--17400648342.F73AB2.13805
Date: Thu, 20 Feb 2025 15:20:34 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237442

            Bug ID: 1237442
           Summary: any_invocable.h:868:1: internal compiler error: Segmentation fault
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: rguenther-at-suse.com
          Reporter: ohering-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Created attachment 880504
  --> https://bugzilla.suse.com/attachment.cgi?id=3D880504&action=3Dedit
ccywekmJ.out.txt.xz

// gcc version 14.2.1 20241007 [revision
4af44f2cf7d281f3e4f3957efce10e8b2ccb2ad3] (SUSE Linux)=20

//                  from stream_out/chromecast/cast.cpp:34:
// /usr/include/absl/functional/internal/any_invocable.h: In static member
function =E2=80=98static ReturnType absl::lts_20250127::internal_any_i
nvocable::Impl<ReturnType(P
...)>::InvokedAfterMove(absl::lts_20250127::internal_any_invocable::TypeEra=
sedState*,
absl::lts_20250127::int
ernal_any_invocable::ForwardedParameterType
...)=E2=80=99:
// /usr/include/absl/functional/internal/any_invocable.h:868:1: internal
compiler error: Segmentation fault
//   868 | ABSL_INTERNAL_ANY_INVOCABLE_IMPL(, , &);
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17400648342.F73AB2.13805
Date: Thu, 20 Feb 2025 15:20:34 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237442

          Summary
          any_invocable.h:868:1: internal compiler error: Segmentation =
fault

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          Linux

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          rguenther@suse.com

          Reporter
          ohering@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Created attachment 880504<=
/a> [details]
ccywekmJ.out.txt.xz

// gcc version 14.2.1 20241007 [revision
4af44f2cf7d281f3e4f3957efce10e8b2ccb2ad3] (SUSE Linux)=20

//                  from stream_out/chromecast/cast.cpp:34:
// /usr/include/absl/functional/internal/any_invocable.h: In static member
function =E2=80=98static ReturnType absl::lts_20250127::internal_any_i
nvocable::Impl<ReturnType(P
...)>::InvokedAfterMove(absl::lts_20250127::internal_any_invocable::Type=
ErasedState*,
absl::lts_20250127::int
ernal_any_invocable::ForwardedParameterType<P>...)=E2=80=99:
// /usr/include/absl/functional/internal/any_invocable.h:868:1: internal
compiler error: Segmentation fault
//   868 | ABSL_INTERNAL_ANY_INVOCABLE_IMPL(, , &);

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17400648342.F73AB2.13805--


body:
--17400823040.BCC4F7.14204
Date: Thu, 20 Feb 2025 20:11:44 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237451

            Bug ID: 1237451
           Summary: can't reach cockpit on localhost:9090
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Cockpit
          Assignee: Cockpit-bugs-at-suse.de
          Reporter: kzqw82347q-online-at-yahoo.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Today I've updated to newest snapshot (20250219) and cockpit was also inclu=
ded
in it from 322 -> 332, and I can't login via localhost:9090 from my browser.

Yesterday cockpit was working just fine, but today, something just changed =
into
the wrong way.

here's a journalctl when I tried to reach cockpit from browser:
febr 20 21:05:31 tumbleweed cockpit-tls[21506]: cockpit-tls: connect(http.s=
ock)
failed: Permission denied

Interestingly, I can remote into cockpit from another machine using cockpit
through cockpit's ssh interface (left side menu, when adding more sessions)

Operating System: openSUSE Tumbleweed 20250219
KDE Plasma Version: 6.3.0
KDE Frameworks Version: 6.11.0
Qt Version: 6.8.2
Kernel Version: 6.13.3-1-default (64-bit)
Graphics Platform: Wayland
Processors: 4 =C3=97 Intel=C2=AE Core=E2=84=A2 i5-6500 CPU @ 3.20GHz
Memory: 15.6 GiB of RAM
Graphics Processor: NVIDIA GeForce GTX 1050 Ti/PCIe/SSE2
Manufacturer: MSI
Product Name: MS-7972
System Version: 2.0
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17400823040.BCC4F7.14204
Date: Thu, 20 Feb 2025 20:11:44 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237451

          Summary
          can't reach cockpit on localhost:9090

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Cockpit

          Assignee
          Cockpit-bugs@suse.de

          Reporter
          kzqw82347q-online@yahoo.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Today I've updated to newest snapshot (20250219) and cockpit=
 was also included
in it from 322 -> 332, and I can't login via localhost:9090 from my brow=
ser.

Yesterday cockpit was working just fine, but today, something just changed =
into
the wrong way.

here's a journalctl when I tried to reach cockpit from browser:
febr 20 21:05:31 tumbleweed cockpit-tls[21506]: cockpit-tls: connect(http.s=
ock)
failed: Permission denied

Interestingly, I can remote into cockpit from another machine using cockpit
through cockpit's ssh interface (left side menu, when adding more sessions)

Operating System: openSUSE Tumbleweed 20250219
KDE Plasma Version: 6.3.0
KDE Frameworks Version: 6.11.0
Qt Version: 6.8.2
Kernel Version: 6.13.3-1-default (64-bit)
Graphics Platform: Wayland
Processors: 4 =C3=97 Intel=C2=AE Core=E2=84=A2 i5-6500 CPU @ 3.20GHz
Memory: 15.6 GiB of RAM
Graphics Processor: NVIDIA GeForce GTX 1050 Ti/PCIe/SSE2
Manufacturer: MSI
Product Name: MS-7972
System Version: 2.0

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17400823040.BCC4F7.14204--

summary: can't reach cockpit on localhost:9090


body:
--17401328300.0aDe0aA7E.15068
Date: Fri, 21 Feb 2025 10:13:50 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237464

            Bug ID: 1237464
           Summary: Java:packages/tuxguitar: Bug
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: 3rd party software
          Assignee: fstrba-at-suse.com
          Reporter: ecsos-at-schirra.net
        QA Contact: screening-team-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Your patches not really work:
Pleas fix it.

org.herac.tuxguitar.player.base.MidiPlayerException: Kann Soundbank-Datei n=
icht
=C3=B6ffnen.
        at
org.herac.tuxguitar.player.impl.jsa.midiport.MidiPortSynthesizer.loadSoundb=
ank(MidiPortSynthesizer.java:101)
        at
org.herac.tuxguitar.player.impl.jsa.midiport.MidiPortSynthesizer.getSynth(M=
idiPortSynthesizer.java:78)
        at
org.herac.tuxguitar.player.impl.jsa.midiport.MidiPortSynthesizer.open(MidiP=
ortSynthesizer.java:48)
        at
org.herac.tuxguitar.player.base.MidiPlayer.loadOutputPort(MidiPlayer.java:9=
38)
        at
org.herac.tuxguitar.player.base.MidiPlayer.openOutputPort(MidiPlayer.java:9=
80)
        at
org.herac.tuxguitar.player.base.MidiPlayer.openOutputPort(MidiPlayer.java:9=
65)
        at
org.herac.tuxguitar.app.TuxGuitar.restorePlayerConfig(TuxGuitar.java:350)
        at org.herac.tuxguitar.app.TuxGuitar.startUIContext(TuxGuitar.java:=
148)
        at org.herac.tuxguitar.app.TuxGuitar.access$100(TuxGuitar.java:70)
        at org.herac.tuxguitar.app.TuxGuitar$1$1.run(TuxGuitar.java:129)
        at
org.herac.tuxguitar.app.synchronizer.TGSynchronizerControllerImpl$1$1.run(T=
GSynchronizerControllerImpl.java:29)
        at org.eclipse.swt.widgets.RunnableLock.run(RunnableLock.java:40)
        at
org.eclipse.swt.widgets.Synchronizer.runAsyncMessages(Synchronizer.java:185)
        at org.eclipse.swt.widgets.Display.runAsyncMessages(Display.java:49=
30)
        at org.eclipse.swt.widgets.Display.readAndDispatch(Display.java:445=
1)
        at
org.herac.tuxguitar.ui.swt.SWTApplication.start(SWTApplication.java:64)
        at
org.herac.tuxguitar.app.TuxGuitar.createUIContext(TuxGuitar.java:122)
        at
org.herac.tuxguitar.app.TuxGuitar.createApplication(TuxGuitar.java:103)
        at
org.herac.tuxguitar.app.TGMainSingleton.launchTuxGuitar(TGMainSingleton.jav=
a:57)
        at
org.herac.tuxguitar.app.TGMainSingleton.launchSingleton(TGMainSingleton.jav=
a:45)
        at
org.herac.tuxguitar.app.TGMainSingleton.main(TGMainSingleton.java:35)
Caused by: java.io.FileNotFoundException:
/home/eric/share/soundfont/MagicSFver2.sf2 (Datei oder Verzeichnis nicht
gefunden)
        at java.base/java.io.FileInputStream.open0(Native Method)
        at java.base/java.io.FileInputStream.open(FileInputStream.java:213)
        at java.base/java.io.FileInputStream.<init>(FileInputStream.java:15=
2)
        at media.sound.DLSSoundbank.<init>(DLSSoundbank.java:200)
        at
media.sound.DLSSoundbankReader.getSoundbank(DLSSoundbankReader.java:69)
        at
java.desktop/javax.sound.midi.MidiSystem.getSoundbank(MidiSystem.java:533)
        at
org.herac.tuxguitar.player.impl.jsa.midiport.MidiPortSynthesizer.loadSoundb=
ank(MidiPortSynthesizer.java:99)
        ... 20 more
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17401328300.0aDe0aA7E.15068
Date: Fri, 21 Feb 2025 10:13:50 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237464

          Summary
          Java:packages/tuxguitar: Bug

          Classification
          openSUSE

          Product
          openSUSE.org

          Version
          unspecified

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          3rd party software

          Assignee
          fstrba@suse.com

          Reporter
          ecsos@schirra.net

          QA Contact
          screening-team-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Your patches not really work:
Pleas fix it.

org.herac.tuxguitar.player.base.MidiPlayerException: Kann Soundbank-Datei n=
icht
=C3=B6ffnen.
        at
org.herac.tuxguitar.player.impl.jsa.midiport.MidiPortSynthesizer.loadSoundb=
ank(MidiPortSynthesizer.java:101)
        at
org.herac.tuxguitar.player.impl.jsa.midiport.MidiPortSynthesizer.getSynth(M=
idiPortSynthesizer.java:78)
        at
org.herac.tuxguitar.player.impl.jsa.midiport.MidiPortSynthesizer.open(MidiP=
ortSynthesizer.java:48)
        at
org.herac.tuxguitar.player.base.MidiPlayer.loadOutputPort(MidiPlayer.java:9=
38)
        at
org.herac.tuxguitar.player.base.MidiPlayer.openOutputPort(MidiPlayer.java:9=
80)
        at
org.herac.tuxguitar.player.base.MidiPlayer.openOutputPort(MidiPlayer.java:9=
65)
        at
org.herac.tuxguitar.app.TuxGuitar.restorePlayerConfig(TuxGuitar.java:350)
        at org.herac.tuxguitar.app.TuxGuitar.startUIContext(TuxGuitar.java:=
148)
        at org.herac.tuxguitar.app.TuxGuitar.access$100(TuxGuitar.java:70)
        at org.herac.tuxguitar.app.TuxGuitar$1$1.run(TuxGuitar.java:129)
        at
org.herac.tuxguitar.app.synchronizer.TGSynchronizerControllerImpl$1$1.run(T=
GSynchronizerControllerImpl.java:29)
        at org.eclipse.swt.widgets.RunnableLock.run(RunnableLock.java:40)
        at
org.eclipse.swt.widgets.Synchronizer.runAsyncMessages(Synchronizer.java:185)
        at org.eclipse.swt.widgets.Display.runAsyncMessages(Display.java:49=
30)
        at org.eclipse.swt.widgets.Display.readAndDispatch(Display.java:445=
1)
        at
org.herac.tuxguitar.ui.swt.SWTApplication.start(SWTApplication.java:64)
        at
org.herac.tuxguitar.app.TuxGuitar.createUIContext(TuxGuitar.java:122)
        at
org.herac.tuxguitar.app.TuxGuitar.createApplication(TuxGuitar.java:103)
        at
org.herac.tuxguitar.app.TGMainSingleton.launchTuxGuitar(TGMainSingleton.jav=
a:57)
        at
org.herac.tuxguitar.app.TGMainSingleton.launchSingleton(TGMainSingleton.jav=
a:45)
        at
org.herac.tuxguitar.app.TGMainSingleton.main(TGMainSingleton.java:35)
Caused by: java.io.FileNotFoundException:
/home/eric/share/soundfont/MagicSFver2.sf2 (Datei oder Verzeichnis nicht
gefunden)
        at java.base/java.io.FileInputStream.open0(Native Method)
        at java.base/java.io.FileInputStream.open(FileInputStream.java:213)
        at java.base/java.io.FileInputStream.<init>(FileInputStream.j=
ava:152)
        at media.sound.DLSSoundbank.<init>(DLSSoundbank.java:200)
        at
media.sound.DLSSoundbankReader.getSoundbank(DLSSoundbankReader.java:69)
        at
java.desktop/javax.sound.midi.MidiSystem.getSoundbank(MidiSystem.java:533)
        at
org.herac.tuxguitar.player.impl.jsa.midiport.MidiPortSynthesizer.loadSoundb=
ank(MidiPortSynthesizer.java:99)
        ... 20 more

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17401328300.0aDe0aA7E.15068--

summary: Java:packages/tuxguitar: Bug


--17401551790.dd9b8ca1f.16147
Date: Fri, 21 Feb 2025 16:26:19 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237497

            Bug ID: 1237497
           Summary: kdump makes dumped dmesg and vmcore world-readable
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: jbohac-at-suse.com
          Reporter: jbohac-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

File permissions of the dmesg and vmcore files produced by kdump are rwxr--=
r--.
Since dmesg and vmcore may contain sensitive data, the permissions should be
more restrictive.=20

Fixed in this commit:
https://github.com/openSUSE/kdump/commit/a02becb16f93ee995bea2285d9ee649a83=
ca4851
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17401551790.dd9b8ca1f.16147
Date: Fri, 21 Feb 2025 16:26:19 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237497

          Summary
          kdump makes dumped dmesg and vmcore world-readable

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel

          Assignee
          jbohac@suse.com

          Reporter
          jbohac@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

File permissions of the dmesg and vmcore files produced by k=
dump are rwxr--r--.
Since dmesg and vmcore may contain sensitive data, the permissions should be
more restrictive.=20

Fixed in this commit:
https://github.com/openSUSE/kdump/commit/a02becb16f93ee9=
95bea2285d9ee649a83ca4851

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17401551790.dd9b8ca1f.16147--


--17403129632.956CCCA76.16974
Date: Sun, 23 Feb 2025 12:16:03 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237511

            Bug ID: 1237511
           Summary: [SELinux] avc denied entries for sulogin and findmnt
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: simonsan-at-systemli.org
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Operating System: openSUSE Tumbleweed
SELinux status, mode and policy name:

```console
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33
```

SELinux policy version and repository:

```console
nformation for package selinux-policy:
---------------------------------------
Repository     : Main Repository (OSS)
Name           : selinux-policy
Version        : 20250218-1.1
Arch           : noarch
Vendor         : openSUSE
Installed Size : 24.9 KiB
Installed      : Yes (automatically)
Status         : up-to-date
Source package : selinux-policy-20250218-1.1.src
Upstream URL   : https://github.com/fedora-selinux/selinux-policy.git
Summary        : SELinux policy configuration
Description    :=20
    A complete SELinux policy that can be used as the system policy for a
variety
    of systems and used as the basis for creating other policies.
```

The software (incl. version) that is affected by the SELinux issue and the
error message:

```console
sulogin from util-linux 2.40.4 (features: emergency-mount)
findmnt from util-linux 2.40.4
```

SELinux Audit log:

```console
=E2=9D=AF sudo ausearch -ts today -m avc
----
time->Sun Feb 23 12:33:47 2025
type=3DAVC msg=3Daudit(1740310427.207:326): apparmor=3D"DENIED" operation=
=3D"open"
class=3D"file" info=3D"Failed name lookup - disconnected path" error=3D-13
profile=3D"plasmashell" name=3D".flatpak-info" pid=3D3676 comm=3D"plasmashe=
ll"
requested_mask=3D"r" denied_mask=3D"r" fsuid=3D1000 ouid=3D1000
----
time->Sun Feb 23 13:03:19 2025
type=3DAVC msg=3Daudit(1740312199.546:7): avc:  denied  { compute_relabel }=
 for=20
pid=3D3401 comm=3D"sulogin" scontext=3Dsystem_u:system_r:sulogin_t:s0-s0:c0=
.c1023
tcontext=3Dsystem_u:object_r:security_t:s0 tclass=3Dsecurity permissive=3D1
----
time->Sun Feb 23 13:04:02 2025
type=3DAVC msg=3Daudit(1740312242.351:8): avc:  denied  { setexec } for  pi=
d=3D3402
comm=3D"sulogin" scontext=3Dsystem_u:system_r:sulogin_t:s0-s0:c0.c1023
tcontext=3Dsystem_u:system_r:sulogin_t:s0-s0:c0.c1023 tclass=3Dprocess perm=
issive=3D1
----
time->Sun Feb 23 13:04:06 2025
type=3DAVC msg=3Daudit(1740312246.532:9): avc:  denied  { dac_read_search }=
 for=20
pid=3D3453 comm=3D"findmnt" capability=3D2=20
scontext=3Dsystem_u:system_r:selinux_autorelabel_generator_t:s0
tcontext=3Dsystem_u:system_r:selinux_autorelabel_generator_t:s0 tclass=3Dca=
pability
permissive=3D1

~ took 4s=20
```

Any other important details:

I was following this guide step-by-step for switching to selinux
https://en.opensuse.org/Portal:SELinux/Setup

This report was initiated by the reminder in step 9.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17403129632.956CCCA76.16974
Date: Sun, 23 Feb 2025 12:16:03 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237511

          Summary
          [SELinux] avc denied entries for sulogin and findmnt

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          simonsan@systemli.org

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Operating System: openSUSE Tumbleweed
SELinux status, mode and policy name:

```console
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33
```

SELinux policy version and repository:

```console
nformation for package selinux-policy:
---------------------------------------
Repository     : Main Repository (OSS)
Name           : selinux-policy
Version        : 20250218-1.1
Arch           : noarch
Vendor         : openSUSE
Installed Size : 24.9 KiB
Installed      : Yes (automatically)
Status         : up-to-date
Source package : selinux-policy-20250218-1.1.src
Upstream URL   : <a href=3D"https://github.com/fedora-selinux/selinux-polic=
y.git">https://github.com/fedora-selinux/selinux-policy.git</a>
Summary        : SELinux policy configuration
Description    :=20
    A complete SELinux policy that can be used as the system policy for a
variety
    of systems and used as the basis for creating other policies.
```

The software (incl. version) that is affected by the SELinux issue and the
error message:

```console
sulogin from util-linux 2.40.4 (features: emergency-mount)
findmnt from util-linux 2.40.4
```

SELinux Audit log:

```console
=E2=9D=AF sudo ausearch -ts today -m avc
----
time->Sun Feb 23 12:33:47 2025
type=3DAVC msg=3Daudit(1740310427.207:326): apparmor=3D"DENIED" o=
peration=3D"open"
class=3D"file" info=3D"Failed name lookup - disconnected pat=
h" error=3D-13
profile=3D"plasmashell" name=3D".flatpak-info" pid=3D36=
76 comm=3D"plasmashell"
requested_mask=3D"r" denied_mask=3D"r" fsuid=3D1000 oui=
d=3D1000
----
time->Sun Feb 23 13:03:19 2025
type=3DAVC msg=3Daudit(1740312199.546:7): avc:  denied  { compute_relabel }=
 for=20
pid=3D3401 comm=3D"sulogin" scontext=3Dsystem_u:system_r:sulogin_=
t:s0-s0:c0.c1023
tcontext=3Dsystem_u:object_r:security_t:s0 tclass=3Dsecurity permissive=3D1
----
time->Sun Feb 23 13:04:02 2025
type=3DAVC msg=3Daudit(1740312242.351:8): avc:  denied  { setexec } for  pi=
d=3D3402
comm=3D"sulogin" scontext=3Dsystem_u:system_r:sulogin_t:s0-s0:c0.=
c1023
tcontext=3Dsystem_u:system_r:sulogin_t:s0-s0:c0.c1023 tclass=3Dprocess perm=
issive=3D1
----
time->Sun Feb 23 13:04:06 2025
type=3DAVC msg=3Daudit(1740312246.532:9): avc:  denied  { dac_read_search }=
 for=20
pid=3D3453 comm=3D"findmnt" capability=3D2=20
scontext=3Dsystem_u:system_r:selinux_autorelabel_generator_t:s0
tcontext=3Dsystem_u:system_r:selinux_autorelabel_generator_t:s0 tclass=3Dca=
pability
permissive=3D1

~ took 4s=20
```

Any other important details:

I was following this guide step-by-step for switching to selinux
https://en.opensus=
e.org/Portal:SELinux/Setup

This report was initiated by the reminder in step 9.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17403129632.956CCCA76.16974--


--17403154610.CebE42cf2.16980
Date: Sun, 23 Feb 2025 12:57:41 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237513

            Bug ID: 1237513
           Summary: [SELinux] sshd not allowed to write to wtmpdb socket
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: opensuse-at-bitsbetwixt.com
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Operating System: openSUSE Tumbleweed
SELinux status, mode and policy name: enabled
SELinux policy version and repository: 20250218-1.1 openSUSE-Tumbleweed-Oss
The software (incl. version) that is affected by the SELinux issue and the
error message: sshd
SELinux Audit log:
type=3DAVC msg=3Daudit(1740314246.157:96): avc:  denied  { create } for  pi=
d=3D1257
comm=3D"sshd-session" name=3D"wtmpdb"
scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023
tcontext=3Dsystem_u:object_r:var_lib_t:s0 tclass=3Ddir permissive=3D0

The selinux violation shows up after setting up a new
openSUSE-Tumbleweed-Minimal-VM.x86_64-kvm-and-xen-sdboot vm.
Does tumbleweed need the same fix as
https://bugzilla.opensuse.org/show_bug.cgi?id=3D1235660?
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17403154610.CebE42cf2.16980
Date: Sun, 23 Feb 2025 12:57:41 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237513

          Summary
          [SELinux] sshd not allowed to write to wtmpdb socket

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          opensuse@bitsbetwixt.com

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Operating System: openSUSE Tumbleweed
SELinux status, mode and policy name: enabled
SELinux policy version and repository: 20250218-1.1 openSUSE-Tumbleweed-Oss
The software (incl. version) that is affected by the SELinux issue and the
error message: sshd
SELinux Audit log:
type=3DAVC msg=3Daudit(1740314246.157:96): avc:  denied  { create } for  pi=
d=3D1257
comm=3D"sshd-session" name=3D"wtmpdb"
scontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023
tcontext=3Dsystem_u:object_r:var_lib_t:s0 tclass=3Ddir permissive=3D0

The selinux violation shows up after setting up a new
openSUSE-Tumbleweed-Minimal-VM.x86_64-kvm-and-xen-sdboot vm.
Does tumbleweed need the same fix as
https:/=
/bugzilla.opensuse.org/show_bug.cgi?id=3D1235660?

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17403154610.CebE42cf2.16980--


--17403172541.12Fd.16992
Date: Sun, 23 Feb 2025 13:27:34 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237515

            Bug ID: 1237515
           Summary: [SELinux] systemd-resolved fails to start due to write access to tmpfs denied
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: opensuse-at-bitsbetwixt.com
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Operating System: openSUSE Tumbleweed
SELinux status, mode and policy name: enabled
SELinux policy version and repository: 20250218-1.1 openSUSE-Tumbleweed-Oss
The software (incl. version) that is affected by the SELinux issue and the
error message: systemd-network-257.3-2.1.x86_64 (openSUSE-Tumbleweed-Oss)
Feb 22 14:43:16 podzilla systemd[1]: Starting Network Name Resolution...
Feb 22 14:43:16 podzilla (resolved)[732]: Failed to create destination mount
point node '/run/systemd/mount-rootfs/var/tmp', ignoring:>
Feb 22 14:43:16 podzilla (resolved)[732]: Failed to mount
/run/systemd/unit-private-tmp/var-tmp to /run/systemd/mount-rootfs/var/tmp:=
 >

SELinux Audit log:
type=3DAVC msg=3Daudit(1740316682.472:3339): avc:  denied  { write } for  p=
id=3D1009
comm=3D"systemd-network" path=3D2F6D656D66643A646174612D6664202864656C65746=
56429
dev=3D"tmpfs" ino=3D2128 scontext=3Dsystem_u:system_r:systemd_networkd_t:s0
tcontext=3Dsystem_u:object_r:tmpfs_t:s0 tclass=3Dfile permissive=3D0

Any other important details:
On a new openSUSE-Tumbleweed-Minimal-VM.x86_64-kvm-and-xen-sdboot vm run:

systemctl stop NetworkManager
systemctl disable NetworkManager

zypper install systemd-network

tee /etc/systemd/network/10-wired.network <<EOF
[Match]
Name=3Denp1s0

[Network]
IPv6AcceptRA=3Dtrue
IPv6PrivacyExtensions=3Dkernel
Address=3Dfdeb:5f97:2939::2/64
Gateway=3Dfdeb:5f97:2939::1
Domains=3Dsearch.domain
DNS=3Dfdeb:5f97:2939::1
EOF

tee /etc/systemd/network/10-wired.link <<EOF
[Match]
Name=3Denp1s0

[Link]
MACVLAN=3Dnone
EOF

systemctl enable systemd-networkd
systemctl enable systemd-resolved

reboot
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17403172541.12Fd.16992
Date: Sun, 23 Feb 2025 13:27:34 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237515

          Summary
          [SELinux] systemd-resolved fails to start due to write access=
 to tmpfs denied

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          opensuse@bitsbetwixt.com

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Operating System: openSUSE Tumbleweed
SELinux status, mode and policy name: enabled
SELinux policy version and repository: 20250218-1.1 openSUSE-Tumbleweed-Oss
The software (incl. version) that is affected by the SELinux issue and the
error message: systemd-network-257.3-2.1.x86_64 (openSUSE-Tumbleweed-Oss)
Feb 22 14:43:16 podzilla systemd[1]: Starting Network Name Resolution...
Feb 22 14:43:16 podzilla (resolved)[732]: Failed to create destination mount
point node '/run/systemd/mount-rootfs/var/tmp', ignoring:>
Feb 22 14:43:16 podzilla (resolved)[732]: Failed to mount
/run/systemd/unit-private-tmp/var-tmp to /run/systemd/mount-rootfs/var/tmp:=
 >

SELinux Audit log:
type=3DAVC msg=3Daudit(1740316682.472:3339): avc:  denied  { write } for  p=
id=3D1009
comm=3D"systemd-network" path=3D2F6D656D66643A646174612D666420286=
4656C6574656429
dev=3D"tmpfs" ino=3D2128 scontext=3Dsystem_u:system_r:systemd_net=
workd_t:s0
tcontext=3Dsystem_u:object_r:tmpfs_t:s0 tclass=3Dfile permissive=3D0

Any other important details:
On a new openSUSE-Tumbleweed-Minimal-VM.x86_64-kvm-and-xen-sdboot vm run:

systemctl stop NetworkManager
systemctl disable NetworkManager

zypper install systemd-network

tee /etc/systemd/network/10-wired.network <<EOF
[Match]
Name=3Denp1s0

[Network]
IPv6AcceptRA=3Dtrue
IPv6PrivacyExtensions=3Dkernel
Address=3Dfdeb:5f97:2939::2/64
Gateway=3Dfdeb:5f97:2939::1
Domains=3Dsearch.domain
DNS=3Dfdeb:5f97:2939::1
EOF

tee /etc/systemd/network/10-wired.link <<EOF
[Match]
Name=3Denp1s0

[Link]
MACVLAN=3Dnone
EOF

systemctl enable systemd-networkd
systemctl enable systemd-resolved

reboot

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17403172541.12Fd.16992--


body:
--17403499643.E2072c8.17093
Date: Sun, 23 Feb 2025 22:32:44 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237517

            Bug ID: 1237517
           Summary: selinux: stop with the bashisms
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jengelh-at-inai.de
        QA Contact: qa-bugs-at-suse.de
                CC: dimstar-at-opensuse.org
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Version: 20250221
Status: repeatable

Ensure dash-sh package is installed. Then run:

# zypper in -f selinux-policy-minimum
The following package is going to be reinstalled:
  selinux-policy-minimum
...
Continue? [y/n/v/...? shows all options] (y):=20
Retrieving: selinux-policy-minimum-20250221-1.1.noarch (base)
                                                            (1/1),   6.8 Mi=
B=20=20=20=20
Retrieving: selinux-policy-minimum-20250221-1.1.noarch.rpm ..[done (11.2
MiB/s)]
Verifying
................................................................[done]
Preparing
................................................................[done]
/var/tmp/rpm-tmp.38o7UG: 1: /etc/selinux/config: SELINUX: not found
/var/tmp/rpm-tmp.38o7UG: 13: [:
ffa4e73a5c25a62b1c51acde31489ce46893e071012ae5dcff80932ae2589b1a57955186d7c=
f9008d55656cb834a0979db4a3992bf3e0fc455b36d6c9ef59a52:
unexpected operator
(0/1) Executing prein script for:
selinux-policy-minimum-20250221-1.1.noar[done]
(1/1) Installing: selinux-policy-minimum-20250221-1.1.noarch
.............[done]
(1/1) Executing postin script for:
selinux-policy-minimum-20250221-1.1.noarch[|]

With bash-sh installed, there's still residue:

Preparing
................................................................[done]
/etc/selinux/config: line 1: SELINUX: command not found
(0/1) Executing prein script for:
selinux-policy-minimum-20250221-1.1.noar[done]

$ cat /etc/selinux/config
SELINUX =3D disabled
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17403499643.E2072c8.17093
Date: Sun, 23 Feb 2025 22:32:44 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237517

          Summary
          selinux: stop with the bashisms

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          jengelh@inai.de

          QA Contact
          qa-bugs@suse.de

          CC
          dimstar@opensuse.org

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Version: 20250221
Status: repeatable

Ensure dash-sh package is installed. Then run:

# zypper in -f selinux-policy-minimum
The following package is going to be reinstalled:
  selinux-policy-minimum
...
Continue? [y/n/v/...? shows all options] (y):=20
Retrieving: selinux-policy-minimum-20250221-1.1.noarch (base)
                                                            (1/1),   6.8 Mi=
B=20=20=20=20
Retrieving: selinux-policy-minimum-20250221-1.1.noarch.rpm ..[done (11.2
MiB/s)]
Verifying
................................................................[done]
Preparing
................................................................[done]
/var/tmp/rpm-tmp.38o7UG: 1: /etc/selinux/config: SELINUX: not found
/var/tmp/rpm-tmp.38o7UG: 13: [:
ffa4e73a5c25a62b1c51acde31489ce46893e071012ae5dcff80932ae2589b1a57955186d7c=
f9008d55656cb834a0979db4a3992bf3e0fc455b36d6c9ef59a52:
unexpected operator
(0/1) Executing prein script for:
selinux-policy-minimum-20250221-1.1.noar[done]
(1/1) Installing: selinux-policy-minimum-20250221-1.1.noarch
.............[done]
(1/1) Executing postin script for:
selinux-policy-minimum-20250221-1.1.noarch[|]

With bash-sh installed, there's still residue:

Preparing
................................................................[done]
/etc/selinux/config: line 1: SELINUX: command not found
(0/1) Executing prein script for:
selinux-policy-minimum-20250221-1.1.noar[done]

$ cat /etc/selinux/config
SELINUX =3D disabled

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17403499643.E2072c8.17093--

summary: selinux: stop with the bashisms


body:
--17403531552.eD309Dcb.17114
Date: Sun, 23 Feb 2025 23:25:55 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237518

            Bug ID: 1237518
           Summary: Update Emacs to 30.1
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: bjorn.bidar-at-thaodan.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Emacs 30.1 has ben released today.=20

I have document most of the patches where they have been replaced by newer
upstream patches, the reason why they have been added if not or what should=
 be
upstream.=20
Where the patches didn't contain attribution I added it.

Some patches where already included in my branch for Emacs master before or
where included in Emacs 29.1

Patch that need documentation which don't contain a commit message such as:
- emacs-24.1-ps-mule.patch
- emacs-24.3-asian-print.patch
- emacs-24.4-glibc.patch
- emacs-24.4-flyspell.patch
  - Is this patch still required?
    The workaround does seem a little strange since all it does is that
    it circumvents the code path when there's no separator set in message-m=
ode
- emacs-29.4-boo1234673.patch Is this still needed after compat-30 has been
added to the emacs-compat package?

Patches I checked which previously featured no attribution and/or commit
message:
- emacs-25.1-custom-fonts.patch
- emacs-26.1-xft4x11.patch Upstream?

Patches which should be upstream:
- emacs-27.1-Xauthority4server.patch the changes to emacs.service
  Only the changes to the Emacs user service should be needed now
  that it only starts as late inside the graphical-session.target.
  Personally I am only using the changes to emacs.service in my personal se=
tup
  without any of the issues mentioned.

Patch which have been made redundant by other patches or have been merged:
- macs-25.2-ImageMagick7.patch Replaced by upstream ref
5729486951e6a60db55ea17ee3bac9baf8b54f6a in Emacs 27.1
- CVE-2025-1244.patch The patch has been merged

The other patches I rebased now or skipped since they have been merged to E=
macs
30.
Some patches where already included in my branch for Emacs master before or
where included in Emacs 29.1

The branch with those patches can be found here:
https://codeberg.org/Thaodan/emacs/src/branch/thaodan/emacs-30/opensuse_pat=
ches
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17403531552.eD309Dcb.17114
Date: Sun, 23 Feb 2025 23:25:55 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237518

          Summary
          Update Emacs to 30.1

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          bjorn.bidar@thaodan.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Emacs 30.1 has ben released today.=20

I have document most of the patches where they have been replaced by newer
upstream patches, the reason why they have been added if not or what should=
 be
upstream.=20
Where the patches didn't contain attribution I added it.

Some patches where already included in my branch for Emacs master before or
where included in Emacs 29.1

Patch that need documentation which don't contain a commit message such as:
- emacs-24.1-ps-mule.patch
- emacs-24.3-asian-print.patch
- emacs-24.4-glibc.patch
- emacs-24.4-flyspell.patch
  - Is this patch still required?
    The workaround does seem a little strange since all it does is that
    it circumvents the code path when there's no separator set in message-m=
ode
- emacs-29.4-boo1234673.patch Is this still needed after compat-30 has been
added to the emacs-compat package?

Patches I checked which previously featured no attribution and/or commit
message:
- emacs-25.1-custom-fonts.patch
- emacs-26.1-xft4x11.patch Upstream?

Patches which should be upstream:
- emacs-27.1-Xauthority4server.patch the changes to emacs.service
  Only the changes to the Emacs user service should be needed now
  that it only starts as late inside the graphical-session.target.
  Personally I am only using the changes to emacs.service in my personal se=
tup
  without any of the issues mentioned.

Patch which have been made redundant by other patches or have been merged:
- macs-25.2-ImageMagick7.patch Replaced by upstream ref
5729486951e6a60db55ea17ee3bac9baf8b54f6a in Emacs 27.1
- CVE-2025-1244.patch The patch has been merged

The other patches I rebased now or skipped since they have been merged to E=
macs
30.
Some patches where already included in my branch for Emacs master before or
where included in Emacs 29.1

The branch with those patches can be found here:
https://codeberg.org/Thaodan/emacs/src/branch/thaodan/emac=
s-30/opensuse_patches

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17403531552.eD309Dcb.17114--

summary: Update Emacs to 30.1


--17404410460.De8EA8a14.23743
Date: Mon, 24 Feb 2025 23:50:46 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237585

            Bug ID: 1237585
           Summary: Update nvidia driver to > 570.86.16 release
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 3rd Party Driver
          Assignee: gfx-bugs-at-suse.de
          Reporter: sndirsch-at-suse.com
        QA Contact: sndirsch-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Update nvidia driver to > 570.86.16 release
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17404410460.De8EA8a14.23743
Date: Mon, 24 Feb 2025 23:50:46 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237585

          Summary
          Update nvidia driver to > 570.86.16 release

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          X11 3rd Party Driver

          Assignee
          gfx-bugs@suse.de

          Reporter
          sndirsch@suse.com

          QA Contact
          sndirsch@suse.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Update nvidia driver to > 570.86.16 release

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17404410460.De8EA8a14.23743--


--17404722150.4de5.25798
Date: Tue, 25 Feb 2025 08:30:15 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237596

            Bug ID: 1237596
           Summary: [SELinux] apache2 runs as unconfined_service_t
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Operating System: tw + slfo
systemctl start apache2

ps auxZ | grep uncon
system_u:system_r:unconfined_service_t:s0 root 21666 0.0  0.5 15864 10700 ?=
=20=20=20=20
 Ss   09:24   0:00 /usr/sbin/httpd-prefork -DSYSCONFIG -C PidFile
/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Incl=
ude
/etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include
/etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start
system_u:system_r:unconfined_service_t:s0 wwwrun 21679 0.0  0.2 16260 5624 =
?=20=20=20
 S    09:24   0:00 /usr/sbin/httpd-prefork -DSYSCONFIG -C PidFile
/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Incl=
ude
/etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include
/etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start
system_u:system_r:unconfined_service_t:s0 wwwrun 21680 0.0  0.2 16260 5624 =
?=20=20=20
 S    09:24   0:00 /usr/sbin/httpd-prefork -DSYSCONFIG -C PidFile
/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Incl=
ude
/etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include
/etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start
system_u:system_r:unconfined_service_t:s0 wwwrun 21681 0.0  0.2 16260 5624 =
?=20=20=20
 S    09:24   0:00 /usr/sbin/httpd-prefork -DSYSCONFIG -C PidFile
/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Incl=
ude
/etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include
/etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start
system_u:system_r:unconfined_service_t:s0 wwwrun 21682 0.0  0.2 16260 5624 =
?=20=20=20
 S    09:24   0:00 /usr/sbin/httpd-prefork -DSYSCONFIG -C PidFile
/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Incl=
ude
/etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include
/etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start
system_u:system_r:unconfined_service_t:s0 wwwrun 21683 0.0  0.2 16260 5624 =
?=20=20=20
 S    09:24   0:00 /usr/sbin/httpd-prefork -DSYSCONFIG -C PidFile
/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Incl=
ude
/etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include
/etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17404722150.4de5.25798
Date: Tue, 25 Feb 2025 08:30:15 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237596

          Summary
          [SELinux] apache2 runs as unconfined_service_t

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          cathy.hu@suse.com

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Operating System: tw + slfo
systemctl start apache2

ps auxZ | grep uncon
system_u:system_r:unconfined_service_t:s0 root 21666 0.0  0.5 15864 10700 ?=
=20=20=20=20
 Ss   09:24   0:00 /usr/sbin/httpd-prefork -DSYSCONFIG -C PidFile
/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Incl=
ude
/etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include
/etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start
system_u:system_r:unconfined_service_t:s0 wwwrun 21679 0.0  0.2 16260 5624 =
?=20=20=20
 S    09:24   0:00 /usr/sbin/httpd-prefork -DSYSCONFIG -C PidFile
/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Incl=
ude
/etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include
/etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start
system_u:system_r:unconfined_service_t:s0 wwwrun 21680 0.0  0.2 16260 5624 =
?=20=20=20
 S    09:24   0:00 /usr/sbin/httpd-prefork -DSYSCONFIG -C PidFile
/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Incl=
ude
/etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include
/etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start
system_u:system_r:unconfined_service_t:s0 wwwrun 21681 0.0  0.2 16260 5624 =
?=20=20=20
 S    09:24   0:00 /usr/sbin/httpd-prefork -DSYSCONFIG -C PidFile
/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Incl=
ude
/etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include
/etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start
system_u:system_r:unconfined_service_t:s0 wwwrun 21682 0.0  0.2 16260 5624 =
?=20=20=20
 S    09:24   0:00 /usr/sbin/httpd-prefork -DSYSCONFIG -C PidFile
/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Incl=
ude
/etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include
/etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start
system_u:system_r:unconfined_service_t:s0 wwwrun 21683 0.0  0.2 16260 5624 =
?=20=20=20
 S    09:24   0:00 /usr/sbin/httpd-prefork -DSYSCONFIG -C PidFile
/run/httpd.pid -C Include /etc/apache2/sysconfig.d//loadmodule.conf -C Incl=
ude
/etc/apache2/sysconfig.d//global.conf -f /etc/apache2/httpd.conf -c Include
/etc/apache2/sysconfig.d//include.conf -DSYSTEMD -DFOREGROUND -k start

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17404722150.4de5.25798--


--17404754540.CbdC0aa.26053
Date: Tue, 25 Feb 2025 09:24:14 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237603

            Bug ID: 1237603
           Summary: [glibc2.41] qemu:qemu-linux-user fails to build
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

openSUSE Factory is in progress of updating glibc to version 2.41

While staging this, it was identified that qemu:qemu-linux-user fails to bu=
ild:

https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:=
O/qemu:qemu-linux-user/standard/x86_64

[  158s] ../linux-user/syscall.c:362:8: error: redefinition of =E2=80=98str=
uct
sched_attr=E2=80=99
[  158s]   362 | struct sched_attr {
[  158s]       |        ^~~~~~~~~~
[  158s] In file included from /usr/include/bits/sched.h:63,
[  158s]                  from /usr/include/sched.h:43,
[  158s]                  from /usr/include/pthread.h:22,
[  158s]                  from
/usr/include/glib-2.0/glib/deprecated/gthread.h:126,
[  158s]                  from /usr/include/glib-2.0/glib.h:115,
[  158s]                  from
/home/abuild/rpmbuild/BUILD/qemu-linux-user-9.2.1-build/qemu-9.2.1/include/=
glib-compat.h:32,
[  158s]                  from
/home/abuild/rpmbuild/BUILD/qemu-linux-user-9.2.1-build/qemu-9.2.1/include/=
qemu/osdep.h:161,
[  158s]                  from ../linux-user/syscall.c:20:
[  158s] /usr/include/linux/sched/types.h:98:8: note: originally defined he=
re
[  158s]    98 | struct sched_attr {
[  158s]       |        ^~~~~~~~~~
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17404754540.CbdC0aa.26053
Date: Tue, 25 Feb 2025 09:24:14 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237603

          Summary
          [glibc2.41] qemu:qemu-linux-user fails to build

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

openSUSE Factory is in progress of updating glibc to version=
 2.41

While staging this, it was identified that qemu:qemu-linux-user fails to bu=
ild:

https://build.opensuse.o=
rg/package/live_build_log/openSUSE:Factory:Staging:O/qemu:qemu-linux-user/s=
tandard/x86_64

[  158s] ../linux-user/syscall.c:362:8: error: redefinition of =E2=80=98str=
uct
sched_attr=E2=80=99
[  158s]   362 | struct sched_attr {
[  158s]       |        ^~~~~~~~~~
[  158s] In file included from /usr/include/bits/sched.h:63,
[  158s]                  from /usr/include/sched.h:43,
[  158s]                  from /usr/include/pthread.h:22,
[  158s]                  from
/usr/include/glib-2.0/glib/deprecated/gthread.h:126,
[  158s]                  from /usr/include/glib-2.0/glib.h:115,
[  158s]                  from
/home/abuild/rpmbuild/BUILD/qemu-linux-user-9.2.1-build/qemu-9.2.1/include/=
glib-compat.h:32,
[  158s]                  from
/home/abuild/rpmbuild/BUILD/qemu-linux-user-9.2.1-build/qemu-9.2.1/include/=
qemu/osdep.h:161,
[  158s]                  from ../linux-user/syscall.c:20:
[  158s] /usr/include/linux/sched/types.h:98:8: note: originally defined he=
re
[  158s]    98 | struct sched_attr {
[  158s]       |        ^~~~~~~~~~

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17404754540.CbdC0aa.26053--


--17404809517.c5fdbF.26269
Date: Tue, 25 Feb 2025 10:55:51 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237618

            Bug ID: 1237618
           Summary: VUL-0: CVE-2025-27144: trivy: gopkg.in/go-jose/go-jose.v2: Go JOSE's Parsing Vulnerable to Denial of Service
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/441954/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-27144:7.5:(AV:N/AC:L/PR:N/UI:N/
                    S:U/C:N/I:N/A:H)
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: emanuele.cappello-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1237608
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Go JOSE provides an implementation of the Javascript Object Signing and
Encryption set of standards in Go, including support for JSON Web Encryption
(JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In
versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS=
 or
JWE input, Go JOSE could use excessive memory. The code used
strings.Split(token, ".") to split JWT tokens, which is vulnerable to exces=
sive
memory consumption when processing maliciously crafted tokens with a large
number of `.` characters.  An attacker could exploit this by sending numero=
us
malformed tokens, leading to memory exhaustion and a Denial of Service. Ver=
sion
4.0.5 fixes this issue. As a workaround, applications could pre-validate th=
at
payloads passed to Go JOSE do not contain an excessive number of `.`
characters.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-27144
https://www.cve.org/CVERecord?id=3DCVE-2025-27144
https://github.com/go-jose/go-jose/commit/99b346cec4e86d102284642c5dcbe9bb0=
cacfc22
https://github.com/go-jose/go-jose/releases/tag/v4.0.5
https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78
https://bugzilla.redhat.com/show_bug.cgi?id=3D2347423
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17404809517.c5fdbF.26269
Date: Tue, 25 Feb 2025 10:55:51 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237618

          Summary
          VUL-0: CVE-2025-27144: trivy: gopkg.in/go-jose/go-jose.v2: Go=
 JOSE's Parsing Vulnerable to Denial of Service

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          URL
          https://smash.suse.de/issue/441954/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-27144:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N=
/I:N/A:H)=20

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          dmueller@suse.com

          Reporter
          emanuele.cappello@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1237608

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Go JOSE provides an implementation of the Javascript Object =
Signing and
Encryption set of standards in Go, including support for JSON Web Encryption
(JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In
versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS=
 or
JWE input, Go JOSE could use excessive memory. The code used
strings.Split(token, ".") to split JWT tokens, which is vulnerabl=
e to excessive
memory consumption when processing maliciously crafted tokens with a large
number of `.` characters.  An attacker could exploit this by sending numero=
us
malformed tokens, leading to memory exhaustion and a Denial of Service. Ver=
sion
4.0.5 fixes this issue. As a workaround, applications could pre-validate th=
at
payloads passed to Go JOSE do not contain an excessive number of `.`
characters.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-27144
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-27144
https://github.com/go-jose/go-jose/commit/99b346cec4e86=
d102284642c5dcbe9bb0cacfc22
https://=
github.com/go-jose/go-jose/releases/tag/v4.0.5
https://github.com/go-jose/go-jose/security/advisories/GHSA-c6g=
w-w398-hv78
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2347423

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17404809517.c5fdbF.26269--


body:
--17405320801.932DD.29701
Date: Wed, 26 Feb 2025 01:08:00 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237699

            Bug ID: 1237699
           Summary: chromium 133.0.6943.141 release
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: screening-team-bugs-at-suse.de
          Reporter: ro-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-des=
ktop_25.html

no cve listed yet

This update includes 1 security fix. Please see the Chrome Security Page for
more information.

As usual, our ongoing internal security work was responsible for a wide ran=
ge
of fixes:

[399107077]Various fixes from internal audits, fuzzing and other initiatives
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17405320801.932DD.29701
Date: Wed, 26 Feb 2025 01:08:00 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237699

          Summary
          chromium 133.0.6943.141 release

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          X11 Applications

          Assignee
          screening-team-bugs@suse.de

          Reporter
          ro@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

https://chromereleases.googleblog.c=
om/2025/02/stable-channel-update-for-desktop_25.html

no cve listed yet

This update includes 1 security fix. Please see the Chrome Security Page for
more information.

As usual, our ongoing internal security work was responsible for a wide ran=
ge
of fixes:

[399107077]Various fixes from internal audits, fuzzing and other initiative=
s

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17405320801.932DD.29701--

summary: chromium 133.0.6943.141 release


--17405772021.3dCBEA6.31234
Date: Wed, 26 Feb 2025 13:40:02 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1237777

            Bug ID: 1237777
           Summary: [Build 20250225] display-manager service fails to launch gdm when /usr/bin/X is not present
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4885820/modules/inst
                    allation/steps/14
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: gfx-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: gfx-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

This bug showed up as a side effect of some pattern cleanup (i.e pattern
imaging no longer pulling in pattern X11 - as there can be wayland-only
desktops)

Whenever X is not installed no, xdm fails to start a gdm session - even tho=
ugh
X is not really needed for that (Xwayland would be needed in this case)

the display-manager script though exits with code 6 when /usr/bin/X is not
found

openQA test in scenario opensuse-Tumbleweed-NET-x86_64-autoyast_gnome@64bit
fails in
[installation](https://openqa.opensuse.org/tests/4885820/modules/installati=
on/steps/14)

## Test suite description
Maintainer: QE Yast

Testing autoyast installation with given profile and expect SLES with gnome.
Please, see the profile for more details. Profile is available in distri git
repo under data subdirectory. Same as autoyast_gnome but with product defin=
ed
in the profile.

## Reproducible

Fails since (at least) Build
[20250225](https://openqa.opensuse.org/tests/4883653)

## Expected result

Last good: [20250224](https://openqa.opensuse.org/tests/4881189) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DNET&machine=3D64bit&test=3Dautoyast_gnome&version=3DTumblew=
eed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17405772021.3dCBEA6.31234
Date: Wed, 26 Feb 2025 13:40:02 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1237777

          Summary
          [Build 20250225] display-manager service fails to launch gdm =
when /usr/bin/X is not present

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4885820/modules/installatio=
n/steps/14

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          X.Org

          Assignee
          gfx-bugs@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          gfx-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

This bug showed up as a side effect of some pattern cleanup (i.e pattern
imaging no longer pulling in pattern X11 - as there can be wayland-only
desktops)

Whenever X is not installed no, xdm fails to start a gdm session - even tho=
ugh
X is not really needed for that (Xwayland would be needed in this case)

the display-manager script though exits with code 6 when /usr/bin/X is not
found

openQA test in scenario opensuse-Tumbleweed-NET-x86_64-autoyast_gnome@6=
4bit
fails in
[installation](https://openqa.opensuse.org/tests/4885820/modules/i=
nstallation/steps/14)

## Test suite description
Maintainer: QE Yast

Testing autoyast installation with given profile and expect SLES with gnome.
Please, see the profile for more details. Profile is available in distri git
repo under data subdirectory. Same as autoyast_gnome but with product defin=
ed
in the profile.

## Reproducible

Fails since (at least) Build
[20250225](https://op=
enqa.opensuse.org/tests/4883653)

## Expected result

Last good: [20250224](https://openqa.opensuse.org/tests/4881189) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/lates=
t?arch=3Dx86_64&distri=3Dopensuse&flavor=3DNET&machine=3D64bit&=
amp;test=3Dautoyast_gnome&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17405772021.3dCBEA6.31234--


--17407149493.AFE81D.19305
Date: Fri, 28 Feb 2025 03:55:49 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1238059

            Bug ID: 1238059
           Summary: VUL-0: CVE-2025-27154: python-spotipy: The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/443148/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: python-maintainers-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: stoyan.manolov-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Spotipy is a lightweight Python library for the Spotify Web API. The
`CacheHandler` class creates a cache file to store the auth token. Prior to
version 2.25.1, the file created has `rw-r--r--` (644) permissions by defau=
lt,
when it could be locked down to `rw-------` (600) permissions. This leads to
overly broad exposure of the spotify auth token. If this token can be read =
by
an attacker (another user on the machine, or a process running as another
user), it can be used to perform administrative actions on the Spotify acco=
unt,
depending on the scope granted to the token. Version 2.25.1 tightens the ca=
che
file permissions.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-27154
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/27xxx/CVE-2025=
-27154.json
https://www.cve.org/CVERecord?id=3DCVE-2025-27154
https://github.com/spotipy-dev/spotipy/blob/master/spotipy/cache_handler.py=
#L93-L98
https://github.com/spotipy-dev/spotipy/commit/1ca453f6ef87a2a9e9876f52b6cb3=
8d13532ccf2
https://github.com/spotipy-dev/spotipy/releases/tag/2.25.1
https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-pwhh-q4h6-w=
599
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17407149493.AFE81D.19305
Date: Fri, 28 Feb 2025 03:55:49 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          <a class=3D"bz_bug_link=20
          bz_status_NEW "
   title=3D"NEW - VUL-0: CVE-2025-27154: python-spotipy: The `CacheHandler`=
 class creates a cache file to store the auth token. Prior to version 2.25.=
1, the file created has `rw-r--r--` (644) permissions by default"
   href=3D"https://bugzilla.suse.com/show_bug.cgi?id=3D1238059">1238059

          Summary
          VUL-0: CVE-2025-27154: python-spotipy: The `CacheHandler` cla=
ss creates a cache file to store the auth token. Prior to version 2.25.1, t=
he file created has `rw-r--r--` (644) permissions by default

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/443148/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          python-maintainers@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          stoyan.manolov@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Spotipy is a lightweight Python library for the Spotify Web =
API. The
`CacheHandler` class creates a cache file to store the auth token. Prior to
version 2.25.1, the file created has `rw-r--r--` (644) permissions by defau=
lt,
when it could be locked down to `rw-------` (600) permissions. This leads to
overly broad exposure of the spotify auth token. If this token can be read =
by
an attacker (another user on the machine, or a process running as another
user), it can be used to perform administrative actions on the Spotify acco=
unt,
depending on the scope granted to the token. Version 2.25.1 tightens the ca=
che
file permissions.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-27154
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/27xxx/CVE-2025-27154.json
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-27154
https://github.com/spotipy-dev/spotipy/blob/master/spo=
tipy/cache_handler.py#L93-L98
https://github.com/spotipy-dev/spotipy/commit/1ca45=
3f6ef87a2a9e9876f52b6cb38d13532ccf2
http=
s://github.com/spotipy-dev/spotipy/releases/tag/2.25.1
https://github.com/spotipy-dev/spotipy/security/advisories/=
GHSA-pwhh-q4h6-w599

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17407149493.AFE81D.19305--


--17407194190.D5bfd6.19377
Date: Fri, 28 Feb 2025 05:10:19 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1238062

            Bug ID: 1238062
           Summary: [SELinux] setsebool selinuxuser_execmod 1 fails to commit changes
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: Other
                OS: SUSE Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: colin-at-gauvin.id
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

[SELinux]

On openSUSE Kalpa

colin@boreas:~> sudo setsebool -P selinuxuser_execmod 1
[sudo] password for root:=20
libsepol.context_from_record: type wtmpdbd_var_run_t is not defined
libsepol.context_from_record: could not create context structure
libsepol.context_from_string: could not create context structure
libsepol.sepol_context_to_sid: could not convert
system_u:object_r:wtmpdbd_var_run_t:s0 to sid
invalid context system_u:object_r:wtmpdbd_var_run_t:s0
Failed to commit changes to booleans: Success

openSUSE MicroOS 20250225
KDE Plasma Version 6.3.1
KDE Frameworks Version 6.11.0
Qt Version 6.8.2
Kernel Version 6.13.4-default(64 bit)
Graphics Platform: Wayland
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17407194190.D5bfd6.19377
Date: Fri, 28 Feb 2025 05:10:19 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1238062

          Summary
          [SELinux] setsebool selinuxuser_execmod 1 fails to commit cha=
nges

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          Other

          OS
          SUSE Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          colin@gauvin.id

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

[SELinux]

On openSUSE Kalpa

colin@boreas:~> sudo setsebool -P selinuxuser_execmod 1
[sudo] password for root:=20
libsepol.context_from_record: type wtmpdbd_var_run_t is not defined
libsepol.context_from_record: could not create context structure
libsepol.context_from_string: could not create context structure
libsepol.sepol_context_to_sid: could not convert
system_u:object_r:wtmpdbd_var_run_t:s0 to sid
invalid context system_u:object_r:wtmpdbd_var_run_t:s0
Failed to commit changes to booleans: Success

openSUSE MicroOS 20250225
KDE Plasma Version 6.3.1
KDE Frameworks Version 6.11.0
Qt Version 6.8.2
Kernel Version 6.13.4-default(64 bit)
Graphics Platform: Wayland

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17407194190.D5bfd6.19377--


--17407325030.ebcf.19674
Date: Fri, 28 Feb 2025 08:48:22 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1238075

            Bug ID: 1238075
           Summary: VUL-0: CVE-2025-1744: radare2: heap-based buffer over-read or buffer overflow. This issue affects radare2: before <5.9.9.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/443265/
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Security
          Assignee: daniel-at-molkentin.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: stoyan.manolov-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Out-of-bounds Write vulnerability in radareorg radare2 allows=20

heap-based buffer over-read or buffer overflow.This issue affects radare2:
before <5.9.9.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-1744
https://www.cve.org/CVERecord?id=3DCVE-2025-1744
https://github.com/radareorg/radare2/pull/23969
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17407325030.ebcf.19674
Date: Fri, 28 Feb 2025 08:48:23 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1238075

          Summary
          VUL-0: CVE-2025-1744: radare2: heap-based buffer over-read or=
 buffer overflow. This issue affects radare2: before <5.9.9.

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/443265/

          OS
          Other

          Status
          NEW

          Severity
          Critical

          Priority
          P5 - None

          Component
          Security

          Assignee
          daniel@molkentin.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          stoyan.manolov@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Out-of-bounds Write vulnerability in radareorg radare2 allow=
s=20

heap-based buffer over-read or buffer overflow.This issue affects radare2:
before <5.9.9.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-1744
https://www.cv=
e.org/CVERecord?id=3DCVE-2025-1744
https://github.=
com/radareorg/radare2/pull/23969

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17407325030.ebcf.19674--


--17407468895.df0Fc2c.20424
Date: Fri, 28 Feb 2025 12:48:09 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1238136

            Bug ID: 1238136
           Summary: podman 520-checkpoint (criu) upstream test fails with SELinux
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: rbranco-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

This subtest is failing since SELinux is default on Tumbleweed:

https://github.com/containers/podman/blob/main/test/system/520-checkpoint.b=
ats

Logs:
https://openqa.opensuse.org/tests/4888785/file/podman_integration-bats-root=
-local.tap
https://openqa.opensuse.org/tests/4888785/file/podman_integration-bats-root=
-remote.tap

Audit log: https://openqa.opensuse.org/tests/4888785/logfile?filename=3Daud=
it.txt

Steps to reproduce:

1. Install bats

zypper in bats

2. Clone podman tests

git clone --depth 1 https://github.com/containers/podman
cd git/podman/test/system

3. Run test as root:

bats 520-checkpoint
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17407468895.df0Fc2c.20424
Date: Fri, 28 Feb 2025 12:48:09 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1238136

          Summary
          podman 520-checkpoint (criu) upstream test fails with SELinux

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Containers

          Assignee
          containers-bugowner@suse.de

          Reporter
          rbranco@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

This subtest is failing since SELinux is default on Tumblewe=
ed:

https://github.com/containers/podman/blob/main/test/system/=
520-checkpoint.bats

Logs:
https://openqa.opensuse.org/tests/4888785/file/podma=
n_integration-bats-root-local.tap
https://openqa.opensuse.org/tests/4888785/file/podm=
an_integration-bats-root-remote.tap

Audit log: https://openqa.opensuse.org/tests/4888785/logfile?filena=
me=3Daudit.txt

Steps to reproduce:

1. Install bats

zypper in bats

2. Clone podman tests

git clone --depth 1 https:=
//github.com/containers/podman
cd git/podman/test/system

3. Run test as root:

bats 520-checkpoint

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17407468895.df0Fc2c.20424--


--17407470395.c0BC.20427
Date: Fri, 28 Feb 2025 12:50:39 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1238137

            Bug ID: 1238137
           Summary: [SELinux] Login denied when using kmsconvt@.service
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: jslaby-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

When using kmscon on a VT using the systemd service kmsconvt@tty1, login fa=
ils
with


--17407743001.EB1E7ad2.21398
Date: Fri, 28 Feb 2025 20:25:00 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1238191

            Bug ID: 1238191
           Summary: [SELinux] AVC denials for /usr/sbin/sshd-gen-keys-start after switching to SELinux
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: arvidjaar-at-gmail.com
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

I switched one of Tumbleweed VM to SELinux following
https://en.opensuse.org/Portal:SELinux/Setup. After the first reboot in
permissive mode I got several denials. Per the above article, here is bug
report.

Operating System: openSUSE Tumbleweed

SELinux status, mode and policy name:
uefi:~ # sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33
uefi:~ #=20

SELinux policy version and repository:
uefi:~ # zypper info selinux-policy
Loading repository data...
Reading installed packages...

Information for package selinux-policy:
---------------------------------------
Repository     : openSUSE-20191030-0 (20250225)
Name           : selinux-policy
Version        : 20250224-1.1
Arch           : noarch
Vendor         : openSUSE
Installed Size : 24.9 KiB
Installed      : Yes (automatically)
Status         : up-to-date
Source package : selinux-policy-20250224-1.1.src
Upstream URL   : https://github.com/fedora-selinux/selinux-policy.git
Summary        : SELinux policy configuration
Description    :=20
    A complete SELinux policy that can be used as the system policy for a
variety
    of systems and used as the basis for creating other policies.

uefi:~ #

The software (incl. version) that is affected by the SELinux issue and the
error message:=20
None particular. Just checked AVC denials after switching to SELinux=20

SELinux Audit log:
uefi:~ # ausearch -m avc,user_avc,selinux_err,user_selinux_err -ts boot
----
time->Fri Feb 28 23:18:21 2025
type=3DAVC msg=3Daudit(1740773901.579:149): avc:  denied  { ioctl } for  pi=
d=3D1936
comm=3D"sshd-gen-keys-s" path=3D"socket:[13240]" dev=3D"sockfs" ino=3D13240
ioctlcmd=3D0x5401 scontext=3Dsystem_u:system_r:sshd_keygen_t:s0
tcontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=3Dvsock_socket
permissive=3D1
----
time->Fri Feb 28 23:18:21 2025
type=3DAVC msg=3Daudit(1740773901.581:150): avc:  denied  { getattr } for  =
pid=3D1936
comm=3D"sshd-gen-keys-s" path=3D"socket:[13240]" dev=3D"sockfs" ino=3D13240
scontext=3Dsystem_u:system_r:sshd_keygen_t:s0
tcontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=3Dvsock_socket
permissive=3D1
uefi:~ #

Any other important details: This is after I manually run

/usr/sbin/fixfiles restore

because "touch /.autorelabel" as instructed by wiki did not work due to
https://bugzilla.opensuse.org/show_bug.cgi?id=3D1238190

Before fixfiles there were more denials mostly due to the wrong contexts.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17407743001.EB1E7ad2.21398
Date: Fri, 28 Feb 2025 20:25:00 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1238191

          Summary
          [SELinux] AVC denials for /usr/sbin/sshd-gen-keys-start after=
 switching to SELinux

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          arvidjaar@gmail.com

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

I switched one of Tumbleweed VM to SELinux following
https://en.opensus=
e.org/Portal:SELinux/Setup. After the first reboot in
permissive mode I got several denials. Per the above article, here is bug
report.

Operating System: openSUSE Tumbleweed

SELinux status, mode and policy name:
uefi:~ # sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33
uefi:~ #=20

SELinux policy version and repository:
uefi:~ # zypper info selinux-policy
Loading repository data...
Reading installed packages...

Information for package selinux-policy:
---------------------------------------
Repository     : openSUSE-20191030-0 (20250225)
Name           : selinux-policy
Version        : 20250224-1.1
Arch           : noarch
Vendor         : openSUSE
Installed Size : 24.9 KiB
Installed      : Yes (automatically)
Status         : up-to-date
Source package : selinux-policy-20250224-1.1.src
Upstream URL   : https://github.com/fedora-selinux/selinux-policy.git
Summary        : SELinux policy configuration
Description    :=20
    A complete SELinux policy that can be used as the system policy for a
variety
    of systems and used as the basis for creating other policies.

uefi:~ #

The software (incl. version) that is affected by the SELinux issue and the
error message:=20
None particular. Just checked AVC denials after switching to SELinux=20

SELinux Audit log:
uefi:~ # ausearch -m avc,user_avc,selinux_err,user_selinux_err -ts boot
----
time->Fri Feb 28 23:18:21 2025
type=3DAVC msg=3Daudit(1740773901.579:149): avc:  denied  { ioctl } for  pi=
d=3D1936
comm=3D"sshd-gen-keys-s" path=3D"socket:[13240]" dev=3D=
"sockfs" ino=3D13240
ioctlcmd=3D0x5401 scontext=3Dsystem_u:system_r:sshd_keygen_t:s0
tcontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=3Dvsock_socket
permissive=3D1
----
time->Fri Feb 28 23:18:21 2025
type=3DAVC msg=3Daudit(1740773901.581:150): avc:  denied  { getattr } for  =
pid=3D1936
comm=3D"sshd-gen-keys-s" path=3D"socket:[13240]" dev=3D=
"sockfs" ino=3D13240
scontext=3Dsystem_u:system_r:sshd_keygen_t:s0
tcontext=3Dsystem_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=3Dvsock_socket
permissive=3D1
uefi:~ #

Any other important details: This is after I manually run

/usr/sbin/fixfiles restore

because "touch /.autorelabel" as instructed by wiki did not work =
due to
https:/=
/bugzilla.opensuse.org/show_bug.cgi?id=3D1238190

Before fixfiles there were more denials mostly due to the wrong contexts.</=
pre>

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17407743001.EB1E7ad2.21398--