gmane.linux.suse.opensuse.devel

Re: Roles for security and convenience

Guido Berhoerster — 2012-05-26T10:11:42

This is already the default.

Re: Roles for security and convenience

Guido Berhoerster — 2012-05-26T10:04:48

I'm pretty sure you can configure policykit to authorize e.g. local 
users to do all of the above without asking for a password.

Re: Roles for security and convenience

Guido Berhoerster — 2012-05-26T10:03:12

That's not correct, su currently logs to syslog when you switch to 
another user and shells such as ksh93 provide auditing and per-user 
accounting facilities. Furthermore with a role account you'd disallow 
direct login for role accounts and restrict role assumption to users 
which have explicit authorization to do so.

I'm not sure how RBAC with SELinux works but e.g. in Solaris you can 
assign "rights profiles" (which are an aggregation of related 
privileges) even directly to a user instead of a role account who can 
then invoke commands with elevated privileges without an additional 
password but still with full auditing.

Re: build 383 use wrong branding

Bruno Friedmann — 2012-05-26T09:17:15

I'm using in local kvm testing 
http://download.opensuse.org/factory/iso/openSUSE-NET-x86_64-Build0383-Media.iso

But when I check what openqa has as testing actually the branding is correct?

build 383 use wrong branding

Bruno Friedmann — 2012-05-26T09:12:26

The new 383 doesn't contain the new branding like previous build 381,382
Why ?

Re: Roles for security and convenience

Thomas Leineweber — 2012-05-26T08:16:39

Am 26.05.2012 01:24, schrieb Claudio Freire:

I would read it as follows:

If there is a dedicated account with it's own pwd for the administration
of a service, it is not possible to see, who did the administration
task. Nearly "everybody" could have logged in as the dedicated user,
because many persons know the pwd. That is in contrast to the
requirement, that you can find out who has done the administration
task.

Thomas

Adjust openqa scripts to process ok prompts

2012-05-26T08:01:35

Hello,
Adjust openqa scripts to process ok prompts.

Examples:
http://openqa.opensuse.org/viewimg/openqa/testresults/openSUSE-DVD-x86_64-Build0378-11.2dup/timeout-04.png
http://openqa.opensuse.org/viewimg/openqa/testresults/openSUSE-DVD-x86_64-Build0378-11.2dup/welcome-1.png

Sourced from:
http://openqa.opensuse.org/results/openSUSE-DVD-x86_64-Build0378-11.2dup
Thanls Glenn

Re: Roles for security and convenience

Stefan Seyfried — 2012-05-26T07:22:45

Am 25.05.2012 12:13, schrieb Johannes Meixner:



Not necessarily. They might need to enter their own password (sudo
like).
But for WIFI, even this might feel strange (somewhen in the past
I managed to change the polkit stuff in the KDE gui for it by clueless
clicking so that I am allowed to connect to WiFi networks now and so I
missed all the fun in 12.1. However, most of the time I can just connect
but one out of ten tries, some gnome-polkit-agent or such asks me a
password. Of course it does not tell me which password. On the second
try I then find out that it is my password it is asking for...).

Re: Latest Tumbleweed kernel update 3.3.6 to 3.4.0 breaks cifs-mounting my NAS

Greg KH — 2012-05-26T04:00:20

A newer kernel should not require a userspace tool upgrade, unless
something really went wrong.  Why is this needed?  What changed in the
kernel to require this?


I'll be glad to do so once we figure out why it is needed.

thanks,

greg k-h

Re: Boot failure with latest Live CD iso

Larry Finger — 2012-05-26T02:57:05

I does not have a number as it only lives on my system and I have no place to 
upload it; however, when a new one appears on the Factory list, it should be the 
same content as the one I built here.

Larry

Re: Boot failure with latest Live CD iso

Juan Erbes — 2012-05-26T00:18:22

2012/5/25 Larry Finger <Larry.Finger< at >lwfinger.net>:

MANY THANKS LARRY!

What number is the new build?

Regards,
                 Juan

RPM 4.10 release

Ilya Chernykh — 2012-05-25T23:35:36

RPM 4.10 release: will it get to 12.2?

Re: Latest Tumbleweed kernel update 3.3.6 to 3.4.0 breaks cifs-mounting my NAS

Lars Müller — 2012-05-25T23:28:30

Please try the more current cifs-utils version from the
network:samba:STABLE repository at
http://download.openSUSE.org/repositories/network:/samba:/STABLE/openSUSE_12.1/

If that helps we need to inform Greg to link this version into
Tumbleweed too.

If it doesn't Suresh needs to pull more upstream fixes.  We've added
several but not all.  The goal is to get 5.5 into 12.2.

I had a short conversation with Jeff <jlayton> and he plans to prepare
the 5.5 release over the weekend.

Your feedback if the current version from network:samba:STABLE works is
welcome nevertheless.

Cheers,

Lars

Re: Roles for security and convenience

Claudio Freire — 2012-05-25T23:24:39

What do you mean with that? I can only parse that sentence to mean all
users should have the same password, which seems quite unlikely to be
what you meant as that's nonsense.

Re: Roles for security and convenience

Hans Witvliet — 2012-05-25T23:16:05

<trimmed>

Indeed: don't try to do it all at once,
Just add the granularity bit-by-bit. 
At the moment it is all-or-nothing (root or mortal)

One candidate-role to start with is (using yast-terminology) "software"
if you are member of "software" you should be able to perform everything
related to it. Of course root is member of it, and if your system is
installed as beginner/enduser/simpleton/.. all new users will be part of
it.

Second role is "networking" for configuring any network device

Third for printing

Fourth for daemons/services (in general)

It that is accepted positively, you can add a finer level,
for instance with networking you can split it up in fixed/wifi/wlan
and within services split it up in dhcp/dns/ldap/...


Other approach might be to start with one (for instance "software") and
make that one fine-grained from the start:
individual roles for
-installing / uninstalling
-updating
-repo configuration

And the next time, a second group.
For instance "nfs", "samba", "iscsi"

If you impleme

Re: Roles for security and convenience

Hans Witvliet — 2012-05-25T23:07:49

That means that dedicated user-account, instead of groups.

And the idea was, that
a) if you are the single user & owner you don't want to be bothered with
the concept of other accounts and certainly not the root-pwd (Linus
variant)

b) in a large company specific roles are assigned to certain users,
Those users should only be troubled with their own pwd, and should never
have access to  neither root-pwd nor root-privileges.

Dedicated accounts with their own pwd are a nightmare for an
organisation.

The Live CD iso report

Larry Finger — 2012-05-25T21:18:25

Coolo,

I can now report that the Gnome Live CD also builds and boots.

Both KDE and Gnome both will boot from a USB stick written with imagewriter; 
however, both fail when booted using the iso with qemu-kvm. At the point of 
failure, /var/lob/kiwi.boot shows the following:

===========================================================================

+ echo /dev/ram1
+ return
+ ramOnly=1
+ '[' 1 = 1 ']'
++ cat /proc/meminfo
++ cut -f1 -dk
++ grep MemFree
++ cut -f2 -d:
+ haveKByte='          405108 '
++ expr 405108 / 1024
+ haveMByte=
++ expr '*' 7 / 10
expr: syntax error
+ haveMByte=
+ clic_cmd='clicfs -m '
+ '[' '!' -z '' ']'
+ '[' -z /livecd/openSUSE-12.1-livecd-gnome-read-only.x86_64-2.8.0 ']'
+ clicfs -m /livecd/openSUSE-12.1-livecd-gnome-read-only.x86_64-2.8.0 /read-only
can't read from packfile
: Is a directory
read_pack: Invalid argument
+ Echo 'Failed to mount clic filesystem'
+ '[' 0 = 0 ']'
+ set +x
+ echo '[    9.208387] Failed to mount clic filesystem'
+ '[' 0 = 0 ']'
+ set +x
+ return 1
+ retv

Build disabled for devel packages [Publishing]?

Kyrill Detinov — 2012-05-25T21:02:15

Hello.

I found that some my devel packages are disabled for Factory in 
Publishing project.

Who and why… ?

And I see more disabled in Publishing:
https://build.opensuse.org/project/monitor?arch_i586=1&defaults=0&disabled=1&project=Publishing&repo_openSUSE_Factory=1

Re: Speeding up SRs process to devel projects

Brian K. White — 2012-05-25T20:55:40

 >> [...]

Thanks for both the illumination and the bump. I appreciate it.

Boot failure with latest Live CD iso

Larry Finger — 2012-05-25T17:31:56

Coolo,

Good news.

After 'osc update' this morning, the KDE Live CD builds once again, *and* it 
boots. Thus far, I have run only limited tests, but they include connecting to a 
WPA2-TKIP(AES)-encrypted AP. Networking appears to be fine.

Are there any specific tests you would like me to run?

Larry

Latest Tumbleweed kernel update 3.3.6 to 3.4.0 breaks cifs-mounting my NAS

Daniel Bischof — 2012-05-25T12:34:18

Hi,

the latest Tumbleweed kernel update 3.3.6 to 3.4.0 breaks cifs-mounting my 
NAS (used to work flawlessly with 3.3.6 and before). Accessing the NAS 
with smbclient still works.

Bug?

/etc/fstab excerpt
---
//garcon/media /home/mediarw cifs nodfs,user,noauto,user=daniel,uid=daniel,gid=users,credentials=/home/daniel/.smbcredentials,iocharset=utf8,file_mode=0755,dir_mode=0755 0 0
---

verbose error messages in /var/log/messages
---
May 24 18:36:39 kernel: [ 5128.053888] /[...]/linux-3.4/fs/cifs/cifsfs.c: Devname: //garcon/Volume_1/ flags: 0 
May 24 18:36:39 kernel: [ 5128.053921] /[...]/linux-3.4/fs/cifs/connect.c: iocharset set to utf8
May 24 18:36:39 kernel: [ 5128.053940] /[...]/linux-3.4/fs/cifs/connect.c: Username: daniel
May 24 18:36:39 kernel: [ 5128.053944] /[...]/linux-3.4/fs/cifs/connect.c: file mode: 0x1ed  dir mode: 0x1ed
May 24 18:36:39 kernel: [ 5128.054003] /[...]/linux-3.4/fs/cifs/connect.c: CIFS VFS: in cifs_mount as Xid: 12 with uid: 0
May 24 18:36:39 kernel: [ 5128.054006] /[...]/linux-3