Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package rpmlint for openSUSE:Factory checked in at 2026-07-28 17:48:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rpmlint (Old) and /work/SRC/openSUSE:Factory/.rpmlint.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rpmlint" Tue Jul 28 17:48:46 2026 rev:544 rq:1367095 version:2.9.0+git20260722.276b8fa5 Changes: -------- --- /work/SRC/openSUSE:Factory/rpmlint/rpmlint.changes 2026-07-18 22:24:16.060623161 +0200 +++ /work/SRC/openSUSE:Factory/.rpmlint.new.2004/rpmlint.changes 2026-07-28 17:48:50.829459258 +0200 @@ -1,0 +2,13 @@ +Wed Jul 22 08:44:39 UTC 2026 - Wolfgang Frisch <[email protected]> + +- Update to version 2.9.0+git20260722.276b8fa5: + * scoring-strict: raise badness for permissions-missing-postin + * SUIDPermissionsCheck: enforce whitelistings for capabilities (bsc#1268674) + +------------------------------------------------------------------- +Tue Jul 21 08:43:55 UTC 2026 - Wolfgang Frisch <[email protected]> + +- Update to version 2.9.0+git20260721.7a1b1a93: + * dbus-services: update keepalived (bsc#1271920) + +------------------------------------------------------------------- Old: ---- rpmlint-2.9.0+git20260715.7b097339.tar.xz New: ---- rpmlint-2.9.0+git20260722.276b8fa5.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rpmlint.spec ++++++ --- /var/tmp/diff_new_pack.tOkp80/_old 2026-07-28 17:48:52.405514368 +0200 +++ /var/tmp/diff_new_pack.tOkp80/_new 2026-07-28 17:48:52.405514368 +0200 @@ -23,7 +23,7 @@ %define name_suffix -%{flavor} %endif Name: rpmlint%{name_suffix} -Version: 2.9.0+git20260715.7b097339 +Version: 2.9.0+git20260722.276b8fa5 Release: 0 Summary: RPM file correctness checker License: GPL-2.0-or-later ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.tOkp80/_old 2026-07-28 17:48:52.505517865 +0200 +++ /var/tmp/diff_new_pack.tOkp80/_new 2026-07-28 17:48:52.513518144 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/rpm-software-management/rpmlint.git</param> - <param name="changesrevision">7b097339a5c2584f8259e7a0cd5cb5766310c557</param></service></servicedata> + <param name="changesrevision">276b8fa56741bbb25da850d8626590da91f3ce1b</param></service></servicedata> (No newline at EOF) ++++++ rpmlint-2.9.0+git20260715.7b097339.tar.xz -> rpmlint-2.9.0+git20260722.276b8fa5.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-2.9.0+git20260715.7b097339/configs/openSUSE/dbus-services.toml new/rpmlint-2.9.0+git20260722.276b8fa5/configs/openSUSE/dbus-services.toml --- old/rpmlint-2.9.0+git20260715.7b097339/configs/openSUSE/dbus-services.toml 2026-07-15 12:50:14.000000000 +0200 +++ new/rpmlint-2.9.0+git20260722.276b8fa5/configs/openSUSE/dbus-services.toml 2026-07-22 10:43:50.000000000 +0200 @@ -1137,11 +1137,11 @@ package = "keepalived" type = "dbus" note = "imported from rpmlint1 DBUSServices.WhiteList" -bug = "bsc#1015141" +bugs = ["bsc#1015141", "bsc#1271920"] [[FileDigestGroup.digests]] path = "/etc/dbus-1/system.d/org.keepalived.Vrrp1.conf" digester = "xml" -hash = "d6c62de9278ac8890166387e17e96cc6d950f2f9c2c9e5ca80859e1fb3f087ea" +hash = "2107e6e68c82493fd16d68ea3ff89efa2d215cd6ae3f68fc45cff59eee689b6a" [[FileDigestGroup]] package = "bolt" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-2.9.0+git20260715.7b097339/configs/openSUSE/scoring-strict.override.toml new/rpmlint-2.9.0+git20260722.276b8fa5/configs/openSUSE/scoring-strict.override.toml --- old/rpmlint-2.9.0+git20260715.7b097339/configs/openSUSE/scoring-strict.override.toml 2026-07-15 12:50:14.000000000 +0200 +++ new/rpmlint-2.9.0+git20260722.276b8fa5/configs/openSUSE/scoring-strict.override.toml 2026-07-22 10:43:50.000000000 +0200 @@ -21,9 +21,8 @@ permissions-file-unauthorized = 10000 permissions-file-setuid-bit = 10000 permissions-file-symlink = 10000 -# this one is problematic, because e.g. /etc/cron.* is packaged by multiple -# packages and only one should be responsible for caring about %postin -permissions-missing-postin = 100 +permissions-fscaps = 10000 +permissions-missing-postin = 10000 permissions-parse-error = 10000 polkit-file-digest-mismatch = 10000 polkit-file-ghost = 10000 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-2.9.0+git20260715.7b097339/configs/openSUSE/scoring.toml new/rpmlint-2.9.0+git20260722.276b8fa5/configs/openSUSE/scoring.toml --- old/rpmlint-2.9.0+git20260715.7b097339/configs/openSUSE/scoring.toml 2026-07-15 12:50:14.000000000 +0200 +++ new/rpmlint-2.9.0+git20260722.276b8fa5/configs/openSUSE/scoring.toml 2026-07-22 10:43:50.000000000 +0200 @@ -69,6 +69,7 @@ permissions-file-unauthorized = 10 permissions-file-setuid-bit = 10 permissions-file-symlink = 10 +permissions-fscaps = 10 permissions-parse-error = 10 pam-unauthorized-module = 10 world-writable-unauthorized-file = 10 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-2.9.0+git20260715.7b097339/rpmlint/checks/SUIDPermissionsCheck.py new/rpmlint-2.9.0+git20260722.276b8fa5/rpmlint/checks/SUIDPermissionsCheck.py --- old/rpmlint-2.9.0+git20260715.7b097339/rpmlint/checks/SUIDPermissionsCheck.py 2026-07-15 12:50:14.000000000 +0200 +++ new/rpmlint-2.9.0+git20260722.276b8fa5/rpmlint/checks/SUIDPermissionsCheck.py 2026-07-22 10:43:50.000000000 +0200 @@ -35,30 +35,46 @@ parser = PermissionsParser(self.var_handler, path) self.perms.update(parser.entries) - def _complain_restricted_mode(self, pkg, path, mode): - msg = f'{path} is packaged with setuid/setgid bits (0{stat.S_IMODE(mode):o})' - diag = 'permissions-directory-setuid-bit' if stat.S_ISDIR(mode) else 'permissions-file-setuid-bit' - self.output.add_info('E', pkg, diag, msg) + def _complain_restricted_privs(self, pkg, path, pkgfile): + if stat.S_ISDIR(pkgfile.mode): + diag = 'permissions-directory-setuid-bit' + else: + diag = 'permissions-file-setuid-bit' + + if pkgfile.filecaps: + msg = f'{path} is packaged with capabilities ({pkgfile.filecaps})' + self.output.add_info('E', pkg, diag, msg) + if self._is_suid(pkgfile.mode): + msg = f'{path} is packaged with setuid/setgid bits (0{stat.S_IMODE(pkgfile.mode):o})' + self.output.add_info('E', pkg, diag, msg) - def _verify_entry(self, entry, pkg, path, rpm_mode, rpm_owner): + def _verify_entry(self, entry, pkg, path, pkgfile): """Complains about disagreements between the package metadata and the permissions profile settings. We also require the RPM permissions to match the reference permissions profile (secure).""" is_listed_as_dir = entry.path.endswith('/') - is_packaged_as_dir = stat.S_ISDIR(rpm_mode) + is_packaged_as_dir = stat.S_ISDIR(pkgfile.mode) if is_packaged_as_dir and not is_listed_as_dir: self.output.add_info('W', pkg, 'permissions-dir-without-slash', path) elif is_listed_as_dir and not is_packaged_as_dir: self.output.add_info('W', pkg, 'permissions-file-as-dir', f'{path} is a file but listed as directory') - entry_owner = ':'.join((entry.owner, entry.group)) + if stat.S_IMODE(pkgfile.mode) != entry.mode: + self.output.add_info('E', pkg, 'permissions-incorrect', f'{path} has mode 0{stat.S_IMODE(pkgfile.mode):o} but should be 0{entry.mode:o}') + # it would be too much complexity with little gain to compare the + # capabilities found in RPM metadata against the capabilities + # configured in the permissions profile(s). Thus simply reject + # packaged capabilities outright, they should only be managed by + # `permctl`, not by `rpm`. + if pkgfile.filecaps: + self.output.add_info('E', pkg, 'permissions-fscaps', f'{path} has capabilities "{pkgfile.filecaps}". Capabilities should only be managed by the permissions package.') - if stat.S_IMODE(rpm_mode) != entry.mode: - self.output.add_info('E', pkg, 'permissions-incorrect', f'{path} has mode 0{stat.S_IMODE(rpm_mode):o} but should be 0{entry.mode:o}') + entry_owner = ':'.join((entry.owner, entry.group)) + pkg_owner = ':'.join((pkgfile.user, pkgfile.group)) - if rpm_owner != entry_owner: - self.output.add_info('E', pkg, 'permissions-incorrect-owner', f'{path} belongs to {rpm_owner} but should be {entry_owner}') + if pkg_owner != entry_owner: + self.output.add_info('E', pkg, 'permissions-incorrect-owner', f'{path} belongs to {pkg_owner} but should be {entry_owner}') def _check_post_scriptlets(self, pkg, path): """Checks whether a call to "permctl -n {path}" is found in %post and @@ -108,6 +124,9 @@ return False + def _is_suid(self, mode): + return (mode & (stat.S_ISUID | stat.S_ISGID)) != 0 + def check(self, pkg): if pkg.is_source: return @@ -158,13 +177,9 @@ # is that that we don't see warnings for privileges added by # other mechanisms that are described in these %ghost files continue - if pkgfile.filecaps: - # capabilities are only assigned via permctl, should not be - # packaged directly - self.output.add_info('E', pkg, 'permissions-fscaps', f"{f} has fscaps '{pkgfile.filecaps}'") mode = pkgfile.mode - owner = pkgfile.user + ':' + pkgfile.group + is_link = stat.S_ISLNK(mode) # whether we need to check for invocation of permctl in %post or # %verifyscript for this path check_scriptlets = False @@ -172,19 +187,20 @@ skip_file = False for entry in self.perms.get(f, []): if entry.matches_pkg(pkg.name): - if stat.S_ISLNK(mode): + if is_link: self.output.add_info('W', pkg, 'permissions-symlink', f) skip_file = True break check_scriptlets = True - self._verify_entry(entry, pkg, f, mode, owner) + self._verify_entry(entry, pkg, f, pkgfile) break else: + grants_privileges = pkgfile.filecaps or self._is_suid(pkgfile.mode) # no matching entry found; this means there is no whitelisting for any privileged bits. - if not stat.S_ISLNK(mode) and (mode & (stat.S_ISUID | stat.S_ISGID)): + if not is_link and grants_privileges: check_scriptlets = True - self._complain_restricted_mode(pkg, f, mode) + self._complain_restricted_privs(pkg, f, pkgfile) if skip_file: # is a symlink we warned about diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-2.9.0+git20260715.7b097339/rpmlint/descriptions/SUIDPermissionsCheck.toml new/rpmlint-2.9.0+git20260722.276b8fa5/rpmlint/descriptions/SUIDPermissionsCheck.toml --- old/rpmlint-2.9.0+git20260715.7b097339/rpmlint/descriptions/SUIDPermissionsCheck.toml 2026-07-15 12:50:14.000000000 +0200 +++ new/rpmlint-2.9.0+git20260722.276b8fa5/rpmlint/descriptions/SUIDPermissionsCheck.toml 2026-07-22 10:43:50.000000000 +0200 @@ -8,17 +8,17 @@ the entry in the permissions file refers to a directory but the package actually contains a file. Please contact [email protected] to remove the slash. Please refer to #AUDIT_BUG_URL# for more information. """ permissions-incorrect=""" -please use the %attr macro to set the correct permissions. +please use the %attr/%caps macro to set the correct permissions. """ permissions-incorrect-owner=""" please use the %attr macro to set the correct ownership. """ -permissions-file-setuid-bit="""Packaging setuid/setgid binaries requires a +permissions-file-setuid-bit="""Packaging binaries with setuid/setgid bits or capabilities set requires a review and whitelisting by the SUSE security team. #REVIEW_NEEDED_TEXT#""" permissions-directory-setuid-bit="""#REVIEW_NEEDED_TEXT#""" -permissions-fscaps=""" -Packaging file capabilities is currently not supported. Please use normal permissions instead. You may contact the security team to request an entry that sets capabilities in /usr/share/permissions/permissions instead. -""" +permissions-fscaps="""Packaging files with capabilities is not allowed. The +permissions package manages capabilities via the %set_permissions macro +during %post. Please remove the capabilities from the file.""" permissions-missing-postin=""" Please add an appropriate %post section """ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-2.9.0+git20260715.7b097339/test/test_suid_permissions.py new/rpmlint-2.9.0+git20260722.276b8fa5/test/test_suid_permissions.py --- old/rpmlint-2.9.0+git20260715.7b097339/test/test_suid_permissions.py 2026-07-15 12:50:14.000000000 +0200 +++ new/rpmlint-2.9.0+git20260722.276b8fa5/test/test_suid_permissions.py 2026-07-22 10:43:50.000000000 +0200 @@ -88,7 +88,7 @@ output, test = permissions_check test.check(get_tested_package(package, tmp_path)) out = output.print_results(output.results) - assert "testsuidpermissionscheck.x86_64: E: permissions-fscaps /var/lib/testsuidpermissionscheck/test_permissions_fscaps has fscaps 'cap_net_raw=ep'" in out + assert 'testsuidpermissionscheck.x86_64: E: permissions-file-setuid-bit /var/lib/testsuidpermissionscheck/test_permissions_fscaps is packaged with capabilities (cap_net_raw=ep)' in out @pytest.mark.parametrize('package', ['binary/testsuidpermissionscheck'])
