Conversation

Jarkko Sakkinen

#OpenSUSE should probably have umask when mounting /boot/efi:

UUID=1A65-1563    /boot/efi               vfat   utf8,umask=077                0  2

The default 022 umask is incompatible with bootctl.

#systemd

1
2
1

Jarkko Sakkinen

Edited 7 months ago

Tried to login to bugzilla but had some account issue so waiting for that before moving forward.

With 022 umask:

$ sudo sudo bootctl --make-machine-id-directory=yes install
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/boot/efi/EFI/systemd/systemd-bootx64.efi".
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/boot/efi/EFI/BOOT/BOOTX64.EFI".
⚠ Mount point '/boot/efi' which backs the random seed file is world accessible, which is a security hole! ⚠
⚠ Random seed file '/boot/efi/loader/random-seed' is world accessible, which is a security hole! ⚠
Random seed file /boot/efi/loader/random-seed successfully refreshed (32 bytes).
Created EFI boot entry "Linux Boot Manager".

With 077 umask:

Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/boot/efi/EFI/systemd/systemd-bootx64.efi".
Copied "/usr/lib/systemd/boot/efi/systemd-bootx64.efi" to "/boot/efi/EFI/BOOT/BOOTX64.EFI".
Random seed file /boot/efi/loader/random-seed successfully refreshed (32 bytes).
Created EFI boot entry "Linux Boot Manager".
1
0
0

This other issue is something that I’ve yet to find a reason:

$ zypper se qemu-s390x
Repository 'Main Repository (NON-OSS)' is out-of-date. You can run 'zypper refresh' as root to update it.
Repository 'Main Repository (OSS)' is out-of-date. You can run 'zypper refresh' as root to update it.
Repository 'Main Update Repository' is out-of-date. You can run 'zypper refresh' as root to update it.
Repository 'Open H.264 Codec (openSUSE Tumbleweed)' is out-of-date. You can run 'zypper refresh' as root to update it.
Repository 'Sublime Text - x86_64 - Stable' is out-of-date. You can run 'zypper refresh' as root to update it.
Loading repository data...
Retrieving repository 'Main Repository (NON-OSS)' data...
Error retrieving metadata for 'Main Repository (NON-OSS)':
Can't create metadata cache directory.
Problem loading data from 'Main Repository (NON-OSS)'
Warning: Repository 'Main Repository (NON-OSS)' could not be refreshed. Using old cache.
Retrieving repository 'Main Repository (OSS)' data...
Error retrieving metadata for 'Main Repository (OSS)':
Can't create metadata cache directory.
Problem loading data from 'Main Repository (OSS)'
Warning: Repository 'Main Repository (OSS)' could not be refreshed. Using old cache.
Retrieving repository 'Main Update Repository' data...
Error retrieving metadata for 'Main Update Repository':
Can't create metadata cache directory.
Problem loading data from 'Main Update Repository'
Warning: Repository 'Main Update Repository' could not be refreshed. Using old cache.
Reading installed packages...

S | Name       | Summary                                                  | Type
--+------------+----------------------------------------------------------+--------
  | qemu-s390x | Machine emulator and virtualizer for S/390 architectures | package

~ on  main 
$ sudo zypper se qemu-s390x
Loading repository data...
Reading installed packages...

S | Name       | Summary                                                  | Type
--+------------+----------------------------------------------------------+--------
  | qemu-s390x | Machine emulator and virtualizer for S/390 architectures | package
1
0
0

Jarkko Sakkinen

Edited 7 months ago

Probably also something incorrectly configured in permissions because of this transcript from strace -Z -e trace=openat zypper se qemu-s390x > /dev/null show below the paragraph. (qemu-s390x is a randomly picked keyword). I AB tested with “sudo” version and this is the difference.

openat(AT_FDCWD, "/var/cache/zypp/raw/download.opensuse.org-non-oss/cookie", O_RDONLY) = -1 EACCES (Permission denied)
Error retrieving metadata for 'Main Repository (NON-OSS)':
Can't create metadata cache directory.
Problem loading data from 'Main Repository (NON-OSS)'
openat(AT_FDCWD, "/var/cache/zypp/raw/download.opensuse.org-oss/cookie", O_RDONLY) = -1 EACCES (Permission denied)
Error retrieving metadata for 'Main Repository (OSS)':
Can't create metadata cache directory.
Problem loading data from 'Main Repository (OSS)'
openat(AT_FDCWD, "/var/cache/zypp/raw/download.opensuse.org-tumbleweed/cookie", O_RDONLY) = -1 EACCES (Permission denied)
Error retrieving metadata for 'Main Update Repository':
Can't create metadata cache directory.
Problem loading data from 'Main Update Repository'
openat(AT_FDCWD, "/usr/lib/sysimage/rpm/Index.db", O_RDWR) = -1 EACCES (Permission denied)
openat(AT_FDCWD, "/sys/kernel/tracing", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 EACCES (Permission denied)
openat(AT_FDCWD, "/sys/kernel/debug", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 EACCES (Permission denied)
openat(AT_FDCWD, "/sys/fs/pstore", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 EACCES (Permission denied)
openat(AT_FDCWD, "/sys/fs/bpf", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 EACCES (Permission denied)
openat(AT_FDCWD, "/sys/fs/fuse/connections/84", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 EACCES (Permission denied)
openat(AT_FDCWD, "/sys/fs/fuse/connections/78", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 EACCES (Permission denied)
openat(AT_FDCWD, "/var/lib/zypp/LastDistributionFlavor", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EACCES (Permission denied)
+++ exited with 0 +++
0
0
0