--17280255945.EebCa7da.351
Date: Fri, 4 Oct 2024 07:06:34 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231292

            Bug ID: 1231292
           Summary: VUL-0: CVE-2024-25590: pdns-recursor: Crafted responses can lead to a denial of service due to cache inefficiencies in the Recursor
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/422688/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: amajer-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: stoyan.manolov-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

An attacker can publish a zone containing specific Resource Record Sets.

 Repeatedly processing and caching results for these sets can lead to a=20

denial of service.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-25590
https://seclists.org/oss-sec/2024/q4/3
https://bugzilla.redhat.com/show_bug.cgi?id=3D2316309
https://www.cve.org/CVERecord?id=3DCVE-2024-25590
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-20=
24-04.html
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17280255945.EebCa7da.351
Date: Fri, 4 Oct 2024 07:06:34 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231292

          Summary
          VUL-0: CVE-2024-25590: pdns-recursor: Crafted responses can l=
ead to a denial of service due to cache inefficiencies in the Recursor

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/422688/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          amajer@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          stoyan.manolov@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

An attacker can publish a zone containing specific Resource =
Record Sets.

 Repeatedly processing and caching results for these sets can lead to a=20

denial of service.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-25590
https://seclists.org/oss=
-sec/2024/q4/3
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2316309
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-25590
https://docs.powerdns.com/recursor/security-advisori=
es/powerdns-advisory-2024-04.html

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17280255945.EebCa7da.351--


--17280605930.bAFa7A1.904
Date: Fri, 4 Oct 2024 16:49:53 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231312

            Bug ID: 1231312
           Summary: jc42 not retaining devices after reboot, related i2c issues
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel:Drivers
          Assignee: kernel-bugs-at-suse.de
          Reporter: pallaswept-at-proton.me
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

I noticed today that since kernel 6.11 my DDR4 temperature sensors were abs=
ent
from applications like `sensors` or CoolerControl.=20

The jc42 kernel module which normally provides these hwmon sensors is loaded
and there are no errors in the journal searching for jc42, although there i=
s an
absence of usual log messages from coolercontrol where it lists the devices=
 it
has derived from hwmon.

Looking at my sensors conf file and configuration logs, I know that the
controller for these devices was i2c-6. I notice that this is now occupied =
by
the nvidia GPU:

> sudo i2cdetect -l
i2c-0   i2c             Synopsys DesignWare I2C adapter         I2C adapter
i2c-1   smbus           SMBus PIIX4 adapter port 0 at 0b00      SMBus adapt=
er
i2c-2   smbus           SMBus PIIX4 adapter port 2 at 0b00      SMBus adapt=
er
i2c-3   smbus           SMBus PIIX4 adapter port 1 at 0b20      SMBus adapt=
er
i2c-4   i2c             NVIDIA i2c adapter 1 at 7:00.0          I2C adapter
i2c-5   i2c             NVIDIA i2c adapter 5 at 7:00.0          I2C adapter
i2c-6   i2c             NVIDIA i2c adapter 6 at 7:00.0          I2C adapter
i2c-7   i2c             NVIDIA i2c adapter 7 at 7:00.0          I2C adapter
i2c-8   i2c             NVIDIA i2c adapter 8 at 7:00.0          I2C adapter

Looking at the filesystem I can see that the jc42 devices are not present on
any controller.

If I add new devices, they will function seemingly normally, but upon reboo=
t,
they are lost. I can re-add them and they will function until reboot.=20

Rebooting from 6.11.0 where the devices are not present, having been
'forgotten' from the previous reboot, and the controller is on i2c-1, into
6.10.11, the devices are retained, fully functional, and controlled by i2c-=
6.

I noticed https://bugzilla.opensuse.org/show_bug.cgi?id=3D1231228 but my pr=
oblem
seems different. I do not have the jc42 modules automatically detected like
that (it would be nice!) but I do notice that in 6.11, there are new entries
present which did not exist in 6.10:

Oct 04 23:30:38 localhost kernel: i2c i2c-1: Successfully instantiated SPD =
at
0x50
Oct 04 23:30:38 localhost kernel: i2c i2c-1: Successfully instantiated SPD =
at
0x51
Oct 04 23:30:38 localhost kernel: i2c i2c-1: Successfully instantiated SPD =
at
0x52
Oct 04 23:30:38 localhost kernel: i2c i2c-1: Successfully instantiated SPD =
at
0x53

These are my memory sticks' SPD chips and they were previously only readabl=
e by
using the `eeprom` kernel module. The `ee1004` module and `at24` modules wo=
uld
return nothing. They are now readable without any change by me, using the
ee1004 module, which is in use for the above device.

So, it seems like something changed with the piix4_smbus driver, it having
changed address; and it's now detecting my DRAM SPD, which is nice; And the=
 new
SPD driver works, which is also nice, given that the old one seems to be go=
ne;
but it's not detecting the temperature sensors, and is forgetting(?) them w=
hen
I add them.

I will collect the dmesg and hwinfo outputs from each kernel version (6.10.=
11,
6.11.0, 6.12-rc1) shortly. Is there anything else that might be useful while
I'm at it?

A word of caution to others who might be suffering this bug or one like it:=
 I
experienced very severe hardware faults related to this. After adding the
devices to the controller and rebooting, my monitor started to flash on and=
 off
a few times per second, and after factory-resetting the monitor and rebooti=
ng,
my PC would not POST, failing first to train the RAM (three or four differe=
nt
errors at random, shown on motherboard 8-segment display), and once that was
isolated, failing to detect graphics. A BIOS reset was needed to get it bac=
k in
order. It has been OK since. I believe it to be a one-off not triggered by =
this
bug alone, but it was undoubtedly triggered by my attempt to fix the missing
devices by following standard procedure to add them. It seems fine now, but=
 I
would be reticent not to mention it.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17280605930.bAFa7A1.904
Date: Fri, 4 Oct 2024 16:49:53 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231312

          Summary
          jc42 not retaining devices after reboot, related i2c issues

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel:Drivers

          Assignee
          kernel-bugs@suse.de

          Reporter
          pallaswept@proton.me

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

I noticed today that since kernel 6.11 my DDR4 temperature s=
ensors were absent
from applications like `sensors` or CoolerControl.=20

The jc42 kernel module which normally provides these hwmon sensors is loaded
and there are no errors in the journal searching for jc42, although there i=
s an
absence of usual log messages from coolercontrol where it lists the devices=
 it
has derived from hwmon.

Looking at my sensors conf file and configuration logs, I know that the
controller for these devices was i2c-6. I notice that this is now occupied =
by
the nvidia GPU:

> sudo i2cdetect -l
i2c-0   i2c             Synopsys DesignWare I2C adapter         I2C adapter
i2c-1   smbus           SMBus PIIX4 adapter port 0 at 0b00      SMBus adapt=
er
i2c-2   smbus           SMBus PIIX4 adapter port 2 at 0b00      SMBus adapt=
er
i2c-3   smbus           SMBus PIIX4 adapter port 1 at 0b20      SMBus adapt=
er
i2c-4   i2c             NVIDIA i2c adapter 1 at 7:00.0          I2C adapter
i2c-5   i2c             NVIDIA i2c adapter 5 at 7:00.0          I2C adapter
i2c-6   i2c             NVIDIA i2c adapter 6 at 7:00.0          I2C adapter
i2c-7   i2c             NVIDIA i2c adapter 7 at 7:00.0          I2C adapter
i2c-8   i2c             NVIDIA i2c adapter 8 at 7:00.0          I2C adapter

Looking at the filesystem I can see that the jc42 devices are not present on
any controller.

If I add new devices, they will function seemingly normally, but upon reboo=
t,
they are lost. I can re-add them and they will function until reboot.=20

Rebooting from 6.11.0 where the devices are not present, having been
'forgotten' from the previous reboot, and the controller is on i2c-1, into
6.10.11, the devices are retained, fully functional, and controlled by i2c-=
6.

I noticed https://bugzilla.opensuse.org/show_bug.cgi?id=3D1231228 but my probl=
em
seems different. I do not have the jc42 modules automatically detected like
that (it would be nice!) but I do notice that in 6.11, there are new entries
present which did not exist in 6.10:

Oct 04 23:30:38 localhost kernel: i2c i2c-1: Successfully instantiated SPD =
at
0x50
Oct 04 23:30:38 localhost kernel: i2c i2c-1: Successfully instantiated SPD =
at
0x51
Oct 04 23:30:38 localhost kernel: i2c i2c-1: Successfully instantiated SPD =
at
0x52
Oct 04 23:30:38 localhost kernel: i2c i2c-1: Successfully instantiated SPD =
at
0x53

These are my memory sticks' SPD chips and they were previously only readabl=
e by
using the `eeprom` kernel module. The `ee1004` module and `at24` modules wo=
uld
return nothing. They are now readable without any change by me, using the
ee1004 module, which is in use for the above device.

So, it seems like something changed with the piix4_smbus driver, it having
changed address; and it's now detecting my DRAM SPD, which is nice; And the=
 new
SPD driver works, which is also nice, given that the old one seems to be go=
ne;
but it's not detecting the temperature sensors, and is forgetting(?) them w=
hen
I add them.

I will collect the dmesg and hwinfo outputs from each kernel version (6.10.=
11,
6.11.0, 6.12-rc1) shortly. Is there anything else that might be useful while
I'm at it?

A word of caution to others who might be suffering this bug or one like it:=
 I
experienced very severe hardware faults related to this. After adding the
devices to the controller and rebooting, my monitor started to flash on and=
 off
a few times per second, and after factory-resetting the monitor and rebooti=
ng,
my PC would not POST, failing first to train the RAM (three or four differe=
nt
errors at random, shown on motherboard 8-segment display), and once that was
isolated, failing to detect graphics. A BIOS reset was needed to get it bac=
k in
order. It has been OK since. I believe it to be a one-off not triggered by =
this
bug alone, but it was undoubtedly triggered by my attempt to fix the missing
devices by following standard procedure to add them. It seems fine now, but=
 I
would be reticent not to mention it.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17280605930.bAFa7A1.904--


--17283064672.6c3Adc5.755
Date: Mon, 7 Oct 2024 13:07:47 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231346

            Bug ID: 1231346
           Summary: Virtualbox guest won't start but crashes with NS_ERROR_FAILURE (0X80004005)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: dutchkind-at-txoriaskea.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

After some update the Virtualbox guests wouldn't start anymore. After some
trial and error I found in the Virtualbox log:

00:00:00.011066 main     rtldrNativeLoad:
dlopen('/usr/lib/virtualbox/libpthread.so', RTLD_NOW | RTLD_LOCAL) failed:
/usr/lib/virtualbox/libpthread.so: cannot open shared object file: No such =
file
or directory
00:00:00.011130 main     rtldrNativeLoad:
dlopen('/usr/lib/virtualbox/libdl.so', RTLD_NOW | RTLD_LOCAL) failed:
/usr/lib/virtualbox/libdl.so: cannot open shared object file: No such file =
or
directory

So I created a symbolic link in /usr/lib/virtualbox/ pointing to the current
version of those missing libs giving the link the expected name, after whic=
h I
was able to start a guest OS.

This is obviously a hack and there is probably a better way, so maybe someo=
ne
can fix it
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17283064672.6c3Adc5.755
Date: Mon, 7 Oct 2024 13:07:47 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231346

          Summary
          Virtualbox guest won't start but crashes with NS_ERROR_FAILUR=
E (0X80004005)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Virtualization:Other

          Assignee
          virt-bugs@suse.de

          Reporter
          dutchkind@txoriaskea.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

After some update the Virtualbox guests wouldn't start anymo=
re. After some
trial and error I found in the Virtualbox log:

00:00:00.011066 main     rtldrNativeLoad:
dlopen('/usr/lib/virtualbox/libpthread.so', RTLD_NOW | RTLD_LOCAL) failed:
/usr/lib/virtualbox/libpthread.so: cannot open shared object file: No such =
file
or directory
00:00:00.011130 main     rtldrNativeLoad:
dlopen('/usr/lib/virtualbox/libdl.so', RTLD_NOW | RTLD_LOCAL) failed:
/usr/lib/virtualbox/libdl.so: cannot open shared object file: No such file =
or
directory

So I created a symbolic link in /usr/lib/virtualbox/ pointing to the current
version of those missing libs giving the link the expected name, after whic=
h I
was able to start a guest OS.

This is obviously a hack and there is probably a better way, so maybe someo=
ne
can fix it

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17283064672.6c3Adc5.755--


body:
--17283099571.c6b9af.839
Date: Mon, 7 Oct 2024 14:05:57 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231347

            Bug ID: 1231347
           Summary: javapackages-tools should require which
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Java
          Assignee: java-maintainers-at-suse.de
          Reporter: dmueller-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

$ grep which /usr/share/java-utils/java-functions
    JAVACMD=3D$(which java 2>/dev/null || :)
    local cmd=3D$(which xmvn-resolve 2>/dev/null || :)

this is sourced by tomcat, and it fails to start if which is not found. it
should require which (either javapackage-tools or tomcat)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17283099571.c6b9af.839
Date: Mon, 7 Oct 2024 14:05:57 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231347

          Summary
          javapackages-tools should require which

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Java

          Assignee
          java-maintainers@suse.de

          Reporter
          dmueller@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

$ grep which /usr/share/java-utils/java-functions
    JAVACMD=3D$(which java 2>/dev/null || :)
    local cmd=3D$(which xmvn-resolve 2>/dev/null || :)

this is sourced by tomcat, and it fails to start if which is not found. it
should require which (either javapackage-tools or tomcat)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17283099571.c6b9af.839--

summary: javapackages-tools should require which


--17283795903.d81A.1061
Date: Tue, 8 Oct 2024 09:26:30 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231381

            Bug ID: 1231381
           Summary: AUDIT-0: libcgroup:  permissions.d drop-in snippet, pam-file-unauthorize, non-standard-gid /usr/bin/cgexec cgred
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: werner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

>From a new package checkin:

libcgroup-tools.x86_64: E: permissions-file-unauthorized (Badness: 10)
/usr/share/permissions/permissions.d/libcgroup (sha256 file digest default
filter:6d3a669b10b2449484dcad1c6d932f5897666bcbeef2a45d9608ef63a1e43188 she=
ll
filter:6d3a669b10b2449484dcad1c6d932f5897666bcbeef2a45d9608ef63a1e43188 xml
filter:<failed-to-calculate>)
Packaging permissions.d drop-in snippets requires a review and whitelisting=
 by
the SUSE security team. If the package is intended for inclusion in any SUSE
product please open a bug report to request review of the package by the
security team. Please refer to
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
more information.

... used for setting sgid for new group cgred of binary /usr/bin/cgexec
to be able to open socket open by /usr/sbin/cgrulesengd.

libcgroup-pam.x86_64: E: pam-file-unauthorized (Badness: 10)
/usr/lib64/security/pam_cgroup.so (sha256 file digest default
filter:a0b86ae4acfe39eeaeb149a011080905027f1c7d44faf6be4be68d1cfa10c2b6 she=
ll
filter:<failed-to-calculate> xml filter:<failed-to-calculate>)
Packaging new PAM modules requires a review and whitelisting by the SUSE
security team. If the package is intended for inclusion in any SUSE product
please open a bug report to request review of the package by the security
team. Please refer to
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
more information.

... pam module which allows root to apply cgroups settings done by
 /usr/sbin/cgrulesengd.

libcgroup-tools.x86_64: W: non-standard-gid /usr/bin/cgexec cgred
A file in this package is owned by an unregistered group id.  To register t=
he
group, please make a pull request to the rpmlint config file
configs/openSUSE/users-groups.toml in the opensuse branch of the rpmlint
repository.

The binary cgexec  which only can be used by group members of group cgred.

Compare with https://aur.archlinux.org/packages/libcgroup and
https://packages.debian.org/source/sid/libcgroup
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17283795903.d81A.1061
Date: Tue, 8 Oct 2024 09:26:30 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231381

          Summary
          AUDIT-0: libcgroup:  permissions.d drop-in snippet, pam-file-=
unauthorize, non-standard-gid /usr/bin/cgexec cgred

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          All

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Virtualization:Tools

          Assignee
          virt-bugs@suse.de

          Reporter
          werner@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

From a new package checkin:

libcgroup-tools.x86_64: E: permissions-file-unauthorized (Badness: 10)
/usr/share/permissions/permissions.d/libcgroup (sha256 file digest default
filter:6d3a669b10b2449484dcad1c6d932f5897666bcbeef2a45d9608ef63a1e43188 she=
ll
filter:6d3a669b10b2449484dcad1c6d932f5897666bcbeef2a45d9608ef63a1e43188 xml
filter:<failed-to-calculate>)
Packaging permissions.d drop-in snippets requires a review and whitelisting=
 by
the SUSE security team. If the package is intended for inclusion in any SUSE
product please open a bug report to request review of the package by the
security team. Please refer to
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit=
_bugs for
more information.

... used for setting sgid for new group cgred of binary /usr/bin/cgexec
to be able to open socket open by /usr/sbin/cgrulesengd.

libcgroup-pam.x86_64: E: pam-file-unauthorized (Badness: 10)
/usr/lib64/security/pam_cgroup.so (sha256 file digest default
filter:a0b86ae4acfe39eeaeb149a011080905027f1c7d44faf6be4be68d1cfa10c2b6 she=
ll
filter:<failed-to-calculate> xml filter:<failed-to-calculate>)
Packaging new PAM modules requires a review and whitelisting by the SUSE
security team. If the package is intended for inclusion in any SUSE product
please open a bug report to request review of the package by the security
team. Please refer to
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit=
_bugs for
more information.

... pam module which allows root to apply cgroups settings done by
 /usr/sbin/cgrulesengd.

libcgroup-tools.x86_64: W: non-standard-gid /usr/bin/cgexec cgred
A file in this package is owned by an unregistered group id.  To register t=
he
group, please make a pull request to the rpmlint config file
configs/openSUSE/users-groups.toml in the opensuse branch of the rpmlint
repository.

The binary cgexec  which only can be used by group members of group cgred.

Compare with https=
://aur.archlinux.org/packages/libcgroup and
https://packag=
es.debian.org/source/sid/libcgroup

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17283795903.d81A.1061--


body:
--17284605670.4F7fa.612
Date: Wed, 9 Oct 2024 07:56:07 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231416

            Bug ID: 1231416
           Summary: ZSWAP config cleanup
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: jslaby-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Following:
commit 13a488ad6c85976074f78f80a06414914890703c
Author: Yosry Ahmed <yosryahmed-at-google.com>
Date:   Mon Oct 7 19:21:16 2024 +0000

    mm: z3fold: deprecate CONFIG_Z3FOLD

    The z3fold compressed pages allocator is rarely used, most users use
    zsmalloc.  The only disadvantage of zsmalloc in comparison is the
    dependency on MMU, and zbud is a more common option for !MMU as it was =
the
    default zswap allocator for a long time.

    Historically, zsmalloc had worse latency than zbud and z3fold but offer=
ed
    better memory savings.  This is no longer the case as shown by a simple
    recent analysis [1].  That analysis showed that z3fold does not have any
    advantage over zsmalloc or zbud considering both performance and memory
    usage.  In a kernel build test on tmpfs in a limited cgroup, z3fold took
    3% more time and used 1.8% more memory.  The latency of zswap_load() was
    7% higher, and that of zswap_store() was 10% higher.  Zsmalloc is better
    in all metrics.

    Moreover, z3fold apparently has latent bugs, which was made noticeable =
by
    a recent soft lockup bug report with z3fold [2].  Switching to zsmalloc
    not only fixed the problem, but also reduced the swap usage from 6~8G to
    1~2G.  Other users have also reported being bitten by mistakenly enabli=
ng
    z3fold.

    Other than hurting users, z3fold is repeatedly causing wasted engineeri=
ng
    effort.  Apart from investigating the above bug, it came up in multiple
    development discussions (e.g.  [3]) as something we need to handle, when
    there aren't any legit users (at least not intentionally).

    The natural course of action is to deprecate z3fold, and remove in a few
    cycles if no objections are raised from active users.  Next on the list
    should be zbud, as it offers marginal latency gains at the cost of huge
    memory waste when compared to zsmalloc.  That one will need to wait unt=
il
    zsmalloc does not depend on MMU.

We should likely:
* set CONFIG_ZSWAP_ZPOOL_DEFAULT_Z3FOLD_DEPRECATED=3Dn
* set CONFIG_ZSWAP_ZPOOL_DEFAULT_ZSMALLOC=3Dy and
CONFIG_ZSWAP_ZPOOL_DEFAULT_ZBUD=3Dn
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17284605670.4F7fa.612
Date: Wed, 9 Oct 2024 07:56:07 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231416

          Summary
          ZSWAP config cleanup

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel

          Assignee
          kernel-bugs@opensuse.org

          Reporter
          jslaby@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Following:
commit 13a488ad6c85976074f78f80a06414914890703c
Author: Yosry Ahmed <yosrya=
hmed@google.com>
Date:   Mon Oct 7 19:21:16 2024 +0000

    mm: z3fold: deprecate CONFIG_Z3FOLD

    The z3fold compressed pages allocator is rarely used, most users use
    zsmalloc.  The only disadvantage of zsmalloc in comparison is the
    dependency on MMU, and zbud is a more common option for !MMU as it was =
the
    default zswap allocator for a long time.

    Historically, zsmalloc had worse latency than zbud and z3fold but offer=
ed
    better memory savings.  This is no longer the case as shown by a simple
    recent analysis [1].  That analysis showed that z3fold does not have any
    advantage over zsmalloc or zbud considering both performance and memory
    usage.  In a kernel build test on tmpfs in a limited cgroup, z3fold took
    3% more time and used 1.8% more memory.  The latency of zswap_load() was
    7% higher, and that of zswap_store() was 10% higher.  Zsmalloc is better
    in all metrics.

    Moreover, z3fold apparently has latent bugs, which was made noticeable =
by
    a recent soft lockup bug report with z3fold [2].  Switching to zsmalloc
    not only fixed the problem, but also reduced the swap usage from 6~8G to
    1~2G.  Other users have also reported being bitten by mistakenly enabli=
ng
    z3fold.

    Other than hurting users, z3fold is repeatedly causing wasted engineeri=
ng
    effort.  Apart from investigating the above bug, it came up in multiple
    development discussions (e.g.  [3]) as something we need to handle, when
    there aren't any legit users (at least not intentionally).

    The natural course of action is to deprecate z3fold, and remove in a few
    cycles if no objections are raised from active users.  Next on the list
    should be zbud, as it offers marginal latency gains at the cost of huge
    memory waste when compared to zsmalloc.  That one will need to wait unt=
il
    zsmalloc does not depend on MMU.

We should likely:
* set CONFIG_ZSWAP_ZPOOL_DEFAULT_Z3FOLD_DEPRECATED=3Dn
* set CONFIG_ZSWAP_ZPOOL_DEFAULT_ZSMALLOC=3Dy and
CONFIG_ZSWAP_ZPOOL_DEFAULT_ZBUD=3Dn

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17284605670.4F7fa.612--

summary: ZSWAP config cleanup


--17284783920.E92fA1.890
Date: Wed, 9 Oct 2024 12:53:12 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231424

            Bug ID: 1231424
           Summary: podman: switch to natively using nftables support
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: mrueckert-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

1. firewalld uses nftables as the default backend now.
2. podman/netavark still default to iptables
3. while we are fixing this. do podman/netavark store the state of the fire=
wall
rules so that they could re-emit them?

nft configs often start with "flush ruleset" so it would be nice that the
firewall solutions could ask them "can i see your rules again to reapply th=
em"?

p.s. it is absolute pita to debug a machine that is using firewalld/nft and
then find out that the traffic is blocked by a parallel ruleset in legacy
iptables rules.

you could argue "lets just use iptables-backend-nft" ... but that package o=
nly
provides binaries with a different backend. the user can reconfigure the
systemd to keep using the legacy bindings. so native nftables support would=
 be
preferred
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17284783920.E92fA1.890
Date: Wed, 9 Oct 2024 12:53:12 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231424

          Summary
          podman: switch to natively using nftables support

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Containers

          Assignee
          containers-bugowner@suse.de

          Reporter
          mrueckert@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

1. firewalld uses nftables as the default backend now.
2. podman/netavark still default to iptables
3. while we are fixing this. do podman/netavark store the state of the fire=
wall
rules so that they could re-emit them?

nft configs often start with "flush ruleset" so it would be nice =
that the
firewall solutions could ask them "can i see your rules again to reapp=
ly them"?

p.s. it is absolute pita to debug a machine that is using firewalld/nft and
then find out that the traffic is blocked by a parallel ruleset in legacy
iptables rules.

you could argue "lets just use iptables-backend-nft" ... but that=
 package only
provides binaries with a different backend. the user can reconfigure the
systemd to keep using the legacy bindings. so native nftables support would=
 be
preferred

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17284783920.E92fA1.890--


body:
Gecko/20100101
Firefox/131.0
Build Identifier:=20

Updated to latest virtualbox from OBS (7.1.0-Virt.150600.3.1)=20

$ rpm -qa --last | grep virtualbox
virtualbox-host-source-7.1.0-Virt.150600.3.1.noarch Thu Oct  3 17:33:38 2024
virtualbox-devel-7.1.0-Virt.150600.3.1.x86_64 Thu Oct  3 17:33:38 2024
python3-virtualbox-7.1.0-Virt.150600.3.1.x86_64 Thu Oct  3 17:33:38 2024
virtualbox-qt-7.1.0-Virt.150600.3.1.x86_64    Thu Oct  3 17:33:37 2024
virtualbox-7.1.0-Virt.150600.3.1.x86_64       Thu Oct  3 17:33:34 2024
virtualbox-kmp-default-7.1.0_k6.4.0_150600.21-Virt.150600.3.1.x86_64 Thu Oc=
t  3
17:32:47 2024

and my virtual machines refuse to start up and give the error message:
Result Code: NS_ERROR_FAILURE (0x80004005)

Basically /usr/lib/virtualbox/VirtualBoxVM crashes, the core file contains:

(gdb) where
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
#1  0x00007fcbd3ba7f4c in RTStrCopy (pszDst=3D0x7ffdc98ea188 "", =
cbDst=3D3072,
pszSrc=3D0x0) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/VBox/Runtime/com=
mon/string/RTStrCopy.cpp:49
#2  0x00007fcbd3b166cf in RTErrInfoSet (pszMsg=3D<optimized out>, rc=
=3D-102,
pErrInfo=3D0x7ffdc98ea160) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/VBox/Runtime/com=
mon/err/errinfo.cpp:55
#3  RTErrInfoSet (pErrInfo=3D0x7ffdc98ea160, rc=3D-102, pszMsg=3D<optimi=
zed out>) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/VBox/Runtime/com=
mon/err/errinfo.cpp:48
#4  0x00007fcbd3c4d70e in rtldrNativeLoad (pszFilename=3D0xefa768
"/usr/lib/virtualbox/libpthread.so", phHandle=3D<optimized out=
>,
fFlags=3D<optimized out>, pErrInfo=3D0x7ffdc98ea160) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/VBox/Runtime/r3/=
posix/ldrNative-posix.cpp:100
#5  0x00007fcbd3b632ae in RTLdrLoadEx (pszFilename=3D0xefa768
"/usr/lib/virtualbox/libpthread.so", phLdrMod=3D0x7ffdc98ea140, f=
Flags=3D0,
pErrInfo=3D0x7ffdc98ea160) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/VBox/Runtime/com=
mon/ldr/ldrNative.cpp:154
#6  0x00007fcbd1bab521 in nsDll::Load (this=3Dthis@entry=3D0xeac530) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/libs/xpcom18a4/x=
pcom/components/xcDll.cpp:212
#7  0x00007fcbd1bacff8 in nsNativeComponentLoader::GetFactory (this=3D0xfad=
b40,
aCID=3D..., aLocation=3D<optimized out>, aType=3D<optimized out&gt=
;,
_retval=3D0x7ffdc98eb258) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/libs/xpcom18a4/x=
pcom/components/nsNativeComponentLoader.cpp:114
#8  0x00007fcbd1bb28d8 in nsFactoryEntry::GetFactory (mgr=3D0xee7e80,
aFactory=3D0x7ffdc98eb258, this=3D0x112f170) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/libs/xpcom18a4/x=
pcom/components/nsComponentManager.h:287
#9  nsComponentManagerImpl::CreateInstanceByContractID (aResult=3D0x7ffdc98=
eb2d8,
aIID=3D..., aDelegate=3D0x0, aContractID=3D0xee7e80 "", this=3D0x=
ee7e80) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/libs/xpcom18a4/x=
pcom/components/nsComponentManager.cpp:1941
#10 nsComponentManagerImpl::CreateInstanceByContractID
(this=3Dthis@entry=3D0xee7e80, aContractID=3DaContractID@entry=3D0x=
ed5e40
"@mozilla.org/ipc/dconnect-service;1", aDelegate=3DaDelegate&=
#64;entry=3D0x0, aIID=3D...,
aResult=3D0x7ffdc98eb2d8) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/libs/xpcom18a4/x=
pcom/components/nsComponentManager.cpp:1898
#11 0x00007fcbd1bb01f3 in nsComponentManagerImpl::GetServiceByContractID
(this=3D0xee7e80, aContractID=3D0xed5e40 "@mozilla.org/ipc/dconnec=
t-service;1",
aIID=3D..., result=3D0x7ffdc98eb390) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/libs/xpcom18a4/x=
pcom/components/nsComponentManager.cpp:2361
#12 0x00007fcbd1bce3e5 in nsGetServiceByContractID::operator()
(this=3D0x7ffdc98eb480, aIID=3D..., aInstancePtr=3D0x7ffdc98eb390) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/libs/xpcom18a4/x=
pcom/glue/nsComponentManagerUtils.cpp:121
#13 0x00007fcbd1bce60a in nsCOMPtr_base::assign_from_helper
(this=3Dthis@entry=3D0x7ffdc98eb450, helper=3D..., iid=3D...) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/libs/xpcom18a4/x=
pcom/glue/nsCOMPtr.cpp:114
#14 0x00007fcbd1bb8fb3 in nsCOMPtr<nsISupports>::nsCOMPtr (helper=3D.=
..,
this=3D0x7ffdc98eb450) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/out/linux.amd64/rele=
ase/bin/sdk/bindings/xpcom/include/xpcom/nsCOMPtr.h:845
#15 NS_CreateServicesFromCategory (category=3Dcategory@entry=3D0x7fcbd1=
bd101c
"xpcom-startup", origin=3Dorigin@entry=3D0x0,
observerTopic=3DobserverTopic@entry=3D0x7fcbd1bd101c "xpcom-startu=
p") at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/libs/xpcom18a4/x=
pcom/components/nsCategoryManager.cpp:793
#16 0x00007fcbd1bcfc3e in VBoxNsxpNS_InitXPCOM2 (result=3D<optimized out=
>,
binDirectory=3D<optimized out>, appFileLocationProvider=3D<optimiz=
ed out>) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/libs/xpcom18a4/x=
pcom/build/nsXPComInit.cpp:628
#17 0x00007fcbca91c413 in com::Initialize (fInitFlags=3DfInitFlags@entr=
y=3D3) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/VBox/Main/glue/i=
nitterm.cpp:743
#18 0x00007fcbca50833a in COMBase::InitializeCOM (fGui=3DfGui@entry=3Dt=
rue) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/VBox/Frontends/V=
irtualBox/src/globals/COMDefs.cpp:98
#19 0x00007fcbca58405f in UIGlobalSession::prepare (this=3D0xe92900) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/VBox/Frontends/V=
irtualBox/src/globals/UIGlobalSession.cpp:79
#20 0x00007fcbca566e52 in UICommon::prepare (this=3D0xe1c300) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/VBox/Frontends/V=
irtualBox/src/globals/UIGlobalSession.h:62
#21 0x00007fcbca568ac7 in UICommon::create
(enmType=3DenmType@entry=3DUIType_RuntimeUI) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/VBox/Frontends/V=
irtualBox/src/globals/UICommon.cpp:123
#22 0x00007fcbd2694e3f in TrustedMain (argc=3D<optimized out>, argv=
=3D<optimized
out>) at
/usr/src/debug/virtualbox-7.1.0-Virt.150600.3.1.x86_64/src/VBox/Frontends/V=
irtualBox/src/main.cpp:560
#23 0x00007fcbd3e40eec in __libc_start_call_main (main=3Dmain@entry=3D0=
x401560
<main(int, char**, char**)>, argc=3Dargc@entry=3D6, argv=3Dargv&#=
64;entry=3D0x7ffdc98f1cb8)
at ../sysdeps/nptl/libc_start_call_main.h:58
#24 0x00007fcbd3e40fb5 in __libc_start_main_impl (main=3D0x401560 <main(=
int,
char**, char**)>, argc=3D6, argv=3D0x7ffdc98f1cb8, init=3D<optimized =
out>,
fini=3D<optimized out>, rtld_fini=3D<optimized out>, stack_end=
=3D0x7ffdc98f1ca8) at
../csu/libc-start.c:360
#25 0x0000000000401761 in _start () at ../sysdeps/x86_64/start.S:115

VBOxSVC.log contains:

00:00:00.001773 main     rtldrNativeLoad:
dlopen('/usr/lib/virtualbox/libpthread.so', RTLD_NOW | RTLD_LOCAL) failed:
/usr/lib/virtualbox/libpthread.so: cannot open shared object file: No such =
file
or directory
00:00:00.001778 main     rtldrNativeLoad:
dlopen('/usr/lib/virtualbox/libdl.so', RTLD_NOW | RTLD_LOCAL) failed:
/usr/lib/virtualbox/libdl.so: cannot open shared object file: No such file =
or
directory

Similar issues reported:
https://www.virtualbox.=
org/ticket/22193
https://bbs=
.archlinux.org/viewtopic.php?id=3D299392
https://=
forums.virtualbox.org/viewtopic.php?t=3D112370
https://b=
ugzilla.rpmfusion.org/show_bug.cgi?id=3D7067

There is a manual workaround:
$ cd /usr/lib/virtualbox
$ ln -s /lib64/libpthread.so.0 libpthread.so
$ ln -s /lib64/libdl.so.2 ./libdl.so

Reproducible: Always

Steps to Reproduce:
1.See details above
2.
3.
Actual Results:=20=20
my virtual machines refuse to start up and give the error message:
Result Code: NS_ERROR_FAILURE (0x80004005)

Expected Results:=20=20
my virtual machines start as normal

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17285447791.DA230Fc.458--

summary: After upgrade to Virtualbox 7.1.0 from OBS, virtual machines do not run


--17285517771.0814e4Af.785
Date: Thu, 10 Oct 2024 09:16:17 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231465

            Bug ID: 1231465
           Summary: Kernel 6.11.2-1 causes OOM errors with Plasma 6.2
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: felix.niederwanger-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Created attachment 877874
  --> https://bugzilla.suse.com/attachment.cgi?id=3D877874&action=3Dedit
dmesg

After updating from TW 20241001 to 20241007 (current) causes many OOM errors
when logging in to a Plasma desktop. The issue is only present when booting
with the new 6.11.2-1 kernel, not when booting the older 6.11.0-1 kernel.

I see the login manager and when I try to login as user, the Plasma Splash
screen pops up, and then the laptop freezes. In the dmesg I see many OOM
messages like the following:

> [   92.704048] [    T848] systemd-journal invoked oom-killer: gfp_mask=3D=
0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=3D0, oom_score_adj=3D-250
> [   92.704056] [    T848] CPU: 4 UID: 0 PID: 848 Comm: systemd-journal No=
t tainted 6.11.2-1-default #1 openSUSE Tumbleweed e7184aff5e8c765d07bd8e233=
cb429101cfc70a8
> [   92.704060] [    T848] Hardware name: Dell Inc. Latitude 7290/09386V, =
BIOS 1.39.0 07/04/2024
>=20
> ...
>=20
> [   92.704266] [    T848] Tasks state (memory values in pages):
> [   92.704267] [    T848] [  pid  ]   uid  tgid total_vm      rss rss_ano=
n rss_file rss_shmem pgtables_bytes swapents oom_score_adj name
> ...
> [   92.704386] [    T848] [   5486]  1000  5486 67186069     2101     208=
1       20         0  1273856        0           200 baloo_file
> [   92.704439] [    T848] [   5912]  1000  5912 67125561      700      60=
8       92         0   192512        0           200 kioworkerr
> [   92.704478] [    T848] [   6084]  1000  6084    53113      884      76=
8      116         0   184320        0           200 kioworker
> [   92.704480] [    T848] [   6086]  1000  6086 67125560      753      64=
0      113         0   188416        0           200 kioworker
> ...
> [   92.704510] [    T848] oom-kill:constraint=3DCONSTRAINT_NONE,nodemask=
=3D(null),cpuset=3D/,mems_allowed=3D0,global_oom,task_memcg=3D/,task=3DDisc=
overNotifie,pid=3D6205,uid=3D1000
> [   92.704530] [    T848] Out of memory: Killed process 6205 (DiscoverNot=
ifie) total-vm:1148792kB, anon-rss:174748kB, file-rss:176kB, shmem-rss:0kB,=
 UID:1000 pgtables:912kB oom_score_adj:200

See the full log as attachment.

Hardware: DEll Latitude 7290, Intel i7-8650U, 32 GiB RAM

As said, running the old 6.11.0-1 kernel from the same 20241007 snapshot wo=
rks
without issues.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17285517771.0814e4Af.785
Date: Thu, 10 Oct 2024 09:16:17 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231465

          Summary
          Kernel 6.11.2-1 causes OOM errors with Plasma 6.2

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel

          Assignee
          kernel-bugs@opensuse.org

          Reporter
          felix.niederwanger@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Created attachment 877874 [details]
dmesg

After updating from TW 20241001 to 20241007 (current) causes many OOM errors
when logging in to a Plasma desktop. The issue is only present when booting
with the new 6.11.2-1 kernel, not when booting the older 6.11.0-1 kernel.

I see the login manager and when I try to login as user, the Plasma Splash
screen pops up, and then the laptop freezes. In the dmesg I see many OOM
messages like the following:

> [   92.704048] [    T848] systemd-journal invoke=
d oom-killer: gfp_mask=3D0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=
=3D0, oom_score_adj=3D-250
> [   92.704056] [    T848] CPU: 4 UID: 0 PID: 848 Comm: systemd-journal=
 Not tainted 6.11.2-1-default #1 openSUSE Tumbleweed e7184aff5e8c765d07bd8e=
233cb429101cfc70a8
> [   92.704060] [    T848] Hardware name: Dell Inc. Latitude 7290/09386=
V, BIOS 1.39.0 07/04/2024
>=20
> ...
>=20
> [   92.704266] [    T848] Tasks state (memory values in pages):
> [   92.704267] [    T848] [  pid  ]   uid  tgid total_vm      rss rss_=
anon rss_file rss_shmem pgtables_bytes swapents oom_score_adj name
> ...
> [   92.704386] [    T848] [   5486]  1000  5486 67186069     2101     =
2081       20         0  1273856        0           200 baloo_file
> [   92.704439] [    T848] [   5912]  1000  5912 67125561      700     =
 608       92         0   192512        0           200 kioworkerr
> [   92.704478] [    T848] [   6084]  1000  6084    53113      884     =
 768      116         0   184320        0           200 kioworker
> [   92.704480] [    T848] [   6086]  1000  6086 67125560      753     =
 640      113         0   188416        0           200 kioworker
> ...
> [   92.704510] [    T848] oom-kill:constraint=3DCONSTRAINT_NONE,nodema=
sk=3D(null),cpuset=3D/,mems_allowed=3D0,global_oom,task_memcg=3D/,task=3DDi=
scoverNotifie,pid=3D6205,uid=3D1000
> [   92.704530] [    T848] Out of memory: Killed process 6205 (Discover=
Notifie) total-vm:1148792kB, anon-rss:174748kB, file-rss:176kB, shmem-rss:0=
kB, UID:1000 pgtables:912kB oom_score_adj:200

See the full log as attachment.

Hardware: DEll Latitude 7290, Intel i7-8650U, 32 GiB RAM

As said, running the old 6.11.0-1 kernel from the same 20241007 snapshot wo=
rks
without issues.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17285517771.0814e4Af.785--


--17285633729.65da8C.374
Date: Thu, 10 Oct 2024 12:29:32 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231489

            Bug ID: 1231489
           Summary: [Build 20241008-SELinux] openQA test fails in snapper_thin_lvm
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4548535/modules/snap
                    per_thin_lvm/steps/71
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1230118
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

Tumbleweed iso test with SELinux enabled by default, see tracker bsc#1230118

probably policy issue, avc:
type=3DAVC msg=3Daudit(1728548238.401:476): avc:  denied  { execute } for=20
pid=3D79659 comm=3D"snapperd" name=3D"systemctl" dev=3D"vda2" ino=3D37890
scontext=3Dsystem_u:system_r:snapperd_t:s0
tcontext=3Dsystem_u:object_r:systemd_systemctl_exec_t:s0 tclass=3Dfile perm=
issive=3D0

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-extra_tests_filesystem@64bit fails in
[snapper_thin_lvm](https://openqa.opensuse.org/tests/4548535/modules/snappe=
r_thin_lvm/steps/71)

## Test suite description
Maintainer: QE Core

Filesystem related tests, for example snapper and btrfs features.

## Reproducible

Fails since (at least) Build
[20241008-SELinux](https://openqa.opensuse.org/tests/4548535) (current job)

## Expected result

Last good: [20241009](https://openqa.opensuse.org/tests/4547883) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DDVD&machine=3D64bit&test=3Dextra_tests_filesystem&version=
=3DTumbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17285633729.65da8C.374
Date: Thu, 10 Oct 2024 12:29:32 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231489

          Summary
          [Build 20241008-SELinux] openQA test fails in snapper_thin_lvm

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4548535/modules/snapper_thi=
n_lvm/steps/71

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          cathy.hu@suse.com

          QA Contact
          qa-bugs@suse.de

          Blocks
          1230118

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

Tumbleweed iso test with SELinux enabled by default, see tra=
cker bsc#123=
0118

probably policy issue, avc:
type=3DAVC msg=3Daudit(1728548238.401:476): avc:  denied  { execute } for=20
pid=3D79659 comm=3D"snapperd" name=3D"systemctl" dev=3D=
"vda2" ino=3D37890
scontext=3Dsystem_u:system_r:snapperd_t:s0
tcontext=3Dsystem_u:object_r:systemd_systemctl_exec_t:s0 tclass=3Dfile perm=
issive=3D0

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-extra_tests_filesystem@64bit fails in
[snapper_thin_lvm](https://openqa.opensuse.org/tests/4548535/m=
odules/snapper_thin_lvm/steps/71)

## Test suite description
Maintainer: QE Core

Filesystem related tests, for example snapper and btrfs features.

## Reproducible

Fails since (at least) Build
[20241008-SELinux](ht=
tps://openqa.opensuse.org/tests/4548535) (current job)

## Expected result

Last good: [20241009](https://openqa.opensuse.org/tests/4547883) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tes=
ts/latest?arch=3Dx86_64&distri=3Dopensuse&flavor=3DDVD&machine=
=3D64bit&test=3Dextra_tests_filesystem&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17285633729.65da8C.374--


--17285637886.2A2dA10.407
Date: Thu, 10 Oct 2024 12:36:28 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231491

            Bug ID: 1231491
           Summary: [Build 20241008-SELinux] openQA test fails in slp mta check_default_network_manager: slp does not start
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4548604/modules/slp/
                    steps/24
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1230118
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

Tumbleweed iso test with SELinux enabled by default, see tracker bsc#1230118

probably policy issue:

slp daemon is not starting

=C3=97 slpd.service - OpenSLP daemon for the Service Location Protocol
     Loaded: loaded (/usr/lib/systemd/system/slpd.service; disabled; preset:
disabled)
     Active: failed (Result: exit-code) since Thu 2024-10-10 04:10:55 EDT; =
14ms
ago
   Duration: 3ms
 Invocation: 8033b31a828f48bea5cebb9b2f74c561
    Process: 139142 ExecStart=3D/usr/sbin/slpd -d (code=3Dexited, status=3D=
1/FAILURE)
   Main PID: 139142 (code=3Dexited, status=3D1/FAILURE)
        CPU: 69ms

Oct 10 04:10:55 susetest systemd[1]: Starting OpenSLP daemon for the Service
Location Protocol...
Oct 10 04:10:55 susetest systemd[1]: Started OpenSLP daemon for the Service
Location Protocol.
Oct 10 04:10:55 susetest systemd[1]: slpd.service: Main process exited,
code=3Dexited, status=3D1/FAILURE
Oct 10 04:10:55 susetest systemd[1]: slpd.service: Failed with result
'exit-code'.
xg3Pc-3-

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-extra_tests_textmode@64bit fails in
[slp](https://openqa.opensuse.org/tests/4548604/modules/slp/steps/24)

## Test suite description
Maintainer: slindomansilla-at-suse.de.
Mainly post-installation console extra tests.

## Reproducible

Fails since (at least) Build
[20240702](https://openqa.opensuse.org/tests/4315747)

## Expected result

Last good: [20240611](https://openqa.opensuse.org/tests/4267371) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DDVD&machine=3D64bit&test=3Dextra_tests_textmode&version=3DT=
umbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17285637886.2A2dA10.407
Date: Thu, 10 Oct 2024 12:36:28 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231491

          Summary
          [Build 20241008-SELinux] openQA test fails in slp mta  check_=
default_network_manager: slp does not start

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4548604/modules/slp/steps/24

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          cathy.hu@suse.com

          QA Contact
          qa-bugs@suse.de

          Blocks
          1230118

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

Tumbleweed iso test with SELinux enabled by default, see tra=
cker bsc#123=
0118

probably policy issue:

slp daemon is not starting

=C3=97 slpd.service - OpenSLP daemon for the Service Location Protocol
     Loaded: loaded (/usr/lib/systemd/system/slpd.service; disabled; preset:
disabled)
     Active: failed (Result: exit-code) since Thu 2024-10-10 04:10:55 EDT; =
14ms
ago
   Duration: 3ms
 Invocation: 8033b31a828f48bea5cebb9b2f74c561
    Process: 139142 ExecStart=3D/usr/sbin/slpd -d (code=3Dexited, status=3D=
1/FAILURE)
   Main PID: 139142 (code=3Dexited, status=3D1/FAILURE)
        CPU: 69ms

Oct 10 04:10:55 susetest systemd[1]: Starting OpenSLP daemon for the Service
Location Protocol...
Oct 10 04:10:55 susetest systemd[1]: Started OpenSLP daemon for the Service
Location Protocol.
Oct 10 04:10:55 susetest systemd[1]: slpd.service: Main process exited,
code=3Dexited, status=3D1/FAILURE
Oct 10 04:10:55 susetest systemd[1]: slpd.service: Failed with result
'exit-code'.
xg3Pc-3-

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-extra_tests_textmode@64bit fails in
[slp](https://openqa.opensuse.org/tests/4548604/modules/slp/steps/24)

## Test suite description
Maintainer: slindomansilla&#6=
4;suse.de.
Mainly post-installation console extra tests.

## Reproducible

Fails since (at least) Build
[20240702](https://op=
enqa.opensuse.org/tests/4315747)

## Expected result

Last good: [20240611](https://openqa.opensuse.org/tests/4267371) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests=
/latest?arch=3Dx86_64&distri=3Dopensuse&flavor=3DDVD&machine=3D=
64bit&test=3Dextra_tests_textmode&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17285637886.2A2dA10.407--


--17285643780.dF4dbd.476
Date: Thu, 10 Oct 2024 12:46:18 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231493

            Bug ID: 1231493
           Summary: [Build 20241008-SELinux] openQA test fails in ovs_client: Job for openvswitch-ipsec.service failed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4548860/modules/ovs_
                    client/steps/24
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1230118
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

Tumbleweed iso test with SELinux enabled by default, see tracker bsc#1230118

Job for openvswitch-ipsec.service failed because the control process exited
with error code.
See "systemctl status openvswitch-ipsec.service" and "journalctl -xeu
openvswitch-ipsec.service" for details.

probably policy issue:
type=3DAVC msg=3Daudit(1728548302.694:169): avc:  denied  { getattr } for=20
pid=3D13894 comm=3D"ovs-monitor-ips" path=3D"/usr/sbin/ipsec" dev=3D"vda2" =
ino=3D64150
scontext=3Dsystem_u:system_r:openvswitch_t:s0
tcontext=3Dsystem_u:object_r:ipsec_mgmt_exec_t:s0 tclass=3Dfile permissive=
=3D0
type=3DAVC msg=3Daudit(1728548302.697:170): avc:  denied  { write } for  pi=
d=3D13894
comm=3D"ovs-monitor-ips" name=3D"strongswan.d" dev=3D"vda2" ino=3D63777
scontext=3Dsystem_u:system_r:openvswitch_t:s0 tcontext=3Dsystem_u:object_r:=
etc_t:s0
tclass=3Ddir permissive=3D0

## Observation

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-ovs-client@64bit fai=
ls
in
[ovs_client](https://openqa.opensuse.org/tests/4548860/modules/ovs_client/s=
teps/24)

## Test suite description
Regression test for openvswitch-ipsec. Maintainer: Anna Minou

## Reproducible

Fails since (at least) Build
[20241008-SELinux](https://openqa.opensuse.org/tests/4548860) (current job)

## Expected result

Last good: [20241009](https://openqa.opensuse.org/tests/4547494) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DDVD&machine=3D64bit&test=3Dovs-client&version=3DTumbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17285643780.dF4dbd.476
Date: Thu, 10 Oct 2024 12:46:18 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231493

          Summary
          [Build 20241008-SELinux] openQA test fails in ovs_client: Job=
 for openvswitch-ipsec.service failed

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4548860/modules/ovs_client/=
steps/24

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          cathy.hu@suse.com

          QA Contact
          qa-bugs@suse.de

          Blocks
          1230118

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

Tumbleweed iso test with SELinux enabled by default, see tra=
cker bsc#123=
0118

Job for openvswitch-ipsec.service failed because the control process exited
with error code.
See "systemctl status openvswitch-ipsec.service" and "journa=
lctl -xeu
openvswitch-ipsec.service" for details.

probably policy issue:
type=3DAVC msg=3Daudit(1728548302.694:169): avc:  denied  { getattr } for=20
pid=3D13894 comm=3D"ovs-monitor-ips" path=3D"/usr/sbin/ipsec=
" dev=3D"vda2" ino=3D64150
scontext=3Dsystem_u:system_r:openvswitch_t:s0
tcontext=3Dsystem_u:object_r:ipsec_mgmt_exec_t:s0 tclass=3Dfile permissive=
=3D0
type=3DAVC msg=3Daudit(1728548302.697:170): avc:  denied  { write } for  pi=
d=3D13894
comm=3D"ovs-monitor-ips" name=3D"strongswan.d" dev=3D&q=
uot;vda2" ino=3D63777
scontext=3Dsystem_u:system_r:openvswitch_t:s0 tcontext=3Dsystem_u:object_r:=
etc_t:s0
tclass=3Ddir permissive=3D0

## Observation

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-ovs-client@64bit=
 fails
in
[ovs_client](https://openqa.opensuse.org/tests/4548860/modules/ovs_c=
lient/steps/24)

## Test suite description
Regression test for openvswitch-ipsec. Maintainer: Anna Minou

## Reproducible

Fails since (at least) Build
[20241008-SELinux](ht=
tps://openqa.opensuse.org/tests/4548860) (current job)

## Expected result

Last good: [20241009](https://openqa.opensuse.org/tests/4547494) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?ar=
ch=3Dx86_64&distri=3Dopensuse&flavor=3DDVD&machine=3D64bit&=
test=3Dovs-client&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17285643780.dF4dbd.476--


--17285645145.7F0Eb58d7.482
Date: Thu, 10 Oct 2024 12:48:34 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231494

            Bug ID: 1231494
           Summary: [Build 20241008-SELinux] openQA test fails in rsync_server: rsyncd cant start
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4548658/modules/rsyn
                    c_server/steps/24
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1231483
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

Tumbleweed iso test with SELinux enabled by default, see tracker bsc#1230118

rsyncd cant start

probably policy issue

type=3DAVC msg=3Daudit(1728547661.441:148): avc:  denied  { execute } for  =
pid=3D1700
comm=3D"rsyncd" path=3D"/usr/bin/bash" dev=3D"vda2" ino=3D15343
scontext=3Dsystem_u:system_r:rsync_t:s0
tcontext=3Dsystem_u:object_r:shell_exec_t:s0 tclass=3Dfile permissive=3D0

## Observation

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-rsync-server@64bit f=
ails
in
[rsync_server](https://openqa.opensuse.org/tests/4548658/modules/rsync_serv=
er/steps/24)

## Test suite description
Maintainer: zluo-at-suse.de
install and test rsync server

## Reproducible

Fails since (at least) Build
[20241008-SELinux](https://openqa.opensuse.org/tests/4548658) (current job)

## Expected result

Last good: [20241009](https://openqa.opensuse.org/tests/4547293) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DDVD&machine=3D64bit&test=3Drsync-server&version=3DTumblewee=
d)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17285645145.7F0Eb58d7.482
Date: Thu, 10 Oct 2024 12:48:34 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231494

          Summary
          [Build 20241008-SELinux] openQA test fails in rsync_server: r=
syncd cant start

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4548658/modules/rsync_serve=
r/steps/24

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          cathy.hu@suse.com

          QA Contact
          qa-bugs@suse.de

          Blocks
          1231483

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

Tumbleweed iso test with SELinux enabled by default, see tra=
cker bsc#123=
0118

rsyncd cant start

probably policy issue

type=3DAVC msg=3Daudit(1728547661.441:148): avc:  denied  { execute } for  =
pid=3D1700
comm=3D"rsyncd" path=3D"/usr/bin/bash" dev=3D"vda2=
" ino=3D15343
scontext=3Dsystem_u:system_r:rsync_t:s0
tcontext=3Dsystem_u:object_r:shell_exec_t:s0 tclass=3Dfile permissive=3D0

## Observation

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-rsync-server@64b=
it fails
in
[rsync_server](https://openqa.opensuse.org/tests/4548658/modules/r=
sync_server/steps/24)

## Test suite description
Maintainer: zluo@suse.de
install and test rsync server

## Reproducible

Fails since (at least) Build
[20241008-SELinux](ht=
tps://openqa.opensuse.org/tests/4548658) (current job)

## Expected result

Last good: [20241009](https://openqa.opensuse.org/tests/4547293) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?=
arch=3Dx86_64&distri=3Dopensuse&flavor=3DDVD&machine=3D64bit&am=
p;test=3Drsync-server&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17285645145.7F0Eb58d7.482--


--172865517810.e6dDcc.1622
Date: Fri, 11 Oct 2024 13:59:38 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231562

            Bug ID: 1231562
           Summary: VUL-0: CVE-2024-48949: python-pytest-html: elliptic: Missing Validation in Elliptic's EDDSA Signature Verification
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/423528/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2024-48949:8.2:(AV:N/AC:L/PR:N/UI:N/
                    S:U/C:H/I:L/A:N)
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: daniel.garcia-at-suse.com
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1231557
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The verify function in lib/elliptic/eddsa/index.js in the Elliptic package
before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) ||
sig.S().isNeg()" validation.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-48949
https://www.cve.org/CVERecord?id=3DCVE-2024-48949
https://github.com/indutny/elliptic/commit/7ac5360118f74eb02da73bdf9f24fd0c=
72ff5281
https://github.com/indutny/elliptic/compare/v6.5.5...v6.5.6
https://bugzilla.redhat.com/show_bug.cgi?id=3D2317724
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--172865517810.e6dDcc.1622
Date: Fri, 11 Oct 2024 13:59:38 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231562

          Summary
          VUL-0: CVE-2024-48949: python-pytest-html: elliptic: Missing =
Validation in Elliptic's EDDSA Signature Verification

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          URL
          https://smash.suse.de/issue/423528/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2024-48949:8.2:(AV:N/AC:L/PR:N/UI:N/S:U/C:H=
/I:L/A:N)=20

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          daniel.garcia@suse.com

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1231557

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The verify function in lib/elliptic/eddsa/index.js in the El=
liptic package
before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) ||
sig.S().isNeg()" validation.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-48949
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-48949
https://github.com/indutny/elliptic/commit/7ac5360118f=
74eb02da73bdf9f24fd0c72ff5281
htt=
ps://github.com/indutny/elliptic/compare/v6.5.5...v6.5.6
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2317724

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--172865517810.e6dDcc.1622--


body:
--17287391624.8D17F0B3.593
Date: Sat, 12 Oct 2024 13:19:22 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1231584

            Bug ID: 1231584
           Summary: ldns fails to build with Swig 4.3.0
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: kkaempf-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

ldns fails to build with latest Swig 4.3.0

https://build.opensuse.org/project/monitor/openSUSE:Factory:Staging:H?arch_=
x86_64=3D1&defaults=3D0&failed=3D1&repo_standard=3D1

due to an incompatible change in Swig

https://github.com/swig/swig/blob/master/CHANGES.current

"[Python] #2907 Fix returning null from functions with output
            parameters.  Ensures OUTPUT and INOUT typemaps are handled
            consistently wrt return type.

            New declaration of SWIG_Python_AppendOutput is now:

              SWIG_Python_AppendOutput(PyObject* result, PyObject* obj, int
is_void);

            The 3rd parameter is new and the new $isvoid special variable
            should be passed to it, indicating whether or not the wrapped
            function returns void.

            Also consider replacing with:

              SWIG_AppendOutput(PyObject* result, PyObject* obj);

            which calls SWIG_Python_AppendOutput with same parameters but
adding $isvoid
            for final parameter."
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17287391624.8D17F0B3.593
Date: Sat, 12 Oct 2024 13:19:22 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1231584

          Summary
          ldns fails to build with Swig 4.3.0

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          kkaempf@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

ldns fails to build with latest Swig 4.3.0

https://build.opensuse.org/project/monitor/openSUSE:Factory:Staging:H?arc=
h_x86_64=3D1&defaults=3D0&failed=3D1&repo_standard=3D1

due to an incompatible change in Swig

https:=
//github.com/swig/swig/blob/master/CHANGES.current

"[Python] #2907 Fix returning null from functions with output
            parameters.  Ensures OUTPUT and INOUT typemaps are handled
            consistently wrt return type.

            New declaration of SWIG_Python_AppendOutput is now:

              SWIG_Python_AppendOutput(PyObject* result, PyObject* obj, int
is_void);

            The 3rd parameter is new and the new $isvoid special variable
            should be passed to it, indicating whether or not the wrapped
            function returns void.

            Also consider replacing with:

              SWIG_AppendOutput(PyObject* result, PyObject* obj);

            which calls SWIG_Python_AppendOutput with same parameters but
adding $isvoid
            for final parameter."

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17287391624.8D17F0B3.593--

summary: ldns fails to build with Swig 4.3.0