security [ARCHIVED]

security@lists.fedoraproject.org

840 discussions

End of the line for this mailing list
by Matthew Miller 11 Apr '24

11 Apr '24

Hi everyone! This list hasn't had meaningful activity in years. I'm going to ask for it to be archived. Active discussion is on Matrix at https://matrix.to/#/#security:fedoraproject.org and Fedora Discussion at https://discussion.fedoraproject.org/tag/security-sig

1 0

Failing Unicode check in perl-Prima
by Petr Pisar 07 Sep '23

07 Sep '23

Hello, I observer a Unicode check failure in fedora-ci.koji-build.rpminspect.static-analysis test on perl-Prima-1.70-1.fc40 package in Fedora CI <https://bodhi.fedoraproject.org/updates/FEDORA-2023-54d3e14b6e>: A forbidden code point, 0x202D, was found in the Prima-1.70/Prima/Drawable/Glyphs.pm source file on line 999 at column 3. This source file is used by perl-Prima.spec. Suggested remedy: The rpminspect configuration file contains a list of forbidden Unicode code points. One was found in the extracted and patched source tree or in one of the text source files in the source RPM. Either remove this code point or discuss the situation with the Product Security Team to determine the correct course of action. This is an excerpt from the Glyphs.pm file: 995 =for latex-makedoc cut 996 997 use Prima; 998 $::application-> begin_paint; 999 $::application-> text_shape_out('אפס123', 0,0); 1000 1001 123ספא 1002 1003 =for latex-makedoc cut As you can see it's a text from a documentation in POD format. The documentation is interleaved with a Perl code. I classify the test finding a false positive because Fedora rpminspect policy excludes documentation files. Though rpminspect cannot split a documentation from a code in a single file. I tried to disable the unicode check with a local rpminspect.yaml file, but rpminspect insists on security checks not to be overrided be pacakge: $ rpminspect -c /usr/share/rpminspect/fedora.yaml -T unicode perl-Prima-1.70-1.fc40.src.rpm rpminspect: *** ignoring 'unicode' section in /tmp/rpminspect.yaml; only allowed in system-wide configuration My questions: Do you agree it's a false positve? Can you sanction ammending Fedora rpminspct policy with: unicode: ignore: # 0x202D character used on purpose to demonstrate RLE in # a documentation. - Prima-*/Prima/Drawable/Glyphs.pm -- Petr

4 5

I'm starting up the security meetings again
by JT 12 May '22

12 May '22

All, I'm sending this email to announce that I'm going to start up the weekly Security Meetings in the IRC/Matrix channel. About two months ago I sent in an email to this mailing list and haven't heard any response and there hasn't been any meetings during that period. That's ok. It's an open source project and I know people get busy and priorities change from time to time. I spoke with Matthew Miller and Ben Cotton about stepping up and doing what I can to get the team going again or at the least give it some sign of life until prior members or new members are able to dedicate time to it. Here's my plan. Currently the wiki states that the security meetings are on Thursday at 15 UTC in #fedora-meeting. To avoid conflicts with other meetings I'm going to hold it at the same time, but within the #fedora-security channel until I can figure out a better time that won't conflict with other meetings and will also be time convenient for those in the US and Europe. I may end up changing the time to immediately follow the PgM meetings on Wednesday since I'm around for those as well. But initially it'll be the same time and date as its currently documented but in the security channel: #fedora-security:matrix.org My plan is to be a point of contact for the community and projects to report security issues and who have security questions. I'll be getting with the infrastructure guys to get zodbot to join the channel, but in the meantime I'll be taking notes anytime something comes up and saving it. I will be creating a gitlab repo this week, where all meeting logs and notes can be kept as well as being a place where people can create tickets for issues for us to track. When I spoke with Ben he agreed that Gitlab would be a better location than using the wiki since we need a place to store files and track tickets. Since Fedora mostly consumes upstream projects most of the active security work will be upstream in the respective projects, but there's still work to be done at the Fedora level. Of which I see four primary areas: A) Monitoring things that are reported to the team. B) Reporting and working upstream on any reports/issues that come in C) Managing Community questions about security issues D) Shepherding of long term project with security impacts An example of the last of those would be the systemd service security hardening which came up on the devel mailing list that I have previously spoken with Matthew about shepherding. I'm happy to have assistance from anyone who has time or interest in pitching in. JT

4 5

How to detect users who violate the rules of the code of conduct?
by Ricardo Pinto 14 Mar '22

14 Mar '22

Hi! I'm just an end user of Fedora since Workstation version 21 and I don't feel able to contribute directly but it's the Platform I most identify with. I've tried using Debian, Ubuntu but none beat Fedora for me. It appears that due to my lack of knowledge, my use is being compromised and I would like to ask if there would be the possibility of someone helping me to establish a safe condition of use. Without further ado, I would like to thank you in advance for your special attention and, as far as possible, I will be very happy to hear back from you. Regards, Ricardo. Rio Grande do Sul, Brasil

2 1

How to detect users who violate the rules of the code of conduct?
by Ricardo Pinto 11 Mar '22

11 Mar '22

2 1

Wanted to join the Security Team Apprenticeship program.
by JT 11 Mar '22

11 Mar '22

I'm JT, I've gone by q5sys for decades now at this point, and that's also my FAS ID. I'm a long time Linux user, was a Puppylinux dev for a while, jumped the fence to FreeBSD for a while and was a part of the PC-BSD and TrueOS Teams. I've still got a foot in both worlds, but I'm finally after all these years getting more involved in Fedora. I'm currently the maintainer for Fedora Jam, since it was a good fit from all my years of Linux and OpenSource Podcast production. Been doing that since 2013, and have done production for the Linux Action Show, Linux Unplugged, and How to Linux. Currently the producer of: BSD Now, The Ask Noah Show, The Opinion Dominion, and Open Source Voices. I've done security consulting quite a bit in my career. But I've been out of it for a while (2015) but recently I've been getting more and more security related work at my dayjob (iXsystems), so its time to get back to the grindstone.. I'm on the FPgM team and I'm going to be taking on the task of trying to push for sane defaults for systemd service hardening and feel that I'd be well served by starting to integrate into the Security Team for advice on guidance on that work. https://pagure.io/fedora-pgm/pgm_team/issue/32 Fingerprint: F900 C2DD 20FD 37E0 2459 5A09 3DA8 2972 7A62 09F9 JT

1 0

Autoreply: "security Digest, Vol 112, Issue 1"
by ennio＠rimote.nl 09 Feb '22

09 Feb '22

Beste lezer / Dear reader, Dit e-mailadres gebruik ik tegenwoordig niet meer. Graag voortaan alle e-mail correspondentie richten naar ask(a)enn.io. This e-mailadres is currently no longer in use by me. Please direct all e-mail correspondence to ask(a)enn.io. Met vriendelijke groet / with kind regards, Ennio Wolsink E: ask(a)enn.io W: enn.io T: +31 6 300 24 509

1 0

lsetxattr failed, SELINUX_ERR op=setxattr invalid_context
by Chris Murphy 08 Feb '22

08 Feb '22

Hi, I'm running Fedora 35, and I'm trying to replicate a Fedora 36 root snapshot from one Btrfs file system to another, but it fails. This is what I see on CLI (with verbose logging) set_xattr etc/NetworkManager/dispatcher.d - name=security.selinux data_len=56 data=system_u:object_r:NetworkManager_dispatcher_script_t:s0 ERROR: lsetxattr etc/NetworkManager/dispatcher.d security.selinux=system_u:object_r:NetworkManager_dispatcher_script_t:s0 failed: Invalid argument This is the AVC error: [25325.074972] audit[23509]: AVC avc: denied { mac_admin } for pid=23509 comm="btrfs" capability=33 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=capability2 permissive=0 [25325.075188] audit: SELINUX_ERR op=setxattr invalid_context="system_u:object_r:NetworkManager_dispatcher_script_t:s0" I think what's going on is, Fedora 35's SELinux is preventing `btrfs receive` from setting a label it doesn't know. If so, is this definitely the correct behavior? Or is there something `btrfs receive` could do to allow setting this unfamiliar label anyway? I filed a btrfs-progs bug, feel free to answer there (or here) https://github.com/kdave/btrfs-progs/issues/447 Thanks, -- Chris Murphy

1 1

Autoreply: "security Digest, Vol 110, Issue 1"
by ennio＠rimote.nl 31 Dec '21

31 Dec '21

1 0

zhiquan@vulab.com
by 闫志全 30 Dec '21

30 Dec '21

zhiquan(a)vulab.com

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

security [ARCHIVED]