Hello community, here is the log from the commit of package rpmlint for openSUSE:Factory checked in at 2020-02-03 11:12:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rpmlint (Old) and /work/SRC/openSUSE:Factory/.rpmlint.new.26092 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rpmlint" Mon Feb 3 11:12:05 2020 rev:328 rq:769026 version:1.11 Changes: -------- --- /work/SRC/openSUSE:Factory/rpmlint/rpmlint-tests.changes 2019-09-26 20:36:23.763318096 +0200 +++ /work/SRC/openSUSE:Factory/.rpmlint.new.26092/rpmlint-tests.changes 2020-02-03 11:12:17.613813855 +0100 @@ -1,0 +2,18 @@ +Thu Jan 30 12:34:02 UTC 2020 - [email protected] + +- Update to version 84.87+git20200130.c0de5f4: + * libzork4.spec: removed define for 'basename' in libzork4.spec. + This causes build errors because 'basename' is a builtin and it's + not used + +------------------------------------------------------------------- +Thu Jan 30 08:06:14 UTC 2020 - [email protected] + +- Update to version 84.87+git20200115.9339533: + * use uname -m instead of uname -i as the latter is not portable + * remove rpm directory upon make clean + * Support for different output based on architecture. For that create a + <NAME>.<ARCH>.ref file instead of <NAME>.ref E.g. debug.i386.ref + * verify that new permissions paths need whitelisting + +------------------------------------------------------------------- --- /work/SRC/openSUSE:Factory/rpmlint/rpmlint.changes 2019-12-25 10:55:07.205635295 +0100 +++ /work/SRC/openSUSE:Factory/.rpmlint.new.26092/rpmlint.changes 2020-02-03 11:12:17.765813932 +0100 @@ -1,0 +2,23 @@ +Fri Jan 31 09:52:39 UTC 2020 - [email protected] + +- Whitelist a batch of PAM modules that have been forgotted to be whitelisted + in the past, or have never been requested to be reviewed before + (bsc#1150178). + Since we want to add badness to the PAM warning in rpmlint we need to add + those entries to avoid build errors of existing packages in Factory. + +------------------------------------------------------------------- +Thu Jan 30 16:18:29 UTC 2020 - James Fehlig <[email protected]> + +- config: add 'sanlock' to StandardGroups and StandardUsers +- config: add 'libvirt' to StandardGroups + +------------------------------------------------------------------- +Thu Jan 30 08:06:15 UTC 2020 - [email protected] + +- Update to version master: + * CheckCronJobs: correct cronjob-unauthorized-file explanation + * Use named constants to check file modes + * CheckSUIDPermissions.py: check new permission paths + +------------------------------------------------------------------- Old: ---- rpmlint-tests-84.87+git20190920.e27d431.tar.xz New: ---- rpmlint-tests-84.87+git20200130.c0de5f4.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rpmlint-tests.spec ++++++ --- /var/tmp/diff_new_pack.lnpwwo/_old 2020-02-03 11:12:19.629814874 +0100 +++ /var/tmp/diff_new_pack.lnpwwo/_new 2020-02-03 11:12:19.633814876 +0100 @@ -1,7 +1,7 @@ # # spec file for package rpmlint-tests # -# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2020 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -24,7 +24,7 @@ BuildRequires: rpmlint-mini Name: rpmlint-tests -Version: 84.87+git20190920.e27d431 +Version: 84.87+git20200130.c0de5f4 Release: 0 Summary: rpmlint regression tests License: SUSE-Public-Domain ++++++ rpmlint.spec ++++++ --- /var/tmp/diff_new_pack.lnpwwo/_old 2020-02-03 11:12:19.645814882 +0100 +++ /var/tmp/diff_new_pack.lnpwwo/_new 2020-02-03 11:12:19.649814884 +0100 @@ -1,7 +1,7 @@ # # spec file for package rpmlint # -# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2020 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.lnpwwo/_old 2020-02-03 11:12:19.709814915 +0100 +++ /var/tmp/diff_new_pack.lnpwwo/_new 2020-02-03 11:12:19.709814915 +0100 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/openSUSE/rpmlint-tests.git</param> - <param name="changesrevision">e27d43198d06699c9a705b71e2d511a94efab752</param></service><service name="tar_scm"> + <param name="changesrevision">6e0e54e073ce56ea3a81cedbce436f3f4b8cb094</param></service><service name="tar_scm"> <param name="url">https://github.com/openSUSE/rpmlint-checks.git</param> - <param name="changesrevision">00e6393112de7c6da46780842cd787f693b05af3</param></service></servicedata> \ No newline at end of file + <param name="changesrevision">20b469207308def7aa2d27665c9a9a224d3afe25</param></service></servicedata> \ No newline at end of file ++++++ config ++++++ --- /var/tmp/diff_new_pack.lnpwwo/_old 2020-02-03 11:12:19.729814925 +0100 +++ /var/tmp/diff_new_pack.lnpwwo/_new 2020-02-03 11:12:19.729814925 +0100 @@ -148,6 +148,7 @@ 'kvm', 'ldap', 'libstoragemgmt', + 'libvirt', 'lightdm', 'lighttpd', 'localham', @@ -220,6 +221,7 @@ 'root', 'sabayon-admin', 'salt', + 'sanlock', 'sapdb', 'sddm', 'sensu', @@ -424,6 +426,7 @@ 'sabayon-admin', 'sahara', 'salt', + 'sanlock', 'sapdb', 'sddm', 'sensu', @@ -925,6 +928,19 @@ "pam_pwquality.so", # lxc (bsc#1150519) "pam_cgfs.so", + # google-authenticator-libpam (bsc#1150524) - potential future removal candidate + "pam_google_authenticator.so", + # pam_u2f (bsc#1087061) + "pam_u2f.so", + # pam_kwallet (bsc#993806) + "pam_kwallet5.so", + # pam_dbus (bsc#1039709) + "pam_dbus.so", + # google-compute-engine (bsc#1146353) + "pam_oslogin_admin.so", + "pam_oslogin_login.so", + # fprintd (bsc#792095) + "pam_fprintd.so" )) # Output filters ++++++ rpmlint-checks-master.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-checks-master/CheckCronJobs.py new/rpmlint-checks-master/CheckCronJobs.py --- old/rpmlint-checks-master/CheckCronJobs.py 2019-12-10 13:24:44.000000000 +0100 +++ new/rpmlint-checks-master/CheckCronJobs.py 2019-12-27 11:53:26.000000000 +0100 @@ -78,7 +78,7 @@ for _id, desc in ( ( 'cronjob-unauthorized-file', - """A cron job rule file is installed by this package. If the package is + """A cron job file is installed by this package. If the package is intended for inclusion in any SUSE product please open a bug report to request review of the package by the security team. Please refer to {url} for more information""" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-checks-master/CheckSUIDPermissions.py new/rpmlint-checks-master/CheckSUIDPermissions.py --- old/rpmlint-checks-master/CheckSUIDPermissions.py 2019-12-10 13:24:44.000000000 +0100 +++ new/rpmlint-checks-master/CheckSUIDPermissions.py 2019-12-27 11:53:26.000000000 +0100 @@ -3,7 +3,7 @@ # File : CheckSUIDPermissions.py # Package : rpmlint # Author : Ludwig Nussel -# Purpose : Check for /etc/permissions violations +# Purpose : Check for /usr/share/permissions violations ############################################################################# from __future__ import print_function @@ -15,6 +15,7 @@ import re import rpm import sys +import stat _permissions_d_whitelist = ( "lprng", @@ -37,10 +38,22 @@ AbstractCheck.AbstractCheck.__init__(self, "CheckSUIDPermissions") self.perms = {} - for fname in ('/etc/permissions', '/etc/permissions.secure'): + for fname in self._paths_to('permissions', 'permissions.secure'): if os.path.exists(fname): self._parsefile(fname) + @staticmethod + def _paths_to(*file_names): + # we used to store the permissions data in /etc even though they aren't configuration files + # the whitelisting should check both paths (old /etc and new /usr/share) until all + # distributions using the old one (SLE15) are retired + for name in file_names: + # return the new path first. + # chkstat prefers the new paths over the old ones, so callers that only care about the + # first matching file must mimic that. + yield '/usr/share/permissions/' + name + yield '/etc/' + name + def _parsefile(self, fname): lnr = 0 lastfn = None @@ -68,7 +81,7 @@ "mode": int(mode, 8) & 0o7777} # for permissions that don't change and therefore # don't need special handling - if fname == '/etc/permissions': + if fname in self._paths_to('permissions'): self.perms[fn]['static'] = True else: print('%s: Malformatted line %d: %s...' % @@ -82,30 +95,30 @@ files = pkg.files() - permfiles = {} + permfiles = set() # first pass, find and parse permissions.d files - prefix = "/etc/permissions.d/" for f in files: - if f.startswith(prefix): - - if f in pkg.ghostFiles(): - printError(pkg, 'polkit-ghost-file', f) - continue + for prefix in self._paths_to("permissions.d/"): + if f.startswith(prefix): - bn = f[len(prefix):] - if bn not in _permissions_d_whitelist: - printError(pkg, "permissions-unauthorized-file", f) - - bn = bn.split('.')[0] - if bn not in permfiles: - permfiles[bn] = 1 + if f in pkg.ghostFiles(): + printError(pkg, 'polkit-ghost-file', f) + continue + + bn = f[len(prefix):] + if bn not in _permissions_d_whitelist: + printError(pkg, "permissions-unauthorized-file", f) + + bn = 'permissions.d/' + bn.split('.')[0] + if bn not in permfiles: + permfiles.add(bn) for f in permfiles: - f = pkg.dirName() + "/etc/permissions.d/" + f - if os.path.exists(f + ".secure"): - self._parsefile(f + ".secure") - else: - self._parsefile(f) + # check for a .secure file first, falling back to the plain file + for path in self._paths_to(f + '.secure', f): + if os.path.exists(path): + self._parsefile(path) + break need_set_permissions = False found_suseconfig = False @@ -120,18 +133,9 @@ mode = pkgfile.mode owner = pkgfile.user + ':' + pkgfile.group -# S_IFSOCK 014 socket -# S_IFLNK 012 symbolic link -# S_IFREG 010 regular file -# S_IFBLK 006 block device -# S_IFDIR 004 directory -# S_IFCHR 002 character device -# S_IFIFO 001 FIFO - type = (mode >> 12) & 0o17 - mode &= 0o7777 need_verifyscript = False - if f in self.perms or (type == 4 and f + "/" in self.perms): - if type == 0o12: + if f in self.perms or (stat.S_ISDIR(mode) and f + "/" in self.perms): + if stat.S_ISLNK(mode): printWarning(pkg, "permissions-symlink", f) continue @@ -139,13 +143,13 @@ m = 0 o = "invalid" - if type == 4: + if stat.S_ISDIR(mode): if f in self.perms: printWarning(pkg, 'permissions-dir-without-slash', f) else: f += '/' - if type == 0o10 and mode & 0o111: + if stat.S_ISREG(mode) and mode & (stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH): # pie binaries have 'shared object' here if (pkgfile.magic.startswith('ELF ') and ('shared object' not in pkgfile.magic) and @@ -156,11 +160,11 @@ m = self.perms[f]['mode'] o = self.perms[f]['owner'] - if mode != m: + if stat.S_IMODE(mode) != m: printError( pkg, 'permissions-incorrect', '%(file)s has mode 0%(mode)o but should be 0%(m)o' % - {'file': f, 'mode': mode, 'm': m}) + {'file': f, 'mode': stat.S_IMODE(mode), 'm': m}) if owner != o: printError( @@ -168,29 +172,29 @@ '%(file)s belongs to %(owner)s but should be %(o)s' % {'file': f, 'owner': owner, 'o': o}) - elif type != 0o12: + elif not stat.S_ISLNK(mode): if f + '/' in self.perms: printWarning( pkg, 'permissions-file-as-dir', f + ' is a file but listed as directory') - if mode & 0o6000: + if mode & (stat.S_ISUID | stat.S_ISGID): need_verifyscript = True msg = '%(file)s is packaged with ' \ 'setuid/setgid bits (0%(mode)o)' % \ - {'file': f, 'mode': mode} - if type != 0o4: + {'file': f, 'mode': stat.S_IMODE(mode)} + if not stat.S_ISDIR(mode): printError(pkg, 'permissions-file-setuid-bit', msg) else: printWarning(pkg, 'permissions-directory-setuid-bit', msg) - if type == 0o10: + if stat.S_ISREG(mode): if ('shared object' not in pkgfile.magic and 'pie executable' not in pkgfile.magic): printError(pkg, 'non-position-independent-executable', f) - if mode & 0o2: + if mode & stat.S_IWOTH: need_verifyscript = True printError(pkg, 'permissions-world-writable', '%(file)s is packaged with world writable permissions (0%(mode)o)' % @@ -301,8 +305,8 @@ 'permissions-fscaps', """Packaging file capabilities is currently not supported. Please use normal permissions instead. You may contact the security team to - request an entry that sets capabilities in /etc/permissions - instead.""", + request an entry that sets capabilities in + /usr/share/permissions/permissions instead.""", ), ( 'permissions-missing-postin', ++++++ rpmlint-tests-84.87+git20190920.e27d431.tar.xz -> rpmlint-tests-84.87+git20200130.c0de5f4.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-tests-84.87+git20190920.e27d431/Makefile new/rpmlint-tests-84.87+git20200130.c0de5f4/Makefile --- old/rpmlint-tests-84.87+git20190920.e27d431/Makefile 2019-09-20 15:17:42.000000000 +0200 +++ new/rpmlint-tests-84.87+git20200130.c0de5f4/Makefile 2020-01-30 13:31:47.000000000 +0100 @@ -11,6 +11,6 @@ @obs/mkpackage clean: - rm -rf output + rm -rf output rpms .PHONY: dist clean test all diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-tests-84.87+git20190920.e27d431/run new/rpmlint-tests-84.87+git20200130.c0de5f4/run --- old/rpmlint-tests-84.87+git20190920.e27d431/run 2019-09-20 15:17:42.000000000 +0200 +++ new/rpmlint-tests-84.87+git20200130.c0de5f4/run 2020-01-30 13:31:47.000000000 +0100 @@ -59,18 +59,24 @@ echo -n "checking $f ... " check "$name" "$f" > output/$name.out || true sed -i "s/^$name\.[^:]\+: /$name: /" output/$name.out - if diff -u tests/$name.ref output/$name.out; then - echo "ok" - : $((++good)) - else - echo "fail" - if [ ! -e tests/$name.ref ]; then + reffile="tests/$name.$(uname -m).ref" + if [ ! -e "$reffile" ]; then + reffile="tests/$name.ref" + if [ ! -e "$reffile" ]; then echo "ref file missing." - echo "you may want to copy the following to tests/$name.ref:" + echo "you may want to copy the following to $reffile:" echo '++++' cat output/$name.out echo '++++' fi + fi + echo "testing against $reffile" + + if diff -u $reffile output/$name.out; then + echo "ok" + : $((++good)) + else + echo "fail" : $((++failed)) fail_names+=($name) fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-tests-84.87+git20190920.e27d431/tests/debug.i386.ref new/rpmlint-tests-84.87+git20200130.c0de5f4/tests/debug.i386.ref --- old/rpmlint-tests-84.87+git20190920.e27d431/tests/debug.i386.ref 1970-01-01 01:00:00.000000000 +0100 +++ new/rpmlint-tests-84.87+git20200130.c0de5f4/tests/debug.i386.ref 2020-01-30 13:31:47.000000000 +0100 @@ -0,0 +1,9 @@ +debug: W: static-library-without-debuginfo /usr/lib/foo/t.a +debug: W: static-library-without-symtab /usr/lib/foo/t2.a +debug: E: devel-file-in-non-devel-package (Badness: 50) /usr/lib/foo/t.a +debug: E: devel-file-in-non-devel-package (Badness: 50) /usr/lib/foo/t2.a +debug: E: lto-bytecode (Badness: 10000) /usr/lib/foo/t.a +debug: E: lto-bytecode (Badness: 10000) /usr/lib/foo/t2.a +debug: E: lto-no-text-in-archive (Badness: 10000) /usr/lib/foo/t.a +debug: E: lto-no-text-in-archive (Badness: 10000) /usr/lib/foo/t2.a +1 packages and 0 specfiles checked; 6 errors, 2 warnings. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-tests-84.87+git20190920.e27d431/tests/debug1.i386.ref new/rpmlint-tests-84.87+git20200130.c0de5f4/tests/debug1.i386.ref --- old/rpmlint-tests-84.87+git20190920.e27d431/tests/debug1.i386.ref 1970-01-01 01:00:00.000000000 +0100 +++ new/rpmlint-tests-84.87+git20200130.c0de5f4/tests/debug1.i386.ref 2020-01-30 13:31:47.000000000 +0100 @@ -0,0 +1,9 @@ +debug1: W: static-library-without-debuginfo /usr/lib/foo/t.a +debug1: W: static-library-without-symtab /usr/lib/foo/t2.a +debug1: E: devel-file-in-non-devel-package (Badness: 50) /usr/lib/foo/t.a +debug1: E: devel-file-in-non-devel-package (Badness: 50) /usr/lib/foo/t2.a +debug1: E: lto-bytecode (Badness: 10000) /usr/lib/foo/t.a +debug1: E: lto-bytecode (Badness: 10000) /usr/lib/foo/t2.a +debug1: E: lto-no-text-in-archive (Badness: 10000) /usr/lib/foo/t.a +debug1: E: lto-no-text-in-archive (Badness: 10000) /usr/lib/foo/t2.a +1 packages and 0 specfiles checked; 6 errors, 2 warnings. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-tests-84.87+git20190920.e27d431/tests/debug2.i386.ref new/rpmlint-tests-84.87+git20200130.c0de5f4/tests/debug2.i386.ref --- old/rpmlint-tests-84.87+git20190920.e27d431/tests/debug2.i386.ref 1970-01-01 01:00:00.000000000 +0100 +++ new/rpmlint-tests-84.87+git20200130.c0de5f4/tests/debug2.i386.ref 2020-01-30 13:31:47.000000000 +0100 @@ -0,0 +1,8 @@ +debug2: W: static-library-without-symtab /usr/lib/foo/t2.a +debug2: E: devel-file-in-non-devel-package (Badness: 50) /usr/lib/foo/t.a +debug2: E: devel-file-in-non-devel-package (Badness: 50) /usr/lib/foo/t2.a +debug2: E: lto-bytecode (Badness: 10000) /usr/lib/foo/t.a +debug2: E: lto-bytecode (Badness: 10000) /usr/lib/foo/t2.a +debug2: E: lto-no-text-in-archive (Badness: 10000) /usr/lib/foo/t.a +debug2: E: lto-no-text-in-archive (Badness: 10000) /usr/lib/foo/t2.a +1 packages and 0 specfiles checked; 6 errors, 1 warnings. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-tests-84.87+git20190920.e27d431/tests/libzork4.spec new/rpmlint-tests-84.87+git20200130.c0de5f4/tests/libzork4.spec --- old/rpmlint-tests-84.87+git20190920.e27d431/tests/libzork4.spec 2019-09-20 15:17:42.000000000 +0200 +++ new/rpmlint-tests-84.87+git20200130.c0de5f4/tests/libzork4.spec 2020-01-30 13:31:47.000000000 +0100 @@ -1,5 +1,4 @@ %define soname 42 -%define basename zork Name: zork4 Version: 1.2.3 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-tests-84.87+git20190920.e27d431/tests/permissions1.ref new/rpmlint-tests-84.87+git20200130.c0de5f4/tests/permissions1.ref --- old/rpmlint-tests-84.87+git20190920.e27d431/tests/permissions1.ref 2019-09-20 15:17:42.000000000 +0200 +++ new/rpmlint-tests-84.87+git20200130.c0de5f4/tests/permissions1.ref 2020-01-30 13:31:47.000000000 +0100 @@ -8,4 +8,5 @@ permissions1: W: permissions-missing-verifyscript missing %verify_permissions -e /bin/su permissions1: E: permissions-file-setuid-bit (Badness: 10000) /bin/ls is packaged with setuid/setgid bits (04755) permissions1: E: permissions-unauthorized-file (Badness: 10000) /etc/permissions.d/test -1 packages and 0 specfiles checked; 2 errors, 8 warnings. +permissions1: E: permissions-unauthorized-file (Badness: 10000) /usr/share/permissions/permissions.d/test +1 packages and 0 specfiles checked; 3 errors, 8 warnings. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/rpmlint-tests-84.87+git20190920.e27d431/tests/permissions1.spec new/rpmlint-tests-84.87+git20200130.c0de5f4/tests/permissions1.spec --- old/rpmlint-tests-84.87+git20190920.e27d431/tests/permissions1.spec 2019-09-20 15:17:42.000000000 +0200 +++ new/rpmlint-tests-84.87+git20200130.c0de5f4/tests/permissions1.spec 2020-01-30 13:31:47.000000000 +0100 @@ -21,8 +21,10 @@ %install install -d -m 755 %buildroot/etc/permissions.d +install -d -m 755 %buildroot/usr/share/permissions/permissions.d install -d -m 755 %buildroot/bin echo "/bin/foo root:root 4755" > %buildroot/etc/permissions.d/test +echo "/bin/foo root:root 4755" > %buildroot/usr/share/permissions/permissions.d/test echo "int main() {}" > xx.c gcc -fno-PIE -O2 xx.c -o %buildroot/bin/ls @@ -35,6 +37,7 @@ %files %defattr(-,root,root) %config /etc/permissions.d/test +%attr(0644,root,root) /usr/share/permissions/permissions.d/test %attr(4755,root,root) /bin/ls %attr(0755,root,bin) /bin/su
