- openSUSE Security

[opensuse-security] Re: [opensuse-project] Re: [security-announce] openSUSE Leap 42.1 has reached end of SUSE support
by Michal Kubecek 19 May '17

19 May '17

On Wednesday, 17 May 2017 15:18 Mathias Homann wrote: > ...have we at any time in the past ever had a situation where there > was only ONE version of openSUSE officially supported? > > I mean, Leap 42.3 is not out yet... Current situation is quite different from what we had earlier. In the old model, each new version was really new, forked fresh from Factory, so that there was in actually no real "major" and "minor" version. As new versions came each 6 or 8 months (more or less), noone could blame users who did not want to do a full upgrade to new codebase so often. That's why there was an overlap between [n] and [n+2], so that you could skip e.g. 12.2 and upgrade directly from 12.1 to 12.3 without losing support at any moment. With Leap 42.x, core packages (mostly) follow SLE ones where the policy is that upgrading in a new service pack should be well reasoned, not just "hey, there is a new upstream version". And this logic should apply to most of the distribution - or at least that is the plan. There are exceptions, of course, as some packages do not fit into this model well and some maintainers do not agree with this policy, but in general, Leap 42.x and 42.(x+1) should be much closer to each other than e.g. 12.1 and 12.2. Therefore users should fear upgrading to next point release less and it should make much less sense to skip 42.2 and upgrade 42.1 systems directly to 42.3. What is a different story, though, is moving to new major version with completely new codebase. IMHO we should think very carefully about the overlap of lifetimes of last 42.x and 43.0/15.0/whatever it is called. IMHO it would make good sense to have longer overlap (12 months?) between those. Michal Kubeček -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

6 7

[opensuse-security] ot: TPM modules
by Malte Gell 26 Apr '17

26 Apr '17

Hi there, I have a only slightly off topic questions about TPMs. Is it possible to use e.g. a Gigabyte TPM module on a Asus maiboard and vice versa? Or does the vendor of module and board have to match? And, if a mainboard has no TPM socket, is there a kind of PCI card that features such a socket where you can put in a TPM module? Thanks! -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

3 2

[opensuse-security] Re: [security-announce] openSUSE-SU-2017:0969-1: important: Security update for apparmor
by Carlos E. R. 10 Apr '17

10 Apr '17

On 2017-04-10 15:08, opensuse-security(a)opensuse.org wrote: > openSUSE Security Update: Security update for apparmor > ______________________________________________________________________________ > > Announcement ID: openSUSE-SU-2017:0969-1 > Rating: important > References: #1016259 #1017260 #1029696 > Cross-References: CVE-2017-6507 > Affected Products: > openSUSE Leap 42.2 > openSUSE Leap 42.1 > ______________________________________________________________________________ > > An update that solves one vulnerability and has two fixes > is now available. You forgot to mention that YaST requires a reboot after installing this patch. -- Cheers / Saludos, Carlos E. R. (from 42.2 x86_64 "Malachite" at Telcontar)

2 2

Re: [opensuse-security] signing custom kernel for secure boot
by Malte Gell 04 Apr '17

04 Apr '17

Am 30.03.2017 um 15:48 schrieb jsegitz(a)suse.de: > On Wed, Mar 29, 2017 at 09:19:42PM +0200, Malte Gell wrote: >> And, do I understand correctly, MokManager.efi is signed with the >> Microsoft KEK and writes my user key into the UEFI db key store? Thus, >> MokManager.efi is a way to get user keys into UEFI db? > > yes, with MokManager you can enroll your own keys Oh, is MokManager able to enroll new PK and KEK keys? That would be awesome, some mainboards have no EFI GUI for doing that and my Asrock only has a broken test PK..... :-( thanks Malte -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 1

[opensuse-security] shim bootloader with only SUSE signature?
by Malte Gell 03 Apr '17

03 Apr '17

Morning! I may deal with a system that is not able to cope with a EFI program that carries 2 signatures, like shim. efi. Thus, is there a shim loader that only carries one signature, the signature from openSUSE? I thought, /usr/lib64/efi/fallback.efi was nothing else than shim with just the openSUSE signature, but this seems not to be the case? fallback.efi carries only the openSUSE signature, but it is shim with a different name? What I need is shim.efi just with one signature, from SUSE. thanks! -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 1

[opensuse-security] signing custom kernel for secure boot
by Malte Gell 29 Mar '17

29 Mar '17

Hi there, to bring pain to a new level I play with secure boot and want to get a custom kernel run with secure boot. I read the SUSE how to from there: https://en.opensuse.org/openSUSE:UEFI#Booting_a_custom_kernel But, I am a bit confused, this guides signs vmlinuz, but not a single module!? Don´t the kernel modules need to be signed as well? Or is there some magic that applies the vmlinuz signature automatically to all modules?! Last, there is a UEFI boot entry "opensuse-trusted" (or similar), I guess this is meant to use with secure boot / shim? regards -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

2 2

Re: [opensuse-security] signing custom kernel for secure boot
by Malte Gell 29 Mar '17

29 Mar '17

Am 29.03.2017 um 18:14 schrieb jsegitz(a)suse.de: > On Wed, Mar 29, 2017 at 01:04:46PM +0200, Malte Gell wrote: >> to bring pain to a new level I play with secure boot and want to get a >> custom kernel run with secure boot. I read the SUSE how to from there: >> >> https://en.opensuse.org/openSUSE:UEFI#Booting_a_custom_kernel >> >> But, I am a bit confused, this guides signs vmlinuz, but not a single >> module!? >> Don´t the kernel modules need to be signed as well? > For openSUSE kernels module loading is not restricted (for SLES it is) Ok. I think this is no problem, there still is MODULE_SIG_FORCE to care for signed modules. And, do I understand correctly, MokManager.efi is signed with the Microsoft KEK and writes my user key into the UEFI db key store? Thus, MokManager.efi is a way to get user keys into UEFI db? thanks -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

1 0

[opensuse-security] SUSE kernel security features vs vanilla
by Malte Gell 28 Mar '17

28 Mar '17

Just out of curiousity, do SUSE kernel have security specific patches / features, the vanilla kernel does not have? regards m -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

3 4

[opensuse-security] SUSEfirewall udp broadcast
by Malte Gell 24 Mar '17

24 Mar '17

In order to allow UDP broadcast with the SUSEfirewall, is it enough to add e.g. BROADCAST="123,456" to the rules or is there more to add? I ask, because in my set UDP broadcast may have been dropped, despite using BROADCAST="123".... thanksx -- To unsubscribe, e-mail: opensuse-security+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-security+owner(a)opensuse.org

4 8

[opensuse-security] Question on a seccheck mail
by Werner Flamme 13 Mar '17

13 Mar '17

Hi list, seccheck sent me a mail from a SLES 12 SP 1. I do not understand what the mail should tell me. Subject: *** SECURITY information for <hostname> *** Content (one line): <hostname> : Mar 12 08:09:24 : root : problem with defaults entries ; TTY=unknown ; PWD=/ ; <hostname> ist just the placeholder for the real hostname :) What does "problem with defaults entries" mean? Puzzled Werner --

2 2