Bug 1214101 - AUDIT-WHITELIST: deepin-api: Please keep the old com.deepin.* in whitelist for a while
Summary: AUDIT-WHITELIST: deepin-api: Please keep the old com.deepin.* in whitelist fo...
Status: RESOLVED FIXED
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Security (show other bugs)
Version: Current
Hardware: Other Other
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Matthias Gerstner
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-08-09 07:37 UTC by Hillwood Yang
Modified: 2024-03-13 09:22 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Hillwood Yang 2023-08-09 07:37:54 UTC
According to boo#1211376, com.deepin.* will be renamed to org.deepin.*. But the new version of deepin-api still is testing in X11:Deepin:Factory. We need to keep the old version in the com.deepin.* for a while. 

[  124s] deepin-api.x86_64: E: dbus-file-unauthorized (Badness: 10000) /usr/share/dbus-1/system-services/com.deepin.api.Device.service (sha256 file digest default filter:613bfd2b5d6373ecaa519a1c8a4d2351106cb5986cb9acb04f13df1ba9aef7d6 shell filter:613bfd2b5d6373ecaa519a1c8a4d2351106cb5986cb9acb04f13df1ba9aef7d6 xml filter:<failed-to-calculate>)
[  124s] deepin-api.x86_64: E: dbus-file-unauthorized (Badness: 10000) /usr/share/dbus-1/system.d/com.deepin.api.Device.conf (sha256 file digest default filter:e3effdf083da39eaddce7997c2c4c16f8268c9b9579dd30141f4c2f10a992a4d shell filter:3822da73f18676a6ddaa980449bf4051e1c9d234591a4222448c69830adcbd71 xml filter:36ecf94f509650ce97381a3af592319a124bb8c70e4b664a84fd2a2fb971c9f5)
[  124s] deepin-api.x86_64: E: dbus-file-unauthorized (Badness: 10000) /usr/share/dbus-1/system.d/com.deepin.api.SoundThemePlayer.conf (sha256 file digest default filter:93a5dbb3545ec99317914663407d8608046805a9b0718c592cd19ff47bcc9481 shell filter:d4ec55c10193024a44eef60c9f08a581a45c377e954293bcad3b0a8fcb94c155 xml filter:0e6254e6d3905934d3fa5db5e58815f32fcea5dbac93dbed2a9e15214c8f10eb)
[  124s] deepin-api.x86_64: E: dbus-file-unauthorized (Badness: 10000) /usr/share/dbus-1/system-services/com.deepin.api.SoundThemePlayer.service (sha256 file digest default filter:f906b7c664c7e0f3cf740cad1b63ed9ff668e1ac5233ba5c9a9734b6425b3763 shell filter:f906b7c664c7e0f3cf740cad1b63ed9ff668e1ac5233ba5c9a9734b6425b3763 xml filter:<failed-to-calculate>)
[  124s] deepin-api.x86_64: E: dbus-file-unauthorized (Badness: 10000) /usr/share/dbus-1/system-services/com.deepin.api.LocaleHelper.service (sha256 file digest default filter:c4896ab305c8dff7fa6cfeef2ba194aeec85e649c3d72d3afaa16cc0ac7b7b55 shell filter:c4896ab305c8dff7fa6cfeef2ba194aeec85e649c3d72d3afaa16cc0ac7b7b55 xml filter:<failed-to-calculate>)
[  124s] deepin-api.x86_64: E: dbus-file-unauthorized (Badness: 10000) /usr/share/dbus-1/system.d/com.deepin.api.LocaleHelper.conf (sha256 file digest default filter:7f339a4292fbd17478ff455471743c5a92f72183ca3c1c884f62e28a806ae893 shell
Comment 1 Hillwood Yang 2023-08-09 07:41:08 UTC
Sorry, there is a mistake above. We need to keep com.deepin.* in the whitelist for a while.
Comment 2 Matthias Gerstner 2023-08-09 08:31:52 UTC
You should only ask for whitelisting changes when you're actually going to
submit to Factory - this saves everybody unnecessary extra work.

I will check what can be done about this.
Comment 3 Matthias Gerstner 2023-08-15 08:11:09 UTC
I will reinstate the old D-Bus service names and we will have both variants
active for the time until the rename becomes effective in Factory.
Comment 4 OBSbugzilla Bot 2023-08-18 10:15:04 UTC
This is an autogenerated message for OBS integration:
This bug (1214101) was mentioned in
https://build.opensuse.org/request/show/1104652 Factory / rpmlint
Comment 5 OBSbugzilla Bot 2023-08-18 13:25:02 UTC
This is an autogenerated message for OBS integration:
This bug (1214101) was mentioned in
https://build.opensuse.org/request/show/1104675 Factory / rpmlint
Comment 6 Matthias Gerstner 2023-08-22 10:58:53 UTC
The change should be effective by now, closing as fixed.
Comment 7 Dominique Leuenberger 2023-08-28 11:56:47 UTC
deepin-api still fails to build in Factory:

[   85s] deepin-api.x86_64: E: polkit-untracked-privilege (Badness: 10000) com.deepin.api.device.unblock-bluetooth-devices (no:no:auth_admin_keep)
[   85s] The polkit action is not listed in the polkit-default-privs profiles which
[   85s] makes it harder for admins to find. Furthermore improper polkit authorization
[   85s] checks can easily introduce security issues. If the package is intended for
[   85s] inclusion in any SUSE product please open a bug report to request review of
[   85s] the package by the security team. Please refer to
[   85s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
[   85s] more information.
Comment 8 Matthias Gerstner 2023-08-28 14:26:36 UTC
Argh, this also affects polkit-default-privs. All right. I will adjust that,
too.