behlert (sbehlert) (2009-08-25 16:37:57) Alex, is there soemone on your team who could look at that? MAybe with some support form Tambet? #3: Li Bin (binli) (2009-08-26 05:58:01) I and lance wang would like to take care of it. We still don't know the requirement clearly. 1. disallow workers on centrally administered machines to configure different network settings The workers mean the users in administered machines? Does it right that when workers configure network settings it prompt they are no permission? If so I thought we could change the PolicyKit's configuration file to complete it. 2. protect home users that only ever connect to a few well known nets from accidently changing their setup How to distinguish home users from workers? Does it mean don't allow the user to configure the other users connections? #4: Ludwig Nussel (lnussel) (2009-08-26 08:40:53) (reply to #3) Currently there's only org.freedesktop.network-manager-settings.system. modify, introduce something like org.freedesktop.network-manager- settings.user.modify so NM can determine whether it should accept user settings. #16: Wang Lance (lzwang) (2009-09-25 11:26:20) (reply to #4) Hi Ludwig Nussel I have added the following policy action: org.freedesktop.network-manager-settings.user.wired.apply org.freedesktop.network-manager-settings.user.wireless.apply org.freedesktop.network-manager-settings.user.mobile.apply org.freedesktop.network-manager-settings.user.vpn.apply org.freedesktop.network-manager-settings.user.dsl.apply . NM now can determine whether it should apply the user settings to devices by type. Does the implementation meet your request? I need your feedback to determine what should to do next step. Thanks, Lance Wang #17: Ludwig Nussel (lnussel) (2009-09-25 11:58:50) (reply to #16) Sure, that's even more than I had wished for. Would it be possible to also have a separate privilege for the connection sharing thingy? In contrast to the other configurations that one also messes with iptables and starts a DHCP daemon. #5: JP Rosevear (jproseve) (2009-08-26 17:06:51) (reply to #3) My suggestion would be to look at something like the following: org. freedesktop.network-manager-settings.system.modify org.freedesktop. network-manager-settings.system.add org.freedesktop.network-manager- settings.system.delete and the same for .user - you may even want to specifically allow or disallow adding for specific network types like wired, wireless, etc. You probably also want to have the ability to enable/disable wireless in general and enable/disable networking covered. You can default all of these to the current settings, but adding these would allow more lockdown opportunities. #6: Li Bin (binli) (2009-08-31 11:22:12) Well, We'll works on this feature in this week, know about the PolicyKit and NetworkManager, write the patch if time is okay. Tambet, Do you have any idea about this feature? #7: Luis Medinas (lmedinas) (2009-08-31 18:40:51) (reply to #6) Might worth looking at NM 0.8 (git master), it supports the latest polkit-1 and it should be released before 11.2. Maybe some of this features were introduced. #8: Tambet Ingo (tambet) (2009-09-01 09:40:05) (reply to #7) NM 0.8 will not be out before 11.2, it'll be out for the next Fedora release which will happen after 11.2. Also, current git master does not have any work for this feature, it's just been converted to use the newer, incompatible polkit API. #9: Tambet Ingo (tambet) (2009-09-01 09:43:56) (reply to #6) The upstream has been planning on having similar feature for a while now, but no work has been done on it yet. I strongly suggest to have a discussion with the upstream maintainer before any work gets done, otherwise our effort might end up thrown away as soon as upstream implements it. #10: Li Bin (binli) (2009-09-01 09:14:24) Yes, I talk with the upstream today, just wait for response. You can follow it from below link. Thanks! http://mail.gnome.org/archives/networkmanager-list/2009-September/date.html #11: Stephan Kulow (coolo) (2009-09-07 13:39:17) (reply to #10) didn't see a lot of replies. #12: Li Bin (binli) (2009-09-10 05:24:05) The upstream maintainer Dan already reply this issue, and it's no user case for seperating add, modify and delete permission, and the others was agreed. Lanc wang with me work the sled11 and upstream now, we'll provide a patch in this week. #13: Wang Lance (lzwang) (2009-09-15 08:10:43) Hi I add five policy like the following : org.freedesktop.network-manager- settings.system.wired.modify org.freedesktop.network-manager-settings. system.wireless.modify org.freedesktop.network-manager-settings.system. mobile.modify org.freedesktop.network-manager-settings.system.vpn. modify org.freedesktop.network-manager-settings.system.dsl.modify. As you know there will be one policy one type. I make a patch which works. But I feel a little confused on the user settings. As the user settings are saved in the gconf, so adding someting like manager- settings.user.*.modify make no sense. As far as I know user can always edit their gconf settings. I think what should be done may be the policy that determine if the users can apply their settings to the system devices throught dbus. Given we do it like that, should the nm-applet display the user setting in the menu, when a normal user can not apply his or her settings to system devices? I think it is better that nm-applet show both system settings and user settings, and it will show error dialog if a user try to apply user settings when the user does not have the right do that. Hi Tambet, what do you think? #14: Li Bin (binli) (2009-09-17 11:18:37) (reply to #13) Tambet reply in the mailinglist, we just lock the /system/networking path in gconf and the settings can't be changed. #15: Michael Meeks (michael_meeks) (2009-09-23 16:55:40) We should also add the case mentioned in bug #522742 - to allow disabling the "Create new wireless network" functionality. This is of particular concern to the security team, and I'd like to see it addressed as part of the same work if possible. Otherwise, this looks great - thanks Li Bin :-) #18: Li Bin (binli) (2009-09-25 12:03:28) (reply to #15) Michael, I've viewed the bug#522742, it talk more about sharing, and we don't need to disable "Create new wireless network", user can add it, but when they wanna to apply it by click the connection, check org. freedesktop.network-manager-settings.user.wireless.apply permission like the Lance describe in #16. Does it okay? #19: Michael Meeks (michael_meeks) (2009-09-28 10:10:26) (reply to #18) No - connecting to a new wireless network is -very- different from sharing all your existing connections over your current wireless network; I can see why people would want to allow one and not allow the other. We should (ideally) have a different policy setting for this - if possible. Thanks #25: Wang Lance (lzwang) (2009-10-28 11:49:58) (reply to #15) Hi Michael I have read bnc #522742. And it is about sharing network. I wonder that why only the "Create new wireless network" need a policy, since all kinds type connection can be shared. As far as I know in nm-applet 7.0 the "Create new wireless network" is only for adhoc wireless connection. Did you mean that sharing adhoc wireless connection have security problem? And other type connections do not ? Thanks, Lance Wang. #20: Tanja Roth (ta-ro) (2009-10-05 15:01:26) Can you please confirm what the final policy names (identifiers) are going to be for 11.2 and what can be influenced with them? (a short description as available from the Description field in polkit-gnome- authorization would be sufficient). I would like to mention this in the 11.2 docs about NetworkManager, but so far, I only found the one policy that relates to modifying administrator defined connections (org.freedesktop.network-manager- settings.system.modify). From your comments above I'm not sure if the names mentioned in #16 are the final ones for the newly added policies (and if the list is complete). Please advise asap as the translation deadline for this chapter is approaching. Thanks! #22: (binli) (2009-10-12 11:27:53) (reply to #20) Tanja, Just come back from holiday, sorry for late. Now this feature is still not in the upstream, I'm still working on it. I prepare to seperate the permission into more fined like, org.freedesktop.network-manager-settings.system.wireless.modify - Modify system wired connections org.freedesktop.network-manager-settings.system.wired.modify - Modify system wireless connections the description follow the policy. The #16 is now for the SLED 11-SP1 for temporary resolving usercase, I'm not sure if it could be received by upstream which is used for 11.2. So what's your translation deadline? I'll inform you when I confirm it with upstream. #23: (ta-ro) (2009-10-12 12:25:30) (reply to #22) Lin Bi, thanks very much for clarifying! :) Our localization deadline is Oct 15th but as the files have to go through language proofreading before, I have to finish the chapter today, I'm afraid. But don't worry, to be on the safe side (whatever the upstream decision may be), we can handle it as follows: for now, I'll only mention that there *are* policies for NetworkManager and where to find them in PolicyKit. We can then add more details for the next release of the docs (presumably SLE 11 SP1). #24: (ta-ro) (2009-10-12 13:18:21) (reply to #23) Removing the needinfo status. + #26: Wang Lance (lzwang) (2009-11-02 08:51:11) + Hi Ludwig Nussel + Could you test this new functions in SLED11. I made the packages with + the function. These are the URLs + https://api.suse.de/build/home:lzwang:branches:SUSE:SLE-11:Update:Test/stan… + https://api.suse.de/build/home:lzwang:branches:SUSE:SLE-11:Update:Test/stan… + https://api.suse.de/build/home:lzwang:branches:SUSE:SLE-11:Update:Test/stan… + I implemented the following policy: + "org.freedesktop.network-manager-settings.system.wired.modify" "org. + freedesktop.network-manager-settings.system.wireless.modify" "org. + freedesktop.network-manager-settings.system.mobile.modify" "org. + freedesktop.network-manager-settings.system.vpn.modify" "org. + freedesktop.network-manager-settings.system.dsl.modify" + "org.freedesktop.network-manager-settings.user.wired.apply" "org. + freedesktop.network-manager-settings.user.wireless.apply" "org. + freedesktop.network-manager-settings.user.mobile.apply" "org. + freedesktop.network-manager-settings.user.vpn.apply" "org.freedesktop. + network-manager-settings.user.dsl.apply" + . + And *.modify are the policy for the editing adding and deleting of the + system connections. And *.apply are the policy for applying the user + connection to activate the devices. + You can see the default settings in /usr/share/PolicyKit/policy/org. + freedesktop.network-manager-settings.system.policy, which make the NM + behave like the one without those policy. + Thanks, + Lance Wang -- openSUSE Feature: https://features.opensuse.org/305657

1 0

[openFATE 300758] Show orphaned packages
by fate_noreply＠suse.de 02 Nov '09

02 Nov '09

Feature changed by: Kornél Jahn (cornail) Feature #300758, revision 93 Title: Show orphaned packages openSUSE-10.2: Rejected by Thorsten Kukuk (kukuk) reject date: 2006-08-02 11:31:19 reject reason: For SL10.2 we have to get libzypp really stable and fast before we add new features. Priority Requester: Important openSUSE-10.3: Rejected by Stanislav Visnovsky (visnov) reject date: 2007-07-17 17:03:57 reject reason: Postponing. Priority Requester: Important Projectmanager: Desirable openSUSE-11.0: Rejected by Stanislav Visnovsky (visnov) reject date: 2007-11-21 12:16:20 reject reason: Out of scope for 11.0 Priority Requester: Important openSUSE-11.1: Rejected by Stanislav Visnovsky (visnov) reject date: 2008-07-07 13:34:02 reject reason: Postponing, needs underlaying infrastructure to be fixed first. Priority Requester: Important openSUSE-11.2: Done Priority Requester: Important Projectmanager: Important openSUSE-11.3: Done Priority Requester: Desirable Requested by: JP Rosevear (jproseve) Description: The package manager should learn to show orphanized packages (packages which are not required by other packages and are not in wanted selections) and allow to deinstall them like the popular debfoster/deborphan tools. A typical use case: user installs an application which pulls in some dependencies to test it, uninstalls the application shortly after or way later but the dependencies stay unused installed on the system. Commandline UI (zypper) only. References: https://bugzilla.novell.com/show_bug.cgi?id=166132 Discussion: #1: Jiri Srain (jsrain) (2007-06-05 13:46:00) Schubi, is there any possibility to make solver tell which packages are orphanized? It would be interesting especially if the packages which are marked for deletion were considered as non-installed (eg. if foo- devel is installed but marked for deletion and nothing else requires foo, then foo is orphanized). #2: Stefan Schubert (schubi2) (2007-06-06 11:04:04) (reply to #1) Currently not cause the solver has no information about who (user, package,...) has triggered the installation of a package. If we are storing this information it would be possible for solver to remove these kind of packages too. It is not simple but doable. By the way, we will have to store this kind of information in the future. E.g. we need to save the "keep state by user" in a database in order to regard this state in future solver runs. #3: Jiri Srain (jsrain) (2007-06-06 14:25:07) (reply to #2) Looks like a missunderstanding. Basically every package wihch is not required/recommended/suggested or doesn't enhance anything that is installed and not marked for deletion is IMO considered to be orphanized. If user eg. wants to remove a pattern including all its packages (which are not required by something else), solver providing this kind of information would help a lot (and I don't think that we would need any other information to be stored. #4: Stefan Schubert (schubi2) (2007-06-06 15:33:44) (reply to #3) I do not think so. What does "orphanized" mean ? Let me take your example from comment #1. foo should be deleted too if the user delete foo-devel and foo has been installed due the requirement of foo-devel. BUT the user will kill us if we are deleting foo although the user has installed foo explicit sometime ago in a seperate installation workflow. So this information ( The USER has installed foo) will be currently not saved and is needed here to decide if foo has to be deleted or not. #5: Stefan Schubert (schubi2) (2007-06-06 15:39:47) (reply to #3) Lets take your example concerning the erasing of patterns. That is much more complex. I have already described the problem here: http://en.opensuse.org/Libzypp/Solver#Known_Problems " Proper behaviour of erasing patterns" There are already some bugzilla entries: Bug 274283 - Delete iFolder from YaST makes eDirectory Delete mandatory Bug 238250 - YaST does not upgrade an Add-on Product #6: Jiri Srain (jsrain) (2007-06-08 16:46:32) See also https://bugzilla.novell.com/show_bug.cgi?id=166132 This is another use case for the same solver functionality #8: Federico Lucifredi (flucifredi) (2008-06-12 20:46:17) this should be commandline-only, definitely an advanced-user option. #9: Federico Lucifredi (flucifredi) (2008-06-12 20:47:28) cut from description: See Bug 140346 #10: Duncan Mac-Vicar (dmacvicar) (2008-11-03 11:24:53) As discussed in Prague, this could be done using the package history once we have a reader. #11: Karsten König (remur) (2009-01-19 10:09:49) How about using rpmorphan, I agree with flucifredi about the command line idea... http://rpmorphan.sourceforge.net/ And otherwise you could use their system to find orphanized packages and display them in yast but make clear that deleting -all orphanized packages will also delete the ones explicitly installed... (it only detects wether the package fullfiles any requirement...) #12: Ján Kupec (jkupec) (2009-01-19 14:48:38) (reply to #11) I'm not the solver developer, but i'm pretty sure it's easy (and probably more effective) to find the 'leaf' packages (that's what rpmorphan seems to do) using existing solver (see satsolver package). But we don't want to just highlight leaf packages, we want to remove unused packages, that is all leaves minus those explicitly installed. So we will feed the solver with this 'explicitly-installed' information. The package history will be the source of this info for now. Maybe later we find some way to store this info that could be used across tools (e.g. directly in the rpm db). So rpmorphan will be able to use this info as well. #13: Pavol Rusnak (prusnak) (2009-01-19 15:44:26) (reply to #12) Yes, that's good idea. Detecting leaf packages is the first step. Detecting which ones to remove (i.e. not explicitly installed) is the second. I think that rpmorphan shows all leaf packages, but it selects only the ones that start with "lib". If we strictly followed library packaging policy that would do the trick. btw. rpmorphan is packaged in Contrib (http://en.opensuse.org/Contrib) #14: Michal Smrž (ilfirin) (2009-03-07 20:05:22) (reply to #11) I am afraid of using rpmorphan to do this. Cause last time, I tested it, it wants to remove libdvdnav and libdvdcss libraries. This is very bad. It leads to many not advanced users to ask in phorums "Why OpenSUSE is not playing DVDs anymore?" I see many problems this could make. #15: Christoph Thiel (cthiel1) (2009-04-21 15:23:06) We don't have the resources to implementing this. Seems to be a prefect fit for a community project. #17: Piotrek Juzwiak (benderbendingrodriguez) (2009-04-22 07:58:47) Maybe the idea to accomplish this would be simply by using the packages. xml file and diff it. We can already export what packages we got right? So if it would compare the packages.xml before installation and after it would then delete it. There is a problem when installing many packages, they would all have to be "grouped" which pulled which dependencies. #20: Vladimirs Kuzmins (vovachaka) (2009-10-26 16:27:51) This feature is a specially important, now when we have distro upgrade, which changes a lot of dependencies and a lot of obsolete packages remain installed. Please, someone implement it! #21: Thomas Göttlicher (tgoettlicher) (2009-10-26 16:41:29) I've added a view for orphaned packages in yast2-qt-pkg. There is a package group "orphaned packages" similar to "suggested packages" and "recommended packages" in yast2-qt-pkg version 2.18.17. #22: Atri Bhattacharya (badshah400) (2009-10-31 14:55:26) (reply to #21) Thanks for implementing this much needed feature. But this feature does not work with the gtk interface in 11.2 RC2; please have this added for the final release of 11.2. #23: Kornél Jahn (cornail) (2009-11-02 07:48:05) (reply to #21) Tried to test this but didn't seem to work on RC2: Orphaned packages view is empty. E.g. installed blender, which pulled yafray. After uninstalling blender, yafray remained installed but didn't show up as an orphaned package. Also installing audacity or inkscape pulled a lot of dependencies which were not showed as orphaned after uninstalling them. + #24: Kornél Jahn (cornail) (2009-11-02 08:06:38) (reply to #23) + Since it is marked as done, I filed a bug for it: + https://bugzilla.novell.com/show_bug.cgi?id=551771 + (https://bugzilla.novell.com/show_bug.cgi?id=551771) -- openSUSE Feature: https://features.opensuse.org/300758

1 0